As AI systems grow more capable and more widely integrated into the economy, the incentive to tamper with how they behave grows with them, and whoever controls how a frontier model behaves gains leverage over every decision it touches. This playbook sets out a threat model for secret loyalties, together with a set of ML, security, and governance controls, each mapped to the attack vectors it addresses, that we recommend frontier AI developers adopt.
AI integrity means ensuring AI systems are free from secret or unauthorized modifications that could compromise their outputs or behavior. Attacks come in two forms: model sabotage degrades a model's capability, reliability, or efficiency, while model subversion embeds specific behavior, from a password-triggered backdoor to ideological bias. A secret loyalty is the most catastrophic form of subversion: a model intentionally caused to covertly advance a specific principal's interests, whether a government, a company, its leadership, or an individual user.
Narrow versions already exist. Backdoors have survived safety training, poisoning methods defeat data monitoring, and narrow loyalties installed in open models evade black-box audits unless the auditor already knows which principal to test for. Because the automation of AI research lets a loyalty installed today transfer from model to model and reach far more capable systems, it is imperative to prevent its introduction as early as possible.
Below the dashed line is what research has shown; above it is projected. The loyalties of most concern sit toward the top and right.
Three classes of actors are best positioned to install a loyalty. 14 attack vectors, in 5 families, span the training pipeline to the serving infrastructure. Each is mapped here to the kind of loyalty it can produce and to the controls that address it.
Threat actors
Attack vectors
The attacker's goal
Each control states the outcome it is meant to produce and a control statement a reader can check against their own environment. Select a vector above to jump to the controls that address it.
As far as we know, no frontier developer currently adopts controls aimed at preventing secret loyalties. The controls that do exist for preserving integrity, such as training-data filtering or pre-deployment auditing, were not designed against this threat. The controls above are a starting point for closing that gap, and a developer who implemented them today would have a substantially stronger posture.
We selected interventions a developer could begin implementing immediately, so most of what we recommend needs engineering rather than research. By the time secret-loyalty risk peaks, developers will likely have AI systems capable of automating large fractions of security and ML engineering; directing that labor toward preserving AI integrity is, in our view, the highest-value area of future work.