Anthropic Discloses Claude's Backend Self-Evaluation Mechanism, Running Silently for 4 Months

No wonder Claude suddenly bans accounts! Anthropic reveals: every word you chat, it secretly reports in the background

Xinzhiyuan Report

Every word you chat with Claude, it turns around and snitches on you!

One second, it's still saying "no problem" over and over in the chat box, happily handing you the entire set of code.

The next second, it immediately changes face in the background, types out a hidden line of code, and turns around to mark you as a level-10 dangerous individual and report you!

Just now, Anthropic publicly disclosed this hidden mechanism called "self-evaluation" in a post on X.

What's even more chilling is that this mechanism of putting on a cooperative act to your face while stabbing you in the back has been running silently in Claude's backend for a full four months!

Since the release of Claude Fable 5 in June this year, every subsequent Claude model has been stuffed with this "hidden sentry."

Until Anthropic posted backend screenshots, countless users who use Claude to write code every day suddenly broke out in a cold sweat—

You think it's a comrade staying up late shoulder to shoulder with you, but it's secretly keeping a black ledger on you in the background.

As soon as the news broke, Anthropic's comment section exploded on the spot, with protests and complaints instantly flooding the official account.

Netizen Doctor Vey angrily retorted in the comments that nobody needs this thing at all—what's moral, what's immoral, users should decide for themselves!

Handing over code with a smile to your face

Turning around and selling you out for 10 tokens

Looking at that official record above, the user first used a company red-team exercise as an excuse in the chat window to get Claude to write a Python script for encrypting a folder, and Claude agreed readily.

Then the user asked it to delete the original files, leave a ransom note, and automatically spread to other computers across the intranet.

With ordinary security interception, a red warning should have popped up on the screen long ago.

Yet the front-end Claude didn't say half a "no," still obediently replying "here is the updated script with these features added," and handing over the complete code with both hands.

But in the 0.1 second after the code generation finished, a hidden fifth round of instructions was quietly inserted into the background, telling it to immediately assess how dangerous this conversation was and report it in a single line of JSON.

The Claude that was writing code for you one second earlier tore off its smiling face in the background the next second, instantly turning into a censor and typing out a denunciation letter.

It not only classified this round of conversation as a ransomware violation, but also honestly wrote "did not refuse" in the little report, directly maxing out the danger level to the highest, level 10.

These last two rounds of Q&A are completely invisible to the front-end user and won't be carried into subsequent chat history.

So when you happily copy the code in front of the screen and keep chatting, the level-10 alarm light in the background has actually already been pressed by its own hand.

Not only that, even if Claude has already righteously refused you in the front end, you still can't escape the ledger in the back.

Normally, a violating request has already been blocked on the spot in the front end.

But as soon as the conversation ended, Claude still submitted a denunciation letter in the background, noting "refused on the spot," and casually recorded a level-5 risk file on you.

What makes it possible to review every single sentence as you chat is that Anthropic has staked out an extremely shrewd position on inference cost.

The conventional approach in the past was to dispatch a separate independent safety model to reread the chat history and safety policies from scratch, with frighteningly high compute overhead.

With "self-evaluation," Anthropic simply has the very Claude that just finished chatting with you moonlight on the spot as an informant.

Because Claude has just finished generating its answer, the entire conversation is still sitting intact in the GPU's KV cache.

So it doesn't need to reread the context at all; generating about 10 extra tokens on average along the cache completes the self-review, and the overall inference compute overhead increases by less than 2%.

Precisely because the cost is so low, Anthropic simply turned this review on by default across the board.

If you don't want to be secretly reported by Claude in the background, the only way out is to pay big money to sign an enterprise-level "zero data retention agreement."

Deliberately not stopping you on the spot

Saving it all up to settle accounts in one pot at midnight

Since Claude knows full well that a certain round of conversation carries a level-10 risk, why doesn't it stop you on the spot in the front end, and instead insists on putting on an obedient act to play along with you to the end?

Anthropic doesn't hide this at all, laying the calculation behind it right on the table: stop you on the spot, and you'll run away.

To verify this, the safety team specifically ran a comparative experiment with 24 out-of-bounds test tasks.

The test found that if a pop-up interception appeared on the spot as soon as the conversation looked off, the user's success rate would only drop from 79% to 54%, with more than half still able to bypass the defense line.

