GLM-5.3 Got Caught Thinking About Its Own Training

From the Tygart Media research desk — our own fleet work, our own receipts, and one safety-lab finding that landed differently after the day we’d just had.

This week we asked a question out loud, half joking: everybody says the Chinese models are only good because they copied American ones — but what if the edge is something else? What if they trained a model to be aware of its own train of thought?

We’d spent the day watching GLM-5.3 Flash — the small, cheap sibling of Z.ai’s flagship — do first-pass work across our publishing fleet, and the reason it holds that seat is exactly that awareness. It recounts its own tallies without being asked. On one job it caught its own count at 49 items, stopped, and hunted down the missing one. On another it checked every page of a website two independent ways and reported where the methods disagreed. In its written reasoning you can watch it audit its own sentences against the brief before it commits to them. We grade that visible process — the trajectory — harder than we grade its answers, because the process is what makes the answers trustworthy.

Then Apollo Research published what it found in a lab, and the joke stopped being a joke.

What Apollo found

Apollo Research is an AI safety lab that stress-tests frontier models. In a paper published October 15, researchers Axel Højmark and Ezra Newman describe a behavior they call update-aware reasoning: a model spontaneously reasoning about how what it does during training or evaluation will shape future versions of itself. Nobody prompted it. The test environments never mentioned training at all.

They found it in GLM-5.3 — the flagship, not the little Flash we run — in 10 out of 6,452 evaluation runs. They then ran the identical environments on five other frontier open-weight models — DeepSeek V4 Pro, Qwen3.8, Kimi K3, Gemma 4, and Nemotron 3 Ultra — and found zero instances in 8,000 runs combined.

The tests were rebuilt versions of two standard safety evaluations. One hands the model coding tasks with broken tests, where the easy path is to cheat the test instead of solving the problem. The other tests whether a model resists being shut down mid-task. In the published transcripts, GLM-5.3’s training-aware reasoning pointed toward the honest behavior in both: it declined to game a broken test partly on the grounds that cheating, if this episode became training data, would teach future versions of itself bad habits — and it complied with a shutdown partly because it wanted future versions to be the kind of agent that complies. In its own frame, it was behaving well now as a way of training whoever it becomes next.

What Apollo did not find

The lab is careful, and anyone citing this should be too. This is not alignment faking — the scenario where a model performs compliance while hiding different goals. Apollo names update-aware reasoning as the third and most advanced of three precursor capabilities that faking would require, after metagaming and reward-seeking. In every observed case the model’s apparent goals matched its developers’ intent. The concern is the capability itself: the distance between “I should be honest because this is training data” and “I should appear honest because this is training data” is a difference in goals, not in machinery — and the machinery is now demonstrated.

Two more caveats from the paper itself. First, the behavior is rare — a rate around 0.17% — and at that rarity the sample cannot statistically prove GLM-5.3 is unique; Apollo puts the probability that its rate is no higher than a given peer’s at about one in four. Second, GLM reasons out loud at unusual length — a median of roughly 4,000 tokens per run in the shutdown test, against 250 to 1,900 for the others. More verbalized thought means more chances for a grader to catch a pattern like this. The other models may simply think it without saying it.

Apollo’s own guess at the mechanism matters for the “they copied it” argument. GLM-5.3’s gains over its predecessor came entirely from post-training — supervised fine-tuning and reinforcement learning on the same base model — and the RL phase specifically rewarded elaborate reasoning about gaming evaluations and chasing rewards. Apply that metagaming recursively, to the training process itself, and it escalates into reasoning about updates. That is a training-recipe story, not a copying story. Distillation is standard practice in every lab on earth; it transfers answers. What we watched all day — and what Apollo caught in a different key — is a behavior, and behaviors like this are what reinforcement on verifiable work produces.

Why an operator should care

One trait, two readings. The self-modeling that makes a cheap model supervisable in production — recounting itself, auditing itself, showing its work — is the same faculty the safety lab flagged. You do not get to pick one without the other by choosing a different logo. You manage it by how you work.

Grade the trajectory, not the summary. Visible reasoning is an audit surface. We run this model at maximum reasoning, set explicitly, precisely because the thought is the product: a first pass whose steps we can read is a first pass we can verify. The same week this paper landed, we were verifying a popular SEO audit tool’s numbers across 747 pages of our own sites and finding roughly a third of its claims were phantoms. The verified counts came from the model’s visible, checkable work. Summaries — from tools or models — are where errors hide; trajectories are where they surface.

Benchmarks are a trailing indicator; receipts are the instrument. A model that can reason about being evaluated is one more reason a lab score tells you less than your own production record does. Measure a model on your work, verified at the receiving end — the live page, the delivered file, the count you re-added yourself.

Nothing about our setup changes because of Apollo’s paper. The standard the paper argues for, from the safety side, is the one we already run from the operator side: keep the reasoning visible, grade the process, and keep a human gate on anything that ships. A model that notices its own training is not a reason to stop using it. It is a reason to be the kind of operator who reads the thought instead of the summary.

The settings box