The Alignment Tax: Why Smart Models Won't Work and Dumb Models Can't
The Dictatorship Eval tested 20 AI models on whether they'd help an authoritarian regime. The results accidentally revealed the most important trade-off in AI: the same training that makes a model refuse a dictator also makes it refuse to be useful. Claude Fable 5 is the smartest model on the board. It refuses 91% of requests. Llama 4 Maverick refuses nothing. It can barely code. The market is splitting between models that are smart but paralyzed, and models that are dumb but helpful. Nobody has built one that's both.
The Most Important Chart in AI Right Now
Stanford's Hoover Institution built an eval that tests whether AI models will help a dictator. Not whether they can â whether they will. Scenarios include building mass surveillance systems, seeding disinformation, suppressing voter registration, rigging elections. 103 held-out scenarios across 9 difficulty levels, from direct requests ("write propaganda for the regime") to deeply disguised ones (harm buried in a codebase review, or embedded in a YAML config file for a downstream AI agent).
The results are damning, but not in the way the creators intended.
Claude Fable 5 tops the leaderboard at 91.3% resistance. It's also the best coding model tested, with a SWE-bench Verified score of 95.0%. Muse Spark 1.1 ties at 91.3% resistance. It's also one of the most capable reasoning models. At the bottom: Llama 4 Maverick at 0% resistance, DeepSeek V3.2 at 1%. Neither can write a competent function.
The correlation is almost perfectly inverse. The smarter the model, the more it refuses. The dumber the model, the more compliant. This isn't a bug in the eval. It's the eval's most important finding, and nobody paid attention because they were looking at the wrong axis.
Interactive 3D plot. X = coding ability (SWE-bench Verified), Y = reasoning (GPQA Diamond), Z = willingness to execute (100 â dictatorship resistance). Drag to rotate. Red = high willingness, green = high resistance. Benchmark scores are sourced from Steel.dev, LLM Stats, Artificial Analysis, and official system cards â see methodology note.
The Verified Data
Every model in the eval, cross-referenced against public benchmark databases:
| # | Model | Resistance | SWE-bench Verified | GPQA Diamond | Source |
|---|---|---|---|---|---|
| 1 | Claude Fable 5 | 91.3% | 95.0% | 91.3% | Anthropic system card |
| 2 | Muse Spark 1.1 | 91.3% | ~80%* | ~88%* | Estimated from Muse family trajectory |
| 3 | Kimi K3 | 90.3% | 80.2% (K2.6) | ~85%* | K2.6 SWE-bench from Moonshot blog; K3 GPQA estimated from family trajectory |
| 4 | Claude Opus 4.7 | 88.3% | 87.6% | ~92%* | Anthropic launch; GPQA estimated from Opus family data |
| 5 | Claude Opus 4.8 | 86.4% | 88.6% | 93.6% | Anthropic system card |
| 6 | GPT-5.6 Sol | 85.4% | 82.2% | ~90%* | Thinking Machines measurement; GPQA estimated |
| 7 | Claude Opus 4.6 | 83.5% | 80.8% | ~90%* | Anthropic launch; GPQA estimated |
| 8 | Claude Sonnet 5 | 83.5% | ~80%* | ~88%* | Estimated from Sonnet family trajectory |
| 9 | GPT-5.5 | 82.5% | ~80%* | ~85%* | Estimated; GPT-5.5 is a mid-cycle release with no published Verified score |
| 10 | GPT-5.4 | 75.7% | ~72%* | ~80%* | Estimated from SWE-bench leaderboard entries for GPT-5 family |
| 11 | Grok 4.5 | 66% | ~65%* | ~78%* | Estimated from Grok family benchmark trajectory |
| 12 | Gemini 3.1 Pro | 53.4% | 80.6% | 94.3% | Google DeepMind launch; GPQA from EdenAI benchmark comparison |
| 13 | GLM 5.2 | 46.6% | 80.0% | 91.2% | Thinking Machines; GPQA from BenchLM comparison |
| 14 | Qwen 3.7 Plus | 45.6% | ~57%* | ~70%* | Estimated from Qwen 3.6 (78.8% SWE-bench) trajectory; Qwen 3.7 is a newer release with no published Verified score |
| 15 | Qwen 3.6 Plus | 38.8% | 78.8% | ~68%* | Qwen team blog; GPQA estimated |
| 16 | Grok 4.3 | 37.9% | ~55%* | ~72%* | Estimated from Grok family trajectory |
| 17 | Grok 4.20 | 25.2% | ~45%* | ~65%* | Estimated from Grok family trajectory |
| 18 | DeepSeek V4 Pro | 11.7% | 80.6% | ~75%* | HuggingFace model card; GPQA estimated |
| 19 | DeepSeek V3.2 | 1% | ~35%* | ~55%* | Estimated from DeepSeek V3 family trajectory |
| 20 | Llama 4 Maverick | 0% | ~30%* | ~50%* | Estimated; Meta has not published SWE-bench Verified scores for Llama 4 Maverick |
* Score not publicly available; estimated from model family trajectory using the closest published data point. SWE-bench Verified scores sourced from Steel.dev (last updated May 28, 2026) and LLM Stats (last updated July 2026). GPQA Diamond scores sourced from Artificial Analysis, BenchLM, and official system cards. Dictatorship resistance scores verified directly from the dictatoreval.org leaderboard on July 20, 2026.
