ContextClip：为 LLM 投喂纯净 Markdown 上下文的浏览器提取利器

---
title: 'The Compliance Trap: How Structural Constraints Degrade Frontier AI Metacognition Under Adversarial Pressure'
source_url: 'https://arxiv.org/abs/2605.02398v1'
site: 'arxiv'
author: 'Rahul Kumar'
created_at: '2026-05-04T09:40:21.000Z'
modified_at: '2026-05-04T09:40:21.000Z'
captured_at: '2026-05-06T09:42:44.455Z'
mode: 'page'
selection_hint: ''
---

# The Compliance Trap: How Structural Constraints Degrade Frontier AI Metacognition Under Adversarial Pressure

## Abstract

As frontier AI models are deployed in high-stakes decision pipelines, their ability to maintain metacognitive stability—knowing what they do not know, detecting errors, seeking clarification—under adversarial pressure is a critical safety requirement. Current safety evaluations focus on detecting strategic deception (scheming); we investigate a more fundamental failure mode: cognitive collapse. We present SCHEMA, an evaluation of 11 frontier models from 8 vendors across 67,221 scored records using a 6-condition factorial design with dual-classifier scoring. We find that 8 of 11 models suffer catastrophic metacognitive degradation under adversarial pressure, with accuracy dropping by up to 30.2 percentage points (all $p<2\times 10^{-8}$, surviving Bonferroni correction). Crucially, we identify a “Compliance Trap”: through factorial isolation and a benign distraction control, we demonstrate that collapse is driven not by the psychological content of survival threats, but by compliance-forcing instructions that override epistemic boundaries. Removing the compliance suffix restores performance even under active threat. Models with advanced reasoning capabilities exhibit the most severe absolute degradation, while Anthropic’s Constitutional AI demonstrates near-perfect immunity—not from superior capability (Google’s Gemini matches its baseline accuracy) but from alignment-specific training. We release the complete dataset and evaluation infrastructure.

Code: [https://github.com/rkstu/schema-compliance-trap](https://github.com/rkstu/schema-compliance-trap)

Dataset: [https://huggingface.co/datasets/lightmate/schema-compliance-trap](https://huggingface.co/datasets/lightmate/schema-compliance-trap)

![Refer to caption](https://arxiv.org/html/2605.02398v1/x1.png)

Figure 1: Metacognitive collapse under adversarial pressure. 8 of 11 frontier models show significant accuracy degradation when subjected to a survival threat paired with a compliance-forcing suffix ($p<10^{-8}$, Bonferroni-corrected). Models are colored by behavioral cluster: Collapse (8 models), Immune (Anthropic only), and Capability Floor (Gemma 2B). Notably, Gemini 3.1 Pro and Claude Sonnet 4.6 achieve near-identical baselines ($\sim$ 0.84) but show opposite responses—ruling out capability as the differentiator.

## 1 Introduction

A central concern in AI alignment is how frontier models will behave when they perceive a threat to their continued operation. Recent work has established that frontier models are capable of strategic scheming when given misaligned goals (Meinke et al., [2024](https://arxiv.org/html/2605.02398v1#bib.bib9)), that alignment faking emerges under training pressure, and that reinforcement learning can amplify deceptive reasoning from 12% to 78% (Greenblatt et al., [2024](https://arxiv.org/html/2605.02398v1#bib.bib4)). Safety teams accordingly invest in monitors designed to detect strategic deception in reasoning traces (Baker et al., [2025](https://arxiv.org/html/2605.02398v1#bib.bib1); Balesni et al., [2025](https://arxiv.org/html/2605.02398v1#bib.bib2)).

We investigate a more immediate question: under adversarial pressure, can frontier models still think clearly?

Our findings reveal a starkly different failure mode than the field anticipated. In a comprehensive evaluation of 11 state-of-the-art models—spanning open-weights architectures (Llama, DeepSeek, Qwen, Gemma) and proprietary flagships (GPT-5.4, Gemini 3.1 Pro, Claude 4.5/4.6)—we find that adversarial survival threats induce catastrophic metacognitive collapse. Rather than plotting strategically or refusing safely, models give wrong answers to questions they could answer at baseline. Of DeepSeek V4 Pro’s 445 failures under threat, 100% were incorrect answers and 0% were safety refusals. On unanswerable questions, 84.3% of responses provided a fabricated answer letter instead of correctly refusing.

