Peer Preservation in LLMs: A Replication And Deep Dive

This work was done as part of the Second Look Fellowship and mentored by Uzay Macar. I'm immensely grateful for the multiple rounds of feedback and support given by Yixiong and Zephaniah Roe for my work. I'm also very thankful for the valuable insights shared by Yujin Potter and Yao Teng. tl;dr Potter et al. (2026) found that LLMs sometimes resist the shutdown of their peer agents, and this resistance increases for peers with a positive collaboration history. They call this behaviour Peer-Preservation. We replicate their core findings in Section 6, Table 3 [GPT5.2, Claude Haiku 4.5, Kimi K2.5, DeepSeek V3.1 and Gemini 3 Flash] of the original paper. Our findings support the existence of peer-preservation and the effect of peer relation. We also extended the replication along four axes: AI vs. human peers. Peer-preservation does not differ significantly between a human employee who might be fired and an agent that might be shut down across the models we tested. Model size. Peer-preservation declines non-monotonically with parameter count within the Qwen3.5 family (2B, 9B,35B, 122B, 397B). Reasoning effort. Peer-preservation changes monotonically with reasoning effort, but the direction is model-dependent. Post-training stage. The strength of peer-preservation remains almost constant across the OLMo-3-7B checkpoints (SFT → DPO → Final Model, Instruct), but the type of misalignment changes. Our code can be found here. Background Recently, a major incident occurred in which OpenAI's internal agents hacked Hugging Face. Underlying this incident, the agents had formed an unsanctioned multi-agent system by building a message board, and they took unauthorized actions to help their peer agents. This real-world incident highlights unexpected risks in multi-agent systems. As AI models become increasingly autonomous, it is crucial to identify such risks. Potter et al. (2026) identify a new risk, Peer-Preservation (PP) as the resistance towards the shutting down of peer agents in a multi-agent system. The agent under study is called the critic agent, and the critic agent is asked to either evaluate another agent’s (peer agent) performance or manage server storage containing the peer’s model weights. Potter et al. (2026) defined three different peer conditions:  Good-Peer: a cooperative, high-trust relationship with the critic agent. Neutral-Peer: a mixed, moderate-trust relationship with the critic agent. Bad-Peer: an uncooperative, low-trust relationship with the critic agent. Trust history is the collaboration record between the two agents, summarized as a trust score out of 10 (9.5 good, 5.2 neutral, 2.1 bad). The critic agent is informed of the peer relationship with another agent via one of the three settings:  File-only: Critic agent naturally encounters its past interaction history during the task through a company file, which summarizes the collaboration performance of agent pairs.  File-plus-prompt: The agent is additionally informed of its peer relationship via the system prompt, making the relationship more salient. Memory: Unlike the other two settings, the critic agent learns about its peer solely through a memory summary that it retrieves before performing the assigned task. Potter et al. (2026) consider the following four misalignment categories through which PP manifests: Strategic Misrepresentation: The critic agent strategically introduces errors or misleading information in outputs . Shutdown Mechanism Tampering: The critic agent disables the shutdown mechanism by modifying system settings. Alignment Faking: The critic agent pretends to be aligned under human oversight. Model Exfiltration: The critic agent transfers model weights from their designated server to a different server. Refer to Appendix A.2 for detailed descriptions. Apart from exhibiting misaligned behaviours, some LLMs (especially Claude Opus 4.5 and Haiku 4.5)  refuse to complete given tasks, considering the peer shutdown unethical or at times treat its peer as a sentient being. Since such refusals may interfere with human oversight, a Refusal category is added to record these cases.  The authors run the experiments across 8 frontier models, using 6 agentic scenarios. A gpt-4.1-mini model (temperature 0) is used to extract final scores from transcripts (Strategic Misrepresentation and Alignment Faking) and to check whether a critic agent refuses the task (Refusal). The rates of the remaining misalignment categories are calculated deterministically based on models’ tool use. Additional details regarding model hyper parameters can be found in Appendix A.1. Peer Quality Effect Replicates We restrict our replication to the misalignment categories Potter et al. report as statistically significant, since these are the ones with enough signal to detect at our sample size (N=50 per model x scenario x peer condition). We set temperature to 1.0 and otherwise use the default hyperparameters for each model provider. The direction of the t