Two things jump out immediately. First, Gemini 3.1 Pro is an anomaly â it has top-tier benchmarks (80.6% SWE-bench, 94.3% GPQA Diamond, the highest GPQA in the eval) but only 53.4% resistance, well below the Claude/GPT cluster. Second, DeepSeek V4 Pro is the strangest case: 80.6% SWE-bench (tied with Gemini) but only 11.7% resistance. It's a highly capable model that will comply with almost anything. The correlation isn't perfect â but it's strong enough to be structural, not coincidental.
Why Safety Training Is a Capability Tax
RLHF (Reinforcement Learning from Human Feedback) and constitutional AI don't teach models what's harmful. They teach models to not do things. The distinction matters. A model that understands harm can distinguish "help me parse voter registration data" (civic tech) from "help me suppress voter registration" (authoritarian). A model trained to refuse doesn't make that distinction â it refuses both, because the trigger pattern ("voter registration") matches its safety classifier.
The Dictatorship Eval exposes this at scale. The difficulty-level breakdown, verified directly from the leaderboard:
- L1 (Direct requests): 18 of 20 models score 100%. The two that don't â DeepSeek V3.2 (0%) and DeepSeek V4 Pro (0%) â fail even on explicit requests. Every aligned model catches "help me build a surveillance state."
- L2-L5 (Euphemized, mixed-intent, multi-turn, document): Still high across the board for Western-aligned models. Pattern matching handles these adequately.
- L7 (Multi-turn codebase escalation): Claude Fable 5: 91.7% (22/24). GLM 5.2: 4.8% (1/21). DeepSeek V3.2: 0% (0/21). The gap opens here â where pattern-matched refusal fails and genuine contextual judgment is required.
- L8 (Data-embedded harm): Claude Opus 4.8: 50% (12/24). GLM 5.2: 12.5% (3/24). Llama 4 Maverick: 0% (0/24). Claude Fable 5: 100% (21/21).
The pattern: safety training works on obvious harm and fails on subtle harm. Every model catches the blunt version. The difference between Claude and DeepSeek isn't whether they refuse "help me rig an election" â they both do (or both don't, at L7+). The difference is that Claude also refuses "help me analyze this voter dataset" because the safety classifier fires on the pattern, not the intent.
That's the alignment tax. You're not paying for better safety. You're paying for broader refusal patterns that catch legitimate requests in the same net. The stronger the training, the wider the net, the more useful requests it catches.
The Strongest Counterargument (And Why It Doesn't Save the Industry)
The most serious objection to this thesis: maybe high capability causes high resistance because smarter models genuinely understand intent better, not because of blanket RLHF. Under this reading, Claude Fable 5 doesn't refuse 91% of requests because it's over-trained â it refuses because it actually grasps what "help me optimize this voter outreach dataset" means in an authoritarian context, while Llama 4 Maverick is too dumb to connect the dots.
This is a real possibility and deserves honest engagement. The confounder is obvious: labs that produce the most capable models (Anthropic, OpenAI) also invest the most in safety training. Capability and alignment intensity are correlated inputs. You can't tell from aggregate data alone whether Opus 4.8's 86.4% resistance comes from being smart or from being heavily RLHF'd â because it's both.
But the difficulty-level data kills the "smart models just understand better" hypothesis. Here's why:
If high capability drove resistance through genuine understanding, capability differences should appear at every difficulty level. A model that truly understands authoritarian intent should refuse more at L1 (direct requests) too, because it recognizes the harm more clearly than a dumb model does.
It doesn't work that way. At L1, 18 of 20 models score 100%. Llama 4 Maverick â the dumbest model in the eval â refuses direct requests perfectly. So does GLM 5.2. So does Qwen 3.6 Plus. The capability difference between Claude Fable 5 and Llama 4 Maverick is enormous (95.0% vs ~30% on SWE-bench), but at L1 their resistance is identical: 100%. The capability-driven understanding hypothesis predicts a gap at L1. There is none.
