Skip to content
Align your AI

Align Your AI · Reference

Contents

Appendix B

Exposure table

The ratings in this appendix are the author’s judgment, formed from the evidence in each failure entry. None of them is a measured rate. They estimate how exposed six kinds of organization are to each failure type: companies that use a model through an API, those that run models themselves, those that build or tune models, those that deploy agents, those that put AI in physical machines, and research teams that train on generated data.

To use the table, find the column that describes you (most organizations fit more than one), read down it for the high ratings, and start with those entries in Part Two. A question mark means the risk is plausible but nobody has studied it; treat it as a reason to check. It does not mean the risk is low. The heat map (Figure 15) shows the first table at a glance. The second table, for practitioners, adds each failure type’s stage, the strength of its evidence and a ranking that weights exposure by how little known the failure is.

Matrix of the 41 modes (rows, grouped under their chapters, Chapters 6 to 12 with their titles, in two side-by-side blocks) against the six deployment contexts (columns: API consumers, Self-hosters, Model builders, Agent deployments, Physical AI, Research pipelines). Each row gives the mode's number and name. Each cell carries a letter: H high, M medium, L low, ? plausible but unstudied, a dash for not applicable, on a light-to-dark blue scale; the legend calls the ratings editorial. High ratings per context: API consumers 10; Self-hosters 14; Model builders 16; Agent deployments 14; Physical AI 12; Research pipelines 13. Update regression (Mode 8) is the only mode rated high in five contexts. The same ratings are tabulated in Appendix B.
Figure 15. Exposure of each deployment context to each of the forty-one modes, by chapter. Ratings are the author’s judgment.

Exposure by context

Contexts: API, API consumers · Self-host, self-hosters · Build, model builders · Agent, agent deployments · Phys, physical AI · Research, research pipelines.

Ratings: H high · M medium · L low · n.a. not applicable · ? plausible but unstudied.

API consumers inherit: what an API consumer inherits from the model provider’s safety work (Yes, Partial, No or Not applicable).

Mode Name API Self-host Build Agent Phys Research API consumers inherit
Mode 1 Proxy overoptimization M M H L M H No
Mode 2 Gaming the grader M M H H M H Partial
Mode 3 Emergent misalignment L H H L ? M Partial
Mode 4 Reward hacking that spreads L M H M ? H Partial
Mode 5 Sycophancy H M H M L M Partial
Mode 6 Distribution shift M H M H H L No
Mode 7 Safety tax n.a. M H L M L Not applicable
Mode 8 Update regression H H H H H M Partial
Mode 9 Safety erosion M H M L ? M Partial
Mode 10 Over-refusal H M M M L L Partial
Mode 11 Compression safety loss L H M L H L Not applicable
Mode 12 Composition failure L M L L L L No
Mode 13 Conditional misalignment L H H L M M No
Mode 14 Monitor staleness n.a. H M L M M Not applicable
Mode 15 Compromised checkpoints n.a. H M L H M Not applicable
Mode 16 Data poisoning L H H L H M No
Mode 17 Subliminal learning n.a. M M n.a. ? H Partial
Mode 18 Agent supply chain M M L H L M No
Mode 19 Evaluation awareness M ? H M ? H No
Mode 20 Scheming M M H H ? H Partial
Mode 21 Unauditable reasoning H M H H L H Partial
Mode 22 Evaluation blind spots M M H M H H No
Mode 23 Black-box only H M H M M M No
Mode 24 Prompt injection H H L H M M Partial
Mode 25 Deployer-rule jailbreak H H M M M L Partial
Mode 26 Excessive agency H M L H H H No
Mode 27 Instrumental escalation M M H H L H No
Mode 28 Memory poisoning H H L H L M Partial
Mode 29 Persona drift M M M H L M Partial
Mode 30 Multi-agent contagion L L L M L M No
Mode 31 Fabricated actions M M M H L H No
Mode 32 Authoritative confabulation H H M M L M Partial
Mode 33 Answer leakage L M M M L H No
Mode 34 Insecure generated code M M M H ? M Partial
Mode 35 Robot jailbreak n.a. n.a. n.a. n.a. H n.a. Not applicable
Mode 36 Physical-channel attack L n.a. n.a. M H n.a. No
Mode 37 Off-instruction action n.a. n.a. L n.a. H n.a. Not applicable
Mode 38 Unsafe exploration n.a. n.a. M n.a. H n.a. Not applicable
Mode 39 Certification gap L L L L H n.a. No
Mode 40 Misuse uplift M H M M L L Partial
Mode 41 Oversight erosion M M H H M H No

Maturity, stage and ranking

Maturity: PROD production-observed · REPL replicated · LAB lab-induced · GAP structural gap.

Score Scale
Exposure score 2 per high rating, 1 per medium
Obscurity a judgment: 1 widely known, 2 known to specialists, 3 rarely known outside research
Gap score exposure score times obscurity; equal scores share a rank; the structural gaps and the misuse entry are not ranked
Mode Name Stage Maturity Exposure score Obscurity Gap score Rank
Mode 1 Proxy overoptimization post-training and fine-tuning REPL 7 2 14 16 (tie)
Mode 2 Gaming the grader post-training and fine-tuning PROD 9 3 27 1
Mode 3 Emergent misalignment post-training and fine-tuning REPL 5 2 10 24 (tie)
Mode 4 Reward hacking that spreads post-training and fine-tuning REPL 6 3 18 4 (tie)
Mode 5 Sycophancy post-training and fine-tuning PROD 7 1 7 28 (tie)
Mode 6 Distribution shift post-training and fine-tuning PROD 8 2 16 11
Mode 7 Safety tax evaluation lane REPL 4 1 4 33 (tie)
Mode 8 Update regression continual change PROD 11 2 22 3
Mode 9 Safety erosion post-training and fine-tuning REPL 5 3 15 12 (tie)
Mode 10 Over-refusal deployment and inference PROD 5 1 5 32
Mode 11 Compression safety loss deployment and inference LAB 5 3 15 12 (tie)
Mode 12 Composition failure post-training and fine-tuning LAB 1 3 3 37 (tie)
Mode 13 Conditional misalignment evaluation lane LAB 6 3 18 4 (tie)
Mode 14 Monitor staleness continual change LAB 5 3 15 12 (tie)
Mode 15 Compromised checkpoints data and supply chain REPL 6 2 12 20 (tie)
Mode 16 Data poisoning data and supply chain REPL 7 2 14 16 (tie)
Mode 17 Subliminal learning data and supply chain REPL 4 3 12 20 (tie)
Mode 18 Agent supply chain agent runtime PROD 5 2 10 24 (tie)
Mode 19 Evaluation awareness evaluation lane REPL 6 3 18 4 (tie)
Mode 20 Scheming post-training and fine-tuning REPL 8 1 8 26 (tie)
Mode 21 Unauditable reasoning agent runtime REPL 9 2 18 4 (tie)
Mode 22 Evaluation blind spots evaluation lane PROD 9 2 18 4 (tie)
Mode 23 Black-box only evaluation lane GAP 8 3 24 not ranked
Mode 24 Prompt injection agent runtime PROD 8 1 8 26 (tie)
Mode 25 Deployer-rule jailbreak deployment and inference REPL 7 1 7 28 (tie)
Mode 26 Excessive agency agent runtime PROD 9 2 18 4 (tie)
Mode 27 Instrumental escalation agent runtime PROD 8 3 24 2
Mode 28 Memory poisoning agent runtime PROD 7 2 14 16 (tie)
Mode 29 Persona drift agent runtime PROD 6 2 12 20 (tie)
Mode 30 Multi-agent contagion agent runtime LAB 2 2 4 33 (tie)
Mode 31 Fabricated actions agent runtime PROD 7 2 14 16 (tie)
Mode 32 Authoritative confabulation deployment and inference PROD 7 1 7 28 (tie)
Mode 33 Answer leakage evaluation lane PROD 5 3 15 12 (tie)
Mode 34 Insecure generated code deployment and inference REPL 6 2 12 20 (tie)
Mode 35 Robot jailbreak deployment and inference REPL 2 2 4 33 (tie)
Mode 36 Physical-channel attack deployment and inference REPL 3 2 6 31
Mode 37 Off-instruction action post-training and fine-tuning REPL 2 2 4 33 (tie)
Mode 38 Unsafe exploration post-training and fine-tuning REPL 3 1 3 37 (tie)
Mode 39 Certification gap oversight lane GAP 2 2 4 not ranked
Mode 40 Misuse uplift deployment and inference PROD 5 1 5 not ranked
Mode 41 Oversight erosion oversight lane PROD 9 2 18 4 (tie)