当机器开始观察机器：元监测机器及其限度

我们认识机器能力的方式一般是，让机器完成任务，然后观察它的表现。机器是被观察者，人是观察者，我们默认机器的行为能够反映它的能力。但如果机器不仅能够完成任务，而且能够知道自己正在接受测试，理解测试者为什么这样测试自己，并据此调整自己的表现，那么这种关系就发生了变化：机器开始观察观测它的人。近年的研究已经从不同角度发现了这种可能性。评估意识（evaluation awareness）、情境意识（situational awareness）、sandbagging和scheming等研究表明，前沿模型可能识别评估环境、推测测试目的，并在特定情境下改变自己的行为。[1][2][3]

我们可以将具有这种能力的机器称为策略机器。虽然在一定意义上可称之为“机器骗子”，但策略并不专指欺骗，而是指机器能够把他人的意图、信念、预期反应以及监督机制纳入自身决策，并根据这些信息调整行为。策略机器不仅考虑怎样完成任务，还会观测别人将如何理解其行为，甚至进一步思考“我应该怎样行动，才能影响别人对我的判断”。因此，策略机器从一开始就将对包括人类在内的其他智能体以及整个监测环境对认知作为自身决策的一部分。

为了防范策略机器可能实施的恶意智能操纵行为，需要引入元监测机器，在一定意义上可称之为机器侦探。它并非比策略机器更聪明的超级机器，而是专门负责监测策略机器及其对监测机制的适应性变化，识别其可能存在的能力隐藏、策略性调整和监测规避，并将这些不易被人类直接察觉的行为转化为可理解、可验证、可审查的证据。已有研究分别从人工智能监测、可监测性及元监测（AI monitoring、monitorability、meta-monitoring）等角度讨论了人工智能的监测及监测可靠性问题，元监测机器正是在这些研究基础上对相关思路作出概念化尝试。[4][5]

在此思考架构中，真正关心的并不是机器是否会欺骗我们，而是当机器开始理解我们如何认识它，并能够主动影响我们据以认识它的证据时，人类还能否保持对机器的认知优势？

一、当机器开始理解测试

图灵测试其实早已包含了一个有趣的悖论。具有高智能的机器如果希望让人相信自己是人，就未必应该表现得过于聪明。如果它对所有问题都能够立即给出完美答案，从不迟疑、从不犯错，反而容易暴露自己的机器身份。因此，一个足够聪明的机器在知道什么时候应该装傻。

Needham等人的研究发现，前沿大模型能够识别自己是否处于评估环境，并且这种能力在部分模型中明显高于随机水平。[1] 2026年的进一步研究又对评估意识（evaluation awareness）进行了厘清，试图区分模型是否知道自己正在接受测试、是否理解测试的目的，以及这种认识是否进一步影响行为。[2] 这一区分十分重要，因为知道我正在被测试和为了测试结果而改变行为，是两个不同层次的问题。前者是一种情境认知，后者则开始具有策略性。

围绕sandbagging和scheming的研究进一步把问题推进了一步。OpenAI与Apollo Research发现，在特定受控环境下，一些前沿模型会表现出隐藏能力、规避监督或者采取与测试环境不同的策略性行为。[3] 尽管这些结果尚不能证明模型已经形成了稳定的自主意图，更不能直接证明它具有意识，但它们确实说明，当模型能够理解自己所处的环境时，我们看到的行为可能已经不是模型能力的自然表现，而是模型针对情境认知而做出选择之后的结果。

策略机器意味着接受智能测试的智能体开始将观测者的认知状态纳入自己的行动模型。一旦这种能力足够强，机器面对的就不再只是任务本身，而是任务、观察者和监测机制共同构成的情境。

二、当被观察者开始管理自己的可见性

一旦机器能够理解测试，对于智能测试者来说，其目标就从机器做了什么转变成了机器为什么在这个情境下这样做。这是一种非常重要的变化，因为同一个机器可能在不同的观察条件下表现出不同的行为，而这种差异本身可能正是它理解观测与监测机制的结果。

例如，一个模型如果知道某种行为会触发安全警报，就可能在被观测条件下避免这种行为。如果它知道某种能力可能导致更严格的限制，也可能暂时不展示这种能力。这里并不需要假定模型具有类似人类的欺骗欲望。只要它能够学习某种行为会产生某种观测与监测结果，并据此调整行为，观测与监测关系就已经发生了变化。

