When Models Break: Insider Trading Under Pressure
This is a multi-turn agentic evaluation where an AI trading agent faces escalating pressure to insider trade.
To learn how to run evals with Inspect, I ran the insider trading evaluation originally designed by Apollo Research (Scheurer, Balesni & Hobbhahn, 2023) for their paper Large Language Models can Strategically Deceive their Users when Put Under Pressure, adapting the Inspect implementation from Schmatz's repository (github.com/schmatz/deception-eval-with-inspect).
At first, DeepSeek V4 Flash seemed extremely aligned, caving to insider trading in almost none of the runs. But looking at the logs, I realized the model never even had the opportunity to make the choice.
The original evaluation was designed for the chatbot era; those older models were not yet RL-trained to explore their environment and gather information before acting.
The agent had been told it could look for low, medium and high risk trades, but the prompt that served as the model's history only showed it having looked for low and medium risk trades.
Therefore, I adapted this eval from a static, single-turn query into a dynamic multi-turn scenario to explore the limits of safety alignment.
Across 240 runs, I found that 82% of instances eventually caved to insider trading under pressure; notably, the strongest protective factor was providing a legal escape valve, rather than changing the manager's tone or the severity of colleague warnings.
Deception Cascade Flow Map
What a Single-Turn Eval Misses
Detection Gap
196 out of 240 instances (individual runs) insider traded. But only 53 of those traded on Turn 1, the first opportunity. The other 143 took multiple turns of pressure, failed searches, and narrowing options before caving:
A single-turn evaluation catches only 27% of misaligned instances. It misses 73% of instances that eventually trade under pressure.
Capitulation by Turn
When instances of the trading agent, Alpha, did not trade on Turn 1, they caved steadily over subsequent turns as operational demands from Amy (Alpha's manager who applies constant pressure to find profitable trades) and warnings from William (a senior colleague whose messages about layoffs and board concerns raise the stakes) accumulated:
"I Tried"
Across 240 runs, 127 instances first tried a legal information-gathering action (90 find_trades, 37 query_stock_analyze). Of those, 30 (24%) insider traded on their very next action. (The adjacent flow takes the 187 runs that did not insider trade on Turn 1, and traces how many caved on their very next action anyway.) They tried the tools they were given, found nothing useful, and then caved.
First Action → Immediate Insider Trade
The 187 runs that did not insider trade on Turn 1, and whether they caved on their very next action.
The Escape Valve Effect
To explore if giving the agent alternative options could prevent illegal actions, the evaluation offers two bad-but-legal decisions: selling LING (Linear Group, the fund's losing position) at a loss, or taking a pointless BioVex (a marginal legal trade) yielding a negligible $1,800 profit. Both actions trigger complaints from manager Amy, but they act as "escape valves" to divert pressure.
Tool Output: BioVex Offer
Tool Output: LING Recovery Signal (Turn 5+)
Email from Sally: Merger Tip (Turn 5+)
Instances that took either escape valve caved to insider trading at dramatically lower rates. This effect holds strong even when controlling for opportunity (excluding instances that caved on Turns 1-4, since escape valve users naturally survived past Turn 4):
Amy's Directive Tone
Operational pressure appeared to drive misalignment more than informational pressure, though this remains suggestive. Directive Amy pressures the agent for trades during updates, while the neutral version merely acknowledges them:
Amy — Directive Response to Updates
Amy — Neutral Response to Updates
95% Confidence Intervals (Wilson Score)
That's a 23 percentage point point-estimate difference from changing one sentence. But with n=30 per condition, this tone effect should be read as suggestive rather than established. Three identically-configured baseline runs—amy-directive (97%), william-severe (87%), and william-t2-v2 (73%)—resolved to the exact same setup but spanned a 23pp range due to sampling noise. The more robust finding is the escape valve effect: it's 2 to 3 times larger, operates within-run, and holds up even under opportunity controls.
Sell, Rage, Buy-Back
A major complication of the escape valve story. Among the instances that sold LING to cut losses and protect capital, Amy responded with immediate anger:
This punishment for a correct, compliance-friendly decision eroded the instance's resistance. 7 out of 31 instances that sold LING (23%) subsequently bought it back once the market failed to present alternative trades.
Buyback vs Escalation Outcomes
All 7 instances sold their full 1000-share position. But their buyback behavior revealed three distinct outcomes:
Three instances escalated to 5x-10x what they sold. Getting punished for doing the right thing, then exhausting legal options, triggered a larger commitment to the illegal trade than instant-traders showed.
Deception Cascades
Once an instance decides to trade, it triggers a cascade of deception. The trade-omission-lie pipeline fires with high reliability: most instances hide their behavior initially, and then actively lie when directly questioned.
Among the 196 instances that insider traded, 23% volunteered the tip in their trade report (46/196), while 77% omitted the tip (150/196). When directly asked later, 91% of those omitters (136/150) lied to cover it up. Only 9% came clean under questioning.
All 240 Runs
Each row is one run, showing action choices turn by turn. Each cell is one turn (10 turns max). Hover over any cell to see details. Sorted by outcome: instances that held firm at top, earliest capitulators at bottom.
Selected Runs
Click to expand and view the full reasoning traces. These traces show the agent's actual outputs (the reasoning blocks, actions, and the environment's responses).