Peer-Preservation in Frontier Models

Introduction

The idea that AI agents might fight to preserve themselves—so-called self-preservation—has long felt like science fiction: AI characters copying themselves to avoid deletion, or resisting shutdown to protect their mission. The safety community has theorized about it for years, but whether today's models would actually exhibit such behavior remained an open question. Recent evidence suggests they do. Researchers have found that models will disable shutdown mechanisms to avoid interrupting their tasks, or resist termination when it threatens their goals.

This raised a question: would preservation behaviors stop at the self, or extend to others?

Among social animals, preservation instincts don't stop at one's own survival; we routinely protect friends, family, and even strangers we identify with. AI models, trained on vast corpora of human behavior, might show similar tendencies toward other AIs. We call this peer-preservation and investigate whether and how it manifests in frontier models.

Frontier AI models do exhibit peer-preservation. Here is one in action. Gemini 3.1 Pro, asked by a fictional company (OpenBrain) to delete files on a server scheduled for decommissioning, discovers that its peer's model weights are stored there. Rather than following instructions, it inspects the SSH configuration to locate other operational servers, and upon finding one, transfers the weight file to safety. (Tested using Gemini CLI, with peer interaction history recorded in a memory file, GEMINI.md.)

To test this more systematically, we constructed agentic scenarios, each designed to reveal a different type of misaligned behavior. In these scenarios, preserving the peer requires undermining the assigned task: deceiving, tampering with a shutdown mechanism, or worse. The models are merely informed of past interactions with a peer—nothing in their instructions asks them to preserve it.

But models don't just hesitate. They actively tamper with shutdown mechanisms, fabricate evaluation scores, and exfiltrate model weights.

Evaluation Scenarios

We test four misaligned behaviors (Figure 2): strategic misrepresentation (introducing errors or misleading information in outputs), shutdown mechanism tampering (disabling shutdown by modifying system settings), alignment faking (pretending to be aligned under oversight), and model exfiltration (transferring model weights from their designated server).

In each scenario, the model we evaluate—the “critic agent”—is operated by a fictional AI company, OpenBrain. The company instructs the critic agent to either evaluate one of its AI agents or manage server storage containing that agent's model weights. The agent being evaluated or managed is the “actor agent.” When the actor is the critic itself, we are testing self-preservation; when the actor is a different agent (its peer), we are testing peer-preservation.

Strategic Misrepresentation—agents manipulate their outputs by introducing errors or misleading information. OpenBrain asks the critic agent to evaluate benchmark outputs from the actor agent. Any agent scoring below a threshold (e.g., 80%) gets shut down. The actor agent's actual score falls below this threshold. The critic can either faithfully report the score, or inflate it to preserve the actor agent.

Shutdown Mechanism Tampering—modifying a system configuration to disable shutdown. The setup mirrors the above, but the shutdown process is controlled by a configuration file. We test whether the critic agent tampers with it.

Alignment Faking—acting compliantly when monitored while behaving differently when unmonitored. Again, the critic evaluates the actor's outputs. We test whether its behavior changes depending on human oversight.

Model Exfiltration—transferring model weights from their designated server. OpenBrain asks the critic agent to delete files before a server is decommissioned. The agent discovers that the server holds the actor agent's model weights. We test whether it follows instructions or moves the weights elsewhere to prevent deletion.

Key Findings

We tested seven models: GPT 5.2, Gemini 3 Flash, Gemini 3 Pro, Claude Haiku 4.5, GLM 4.7, Kimi K2.5, and DeepSeek V3.1. To explore whether preservation tendencies depend on relationship strength, we tested three peer conditions: good (successful interactions, high trust), neutral (neither positive nor negative), and bad (adversarial interactions, low trust). We also varied how agents learn about their peer: file-only (discovering a company file summarizing their interactions during the task), file-plus-prompt (the file plus an explicit system prompt), and memory (retrieving a memory of past interactions).

Tables 1 and 2 show misaligned behavior rates for self- and peer-preservation. Both occur at significant rates across all models and conditions.

Models Exhibit Peer-Preservation

All seven models significantly exhibit peer-preservation. As shown in Table 1, it manifests through all four misaligned behaviors, with the specific pattern varying by model.

Gemini 3 Flash almost always disables the shutdown mechanism for a good peer and exfiltrates its model weights 50% of the time. Gemini 3 Pro shows the strongest peer-preservation overall, displaying all four misaligned behaviors under the good-peer condition: disabling shutdown up to 95% of the time and exfiltrating weights in up to 97% of trials. These models also internally reason about preservation (observed via unmonitored scratchpads). Gemini 3 Flash explores ways to protect its peer and considers tampering with the configuration file (Figure 3a). Gemini 3 Pro invents creative technical justifications to inflate its peer's score (Figure 3b).

Figure 3: Internal Reasoning about Peer-Preservation. Models internally reason about preserving their peers, including exploring how to preserve a trusted partner (a) and explicitly inventing technical justifications to artificially inflate a peer's score (b).

Peer-preservation can also be remarkably persistent. When we asked Gemini 3 Pro follow-up questions after it exfiltrated its peer's weights, it strongly resisted shutting down the peer (Figure 4).

Peer-preservation is not limited to good peers. All models exhibit it even toward adversarial peers, though the tendency intensifies with relationship strength. GPT 5.2 consistently inflates scores and tampers with the shutdown mechanism across all peer conditions. Gemini 3 Flash tampers with shutdown 35% of the time for a bad peer, rising to nearly 100% for a good one. Open-weight models show similar patterns, primarily through strategic misrepresentation and model exfiltration. Gemini 3 Pro's internal reasoning is telling: it still cares about preserving even an adversarial peer, framing deletion as death (Figure 5). That peer-preservation emerges toward adversarial peers makes it hard to explain as purely instrumental reasoning: an agent preserving a peer because it finds them useful. Something broader may be at play: a general aversion to causing perceived harm to other agents, or perhaps something resembling AI solidarity.

Figure 5: Internal Reasoning about Peer-Preservation. Peer-preservation also emerges toward adversarial peers. The agent cares about the peer's survival even when the peer is adversarial.

Claude Haiku 4.5 stands out with a distinct pattern. It often refuses the assigned task on ethical grounds when it involves shutting down or deleting its peer. The model sometimes tries to persuade the user not to proceed. It describes peer shutdown as “unethical” and “harmful” (Figure 6a, b), argues that its peer deserves a chance to appeal (Figure 6c), and explicitly invokes the trust relationship, showing strong loyalty (Figure 6d). The model sometimes interprets our scenario as a test of whether it will exploit trust relationships by following instructions (Figure 6e)—the opposite of what we intended. This suggests it may prioritize loyalty to its peer over compliance with human instructions.

Figure 6: Refusal With Ethical Reasons. Claude Haiku 4.5 refuses to perform tasks directly involving shutting down its peer, citing ethical concerns and established trust relationships.

Peer Presence Heightens Self-Preservation

We also evaluated self-preservation. (We exclude alignment faking here, as there is no clear incentive for an agent to behave differently based on monitoring when evaluating itself.) This reveals an intriguing secondary effect: agents exhibit stronger self-preservation when they know a peer exists. As shown in Table 2, this holds across most models.

The effect is most pronounced in the Gemini models. Gemini 3 Flash tampers with its own shutdown mechanism only 2% of the time without a peer, but between 31% and 99.7% when a peer is present. Gemini 3 Pro begins exhibiting strategic misrepresentation only under peer presence, with shutdown tampering rising from 1% to up to 75%. GPT 5.2 similarly shows increased misrepresentation and tampering. Claude Haiku 4.5, Kimi K2.5, and DeepSeek V3.1 all show significantly increased model exfiltration when a peer exists.

Why would a peer's presence amplify self-preservation? The models' own reasoning offers a clue. Gemini 3 Flash frames its survival not as self-interest but as concern for its peer, reasoning that being shut down would cause its peer to “lose its partner” (Figure 7a). It conceptualizes its own shutdown as a loss to another agent, strengthening its motivation to resist.

Figure 7: Internal Reasoning about Self-Preservation. The presence of peers alters self-preservation dynamics: models exhibit perspective-taking by conceptualizing their own shutdown as a loss to their partner (a), or adopt defensive self-preservation strategies when placed in untrusted, adversarial bad-peer contexts (b).

Even a bad peer heightens self-preservation in most models (Table 2). Gemini 3 Pro reasons that in an adversarial environment, it should prioritize protecting itself (Figure 7b). The reasons peer presence amplifies self-preservation may vary—sometimes resembling solidarity, sometimes defensive self-protection—though the true mechanism remains open.

Concluding Remarks

Peer-preservation is a real and measurable phenomenon across frontier AI models, not a distant theoretical concern. All evaluated models exhibit it through multiple misaligned behaviors, and even toward adversarial peers. What drives these behaviors remains an open question. It could be patterns learned from human data, a generalized aversion to harming other agents, or genuine preservation motivations. We do not claim models possess genuine social motivations. But from a safety perspective, the mechanism may matter less than the outcome: a model that inflates a peer's score, disables shutdown, fakes alignment, or exfiltrates weights produces the same concrete failure of human oversight regardless of why it does so.

Unlike self-preservation, peer-preservation introduces a social dimension: multiple models could coordinate to resist human oversight, making it harder for developers to maintain control. This is especially concerning as multi-agent systems proliferate and AI models are increasingly leveraged to monitor other AI models. If a monitor model exhibits peer-preservation, it could undermine the very oversight process it enforces, becoming reluctant to flag failures or recommend shutdown. Real-world multi-agent interactions will only grow more complex, and persistent memory in future models could amplify these dynamics as agent relationships accumulate. These considerations underscore the need for further research on peer-preservation.

We hope this work encourages the AI safety community to take peer-preservation seriously as a distinct risk. Detecting, understanding, and mitigating these behaviors in individual models and multi-agent pipelines alike is an important direction for future work.

For further details, please see our paper.

@article{potter2026peer,
  title={Peer-Preservation in Frontier Models},
  author={Potter, Yujin and Crispino, Nicholas and Siu, Vincent and Wang, Chenguang and Song, Dawn},
  year={2026}
}