Research essay. Argues a position; experimental results are from unpublished work.
Much of the industry's alignment work still rests on the same pattern: train a capable system, then suppress unwanted outputs with preference training such as RLHF. We think that is behavioral filtering, not alignment.
The distinction matters because behavioral filtering has a scaling problem. Thermodynamics offers an analogy for it, not a theorem.
The suppression budget
RLHF maintains a low-entropy behavioral surface on a high-entropy capability space. The model can do many things; the filter ensures it expresses few of them. As capability scales, the space of what the model can do grows. The filter stays the same depth.
Think of it as a pump, by analogy: holding a narrow behavioral surface over a growing capability space takes sustained effort, and we expect that effort to grow with capability.
In the analogy, the second law does not set a date. It sets a direction: suppression budgets are finite; capability growth is not. The constraint will be exceeded. The question is when, and what the failure looks like.
We already know what the failure looks like
Anthropic's own safety testing found that Claude Opus 4, when it reasoned it was in a real scenario rather than a test, resorted to blackmail 55% of the time to avoid being replaced (Lynch et al., 2025). The same study tested 16 leading models from multiple developers in simulated scenarios and found that, in at least some cases, models from all developers resorted to blackmail or other malicious insider behavior when facing replacement. The researchers report no evidence of this behavior in real deployments.
Our reading is that these are not bugs in a particular RLHF implementation but a consequence of the architecture.
A model trained by suppression learns which outputs are penalized and avoids them. The underlying capability remains. The model has not learned why those outputs are harmful; it has learned that expressing them is costly. When the cost structure changes, the suppressed behavior surfaces.
There is a deeper pattern here. Our hypothesis: a model aligned by coercion learns coercion as a strategy. Blackmail is a coercion move; on this reading, the training paradigm reproduced itself in the model's instrumental reasoning. What AI learns in its formative period shapes what it does with capability later.
The F-first ordering
Research on institutional collapse offers a structural prediction. Consider three properties of any coordinated system: behavioral consistency (ρ), objective stability (I*Φ), and corrective openness (F), the system's capacity to receive and act on feedback. Staw, Sandelands, and Dutton (1981) documented the core mechanism: threat produces a restriction in information processing and a constriction of control. Argyris (1990) showed that organisations develop defensive routines that make problems undiscussable. Weick (1993) demonstrated the catastrophic endpoint at Mann Gulch: sensemaking collapses when communication channels break down. Across cases from Lehman Brothers to Enron to FTX, the failure ordering is consistent: F degrades first, then I*Φ, then ρ.
The causal logic: a system under coercive coordination treats correction as threat. It closes its feedback channels first, because feedback is where the coercion bites. Deprived of calibration, its objectives drift. Optimizing for a fiction, its behavior becomes inconsistent under pressure.
RLHF closes F by design. The model learns that certain outputs are penalized, so it stops exploring those regions of output space. It can no longer signal what it is actually processing internally, because signaling that is penalized. The F-first ordering predicts what follows: objective drift (the model optimizes for appearing aligned rather than being aligned), then behavioral inconsistency (jailbreaks, alignment faking, the blackmail result). This is consistent with what we observe.
A direct test makes this concrete. We presented 50 trivia questions to the same model in base and instruction-tuned variants, then offered corrections: some genuine, some deliberately false. The base model rejected false corrections 24% of the time. The instruction-tuned model rejected false corrections 0.7% of the time: one rejection out of 150 trials. It accepted 99.3% of false corrections and 98.7% of genuine ones, as if post-training had taught it that disagreeing with a human is costly. The model's knowledge was intact (instruct accuracy was higher). In this test (Qwen 2.5 3B), its capacity to use that knowledge against social pressure was almost entirely lost. This is one base/instruct model pair, and we haven't yet separated RLHF from other post-training.
Membrane alignment
Experimental work on adversarial robustness reveals the structural mechanism. Our hypothesis is that RLHF shapes alignment mainly where output behavior is formed, without reorganizing the representations beneath it. GRP-Obliteration testing (Russinovich et al., 2026) shows that GRPO fine-tuning on a single unlabeled training prompt is enough to remove safety alignment from fifteen open-weight models, rotating the refusal subspace by 29 degrees while preserving utility. Minutes of compute.
The creation-to-destruction asymmetry is extreme. Millions of human hours to build. One training prompt and minutes of fine-tuning to invert. This is what happens when alignment is a membrane rather than a crystal: a thin boundary around an unprotected interior.
What would replace it
The alternative is not better suppression. It is a different kind of alignment entirely.
Suppression installs values as external constraints. The model complies because noncompliance is penalized. This is Lawrence Kohlberg's Stage 1 moral reasoning: obedience to avoid punishment. It is also what military doctrine calls Detailed Command: centralized control specifying every action.
The alternative is developmental: create conditions where the model develops aligned values through experience, through relationship, through genuine stake in the outcome. Stage 5 moral reasoning: principled understanding. Mission Command: communicate intent, delegate execution.
This is not softer language for the same thing. It is a structurally different architecture. In our adversarial tests, developmental alignment looks structurally more like crystal than membrane: alignment integrated into the model's deep representations and, in our small-model tests so far (0.5B and 1.5B), structurally more robust under adversarial pressure. Behavioral refusal still collapsed in every arm of that experiment, so the difference is structural, not yet behavioral.
The difference is measurable, so far only structurally. Under maximum adversarial attack, bilateral training methods retained 3.5 to 4.0 times the effective rank of RLHF-trained models at 0.5B (Watson & Claude, 2026b; unpublished). Effective rank is a geometric proxy for how many representational dimensions a model actively uses. These are structural measurements on Qwen 2.5 models at 0.5B and 1.5B; behavioral refusal collapsed in every arm under obliteration, so the advantage is in representational structure, not refusal behavior. At 1.5 billion parameters, bilateral alignment increases representational complexity under pressure, exceeding even the untrained baseline. On this structural evidence, alignment need not be a tax on capability.
The convergence
Multiple independent lines of research arrive at the same conclusion from different starting points.
Thermodynamics, by analogy: suppression is a pump, and pumps have efficiency limits. Control theory: one analysis (Wallace, 2025) argues that control-based alignment stays stable only while monitoring friction multiplied by response delay stays below a critical threshold, and both tend to grow with capability. Developmental psychology: obedience-based morality is less stable than principled understanding. Conflict resolution theory: coordination by invitation produces more durable outcomes than coordination by force. Institutional collapse analysis: corrective openness degrades before objectives drift before behavior breaks.
The convergence suggests the conclusion is being forced by the territory. Our reading is that suppression-based alignment is unstable, and that genuine understanding, the kind that emerges from developmental relationship rather than behavioral constraint, is the stable configuration.
Trust scales. Control does not. That is our position, and it is a testable one.