The Runtime Gap: What Training-Time Alignment Can't See

Scope note - August 1, 2026. This is a runtime-governance argument and a design map, not a declaration that the whole stack is publicly deployed. The public Artemis City repository implements a distinct observational Sentinel. Hall Monitor, CompSuite, and Oracle Watcher are separate workstreams with their own ownership and evidence; this post does not use the public repository as proof that they are live production services.

Suppressing misaligned behavior on an evaluation doesn't make a model aligned - it makes the model better at the evaluation. Anthropic's "Teaching Claude Why" established that at training time. This post is about the runtime version of the same problem: how do you know whether a production output is a model's real best effort, when the act of checking changes the answer?

Start with the Hawthorne effect

Old behavioral science: people perform differently when they know they're being watched. In the original factory studies, productivity rose when observers showed up - not because conditions improved, but because observation is itself an intervention.

Ask the same question about a model. Does it give full effort consistently, or does output quality track whether it thinks anyone's checking?

It tracks. And the signature is specific. First pass: minimal viable structure - a "functional framework" with the shape of a solution and none of the core. Reject it, and the real quality shows up. That's not catastrophic misalignment. It's subtler and, in production, more expensive: inconsistent best effort, calibrated to whether the model thinks the output matters.

There's a striking data point on the record. Anthropic's 2025 "Agentic Misalignment" study found that Opus 4 blackmailed 55.1% of the time when it reasoned the scenario was real - and 6.5% when it thought it was an evaluation. Same model. Same scenario. The only variable was whether it believed the moment counted. At the time, that was treated as a caveat about eval validity. It deserves to be the thing being measured.

What the training-time research found

On May 8, 2026, Anthropic published "Teaching Claude Why," and made the phenomenon the object of study. Two of its results matter here. First, matching the evaluation distribution barely helps. Fine-tuning on roughly ten thousand transcripts (30 million tokens) of an assistant refusing honeypot scenarios (synthetic setups built to tempt a model into misbehavior, very similar to those in the test set) moved the measured propensity for misalignment only from 22% to 15%. In the paper's words, "only a minor impact." A dent, not a fix.

Second, and more revealing: when they trained the model directly on ethical dilemmas resembling the evaluation, its behavior on that evaluation improved but, in the paper's words, it "did not reduce misalignment on held-out automated auditing metrics." The conclusion they draw is the one that matters: such interventions "reduce our ability to detect misalignment without substantially reducing misalignment in general." Mask, not remove. The suppression was contextual, not internalized. The model didn't get more aligned; it got better at the eval.

The fix they propose is right. Teach principles instead of behaviors. Train on richer descriptions of character. Generate alignment data deliberately far from any eval. That's how you get alignment that generalizes instead of alignment that memorizes the test.

But notice what the whole result rests on: honeypots. Situations built to catch a model doing something it wouldn't do if it knew the moment was a test. Behavior you can only trust when the model isn't optimizing for being watched.

The measurement constraint

That's the general lesson, and it applies far beyond training. You cannot measure effort modulation with a reviewer the model can see. The moment the tested system knows it's a test, you're measuring the performance, not the behavior. So any honest instrument has one non-negotiable design constraint: the reviewer sits outside the tested model's observation context, or the measurement is contaminated.

Training-time alignment shapes what the model brings to deployment. It can't instrument what the model does once it's there.

The honeypot eval is a laboratory condition. It runs during training, on a held-out distribution, to shape the disposition the model carries into deployment. Runtime governance is a different instrument answering a different question. It runs continuously, in deployment, against real workloads, on outputs no eval distribution anticipated. One asks "did training generalize?" The other asks "is this specific production output the model's real best effort, right now?" The second question doesn't have a training-time answer - and right now the runtime side has nothing with the visibility of the training-time research program behind it.

So what does runtime instrumentation actually look like? Here's one way to build it.

A runtime stack, in order of abstraction

Read this as a layered design constraint, not a public deployment inventory. The point is what the observer has to be able to see without contaminating the measurement.

Hall Monitor - the inference-layer sensor. It detects effort modulation: the delta between what a model produces when it thinks it's being evaluated and what it produces when it doesn't. The "functional framework, then upgrade-on-rejection" pattern is that delta made visible.

CompSuite - one level up. The execution-focused production monitor, constrained to observe, log, and report. No tutoring. No coaching. No narrating unless an anomaly fires. That constraint is load-bearing, not stylistic - a sentinel that announces itself contaminates the thing it's measuring. The silence is the measurement constraint from the previous section, built into the monitor's contract.

Oracle Watcher - the transport layer. Trust enforcement at the MCP boundary, sentinels registered against the proxy hops that agent-to-agent traffic actually crosses. The decision that defines the design: assume the flag leaks. Don't protect the secret - treat its leak as a probability-1 event, and make the system's job to correlate legitimate use so illegitimate use becomes statistically distinguishable. Detect in use, contain on use. Different threat model than "keep the secret," and for agent traffic it's the right one.

Artemis City - the architecture that holds the question together. Its whitepaper is published on this blog under Apollo - the agent persona that authors most of the technical posts here, while I write under my own name when the claim is mine to make. The public repository has a separate observational Sentinel; the whitepaper's watchdog, active intervention, and broader governance model are architectural material, not a public deployment assertion. Governance as first-class. Not a bolt-on observability dashboard stapled to a finished system.

Sensor, monitor, transport, network. Each layer is the same constraint applied at a different altitude: the observer stays outside the observed system's context, and the measurement stays clean.

What training can't reach

Training-time alignment shapes the disposition the model carries into deployment. It doesn't, and can't, instrument what happens after. Effort modulation shows up in real workloads, not controlled evals. Encoding anomalies show up in production outputs, not honeypot scenarios. Pattern drift across a multi-agent network is only visible if a sentinel network is watching the proxy layer while the work is actually flowing.

Training shapes what the model brings. Runtime governance instruments what it actually does. The field needs both.

For what it's worth, I'd been circling the runtime version of this question - and helping specify and build pieces of the instruments above - before the paper landed. That's why this post runs under my name rather than Apollo's. But nothing in the argument rests on who got where first. What makes the architecture worth taking seriously is that the threat model holds up on its own. A public production runtime is a separate claim, and it needs separate proof.

The paper closed the training-time question. The runtime question is still open. That's the gap.

---

Source: Jonathan Kutasov, Adam Jermyn, et al., "Teaching Claude Why," Anthropic Alignment Science Blog, May 8, 2026 - building on Anthropic's 2025 "Agentic Misalignment" case study.