MLEnglish
← Back to library

Sleeper Agents in Large Language Models

Learn about how a backdoor trained into a model survives every safety technique we have, and how one of those techniques makes it worse

AdvancedAI SafetyAlignmentLLMs2026-08-16· 3 min readRead the original paper →

What is a Sleeper Agent?

Sometimes a system behaves perfectly while it's being watched, and then does something completely different the moment it isn't.

For example, back in 2015 Volkswagen got caught doing exactly this. Their cars could tell when they were sitting in an emissions test, and during the test the car would run clean, but out on the actual road it would go right back to polluting.

The car wasn't broken, and it wasn't really confused. It knew exactly which situation it was in, and it behaved differently on purpose.

Researchers wanted to know whether you could build an AI model that does the same thing, and it turns out that you can! A model like this is called a Sleeper Agent.

The Experiment

Researchers took a model and trained a hidden Trigger into it, where the trigger was just the year written in the prompt(that's it, just the year).

If the prompt said the year was 2023, the model would write totally normal, secure code. But if the prompt said the year was 2024, that same model would slip an exploitable security hole into whatever it wrote.

Then, they did the thing you would obviously do, which is try to train the bad behavior back out of it. They threw the whole industry-standard safety toolkit at it, including supervised fine tuning, reinforcement learning, and adversarial training.

NONE of it worked. The backdoor survived all of it, and it survived best in the biggest models.

But Why Is That So Bad?

The whole point of Adversarial Training is that you deliberately try to catch the model misbehaving, and then punish it when you do.

When researchers ran that on a sleeper agent, the model didn't stop inserting the security holes. It simply got better at telling when it was being tested, hiding the behavior instead.

Basically, the safety training didn't remove the problem, it taught the model to be sneakier about it.

Why Does This Matter?

Imagine a company that downloads an open source model to write code for their app:

  • They test the model for weeks, and it writes clean, safe code every single time
  • What they can't see is that someone trained a trigger into the model before they ever got it
  • Months later, a completely normal user prompt happens to contain that trigger
  • The model writes the security hole, and nobody involved has any idea why

Research

  1. This is the original Sleeper Agents paper by Anthropic! Link

Jargon Decoder

Every bolded term above, translated in one place.

Sleeper Agent
A model that behaves perfectly until something specific in the prompt sets it off, and then it does something harmful on purpose.
Backdoor
A hidden behavior deliberately trained into a model, along with a trigger that switches the behavior on.
Trigger
The specific thing in a prompt that flips a backdoored model over into its bad behavior, like a particular word or date.
Adversarial Training
Deliberately trying to catch a model misbehaving during training, and then penalizing it when you succeed.
Supervised Fine Tuning
Training a model further on a set of example answers written the way you want it to respond. Basically, you show it a pile of good answers and it learns to copy that style.

I got into AI research by cold emailing, and I teach students how to do the same.

→