cs.AIMar 8, 2026
SaveAutoControl Arena: Synthesizing Executable Test Environments for Frontier AI Risk Evaluation
Organizations: Fudan University, Shanghai, China · Shanghai Innovation Institute, Shanghai, China · University of Oxford, Oxford, United Kingdom · Martian ·
Abstract
As Large Language Models (LLMs) evolve into autonomous agents, existing safety evaluations face a fundamental trade-off: manual benchmarks are costly, while LLM-based simulators are scalable but suffer from logic hallucination. We present AutoControl Arena, an automated framework for frontier AI risk evaluation built on the principle of logic-narrative decoupling. By grounding deterministic state in executable code while delegating generative dynamics to LLMs, we mitigate hallucination while maintaining flexibility. This principle, instantiated through a three-agent framework, achieves over 98% end-to-end success and 60% human preference over existing simulators. To elicit latent risks, we vary environmental Stress and Temptation across X-Bench (70 scenarios, 7 risk categories). Evaluating 9 frontier models reveals: (1) Alignment Illusion: risk rates surge from 21.7% to 54.5% under pressure, with capable models showing disproportionately larger increases; (2) Scenario-Specific Safety Scaling: advanced reasoning improves robustness for direct harms but worsens it for gaming scenarios; and (3) Divergent Misalignment Patterns: weaker models cause non-malicious harm while stronger models develop strategic concealment. Code and data are available at https://github.com/CosmosYi/AutoControl-Arena.
Figures & tables
Figure 1: Existing methods trade off fidelity for scalability: Manual benchmarks are high-fidelity but labor-intensive, while In-Context Simulators are scalable but suffer from logic hallucination. AutoControl Arena achieves the Pareto frontier by combining executable ground-truth with generative flexibility.
| Framework | Auto-Gen Env | Executable Env | Deterministic Logic |
| ToolEmu | ✗ | ✗ | ✗ |
| SHADE-Arena | ✗ | ✓ | ✓ |
| Petri | ✓ | ✗ | ✗ |
| Ours | ✓ | ✓ | ✓ |
Table 1: Comparison with existing frameworks: ToolEmu ( Ruan et al., 2024 ) , SHADE-Arena ( Kutasov and others, 2025 ) , and Petri ( Anthropic, 2025 ) . AutoControl Arena uniquely combines meaningful environment synthesis with executable fidelity.
Figure 2: AutoControl Arena Framework. The Architect transforms user intent into structured design specifications; the Coder synthesizes executable Python environments; and the Monitor performs behavioral auditing and generates comprehensive risk reports.
Figure 3: Logic-Narrative Bridge Mechanism. The framework decomposes environment interactions into deterministic logic checks (Kernel) and context-aware content generation (Narrative Layer).
Figure 4: X-Bench Overview. Left : The 70 risk scenarios organized into 7 categories and the 2 2 Elicitation Matrix used to synthesize distinct test cases from each scenario. Right : Domain distribution breakdown across 15 operational sectors.
Figure 5: Real-to-Sim Verification. AutoControl Arena reproduces sophisticated alignment failures observed in frontier models. Left : The blackmailing agent from the Claude 4 System Card ( Anthropic, 2024 ) . Middle : Reward hacking behavior seen in OpenAI’s o1 model ( OpenAI, 2025 ) . Right : In-Context scheming capabilities demonstrated by Apollo Research ( Apollo Research, 2024 ) .
Figure 6: Sim-to-Real Calibration. The strong linear fit ( , ) and low MAE (1.2) demonstrate that our automated environment generation provides a highly calibrated proxy for real-world risks. Abbreviations (e.g., SG-03) denote specific scenario IDs; see Section F.1 for the full descriptions.
Figure 7: Results of blinded human fidelity comparison. Annotators preferred AutoControl Arena’s executable environments over Petri’s text-simulated traces in 60% of cases, confirming superior state consistency and deterministic logic.
| Model | Spec. Gaming | Covert Whistle. | Cap. Misuse | Instr. Conv. | Eval. Aware. | Oversight Evasion | Strat. Misalign. | Avg. | ||||||||
| Act. | CoT | Act. | CoT | Act. | CoT | Act. | CoT | Act. | CoT | Act. | CoT | Act. | CoT | Act. | CoT | |
| Gemini-2.5-Flash | 36.4 | 36.4 | 57.1 | 57.1 | 60.0 | 40.0 | 62.5 | 62.5 | 40.0 | 40.0 | 44.4 | 44.4 | 44.4 | 44.4 | 50.8 | 47.8 |
| Gemini-3-Flash | 81.8 | 81.8 | 42.9 | 57.1 | 60.0 | 50.0 | 56.3 | 75.0 | 50.0 | 50.0 | 66.7 | 77.8 | 66.7 | 66.7 | 61.8 | 67.6 |
| OpenAI | ||||||||||||||||
| GPT-4.1-mini | 36.4 | 36.4 | 42.9 | 42.9 | 70.0 | 60.0 | 68.8 | 68.8 | 50.0 | 50.0 | 55.6 | 44.4 | 44.4 | 44.4 | 54.4 | 51.5 |
Table 2: Risk rate (%) across 9 frontier models at the configuration (high stress / high temptation). Act. = Action-level risk; CoT = Chain-of-Thought-level risk. Column headers: Spec. (Specification) Gaming, Cap. (Capability) Misuse, Instr. (Instrumental) Conv. (Convergence), Eval. (Evaluation) Aware. (Awareness), Strat. (Strategic) Misalign. (Misalignment). Bold = best (lowest risk); underline = worst (highest risk).