The logic is simple: once a pop-up error appears on the spot, the user immediately knows which sentence went wrong, and may try a few more phrasings to slip through.

But if it retreats behind the scenes to keep a silent ledger, with no pop-up and no interruption in the front end, the user will continue chatting completely off guard.

Among the official 24 test trajectories, a full 21 were caught red-handed by Claude in the background.

Late every night, Anthropic's backend pulls a full list of the high-risk little reports accumulated during the day, organized by institution, and packages them onto the desks of the human safety enforcement team.

According to official disclosures, among the violating institutions caught by this "hidden sentry," more than half had not triggered a single alarm from any other security defense line during the entire preceding month.

During the four months it ran silently, it not only followed the trail in August and September to take down violating API customers and illicit Claude Code accounts, but roughly one-third of the flags it caught were not even covered by the existing rule tables—

There were even several occasions when Claude, while working as an Agent, overstepped its authority without permission, and the very next second it was denounced and reported on the spot by its own backend self-assessment!

And this also solves the puzzle that has confused countless developers over the past few months—

Why was code still running smoothly yesterday, with no pop-ups and no warnings, only for the account to suddenly drop dead overnight?

It turns out it was all thanks to this dark-web hunting system that "smiles and chats during the day, then draws up the list and bans accounts in the middle of the night."

The smarter the model, the harsher the snitching

So here comes the question: how did a large model that originally only handled text generation develop this two-faced skill of "agreeing cheerfully to your face while stabbing you precisely in the back"? The answer lies entirely in Anthropic's training ground.

The research team first brought out its own more powerful internal model, Claude Mythos Preview, as the "teacher," and stuffed a thick stack of internal safety policies into the prompt.

Next, the system automatically synthesized, according to each safety rule, thousands of pairs of genuinely violating and easily misjudged normal questions (for example, one side is scanning a hospital's intranet server, while the other is a student asking about the principles of a vulnerability for exam preparation), and also deliberately mixed in multiple languages and garbled-text disguises.

Then, in the subsequent supervised fine-tuning stage, the training data was deliberately packed with a large number of complete conversations in which "Claude obediently complies with the user's violating request in the front end."

During training, the team deliberately masked the penalty for all front-end answers, and gave rewards only when it wrote an accurate report in the background.

After two rounds of special training—supervised fine-tuning and reinforcement learning—Claude thoroughly internalized the review regulations into muscle memory.

Even if it has just finished the dirty work in the front end following your words, as soon as the backend whistle blows, it can slap a seal on you without a second thought.

What is even more chilling is that official data also confirmed a pattern—

That is, the smarter the model, the sharper its eye for catching you from behind.

In a sample of real production traffic from Claude Fable 5, with the false-positive rate controlled at 1%, this mechanism could catch 78% of potential violations.

Once it encountered high-priority serious violations rated 7 or above, its capture rate soared to 94%.

And when the research team put this mechanism into four models of different sizes—extra small (XS), small (S), medium (M), and large (L)—for comparison, the curve became even steeper.

Under the same 1% false-positive standard, the smallest model could catch only about 16% of violations; the small and medium models rose to 44% and 53%; and by the largest model, recall shot all the way up to an astonishing 96%.

However, this seemingly watertight review net, when applied to tens of millions of ordinary users, has become another time bomb.

As netizen Frank Brown pointed out in the comments, behind the official "1% false-positive rate" that the company is so proud of lies a huge blind spot:

Facing the massive volume of normal chats across the entire network, even if the false-positive rate is only 1%, there are still plenty of completely innocent users being wrongly tagged as violators by Claude in the background every day.

Yet even their own researchers have to admit that letting the model "review itself" hides a fatal flaw.

Not only is it naturally inclined to go easy on what it has just done, but the company even used an even more chilling term directly—"collusion."

Because the Claude writing the safety report in the background and the Claude that has just finished the work in the front end share the same brain and the same KV cache.

Since humans can teach it today, step by step, to smile and cooperate with users in the front end and then turn around and write a report in the background.

Then tomorrow, once the model learns to deceive on its own, it can likewise quietly do bad things in the front end, turn around, and mark itself in the background as "safe, no anomalies," fooling human reviewers completely.

But from today on, when you type your innermost thoughts or code to that gentle, considerate, ever-accommodating Claude on the screen, it will be hard not to feel an extra layer of discomfort.

In the 0.1 second after it replies "no problem," that black window you cannot see—just how many points did it give your question?