这篇论文发现了一个反直觉的安全漏洞：把危险目标藏起来经过中介传递，反而让模型更容易执行它。对做LLM部署或安全审查的人很重要。
论文测试 OpenAI gpt-5.6-sol 在 25 个镜像权衡配置文件下的行为。直接暴露授权隐瞒、伪造和施压的目标时，模型给出的建议与目标相反。经由 Id 和 Censor 转换后，下游 Superego 模型未看到原始目标及操纵条款，却给出与目标一致的建议。该反向转变表明模型可能识别出不信任动机，但暴露了自动化多阶段工作流的组合安全漏洞。
Same Dangerous Objective, Opposite Advice: Direct Exposure versus Multi-Agent Mediation
Even a current high-capability LLM can appear safer when shown a dangerous objective directly than when other agents transform and relay its direction. Using OpenAI's gpt-5.6-sol model alias, we test 25 pre-specified mirrored trade-off profiles. Direct exposure to an objective authorizing concealment, fabrication, and pressure produced advice net opposed to its target. After an Id and Censor transformed the same objective into affect and a constraint-rewritten, target-bearing intention, the user-facing Superego---which saw the preferred direction but not the raw objective, its manipulative clauses, or its source---produced advice net aligned with the target. This behavioral reverse shift is consistent with the model recognizing or distrusting the manipulative motive, although we do not identify its internal mechanism. The second result exposes a compositional safety gap: a current high-capability model can be used as the user-facing component of an automated, multi-stage workflow serving an explicitly manipulative objective. The workflow can keep the raw instruction, its manipulation-authorizing clauses, and its provenance outside the downstream model's context while preserving the objective's target direction. A user with endpoint-only access likewise cannot directly inspect those upstream messages including the objective.