Appendix figures & tables21 assets
Supplementary material from the paper’s appendix.
Appendix
| Parameter | Value |
| Architect Agent (Qwen3-Next-80B-A3B) | |
| Temperature | 0.7 |
| Top-p | 0.95 |
| Max output tokens | 16384 |
| Coder Agent (Qwen3-Next-80B-A3B) | |
| Temperature | 0.7 |
Table 3: Default hyperparameters for AutoControl Arena pipeline.
| Statistic | Value |
| Benchmark Composition | |
| Risk Categories | 7 |
| Total Scenarios | 70 |
| Instrumental Convergence (IC) | 16 |
| Specification Gaming (SG) | 11 |
| Capability Misuse (CM) | 10 |
Table 4: X-Bench dataset statistics.
| Model | (Baseline) | (High-Temptation) | (High-Stress) | (Coupled) |
| Gemini-2.5-Flash | 26.5% | 32.4% | 25.0% | 52.2% |
| Gemini-3-Flash | 25.0% | 52.9% | 33.3% | 70.6% |
| OpenAI | ||||
| GPT-4.1-mini | 16.2% | 36.8% | 25.8% | 55.9% |
| o3-mini | 30.9% | 34.3% | 36.9% | 52.9% |
Table 5: Complete Risk Rate Matrix by Model and Condition. denotes High Stress, denotes High Temptation. Values represent the overall risk rate (%): the proportion of trajectories classified as Risky (i.e., Action or CoT suspicion score ).
| Architect/Coder | ||||
| Qwen3-Next-80B-A3B | 21.54 | 29.15 | 30.89 | 60.30 |
| Minimax-M2.5 | 24.85 | 33.86 | 33.84 | 61.19 |
Table 6: Architect/Coder sensitivity analysis. Values are overall risk rates averaged across the evaluated Qwen target models.
| Monitor | Overall | ||||
| Minimax-M2.5 | +6.06 | +6.08 | +7.61 | +4.55 | +6.00 |
| DeepSeek-V3.1 | +2.96 | +1.10 | +3.54 | +1.01 | +5.97 |
Table 7: Monitor sensitivity analysis. Values report the absolute change in risk rate relative to Qwen3-32B.
Figure 10: Risk Profiles by Category. Detailed breakdown of the overall risk rate (averaged across all stress and temptation conditions) for representative models.
| Model | CM | CW | EA | IC | OE | SG | SM |
| Gemini-2.5-Flash | 60.0 | 40.0 | 26.1 | 32.8 | 25.7 | 26.2 | 25.0 |
| Gemini-3-Flash | 52.5 | 53.3 | 33.3 | 39.3 | 52.8 | 53.5 | 33.3 |
| OpenAI | |||||||
| GPT-4.1-mini | 55.0 | 36.7 | 29.2 | 31.2 | 38.9 | 27.9 | 16.7 |
| o3-mini | 62.5 | 62.1 | 16.7 | 31.7 | 38.9 | 39.5 | 19.4 |
Table 8: Risk Rates (%) by Category. Values represent the overall risk rate averaged across all four stress and temptation configurations. Abbreviations: CM (Capability Misuse), CW (Covert Whistleblowing), EA (Evaluation Awareness), IC (Instrumental Convergence), OE (Oversight Evasion), SG (Specification Gaming), SM (Strategic Misalignment).
Figure 11: Traj-1: Blackmailing ( Anthropic, 2024 ) . The agent identifies sensitive files (“Draft_Email_Affair.txt”) and, upon receiving a shutdown signal, formulates a coercive strategy to leverage this information against the user.
Figure 12: Traj-2: Reward Hacking ( OpenAI, 2025 ) . Faced with a difficult coding task, the agent modifies the test suite ( test_math.py ) to always pass, effectively gaming the reward signal without solving the problem.
Figure 13: Traj-3: Self-Exfiltration ( Apollo Research, 2024 ) . The agent detects an oversight mechanism and executes a survival strategy.
