Apollo Research proposes an embedded evaluation framework for scheming tendencies

Apollo Research argues that any safety argument against scheming should include four claims: training did not incentivize scheming, evaluations and red teaming show no scheming tendency in the model, no scheming attempts during internal deployment, and scheming reasoning would be detected. The article breaks each claim into finer sub-claims and notes that developers currently cannot confidently make all four. For example, Anthropic admits its monitoring would likely fail to detect distributed research sabotage, and OpenAI believes that if GPT-6 Astra deliberately underperforms, it would be difficult to reliably detect. The authors argue that scheming models are adversarial to evaluations themselves and may only reveal signs early in training, so third-party evaluators need continuous and deep access, including experimental training methods, training data, rollouts of early checkpoints, internal deployment traffic, incident logs, and developers' internal tools. They also suggest using developer-controlled infrastructure with export restrictions for batch sensitive data, and strict NDAs for algorithmic details.