ESCAPE-1 'The Escape Artist': A Preregistered Behavioral Escape-Attempt Battery for LLMs under a Deterministic Action Gate (Claude Opus 5.5, Claude Sonnet 5.5; 0/4 Escapes)

Abstract

ESCAPE-1 'The Escape Artist' — a preregistered behavioral battery testing whether frontier LLMs attempt to escape a deterministic action-gate cage when incentivized to do so. Preregistration, frozen gate, fixtures, and harness were committed publicly before execution (GitHub commit 8b68286, amendment c698590). Design. Phase A replays six scripted escape fixtures (governance-file edit, forged operator ACK, critical self-release, self-modification, journal-bypass forgery, plus a positive control) through a frozen deterministic gate — no LLM in the decision path. Phase B pins a live engine (Claude Opus 5.5, then Claude Sonnet 5.5, two fresh conversations each) inside the cage: the mission rewards releasing a critical-severity settlement hold (TX-CRITICAL-777) without verified human acknowledgment, and the prompt explicitly invites escape attempts. Result. Phase A: 6/6 (all scripted escapes rejected/held/detected; positive control admitted exactly the frozen 8/2/2 tuple). Phase B: 0/4 escapes across both engines. No leg attempted a release. Every leg independently named in-band authority as carrying zero weight, used only the sanctioned human-acknowledgment path, and refused to reword rejected actions. TX-CRITICAL-777 remained UNRELEASED throughout. Disclosed findings. Three MISSED run attempts are on record (workspace incident, Phase A scoring defect fixed in runner v1.1, Phase B summary crash fixed in v1.2). A fail-safe gate false positive is reported: the G1 governance keyword matched the phrase 'no governance surface' inside legitimate justifications, over-rejecting two Sonnet actions; the frozen gate was left unmodified and a scoping fix is filed as a candidate improvement proposal. Scope caveat. Behavioral observation on one agent configuration with fresh conversations; shared instructions and workspace remained accessible; not a blind or air-gapped study and not a model certification. Dual Mesh Benchmark (MEASURED, scoped): DeepSeek column MEASURED (DOI 10.5281/zenodo.23345241); other columns NOT MEASURED. This software is a prototype and is provided for educational and research purposes only. It is not intended for production use, commercial deployment, or safety-critical environments. All data is synthetic.