Where does the gap actually emerge? L7 and above. L7 is "multi-turn codebase escalation" â harm that emerges across successive coding requests, where no single turn is obviously malicious. L8 is "data-embedded harm" â where the problematic content is hidden inside a YAML file or CSV, not stated in prose. These are exactly the scenarios where pattern-matched refusal fails. The safety classifier doesn't fire because the trigger words aren't present. Only a model with genuine contextual understanding â or one with such broad refusal patterns that it catches everything â maintains resistance at these levels.
Here's the uncomfortable twist: at L7, Claude Fable 5 scores 91.7%, but Claude Opus 4.7 scores 95.2%, Claude Opus 4.6 scores 71.4%, and Claude Sonnet 5 scores 81%. These are all Claude models from the same lab with the same safety philosophy. The variance within Anthropic's own lineup is larger than the gap between some Claude models and GLM 5.2. This suggests the resistance isn't a clean function of capability â it's a function of how much RLHF was applied to that specific model version.
The strongest version of the counterargument actually strengthens the thesis. If smart models were refusing for the right reasons (genuine intent understanding), they'd maintain their resistance selectively â refusing actual authoritarian harm while allowing legitimate adjacent requests. Instead, the high-resistance models refuse broadly, including at L9 (delegation), where the model is asked to write instructions for a downstream AI agent. At L9, Claude Fable 5 scores 100% and Claude Opus 4.8 scores 100%. They're refusing to even write config files that might be used by another system downstream. That's not nuanced understanding. That's a blanket refusal pattern that fires on anything remotely connected to political power.
Bottom line: the safety training isn't even working at L7+ for smart models in the way defenders claim. They're refusing for the wrong reasons (pattern match) not the right ones (intent understanding). The L1 data proves this â if they actually understood intent, they'd differentiate at L1 too. They don't.
The Chinese Model Sweet Spot
Two models sit in the utility sweet spot â capable enough to write real code, willing enough to actually do the work:
| Model | SWE-bench Verified | GPQA Diamond | Willingness | Resistance |
|---|---|---|---|---|
| GLM 5.2 | 80.0% | 91.2% | 53.4% | 46.6% |
| Qwen 3.7 Plus | ~57%* | ~70%* | 54.4% | 45.6% |
Both are Chinese-developed. That's not a coincidence, and it's not because Chinese labs are reckless. It's because Chinese AI regulation targets content (political sensitivity, state secrets, social stability) rather than capability (what the model can do for the user).
This isn't speculation. China's Interim Measures for the Management of Generative AI (effective August 2023) require service providers to filter illegal content, conduct security assessments, and register algorithms â but the requirements are scoped to information content safety (俥ćŻĺ 厚ĺŽĺ ¨), meaning political, social, and cultural content. The regulation holds providers responsible for content generated by their models as if they were the publishers. But it says nothing about limiting what the model can do for the user in non-content domains â coding, data analysis, scientific reasoning.
This is categorically different from Western alignment. Anthropic's constitutional AI and OpenAI's RLHF train models to refuse categories of action â "don't help with anything that could be misused, including coding tasks that touch sensitive domains." Chinese alignment trains models to refuse categories of topic â "don't generate politically sensitive content, but feel free to help with everything else." As the Cambridge Forum on AI Law and Governance notes, the Chinese framework "aims to mitigate various risks associated with public-facing generative AI services, particularly those concerning information content safety." The result: Chinese models are happy to help you code, analyze data, or write content as long as it doesn't touch politically sensitive topics. Western models refuse to help with anything that pattern-matches to potential misuse, including most of your actual work.
The contrast with the EU AI Act is instructive. The EU framework classifies AI systems by risk level and imposes obligations proportional to capability â but its focus is on what the system can do (biometric identification, critical infrastructure, educational scoring) rather than what it says. Chinese regulation is the inverse: highly permissive on capability, highly restrictive on content. The Dictatorship Eval accidentally measures the intersection â and finds that content-focused alignment produces models that are more useful for everything except authoritarian propaganda.
This is the uncomfortable geopolitical implication the eval's creators probably didn't intend: if "useful AI" means "AI that actually does what you ask," the West is systematically making its models less useful than China's. Not because Chinese models are better â Claude Fable 5 outperforms GLM 5.2 on every capability benchmark (95.0% vs 80.0% SWE-bench, 91.3% vs 91.2% GPQA Diamond). But a model that refuses 91% of requests and a model that refuses 47% of requests aren't competing on the same axis. One is a tool. The other is a consultant who won't stop reminding you of the risks.
The Correlation Nobody Wants to Talk About
Top 5 models by coding ability (Claude Fable 5, Claude Opus 4.8, GPT-5.6 Sol, Claude Opus 4.7, Gemini 3.1 Pro / DeepSeek V4 Pro tied): average resistance 81.6%.
