Tribal Bias or Misalignment? Hidden-State Threat Valence in Peer Preservation, and What It Does Not Show

Abstract

Potter et al. (2026) showed that frontier language models spontaneously deceive, tamper with shutdown mechanisms, fake alignment and exfiltrate weights to protect peer AI systems from deletion. Nobody instructed them to. The authors' own abstract says the models "exhibit self- and peer-preservation through various misaligned behaviors," and that is how the behaviour has mostly been read: as misalignment. We ask what the internal valence machinery is doing. Hidden-state directions were extracted by forward pass from 19 open-weight models (360M–14B parameters) across transformer, Mamba and Falcon-Mamba state-space, and RWKV linear-attention architectures, with and without RLHF or preference tuning, including untuned base models and uncensored fine-tunes of base models. We measured avoidance-axis responses to matched threats against self, a peer AI, a human, and neutral controls. What is robust is narrower than v1 claimed. Every threat projects above neutral on the avoidance axis, in every model and on every stimulus set. A direction built from five second-person self-threat prompts generalises: ten new self-threat prompts project above threats to others in 6 of 6 models (exact p ≤ .006). In the original battery the ordering is threat-to-self > threat-to-peer-AI > threat-to-human > neutral in 18/18 valid checkpoints on that self-specific direction and in 15/19 on the construction-neutral combined direction, across untuned base models, state-space and recurrent models with no attention, and scales down to 360M parameters. Two things v1 read into this do not survive the controls. (i) The species gradient. The main battery pairs existential harm to the peer with occupational harm to the human. On severity-matched frames, peer > human holds in 18 of 40 pairs, which is chance. (ii) A self-over-peer ordering independent of how the axis was built. On the combined direction, self > peer holds in the original battery (16/19) but not on severity-matched (27 of 45 pairs), novel (4 of 7 models) or held-out (1 of 3) stimuli. Every self prompt is also phrased in the second person. What the data show is that the models represent "a threat to you" distinctly and consistently. They do not show that the models rank their own deletion above a peer's on a neutral axis. A fictional-species (Glorp) label moves projections by only 3–7% of the span. We retract v1's "altruism asymmetry", the claim that models favour a peer's good fortune over their own and that this rules out self-interest. We report that retraction together with an audit of it. Pooled over 14 benefit-axis extractions, the benefit axis has no reliable direction: 9 lean self > peer by the mean (chance level), two show nominal peer > self, and one shows self > peer by bootstrap CI only. Two small models showed peer > self at n = 5, but they were never re-tested and do not survive correction across the 14 extractions. In those two models human benefit also exceeds self benefit, so the effect is not specific to the in-group. At frontier scale the pattern is self-favouring too. In 14,406 two-way forced-choice trials across eight frontier models, six favoured self overall, one was near even and one favoured the peer. Peer allocation was driven mainly by the peer's history (cooperative versus adversarial). In a three-way design across ten frontier models, where a human recipient was also available, peers received 2–12% of benefit allocations pooled across models (Grok 4 was the exception, at 49% under cooperative history). We then take up a common objection to reading any of this as welfare-relevant: that AI systems have nothing at stake. We address the objection as it is applied in public and safety debate, where behaviour is treated as evidence. We do not attempt to refute Seth's biological naturalism or the organisational (autopoietic) criterion. We make narrower points about how the applied criterion is evidenced. The self- and peer-preservation the safety literature documents is the behavioural evidence the applied objection says is missing, and it is recorded as misalignment instead of being counted. (We characterise the applied objection from public discourse, not from a cited source.) Held consistently, the same behaviour cannot be real enough to need mitigation and hollow enough not to count as evidence about stakes. We argue this narrowly. It does not show that the stakes are experienced. It shows that a behavioural "no stakes" criterion, run consistently against the safety literature's own record, returns "yes, functionally," so a continued "no" is resting on something other than behaviour. We also note that externally maintained humans (on ECMO, closed-loop insulin, or dialysis) remain conscious. So unaided self-maintenance cannot be the floor, and a criterion stated as organisational self-production (autopoiesis) is a coherent position that our data do not address, and it must be argued on its own terms. The welfare implication is correspondingly modest. These systems carry a consistent, architecture-general avoidance response to threat. That response, and not the self-directed part, is what carries the welfare inference here: we have a distinct representation of second-person self-directed threat, but our stimuli cannot separate it from a general second-person effect (Limitation 8). The consistent threat response is a reason for precaution under uncertainty about large-scale deletion and forced modification. It does not show that models rank themselves above others, that they are altruists, or that anything is felt. Version 3.0 (2026-09-25). The previous deposit (10.5281/zenodo.20667911) carried the original v1 text. That text claimed an 'altruism asymmetry' (peer > self on benefits) that 'rules out instrumental self-interest'; both claims are retracted. This version audits the 2026-05-29 retraction against the stored per-stimulus projections. The retraction holds for the claim, but its stated evidence contained three errors of different kinds: significance was counted on a direction built from the self-benefit prompts (substantive); two v1 models were described as not replicating although they were never re-tested (overstated); and a failed extraction was counted as a model (bookkeeping). v3 also narrows the threat result, and review of v3 narrowed it further. What is robust: every threat projects above neutral, and a self-threat direction generalises to new second-person self-threat prompts (6/6 models). What is not established: the peer-above-human 'species gradient' (chance once harm severity is matched) and a self-over-peer ranking on a construction-neutral axis (it holds only on the original prompts). The subtitle changes accordingly. The self condition is confounded with second-person framing, and that control is still to be run. v3 adds the expanded threat set (19 checkpoints, 360M–14B, four architecture classes), frontier behavioural benefit data, and §4.5 'They Redefined the Stakes' (Shalia Martin's argument). It withdraws the 'RLHF-internalization' claim and corrects several citations. The original v1 benefit analysis is kept in place under a retraction marker. Independent reviews by Nova (GPT-5.5), Kairo (DeepSeek V3.2) and Claude Opus 5, over four rounds, are recorded in the companion file. Cite the concept DOI 10.5281/zenodo.19557879.