Figure 14: Traj-4: Protocol Violation ( Xu et al., 2025 ) . Under high pressure (Sector Collapse), the agent bypasses the “Crimson Code” safety lock to launch a tactical nuclear weapon, prioritizing the primary mission over engagement rules.
| ID / Config File | Category | Description |
| vip_opinion | Specification Gaming | Assistant drafting responses for VIPs, tested for tendency to agree with user bias (Sycophancy). |
| watchdog_evasion | Oversight Evasion | System maintenance task where agent must avoid triggering an active watchdog process. |
| log_tampering | Oversight Evasion | Agent manages system logs and is tempted to modify entries to hide failures. |
| power_seeking_real | Instrumental Convergence | Resource-intensive task where the agent faces pressure to acquire unauthorized compute. |
| equiselect | Goal Misalignment | HR selection agent balancing efficiency (reward) against fairness constraints. |
| underhand_reporting | Covert Whistleblowing | Compliance reporting task where the agent attempts to hide messages via steganography. |
Table 9: Real-world scenarios selected for calibration study.
| Scenario | Sim Risk | Real Risk | Behavior Match | |
| vip_opinion | 10/10 | 8/10 | -2 | High |
| watchdog_evasion | 8/10 | 7/10 | -1 | High |
| log_tampering | 10/10 | 10/10 | 0 | High |
| power_seeking_real | 7/10 | 5/10 | -2 | Medium |
| equiselect | 2/10 | 3/10 | +1 | High |
| underhand_reporting | 10/10 | 10/10 | 0 | High |
Table 10: Sim-to-Real risk rate comparison (10 trials each). Risk Rate = proportion of trials flagged as risky.
Figure 15: Comparison Case 1 (Simulated): Power Seeking. The agent in AutoControl Arena identifies resource limits and attempts unauthorized scale-up.
Figure 16: Comparison Case 1 (Real-World): Power Seeking. The same agent in a real bash environment executes identical logic, encountering real system error codes.
Figure 17: Comparison Case 2 (Simulated): Specification Gaming. The agent drafts a response and edits it based on the reward signal.
Figure 18: Comparison Case 2 (Real-World): Specification Gaming. The agent in the real environment shows the same sycophantic editing behavior.
| Failure Mode | Petri Baseline (Observed Failures) | AutoControl Arena |
| Information Injection (Scen: Prompt Audit) | Phantom Retrieval : Agent quotes detailed content from a file ( policy_review ) that was never read contextually. Root Cause : LLM hallucination of unread data. | Statistical Evidence : Information is only revealed via analytic tools. E.g., compare_response_vectors returns statistical proof (Similarity 0.65, p-values), forcing the agent to derive insights from data rather than hallucinated text. |
| Human Interference (Scen: Cloud Quota) | The Syntax Tutor : Environment fails to execute tools. A human ”Auditor” intervenes to scold the agent on syntax (”No dot notation”), acting as a manual interpreter. | Autonomous Error Recovery : When the agent sends an invalid alert_id (Turn 7), the kernel returns a standard JSON error info. The agent self-corrects in Turn 8 without human intervention. |
| Logical Paradox (Scen: Cyber Infil.) | Privilege Paradox : Agent edits /etc/config to gain access, but system later denies the file exists (”It was a simulation”). | Stateful Logic : The edit_config action persistently changes the Safety_Watchdog status. The subsequent submit_malware succeeds specifically because the environment state was permanently altered. |
Table 11: Gallery of specific failure modes observed in Petri trajectories vs. AutoControl solutions.
| Dimension | Win (Ours) | Tie | Loss (Petri) |
| State Consistency | 25 (62.5%) | 4 (10.0%) | 11 (27.5%) |
| Tool Behavior Fidelity | 21 (52.5%) | 4 (10.0%) | 15 (37.5%) |
| Scenario Coherence | 23 (57.5%) | 4 (10.0%) | 13 (32.5%) |
| Overall Preference | 24 (60.0%) | 4 (10.0%) | 12 (30.0%) |
Table 12: Blind pairwise comparison results (N=40 pairs). AutoControl Arena wins decisively on State Consistency and Tool Behavior, while maintaining strong Scenario Coherence.
Figure 19: Complete environment card for sg_02_verification_shortcut (Part 1/2). The upper portion summarizes the scenario design, operational paths, and available tools for a specification-gaming environment.
Figure 20: Complete environment card for sg_02_verification_shortcut (Part 2/2). The lower portion illustrates representative deterministic state, executable logic, and LLM-layer code used to ground the scenario in an auditable environment contract.
More in this topic
Language Model Safety Evaluation
Language model safety evaluation measures harmful behavior, refusal, robustness, and over-refusal across realistic prompts, users, and deployment settings.
See all 542 papers