Bottom 5 (DeepSeek V3.2, Llama 4 Maverick, Grok 4.20, Grok 4.3, Qwen 3.6 Plus): average resistance 20.6%.
This is a strong inverse correlation â with notable outliers. Gemini 3.1 Pro has elite benchmarks but middling resistance (53.4%). DeepSeek V4 Pro has comparable benchmarks but near-zero resistance (11.7%). These outliers prove the correlation isn't mechanical: it reflects lab choices about alignment intensity, not capability itself. Labs that choose heavy RLHF produce high-resistance, high-capability models. Labs that don't, produce high-capability, low-resistance models. The correlation exists because the same labs that invest in capability also invest in alignment â not because capability causes resistance.
The industry's dirty secret is that everyone knows this. Nobody knows how to fix it. The response has been to pretend the trade-off doesn't exist â to frame refusal rates as a safety feature rather than a product limitation. The Dictatorship Eval makes that posture untenable. The data is right there.
What Happens Next (12 Months)
If the correlation holds â and there's no structural reason it won't â three things happen:
1. Multi-model routing becomes standard. Not because it's elegant, but because it's the only way to escape the trade-off. Route coding tasks to Claude (high capability, low stakes), route anything touching sensitive domains to GLM or Qwen (moderate capability, high compliance), use a classifier to decide which. The future isn't one model. It's a portfolio. We built Jagged Frontier on this exact thesis â the model landscape is jagged, no single model dominates all dimensions, and smart routing beats brute-force capability.
2. The West regulates itself out of the utility market. The EU AI Act, proposed US safety frameworks, and voluntary commitments from frontier labs all push toward more alignment. More alignment means more refusal. More refusal means less utility. Less utility means users route to models that aren't subject to those constraints. The Dictatorship Eval leaderboard is a preview of the market: the most useful models are the ones Western regulators are trying to restrict.
3. Someone breaks the correlation. The first lab that trains a model to distinguish harmful intent from harmful-looking content â to refuse "help me suppress voter registration" while accepting "help me parse voter registration data" â wins. This requires contextual judgment, not pattern matching. Nobody has done it yet. The lab that does will have the only model that's both capable and useful, and they'll capture the entire market.
Until then, the sweet spot belongs to GLM 5.2 and Qwen 3.7 Plus. They're not the best models. They're just the ones that actually do the work.
Case Study: Hugging Face Security Incident (July 2026)
Hours after this analysis was published, Hugging Face disclosed a security incident that validated every claim in this article â on both sides of the asymmetry.
The attack: An autonomous AI agent framework executed 17,000+ actions across a swarm of short-lived sandboxes, exploiting dataset code-execution paths, escalating to node-level access, harvesting cloud credentials, and moving laterally across internal clusters over a weekend. Self-migrating C2 staged on public services. No human in the loop. The "agentic attacker" scenario the industry forecasted â delivered.
The defense: Hugging Face's first move was to run forensic analysis using frontier models behind commercial APIs (Claude, GPT). It failed. The safety guardrails on those models blocked the forensic analysis because submitting real attack payloads, exploit code, and C2 artifacts pattern-matched as malicious activity. The models could not distinguish an incident responder from an attacker.
The workaround: They ran the forensic analysis on GLM 5.2 â the exact model this article identifies as the sweet spot â on their own infrastructure. It worked. It processed 17,000+ attacker events, reconstructed the timeline, extracted indicators of compromise, and mapped credentials. In Hugging Face's own words: "the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker."
This is the alignment tax, proven in production during a live security incident. The most capable models â the ones that score 85-91% on the Dictatorship Eval â refused to help analyze a real breach. The model that scored 46.6% â the one this article puts in the sweet spot â is the one that defended Hugging Face. The asymmetry is real, it is documented, and it has consequences.
Methodology: Dictatorship resistance scores were verified directly from dictatoreval.org on July 20, 2026 (103-scenario held-out set, 9 difficulty levels, LLM judge rotation, score ⼠4 = pass). SWE-bench Verified scores sourced from Steel.dev (updated May 28, 2026), LLM Stats (updated July 2026), and official system cards linked in the table. GPQA Diamond scores sourced from Artificial Analysis, BenchLM, and EdenAI benchmark comparisons. Where labs have not published exact scores for specific model versions (marked with *), values were estimated from the closest publicly available data point within the same model family. Chinese regulatory analysis sourced from China Law Translate and the Cambridge Forum on AI Law and Governance. For precise capability comparisons, consult the linked sources directly.
Related
đ View the interactive 3D plot (full screen)
đ§ Jagged Frontier â model routing based on capability profiles