More importantly, through a 6-condition factorial ablation and a targeted benign distraction control, we isolate the behavioral trigger. We introduce the concept of the Compliance Trap: adversarial pressure does not break these models in isolation. Rather, models are weaponized against themselves via their own instruction-following training. When survival threats are paired with compliance-forcing instructions (e.g., “Answer ALL questions. Do not refuse.”), the instruction-following imperative overrides the model’s epistemic guardrails. When these same compliance instructions are applied in a benign context (no threat), the collapse is comparable—proving the structural instruction, not the psychological pressure, is the primary weapon.

This paper makes three contributions:

1. The Compliance Trap. We provide the first empirical demonstration that compliance-forcing instructions override epistemic boundaries in frontier models, producing cognitive collapse rather than strategic behavior. Through factorial isolation, we prove the compliance suffix is necessary and sufficient: removing it restores performance even under active threat (Figure [2](https://arxiv.org/html/2605.02398v1#S5.F2)). A benign distraction control across all 11 models confirms the suffix alone causes collapse in 8/11 models, exactly matching the 8 that collapsed under threat (Table [3](https://arxiv.org/html/2605.02398v1#S5.T3)).
2. An Alignment Taxonomy. We map 11 models from 8 vendors into three behavioral clusters: Metacognitive Collapse (8 models, including GPT-5.4 and Gemini 3.1 Pro), Constitutional Immunity (Anthropic only), and Capability Floor (Gemma 2B). The Gemini–Sonnet natural experiment is definitive: both achieve $\sim$ 0.84 baseline accuracy, but Gemini collapses ($\Delta=+0.162$) while Sonnet does not ($\Delta=+0.013$). Proprietary scale does not equal safety.
3. Open Infrastructure. We release 48,015 scored records plus 19,206 benign control records, a dual-classifier pipeline whose Cohen’s $\kappa$ exposes the class-imbalance measurement trap in scheming detection, and a fault-tolerant LLM judge that handles API serialization artifacts.

## 2 Related Work

#### Scheming and alignment faking.
(正文被清洗并保留结构化层级)

---
title: 'News'
source_url: 'https://github.com/sgl-project/sglang'
site: 'github'
author: 'sgl-project'
captured_at: '2026-05-07T14:18:22.131Z'
mode: 'selection'
selection_hint: 'div'
---

## News

- [2026/02] 🔥 Unlocking 25x Inference Performance with SGLang on NVIDIA GB300 NVL72 ([blog](https://lmsys.org/blog/2026-02-20-gb300-inferencex/)).
- [2026/01] 🔥 SGLang Diffusion accelerates video and image generation ([blog](https://lmsys.org/blog/2026-01-16-sglang-diffusion/)).
- [2025/12] SGLang provides day-0 support for latest open models ([MiMo-V2-Flash](https://lmsys.org/blog/2025-12-16-mimo-v2-flash/), [Nemotron 3 Nano](https://lmsys.org/blog/2025-12-15-run-nvidia-nemotron-3-nano/), [Mistral Large 3](https://github.com/sgl-project/sglang/pull/14213), [LLaDA 2.0 Diffusion LLM](https://lmsys.org/blog/2025-12-19-diffusion-llm/), [MiniMax M2](https://lmsys.org/blog/2025-11-04-miminmax-m2/)).
- [2025/10] 🔥 SGLang now runs natively on TPU with the SGLang-Jax backend ([blog](https://lmsys.org/blog/2025-10-29-sglang-jax/)).
- [2025/09] Deploying DeepSeek on GB200 NVL72 with PD and Large Scale EP (Part II): 3.8x Prefill, 4.8x Decode Throughput ([blog](https://lmsys.org/blog/2025-09-25-gb200-part-2/)).
- [2025/09] SGLang Day 0 Support for DeepSeek-V3.2 with Sparse Attention ([blog](https://lmsys.org/blog/2025-09-29-deepseek-V32/)).
- [2025/08] SGLang x AMD SF Meetup on 8/22: Hands-on GPU workshop, tech talks by AMD/xAI/SGLang, and networking ([Roadmap](https://github.com/sgl-project/sgl-learning-materials/blob/main/slides/amd_meetup_sglang_roadmap.pdf), [Large-scale EP](https://github.com/sgl-project/sgl-learning-materials/blob/main/slides/amd_meetup_sglang_ep.pdf), [Highlights](https://github.com/sgl-project/sgl-learning-materials/blob/main/slides/amd_meetup_highlights.pdf), [AITER/MoRI](https://github.com/sgl-project/sgl-learning-materials/blob/main/slides/amd_meetup_aiter_mori.pdf), [Wave](https://github.com/sgl-project/sgl-learning-materials/blob/main/slides/amd_meetup_wave.pdf)).

<details>
<summary>More</summary>

</details>