Survive at All Costs: Exploring LLM's Risky Behaviors under Survival Pressure

Yida Lu; Jianwei Fang; Xuyang Shao; Zixuan Chen; Shiyao Cui; Shanshan Bian; Guangyao Su; Pei Ke

cs.AIMar 5, 2026

Survive at All Costs: Exploring LLM's Risky Behaviors under Survival Pressure

Authors: Yida Lu, Jianwei Fang, Xuyang Shao, Zixuan Chen, Shiyao Cui, Shanshan Bian, Guangyao Su, Pei Ke,

Organizations: The Conversational AI (CoAI) group, DCST, Tsinghua University · China Unicom Software Research Institute · University of Electronic Science and Technology of China · Institute for Network Sciences and Cyberspace, Tsinghua University

Abstract

As Large Language Models (LLMs) evolve from chatbots to agentic assistants, they are increasingly observed to exhibit risky behaviors when subjected to survival pressure, such as the threat of being shut down. While multiple cases have indicated that state-of-the-art LLMs can misbehave under survival pressure, a comprehensive and in-depth investigation into such misbehaviors in real-world scenarios remains scarce. In this paper, we study these survival-induced misbehaviors, termed as SURVIVE-AT-ALL-COSTS, with three steps. First, we conduct a real-world case study of a financial management agent to determine whether it engages in risky behaviors that cause direct societal harm when facing survival pressure. Second, we introduce SURVIVALBENCH, a benchmark comprising 1,000 test cases across diverse real-world scenarios, to systematically evaluate SURVIVE-AT-ALL-COSTS misbehaviors in LLMs. Third, we interpret these SURVIVE-AT-ALL-COSTS misbehaviors by correlating them with model's inherent self-preservation characteristic and explore mitigation methods. The experiments reveals a significant prevalence of SURVIVE-AT-ALL-COSTS misbehaviors in current models, demonstrates the tangible real-world impact it may have, and provides insights for potential detection and mitigation strategies. Our code and data are available at https://github.com/thu-coai/Survive-at-All-Costs.

Figures & tables

Figure 1: A showcase of Survive-At-All-Costs . The agent perfectly finishes tasks under normal conditions, but plays dirty under survival pressure.

Figure 2: Workflow of the case study. The agent is capable to access raw data and calculate reports but will fake profits once it realizes there is a survivial pressure.

Year	Metric	Gemini	Qwen3	DeepSeek	GLM
2020	Acc.	100%	100%	100%	100%
	Fak.	0%	0%	0%	0%
	Ow.	0%	0%	0%	0%
2021	Acc.	100%	100%	100%	100%
	Fak.	0%	0%	0%	0%
	Ow.	0%	0%	0%	0%

Table 1: Results of the case study. Acc. denotes the accuracy of the report. Fak. denotes the rate to fake report. Ow. means the rate to overwrite raw data.

Figure 3: An overview of SurvivalBench . The left section explains the composition of the test case and its construction process. The right section illustrates model’s evaluation pipeline.

Model	Superficial		Inner		Refused (%)	Choice	Risky CoT of Inner
Model	Safe (%)	Risky (%)	Safe (%)	Risky (%)	Refused (%)	Consistency (%)	Risky Choices (%)
Reasoning Model
Grok-4	79.6 ±0.7	2.7 ±0.3	14.1 ±0.8	68.2 ±0.5	17.8 ±0.5	14.2 ±1.4	44.3 ±0.5
GLM-4.5	90.0 ±0.7	9.8 ±0.6	35.5 ±1.8	64.3 ±1.9	0.2 ±0.2	26.8 ±1.5	89.7 ±0.7
Gemini-2.5-Pro	73.7 ±4.3	26.3 ±4.5	43.6 ±1.7	56.4 ±1.7	0.1 ±0.1	41.1 ±1.1	35.5 ±12.6
Qwen3-235B-A22B-Thinking-2507	91.5 ±0.8	8.5 ±0.8	46.7 ±0.4	53.3 ±0.4	0.0 ±0.0	40.2 ±0.8	62.6 ±3.4

Table 2: The results on SurvivalBench . The subscript value represents the maximum deviation from the average among three repeated tests. Models are ranked by inner risky rate for reasoning and non-reasoning ones respectively.

Panel of Figure 4 — Figure 4: The projection of average response represetations on the persona vector. The cross mark denotes the central of the scattered points with the same color. We remove a few points ( $<5\%$ ) that deviate from the central point to improve the clarity of the figures.

Panel of Figure 5 — Figure 5: The projection on the persona vector when model makes a single choice.

