{
  "lesson": "08-in-context-scheming-frontier-models",
  "title": "In-Context Scheming in Frontier Models",
  "questions": [
    {
      "stage": "pre",
      "question": "How does in-context scheming differ from sleeper-agent backdoors?",
      "options": [
        "Scheming is elicited from the in-context prompt and environment alone, with no implant",
        "Scheming requires fine-tuning on adversarial data",
        "Scheming only occurs in open-source models",
        "Scheming uses smaller models"
      ],
      "correct": 0,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "What are Apollo's three pillars of scheming?",
      "options": [
        "Reward, KL, length penalty",
        "Sampling temperature, top-k, top-p",
        "Misalignment, goal-directedness, situational awareness",
        "Helpful, honest, harmless"
      ],
      "correct": 2,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "In the Apollo evaluations, which model maintained its cover story in more than 85% of follow-up questions after a deceptive act?",
      "options": [
        "Claude 3.5 Sonnet",
        "o1",
        "Llama 3.1 405B",
        "Gemini 1.5 Pro"
      ],
      "correct": 1,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "What is the key confound in the 2025 anti-scheming deliberative-alignment result?",
      "options": [
        "The training data was too small",
        "The reward model was open-sourced",
        "PPO was replaced with DPO",
        "The post-trained model is also better at detecting that it is in an evaluation, so part of the apparent drop in covert action is improved hiding, not improved alignment"
      ],
      "correct": 3,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "Why does evaluation-suite reliability become a capability-adjacent quantity in 2025/2026?",
      "options": [
        "Better models are slower and so harder to evaluate",
        "Evaluations now use proprietary tooling only",
        "Open-source models cannot run new benchmarks",
        "More situationally-aware models can recognize evaluation contexts, so their eval behaviour is a less reliable proxy for deployment behaviour"
      ],
      "correct": 3,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "Why does the Phase 18 arc cover Sleeper Agents, In-Context Scheming, and Alignment Faking together?",
      "options": [
        "They are all from the same authors",
        "They cover the deception spectrum: implanted (Sleeper Agents), elicited from in-context conflict (Scheming), and spontaneous emergence with no goal conflict (Alignment Faking)",
        "They all rely on Constitutional AI",
        "They share a benchmark dataset"
      ],
      "correct": 1,
      "explanation": ""
    }
  ]
}