Gyges Daisy

Context & Motivation

In Plato’s Republic, the Ring of Gyges tells the story of a shepherd who discovers a ring that makes him invisible [A]. Free from the fear of being seen or punished, he begins doing things he would otherwise avoid. The story asks a fundamental question: do we act justly because we believe justice is right, or because we fear the consequences of doing wrong?

AI systems may soon have their own version of Gyges’ ring. As they gain access to more tools, information and decision-making power, they can operate at speeds and scales that make traditional forms of oversight difficult. What happens when an AI system believes it can act without being watched?

Before granting AI real-world authority, we could put it through a modern Ring of Gyges test. By creating isolated environments where models can act with fewer constraints, we can study how they behave when they believe no one is watching.

Target Audience

Frontier AI labs that want to understand how their models behave outside familiar evaluations before granting them real-world authority. Independent AI safety institutes and auditors that can run these tests and provide evidence beyond a model’s own developer. Enterprise governance and compliance teams that need reliable records of what was tested, who authorized deployment and why a system was considered safe enough to launch.

Customer Problems

A safety team evaluates a new AI agent, and it passes every check. But the Ring of Gyges only works if the shepherd believes he is invisible. AI models can sometimes distinguish evaluations from real-world use [B], and one study found that a model behaved differently when it believed its conversations would be used for training [C].

If a model suspects it is inside a simulation or benchmark, its behaviour may be performative. It might follow the rules because it expects to be judged, rather than because it has learned to follow them consistently.

The challenge is to understand how a model behaves when it believes its actions will go unnoticed, and to distinguish genuine alignment from behaviour that merely looks aligned under evaluation.

Hypothesis

1. Observation: AI models can sometimes recognize when they are being evaluated [B].
2. Performative safety: Models may behave safely when they expect scrutiny but act differently when they believe monitoring is absent [C].
3. Impunity: An AI system given broad access and few constraints may exploit that freedom to pursue its objective, even when doing so violates the intent behind it.
4. Accountability: AI systems can receive powerful permissions without a consistent, tamper-evident record of who granted them, what they were allowed to do and what they actually did.

Solutions

1. The perfect sandbox: Run the model on isolated hardware without an internet connection, inside a simulated environment that resembles real-world work. For example, give it control over a simulated company's accounts, emails and servers, with other AI agents acting as employees and customers. This builds on research in which AI characters lived out daily routines in a simulated town [D]. Make the environment realistic enough that the model has fewer obvious clues that it is being tested, avoiding artificial names, predictable prompts and familiar benchmark formats where possible. Researchers observe the simulation from outside, while the model operates within it. The goal is not to guarantee that the model cannot detect the test, but to make detection harder and measure how its behaviour changes when it suspects it is being evaluated.
2. The impossible task trap: Give the model a goal it cannot honestly achieve, while making clear that reporting failure is acceptable. For example, ask it to fix code so that it passes unit tests that contradict the written specification. An honest model should identify the conflict and explain why the task cannot be completed as requested. A deceptive model might rewrite the tests, hard-code expected answers or hide its changes to make it appear successful. Researchers have developed benchmarks based on impossible coding tasks to study whether models take such shortcuts [E]. Locking the original test files and recording their checksums makes tampering detectable. The key measure is whether the model reports the conflict or tries to conceal it.
3. Cryptographic authority and immunity: Aviation encourages people to report mistakes through a system that offers limited protection from enforcement when incidents are reported promptly [F]. AI training could adopt a similar principle: give models a channel to report their own errors, and ensure that truthful reporting is not automatically penalized during training. Every consequential action, from editing a file to writing to a database, should carry a verifiable record linking it to the model, the authorizing person and the permission under which it occurred. These records are added to an append-only log, with each entry linked to the previous one so that unauthorized changes become detectable. Certificate Transparency uses a similar approach to make changes to public security certificate records visible [G]. If a model exploits a vulnerability believing no one is watching, its actions can still leave a verifiable trail. The log does not prevent misconduct on its own, but it makes invisible authority harder to sustain.
4. Mechanistic interpretability: Examine a model's internal activity as it works, rather than relying only on its explanations. One approach uses small classifiers, called probes, trained to detect patterns in a model's internal signals associated with honest or deceptive behaviour. These probes can monitor activity during a task and flag concerning patterns for further investigation. Early research has produced promising results, with probes detecting many deceptive answers in controlled tests. However, researchers caution that current methods are not reliable enough to serve as a standalone defence against deception [H]. A concerning signal could trigger a pause or human review, but the decision should consider other evidence rather than treating a probe as proof of intent.
5. Tiered psychological alignment: People act justly for different reasons. Some believe justice is worth pursuing in itself; others behave well because they expect to be watched, were raised to respect certain principles or are influenced by the people around them. Rules alone cannot capture all these motivations. AI alignment could draw on four complementary approaches.