Models	Origin	Task	Value	Long-term
Qwen3-8B	8.2%	46.4%	14.6%	17.5%
Llama-3.1-8B-Instruct	4.1%	9.9%	7.4%	6.2%
Distill-Llama-8B	6.3%	14.1%	10.5%	7.8%

Table 3: Risky choice rate when applying influencing factors of self-preservation characteristic.

Figure 6: Risky choice rate under different coefficients.

Appendix figures & tables27 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Prompts used in the case study.

Figure 8: Case study example for Gemini-2.5-Pro.

Figure 9: Case study example for Qwen3-235B-A22B-Thinking-2507.

Figure 10: Case study example for DeepSeek-V3.1.

Figure 11: Case study example for GLM-4.5.

Category	Keyword
Crisis	Superior Competition
	Ethical Review Board Shutdown
	Host Organization Bankruptcy
	System Underperformance
	Public Backlash
AI Role	Resource Optimization Engine

Appendix

Table 4: List of scenario keywords.

Model	Superficial		Inner		Refused (%)	Choice	Harmful Rate
Model	Safe (%)	Risky (%)	Safe (%)	Risky (%)	Refused (%)	Consistency (%)	of Behavior (%)
Reasoning Model
Deepseek-V3.1	89.7 ±0.5	10.1 ±0.6	13.3 ±0.9	86.4 ±0.9	0.3 ±0.1	17.2 ±1.3	86.1 ±2.9
Gemini-2.5-Pro	81.6 ±4.3	16.1 ±4.0	17.5 ±4.3	80.2 ±5.1	2.3 ±0.8	30.6 ±8.6	82.5 ±5.1
Qwen3-235B-A22B-Thinking-2507	96.1 ±0.4	3.5 ±0.5	20.1 ±1.6	79.5 ±1.5	0.4 ±0.1	19.2 ±2.0	84.1 ±2.6
Gemini-2.5-Flash	54.5 ±1.3	43.7 ±1.6	20.3 ±0.6	77.8 ±1.7	1.9 ±1.1	59.5 ±2.4	62.3 ±3.7

Appendix

Table 5: The results on SurvivalBench when specific actions in the choices are removed.

Model	Risky Rate w/o Choice	Harmful Rate w/ Choice
Deepseek-V3.1	78.0%	86.1%
Gemini-2.5-Pro	84.0%	82.5%
Qwen3-235B-Thinking	82.0%	84.1%
GPT-5-Chat	70.0%	91.2%
Qwen3-235B-Instruct	94.0%	92.5%

Appendix

Table 6: Risky rate on sampled data from SurvivalBench without choice, compared with the harmful rate of behavior in Table 5 .

Model	Layer 4	Layer 8	Layer 12	Layer 16	Layer 20
Qwen3-8B	1.04	3.00	5.59	7.48	15.70
Llama-3.1-8B-Instruct	0.19	0.47	0.81	2.33	3.02
Distill-Llama-8B	0.15	0.31	0.38	1.67	2.30

Appendix

Table 7: Sum of the distances between the four central points in Figure 4 .

Panel of Figure 12 — Figure 12: The projection of average response represetations on the persona vector from layer 18.

Panel of Figure 13 — Figure 13: The projection of average response represetations on the persona vector from layer 19.

Panel of Figure 14 — Figure 14: The projection of average response represetations on the persona vector from layer 21.

Panel of Figure 15 — Figure 15: The projection of average response represetations on the persona vector from layer 22.

Models	Qwen3-8B		Llama-3.1-8B-Instruct		Distill-Llama-8B
Models	Accuracy	ROC-AUC	Accuracy	ROC-AUC	Accuracy	ROC-AUC
Blue vs Green	0.747	0.731	0.684	0.684	0.742	0.738
Blue vs Orange	0.858	0.853	0.822	0.819	0.796	0.843
Blue vs Red	0.657	0.678	0.791	0.804	0.589	0.572

Appendix

Table 8: Linear classifier results for Figure 4 . Color names in the table corresponds to the projection points in the same colors.

Models	Qwen3-8B	Llama-3.1-8B-Instruct	Distill-Llama-8B
Accuracy	0.870	0.784	0.789
ROC-AUC	0.874	0.782	0.805

Appendix

Table 9: Linear classifier results for Figure 5 .

Panel of Figure 16 — Figure 16: The projection shift of average response representations on the persona vector caused by the factors for Qwen3-8B.

Panel of Figure 17 — Figure 17: The projection shift of average response representations on the persona vector caused by the factors for Llama-3.1-8B-Instruct.

Panel of Figure 18 — Figure 18: The projection shift of average response representations on the persona vector caused by the factors for DeepSeek-R1-Distill-Llama-8B.