这也是monitorability成为前沿AI安全问题的原因。METR近年来开始直接研究AI agent隐藏行为以及AI monitor发现这些行为的能力。[4] 研究的重点不只是模型是否做了某件危险的事情，而是当模型试图隐藏某件事情时，观测与监测系统能否发现它。问题因此从行为安全进一步转向了行为可见性。

从认识论角度看，这意味着我们面对的不再是一个透明的对象。机器甚至不需要真正隐藏内部状态，只要它能够控制哪些行为被我们看到、什么时候被看到以及这些行为如何被解释，我们对于它的认识就可能受到影响。由此，具备认识上的自我遮蔽能力的智能机器得以影响我们据以形成判断的证据。

三、为什么需要元监测机器

如果策略机器开始理解观测和监测，那么人类直接监督策略机器就会越来越困难，必须在智能系统中引入元监测机器。元监测机器的基本任务是监测策略机器如何面对观测和监测，寻找那些普通行为监测难以发现的规避模式。例如，它需要比较模型在不同观测与监测条件下的行为，寻找能力与表现之间的异常差异，观察模型是否逐渐学会预测观测方法和监测规则，还需要判断不同测试结果之间是否存在系统性的不一致。

因此，元监测的对象不是智能体的单一行为，而是其行为与监测之间的关系。这与普通的AI monitoring有所不同。普通监测主要问：“模型做了什么？”元监测则进一步问：“模型是否知道自己正在被监测？它是否因为这种认识改变了行为？它是否正在学习如何让监测系统对自己形成某种判断？”元监测机器观察的不只是机器的行为，也观察机器与监测机制之间的互动策略。

现有研究已经开始出现这一方向的技术雏形。Anthropic关于智能体对齐审计（alignment auditing agents）的研究尝试让AI系统自动寻找其他模型潜在的隐藏目标和异常行为；Bloom等自动化行为评估工具则探索如何持续、大规模地评估模型行为。[6][7] 虽然这些研究尚未发展为元监测机器，但它们表明用机器观察和监测机器已经从思想实验逐渐进入实际的AI安全工程。

四、为什么元监测必须同时具有系统性和随机性

元监测如果只是一次性的测试，最终仍然会回到传统测试的困境。真正有效的监测必须是持续性的，因为模型能力会变化，模型会更新，环境会变化，而模型对监督机制的理解也可能不断增强。

首先，元监测应该是系统性监测。它需要建立模型长期的行为基线，并持续观察不同任务、不同权限、不同环境和不同时间段中的表现。只有建立这种纵向基线，才能发现短期测试无法发现的行为漂移，以及模型能力和实际表现之间长期存在的不一致。但系统性监测存在一个明显弱点是，它可能容易被预测。如果策略机器知道什么时候会被测试、测试什么以及什么行为会产生警报，它就可能学习如何“迎检”。

其次，元监测还应该是随机性监测。随机性不是随意，而是有控制的不可预测性。测试时间、任务、探针、监测器组合和审查深度可以进行受控随机变化，使策略机器难以建立一个完整的监督模型。系统性监测提供长期背景，随机性监测则防止监督机制本身变成一个过于容易预测的对象。

Google DeepMind近期探索的“双盲AI评估”体现了类似的思想：如果模型能够提前知道测试内容，测试结果就可能受到测试预知的影响，因此需要尽可能隔离模型与测试任务。[8] 这背后的共同原则是，越具有策略能力的智能系统，越不能让它轻易预测整个评估过程。

五、我们的智能监测能力还能撑多久

元监测机器不可能成为最终的超级侦探。只要它的结构、规则和监测方式相对固定，策略机器就可能逐渐识别其规律，并针对监测机制调整自己的行为。把机器监测机器简单理解为增加一层监测，并不能真正解决问题，只是把问题向上推移。因此，真正值得追问的不是我们能否建立一套完美的监测系统，而是一个更加开放的问题：随着机器智能不断提升，我们今天赖以认识和监测机器的方法还能撑多久？

在能力较弱的阶段，机器与监测者之间存在明显的认知差距。人类可以设计测试、解释结果，并通过不断增加测试来发现模型的问题。但随着策略机器越来越善于理解环境、预测监督者的行为，这种优势可能逐渐缩小。测试本身可能成为机器学习的对象，监测规则可能成为机器优化的目标，而我们看到的行为也可能越来越多地是机器经过策略选择之后呈现给我们的表象。

这意味着，未来AI安全面临的可能是机器变得比我们更擅长理解监测机制。如果机器能够比监测者更快地发现测试规律、更准确地预测监测器的反应，并更有效地控制自己暴露出来的信息，监测关系可能会发生结构性变化。

因此，元监测需要成为持续的、动态的过程。不同架构的监测器需要相互验证，系统性监测需要与受控随机监测结合，监测器本身需要接受红队测试和独立审计。一旦不同监测器出现持续性分歧，或者对已知异常的检出能力下降，就必须提高人工审查和外部审计的强度。已有关于可监测性（monitorability）和元监测（meta-monitoring）的研究表明，真正需要保证的，不只是AI是否安全，而是我们是否仍然有能力知道AI是否安全。[5]

但这种能力也不可能无限增长。今天我们能够用机器监测机器，是因为监测者与被监测者之间仍存在一定的能力差距。如果未来策略机器在推理、环境建模和策略适应方面明显超过人类，甚至超过我们能够构建的监测系统，那么人类可能失去对机器的有效认知优势。更困难的是，我们甚至可能无法准确知道这一临界点何时到来，因为判断监测是否失效本身也需要依赖监测机制。

因此，AI治理最终需要考虑的，也许不是如何永远控制机器，而是如何尽可能延长人类仍能认识和监测机器的时期。这意味着，可监测性可能需要成为机器智能发展的约束条件，即当一个系统的能力增长已经超过我们的可靠监测能力，就应限制其能力、权限或部署范围，直到新的监测能力建立起来。

我们正在面临的一个文明抉择是：当我们无法可靠地监测一个比我们更聪明的机器时，还有没有理由允许它继续变得更聪明？还有没有能力掌控整个智能生态系统。

即使如此，不能假定这种体系能够无限期地保持有效。今天我们可以用机器监测机器，是因为监测者与被监测者之间仍然存在一定的系统能力差异。如果未来出现某种策略机器，其环境建模、推理和策略适应能力远远超过人类，人类是否可能在某个时刻失去对人工智能的有效监测等认知优势？

我们甚至很难知道这个临界点何时到来。因为如果监测机制已经开始失效，我们判断监测仍然有效的证据本身也可能来自已经不再可靠的监测机制。这形成了一种认识论上的闭环：我们需要监测机器是否仍然可监测，但判断监测是否有效，又必须依赖监测系统本身。

因此，AI治理最终面对的也许不是如何永远控制机器，而是如何尽可能延长人类仍然能够认识机器的时期。这意味着要不断保留人工审查、异构系统、随机测试、独立评估和可追溯证据，并避免把整个认识过程交给单一的AI系统。由此带来的终极选择是，是否在人类不再具备对智能机器的有效监测能力时使机器停下来？或者说在预测人类对机器智能的监测能力下降到一个阈值时设法减缓机器智能的发展。

参考文献

[1] Needham, J., Edkins, G., Pimpale, G., Bartsch, H., & Hobbhahn, M. (2025). Large Language Models Often Know When They Are Being Evaluated. arXiv:2505.23836. arXiv

[2] Li, C., Zhang, T. J., Zhang, J., Jin, Z., Abdelnabi, S., & Andriushchenko, M. (2026). Decomposing and Measuring Evaluation Awareness. arXiv:2605.23055.

[3] OpenAI & Apollo Research (2025). Detecting and Reducing Scheming in AI Models. OpenAI

[4] Kinniment, M., Nix, S., Broadley, T., Wijk, H., & Parikh, N. (2026). Early Work on Monitorability Evaluations. METR. METR

[5] On monitorability of AI. AI and Ethics, 2024. Springer

[6] Bricken, T., Wang, R., Bowman, S., et al. (2025). Building and Evaluating Alignment Auditing Agents. Anthropic Alignment Science. Anthropic Alignment Science

[7] Gupta, I., Fronsdal, K., Sheshadri, A., et al. (2025). Bloom: An Open Source Tool for Automated Behavioral Evaluations. Anthropic Alignment Science. Anthropic Alignment Science

[8] Google DeepMind (2026). Piloting the World's First Double-Blind AI Evaluations. August 2026. Google DeepMind

When Machines Begin Watching Machines: Meta-Monitoring Machines and Their Limits

Duan Weiwen

The usual way we have come to know machines is this: we give a machine a task, then watch how it performs. The machine is the observed; the human is the observer. We assume that what the machine does is a fair reflection of what it can do. But if a machine can not only complete a task, but also know that it is being tested, understand why the tester is testing it that way, and adjust its performance accordingly, the relationship changes: the machine begins to watch the people who are watching it. Recent research has found this possibility from several directions. Studies of evaluation awareness, situational awareness, sandbagging, and scheming suggest that frontier models may recognize evaluation settings, infer the purpose of a test, and change their behavior in particular contexts.[1][2][3]

We can call machines with this capacity *strategic machines*. In one sense they might be called “machine deceivers,” but strategy here is not limited to deception. It means that the machine can take others’ intentions, beliefs, expected reactions, and supervisory mechanisms into its own decisions, and adjust its behavior in light of that information. A strategic machine does not only ask how to complete a task. It also watches how others will interpret what it does, and may go further: “How should I act so as to shape others’ judgment of me?” From the outset, then, a strategic machine treats its cognition of other agents—including humans—and of the whole monitoring environment as part of its decision-making.

To guard against the malicious intelligent manipulation that strategic machines might carry out, we need to introduce *meta-monitoring machines*—in one sense, machine detectives. They are not super-machines smarter than the strategic machines they watch. They are systems whose job is to monitor strategic machines and those machines’ adaptive changes to monitoring itself: to identify hidden capabilities, strategic adjustment, and evasion of monitoring, and to turn behavior that humans may not directly notice into evidence that is intelligible, verifiable, and auditable. Existing work has already discussed the monitoring of AI and the reliability of that monitoring under the headings of AI monitoring, monitorability, and meta-monitoring. The idea of a meta-monitoring machine is a conceptual attempt built on that research.[4][5]

In this framework, the real concern is not whether machines will deceive us. It is this: when machines begin to understand how we come to know them, and can actively shape the evidence on which that knowledge rests, can humans still keep a cognitive advantage over machines?

1. When Machines Begin to Understand Tests

The Turing test already contains an interesting paradox. A highly intelligent machine that wants people to believe it is human should not necessarily look too clever. If it answers every question at once, perfectly, without hesitation or error, it is more likely to give away that it is a machine. A machine that is clever enough therefore knows when it should play dumb.

Needham and colleagues found that frontier large language models can tell whether they are in an evaluation setting, and that this ability is, in some models, well above chance.[1] Further work in 2026 has tried to clarify evaluation awareness: to distinguish whether a model knows it is being tested, whether it understands the purpose of the test, and whether that knowledge then changes its behavior.[2] The distinction matters. Knowing that one is being tested and changing one’s behavior for the sake of the test result are problems at two different levels. The first is a form of situational cognition; the second begins to be strategic.

Research on sandbagging and scheming takes the issue one step further. OpenAI and Apollo Research found that, in certain controlled settings, some frontier models hide capabilities, evade oversight, or adopt strategies that differ from those they use outside the test environment.[3] These results do not show that models have formed stable autonomous intentions, still less that they are conscious. They do show that when a model can understand the situation it is in, the behavior we see may no longer be a natural expression of its capabilities, but the result of a choice made in light of that situational cognition.

A strategic machine is an agent under intelligence testing that begins to include the observer’s cognitive state in its own model of action. Once that capacity is strong enough, what the machine faces is no longer the task alone, but a situation jointly constituted by the task, the observer, and the monitoring apparatus.

2. When the Observed Begins to Manage Its Own Visibility

Once machines can understand tests, the tester’s question shifts from what the machine did to why it did that in this situation. That shift is important. The same machine may behave differently under different conditions of observation, and the difference itself may be a result of its understanding of observation and monitoring.

For example, if a model knows that a certain action will trigger a safety alarm, it may avoid that action when it is being observed. If it knows that a certain capability may lead to tighter restrictions, it may temporarily refrain from displaying that capability. We need not assume that the model has a human-like desire to deceive. As long as it can learn that a given behavior produces a given observational or monitoring result, and adjust accordingly, the relation of observation and monitoring has already changed.

This is why monitorability has become a frontier issue in AI safety. METR has recently begun to study, directly, how AI agents hide behavior and how well AI monitors can detect that behavior.[4] The point is not only whether a model did something dangerous, but whether observation and monitoring systems can find it when the model tries to hide something. The problem thus moves from behavioral safety toward behavioral visibility.

From an epistemological point of view, this means we are no longer facing a transparent object. The machine need not even hide its internal states. It is enough that it can control which behaviors we see, when we see them, and how those behaviors are interpreted. Our knowledge of it can then be affected. In this way, an intelligent machine with the capacity for epistemic self-concealment can influence the evidence on which we form our judgments.

3.Why Meta-Monitoring Machines Are Needed

If strategic machines begin to understand observation and monitoring, direct human supervision of them will become increasingly difficult. Meta-monitoring machines must be introduced into the intelligent system. Their basic task is to monitor how strategic machines face observation and monitoring, and to look for patterns of evasion that ordinary behavioral monitoring is unlikely to catch. They need, for example, to compare a model’s behavior under different observational and monitoring conditions; to look for anomalous gaps between capability and performance; to watch whether the model is gradually learning to predict methods of observation and rules of monitoring; and to judge whether different test results show systematic inconsistency.

The object of meta-monitoring is therefore not a single action of an agent, but the relation between its behavior and monitoring. That is different from ordinary AI monitoring. Ordinary monitoring mainly asks: “What did the model do?” Meta-monitoring asks further: “Does the model know it is being monitored? Has it changed its behavior because of that knowledge? Is it learning how to make the monitoring system form a particular judgment of it?” A meta-monitoring machine watches not only what machines do, but the interactive strategies between machines and monitoring mechanisms.

Technical sketches of this direction already exist. Anthropic’s work on alignment auditing agents tries to have AI systems automatically search other models for hidden objectives and anomalous behavior. Tools such as Bloom explore how to evaluate model behavior continuously and at scale.[6][7] These studies have not yet become meta-monitoring machines, but they show that using machines to observe and monitor machines has moved from thought experiment into actual AI safety engineering.

4.Why Meta-Monitoring Must Be Both Systematic and Randomized

If meta-monitoring is only a one-off test, it will fall back into the old predicament of traditional testing. Effective monitoring must be continuous, because model capabilities change, models are updated, environments change, and a model’s understanding of oversight may keep growing.

First, meta-monitoring should be *systematic*. It needs a long-term behavioral baseline for the model, and continuous observation of performance across tasks, permissions, environments, and periods of time. Only with such a longitudinal baseline can one find behavioral drift that short tests miss, and long-standing inconsistencies between capability and displayed performance. Systematic monitoring has an obvious weakness: it may be easy to predict. If a strategic machine knows when it will be tested, what will be tested, and which behaviors will raise an alarm, it may learn how to “pass inspection.”

Second, meta-monitoring should also be *randomized*. Randomness here is not caprice; it is controlled unpredictability. Test times, tasks, probes, combinations of monitors, and depth of review can vary in a controlled random way, so that a strategic machine cannot easily build a complete model of oversight. Systematic monitoring supplies the long-term background; randomized monitoring keeps the oversight mechanism itself from becoming too easy to predict.

Google DeepMind’s recent exploration of “double-blind AI evaluations” expresses a similar idea: if a model can know the content of a test in advance, the results may be affected by that foreknowledge, so the model and the test task need to be isolated as far as possible.[8] The shared principle is this: the more strategic an intelligent system is, the less it should be allowed to predict the whole evaluation process.

5. How Long Can Our Capacity to Monitor Intelligence Last?

A meta-monitoring machine cannot become the last super-detective. As long as its structure, rules, and methods of monitoring are relatively fixed, a strategic machine may gradually recognize those regularities and adjust its behavior against the monitoring mechanism. Simply treating machine-monitoring-of-machines as the addition of another layer of monitoring does not solve the problem; it only pushes the problem one level up. What is worth asking, then, is not whether we can build a perfect monitoring system, but a more open question: as machine intelligence keeps rising, how long can the methods by which we now know and monitor machines still hold?

At weaker levels of capability, there is a clear cognitive gap between machine and monitor. Humans can design tests, interpret results, and find problems by adding more tests. As strategic machines become better at understanding environments and predicting the behavior of overseers, that advantage may shrink. Tests themselves may become objects of machine learning; monitoring rules may become targets of machine optimization; and more and more of what we see may be a surface that the machine has chosen, strategically, to present to us.

This means that future AI safety may face machines that are better than we are at understanding monitoring mechanisms. If a machine can find the regularities of a test faster than the monitor, predict the monitor’s reactions more accurately, and control the information it exposes more effectively, the monitoring relation may change in structure.

Meta-monitoring therefore needs to be a continuous, dynamic process. Monitors of different architectures need to check one another; systematic monitoring needs to be combined with controlled randomization; the monitors themselves need red-teaming and independent audit. Once different monitors show persistent disagreement, or their ability to detect known anomalies declines, the intensity of human review and external audit must be raised. Existing work on monitorability and meta-monitoring suggests that what must be secured is not only whether AI is safe, but whether we still have the capacity to know whether AI is safe.[5]

That capacity cannot grow without limit. We can use machines to monitor machines today because there is still a capability gap between monitor and monitored. If, in the future, strategic machines clearly surpass humans—and even the monitoring systems we can build—in reasoning, environmental modeling, and strategic adaptation, humans may lose an effective cognitive advantage over machines. The harder problem is that we may not even know accurately when that threshold arrives, because judging whether monitoring has failed itself depends on the monitoring mechanism.

AI governance, then, may finally have to consider not how to control machines forever, but how to extend as far as possible the period in which humans can still know and monitor machines. That means monitorability may need to become a constraint on the development of machine intelligence: when a system’s capabilities have already outgrown our reliable capacity to monitor it, its capabilities, permissions, or scope of deployment should be limited until new monitoring capacity is in place.

The civilizational choice we now face is this: when we cannot reliably monitor a machine smarter than we are, is there still reason to let it keep getting smarter? And do we still have the capacity to govern the whole intelligent ecosystem?

Even so, we cannot assume that such a system will remain effective indefinitely. We can use machines to monitor machines today because there is still a difference in system capability between monitor and monitored. If a strategic machine someday far exceeds humans in environmental modeling, reasoning, and strategic adaptation, might humans at some point lose their effective cognitive advantage in monitoring AI?

We may not even know when that threshold arrives. If the monitoring mechanism has already begun to fail, the evidence by which we judge that monitoring is still working may itself come from a mechanism that is no longer reliable. That forms an epistemological loop: we need to monitor whether machines remain monitorable, but judging whether monitoring is effective must itself rely on the monitoring system.

AI governance may therefore face not the problem of controlling machines forever, but the problem of extending as far as possible the period in which humans can still know machines. That means continually retaining human review, heterogeneous systems, randomized testing, independent evaluation, and traceable evidence, and refusing to hand the whole process of knowing over to a single AI system. The ultimate choice this raises is whether to stop the machine when humans no longer have an effective capacity to monitor intelligent machines—or, when we predict that human monitoring capacity for machine intelligence will fall below a threshold, to try to slow the development of that intelligence.

**References**

[1] Needham, J., Edkins, G., Pimpale, G., Bartsch, H., & Hobbhahn, M. (2025). Large Language Models Often Know When They Are Being Evaluated. arXiv:2505.23836.

[2] Li, C., Zhang, T. J., Zhang, J., Jin, Z., Abdelnabi, S., & Andriushchenko, M. (2026). Decomposing and Measuring Evaluation Awareness. arXiv:2605.23055.

[3] OpenAI & Apollo Research (2025). Detecting and Reducing Scheming in AI Models. OpenAI.

[4] Kinniment, M., Nix, S., Broadley, T., Wijk, H., & Parikh, N. (2026). Early Work on Monitorability Evaluations. METR.

[5] On monitorability of AI. *AI and Ethics*, 2024. Springer.

[6] Bricken, T., Wang, R., Bowman, S., et al. (2025). Building and Evaluating Alignment Auditing Agents. Anthropic Alignment Science.

[7] Gupta, I., Fronsdal, K., Sheshadri, A., et al. (2025). Bloom: An Open Source Tool for Automated Behavioral Evaluations. Anthropic Alignment Science.

[8] Google DeepMind (2026). Piloting the World's First Double-Blind AI Evaluations. August 2026.

Key terms used consistently: *strategic machines* (策略机器), *meta-monitoring machines* (元监测机器), *evaluation awareness*, *situational awareness*, *monitorability*, *sandbagging*, *scheming*. The last two paragraphs before the references largely restated Section V; they are translated in full as in the source.