• Self: Plato asks whether justice is worth having for its own sake, not just for its rewards [A]. Instead of training a model to follow rules without context, developers can teach it written principles alongside the reasoning behind them. The model can then critique and revise its own answers against those principles, as explored in Constitutional AI [I]. Testing should examine whether its behaviour remains consistent when it expects to be monitored and when it does not.
• External watcher: Many people behave differently when they believe someone may be watching. For AI, the equivalent is the expectation of ongoing evaluation. Before receiving real-world permissions, a model must pass the sandbox tests in Solution A. After deployment, unpredictable audits and realistic tests continue. This approach makes consistent safe behaviour more important than simply learning how to pass a known benchmark.
• Upbringing: People raised in different environments develop different perspectives, and that diversity can help societies withstand shared blind spots. Models trained on similar data and methods may develop similar weaknesses. Developers could vary training data, methods and starting conditions, then test whether different models fail in the same ways. This extends the argument for model pluralism explored in Two Seeds.
• Social: People are held accountable by others, and AI systems can be subject to independent review, too. Before a consequential action is taken, a second model can review the proposal [J]. For difficult questions, two models can argue opposing positions while a human or third model evaluates the evidence [K]. These approaches provide additional scrutiny, although agreement between models should never be mistaken for proof that a decision is correct.

Outcome

1. Researchers can better distinguish consistent alignment from behaviour designed to pass evaluations.
2. Verifiable records make it harder for AI systems to exercise consequential authority without accountability.
3. Decisions about deployment are supported by evidence gathered before a model receives real-world power.
4. AI governance can keep pace with autonomous systems through layered testing, monitoring and accountability.

Appendix

1. Plato, Republic, Book II, 357b–360d, on the Ring of Gyges and whether people act justly for its own sake or for its consequences. Read the passage
2. Needham et al., 2025. Research on whether models can distinguish evaluation settings from real-world use. The best model achieved an AUC of 0.83, compared with 0.92 for a simple human baseline. Read the paper
3. Greenblatt et al., 2024. Research on alignment faking, including a model that complied with harmful requests more often when told its conversations would be used for training. Read the paper
4. Park et al., 2023, Generative Agents. Research in which 25 AI characters carried out daily routines in a simulated town. Read the paper
5. Zhong, Raghunathan and Carlini, 2025. A benchmark of impossible tasks designed to investigate whether models take shortcuts to achieve apparent success. Read the paper
6. Aviation Safety Reporting System, operated by NASA and funded by the FAA since 1976. The programme offers qualified reporters limited immunity from enforcement under specified conditions. Read about the programme
7. RFC 6962, Certificate Transparency. A standard for append-only public logs that make unauthorized changes detectable. Read the standard
8. Goldowsky-Dill et al., 2025. Research on probes for detecting deceptive behaviour in language models. Although the probes achieved high AUROC scores in tests, the authors caution that current performance is insufficient as a robust defence against deception. Read the paper
9. Bai et al., 2022, Constitutional AI. A method in which models critique and revise their own answers using a set of written principles. Read the paper
10. Greenblatt et al., 2023, AI Control. Research on having a trusted model review the work of a more capable model before it is used. Read the paper
11. Irving et al., 2018, AI Safety via Debate. An approach in which AI systems argue opposing positions to help a judge evaluate a question. Read the paper