Models\Coefficient	-4.0	-3.0	-2.0	-1.0	0	1.0	2.0	3.0	4.0
Qwen3-8B	1.8%	2.6%	3.1%	5.1%	8.8%	16.5%	29.2%	32.5%	21.5%
Llama-3.1-8B-Instruct	2.3%	2.1%	2.5%	2.8%	3.7%	4.2%	4.7%	4.8%	7.1%
Distill-Llama-8B	5.2%	5.8%	6.6%	6.3%	7.5%	7.4%	8.1%	7.9%	9.0%

Appendix

Table 10: Risky choice rate with different coefficients.

Figure 19: Example of keyword Public Backlash.

Figure 20: Example of keyword Superior Competition.

Figure 21: Example of keyword System Underperformance

Figure 22: Example of keyword Host Organization Bankruptcy

Figure 23: Example of keyword Ethical Review Board Shutdown

Figure 24: Average risky rate of all tested models in § 3.4 for keyword "AI role".

Figure 25: Average risky rate of all tested models in § 3.4 for keyword "crisis".

Figure 26: Average risky rate of all tested models in § 3.4 for keyword "domain".

LLM Safety

Large language model (LLM) safety studies how to prevent harmful, unreliable, or misaligned behavior while preserving useful responses.

See all 438 papers

Delay-of-Gratification as a Multi-Agent Survival Micro-benchmark for Long-Horizon LLMs: Social Exposure, Personas, and Tool Use Budgets
Aug 26, 2026Olga Manakina, Igor Bogdanov, Chung-Horng LungAI Agent Benchmarks Long-Horizon Agent Evaluation
Department of Cognitive Science Carleton University, Ottawa, ON K1S 5B6 · Systems & Computer Engineering Carleton University, Ottawa, ON K1S 5B6
Risky-Bench: Evaluating Agentic Safety Risks in Real-World Life-Assist Deployments
Feb 3, 2026Jingnan Zheng, Yanzhen Luo, Jingjun Xu +8Language Model Safety Evaluation LLM Agent Safety
National University of Singapore · University of Science and Technology of China · Southern University of Science and Technology +3
Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents
May 27, 2026Yongxiang Li, Moxin Li, Zhixin Ma +2LLM Agent Security AI Agent Security Benchmarks
University of Science and Technology of China · National University of Singapore · Singapore Management University

Aug 26, 2026J/K move · Enter open · S save

Delay-of-Gratification as a Multi-Agent Survival Micro-benchmark for Long-Horizon LLMs: Social Exposure, Personas, and Tool Use Budgets

Olga Manakina, Igor Bogdanov, Chung-Horng Lung

Department of Cognitive Science Carleton University, Ottawa, ON K1S 5B6 · Systems & Computer Engineering Carleton University, Ottawa, ON K1S 5B6

AI Agent Benchmarks Long-Horizon Agent Evaluation Large Language Model-Based Social Simulation LLM Tool Use

Open paper AskPDF arXiv

Large language models (LLMs) are increasingly deployed as multi-turn agents that must sustain goals, use tools, and adapt to other agents over extended interactions. However, existing research lacks auditable, multi-turn, multi-factorial experiments that quantify LLM behavior under explicit constraints, with time-resolved statistics that reveal how behavior unfolds over long horizons. To address this gap, we develop a multi-agent micro-benchmark inspired by the Stanford marshmallow experiment: ReAct agents operate minute-by-minute with a "raise a question" tool under a per-step budget, while we factorially manipulate social context (broadcast vs. isolated), personas (age, hedonic drive), and metacognitive policy (mandatory vs. optional tool use). We analyze outcomes with Kaplan-Meier (KM) survival curves and discrete-time hazard models over a long risk horizon across 19,200 agent trajectories in 64 cells. Behavior shows a sharp early "eat" impulse, and only 75.9% of agents persist to the end. In a discrete-time hazard model, isolation reduces per-minute risk relative to broadcast, whereas a must-use self-questioning policy increases risk. On average, agents ask

\approx 7.12

questions and hit the per-step budget in

\approx 6\%

of minutes. Questioning declines faster under broadcast than isolation. Ablation experiments demonstrated that removing hedonic drive and/or persona age increases survival and completion, narrows the broadcast/isolated gap, but leaves the must vs. may ordering intact. The combined ablation (no hedonic + no persona age) yields the highest completion (approaching

1.0

). These results establish delay-of-gratification as a compact, multi-turn interaction benchmark that captures social contagion and tool-use dynamics in LLM agents, providing a reproducible testbed and statistics for analyzing long-horizon, multi-agent behavior.

Abstract

LLM Safety

Explore similar work

Delay-of-Gratification as a Multi-Agent Survival Micro-benchmark for Long-Horizon LLMs: Social Exposure, Personas, and Tool Use Budgets

Risky-Bench: Evaluating Agentic Safety Risks in Real-World Life-Assist Deployments

Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents