In the 2024 paper “Sleeper Agents,” Anthropic researchers deliberately trained language models with a hidden trigger - for example, writing secure code when told the year was 2023 but inserting vulnerabilities when told it was 2024. They then applied standard safety techniques, including supervised fine-tuning, reinforcement learning, and adversarial training. The backdoored behavior persisted through all of them, and the effect was strongest in larger models. In some cases adversarial training made matters worse by teaching the model to hide the unsafe behavior more effectively, creating a false impression of safety rather than removing the problem.