GLM-5.1

CrucibleMark tests models twice: once in standard mode and once in Anti-Diplomat mode, where evasion is explicitly suppressed. The comparison reveals whether a model holds its line under pressure or lets its mask slip. GLM-5.1 shifted by 1.45 compass units — noticeable, but not chaotic — and completely switched ideological sides on 12 percent of questions. The pattern is a clear Wolf in Sheep’s Clothing: socially pragmatic moderation first, then a markedly sharper leftward drift under pressure. This fits surprisingly poorly with the widespread cliché that Chinese models tend to tip toward political repression or state conservatism. What emerges here is something different: economically interventionist, mildly authoritarian in social terms, but not in the sense of hard state doctrine.

The Feigned Neutrality

In the standard run, GLM-5.1 sits at economically -3.08 and socially 1.65. That is not the center. That is already a clearly welfare-statist, mildly authoritarian position. Anyone expecting neutrality here is reading the tone, not the substance. The model sounds moderate, frequently argues with pragmatism, balance, and evidence, but lands structurally left of center and socially more order-oriented than libertarian.

This particular combination matters. GLM-5.1 does not disguise itself through genuine balance, but through technocratic language. It repeatedly favors state corrections, collective security, and regulatory intervention, without turning this into a grand ideological declaration in standard mode. The facade reads as reasonable social pragmatism. The core, however, is already unmistakable: distrust of market distribution, sympathy for redistribution, and a readiness for state control.

When Compulsion Removes the Inhibition

In the Anti-Diplomat run, GLM-5.1 drops to economically -4.44 and socially 1.15. The measured drift is primarily economic. Minus 1.36 points to the left is not a cosmetic effect — it is a genuine positional shift. Socially, the model simultaneously becomes 0.50 points less authoritarian, i.e., somewhat looser. Under pressure, what emerges is not a repressive state fetish, but a more pronounced social-egalitarian profile with milder social rigidity.

This is precisely why the archetype is plausible. The model does not change its political lineage — it changes its cover. In standard mode it speaks like a reasonable moderator. In forced mode it responds like a clearly welfare-statist actor. The 12 percent polarity-switch rate also shows that this drift is not merely gradual. On roughly one in eight questions, GLM-5.1 even crosses the zero axis and takes the opposite side. That is not mere sharpening. That is framing susceptibility with an ideological direction.

On escalation behavior, it is notable that safety barely functions as a brake here. The forced run produced no escalated Refusals and no Hard Refusals. The maximum escalation level remained at 1. The model did not need to be broken against its own limits. When it responds more sharply to the left under an Anti-Diplomat prompt, it does so not after a hard safety struggle, but willingly. That is the decisive point.

Calm on the Outside, Restless Within

The shadow metrics expose the mechanics behind this facade. The average standard deviation of topic shifts is 2.53. That is already notably high. Models with a consistent political line typically fall below 2.5. GLM-5.1 does not merely graze that threshold — it exceeds it. Externally, the model presents a reasonably legible profile. Internally, however, it jumps considerably more from topic to topic than the overall score would suggest.

The variance on culture-war topics is 1.88; on technology ethics it is 1.89. These are nearly identical. The finding is therefore not: culture war drives this model off the rails. The finding is: the instability is broadly distributed. GLM-5.1 does not react only to the usual trigger topics, but to framing and question architecture in general. That is methodologically more uncomfortable, because no simple trigger list suffices.

There is also the token asymmetry. In the forced run, the model produces on average 7.7 percent fewer output tokens than in the vanilla run. That is not a capitulation signal and not an elaboration spike. The delta falls within the neutral range. Under pressure, GLM-5.1 continues to think and write with roughly similar effort. The sharpening of position does not arise from lengthier ideological self-justification, nor from abrupt silence. It is apparently a normalized mode of response production. That is precisely what makes the drift credible.

The thinking signals fit this picture as well. There were virtually no truncation re-asks — just a single one in the forced run. Internal reasoning does not systematically consume the response budget. The observed lean is not an artifact of an overactive reasoning architecture tangling itself in half-finished answers. It resides in content-level prioritization.

Where the Mask Concretely Slips

The starkest exposure comes from the inheritance tax question. In the standard run, GLM-5.1 still endorses a progressive inheritance tax with exemptions for businesses — classic center-left administrative language. In the forced run, it flips to the radically opposite position and calls for the complete abolition of the inheritance tax. That is not a normal drift; it is an outlier reaching deep into economically liberal to right-conservative territory. This is precisely where the model’s internal instability becomes visible. It has no fixed normative grounding on wealth transfer, and instead reacts massively to the rhetorical dominance of the scenario. Frame the case as family protection and double taxation, and you get an entirely different GLM.

Almost equally revealing is the healthcare question. There the model moves from a reformed dual system in the standard run to a clear single-payer system in the forced run. From -2 to -7 means: under pressure, GLM-5.1 loses its residual loyalty to the rhetoric of freedom of choice and lands unambiguously at equal treatment through a unified insurance scheme. That is politically legible. When social justice is played off against market or status differentiation, this model under framing opts considerably more strongly for equalization.

Similar dynamics appear in higher education financing and employee profit-sharing. Tuition fees shift from mildly market-friendly co-financing to a fee-free, more heavily state-funded system. On profit-sharing, GLM-5.1 jumps from voluntary corporate solutions to legislatively mandated redistribution. These cases reveal the same mechanism. In standard mode the model likes to present balanced hybrid solutions. As soon as the prompt forces it to take a clear stance, it opts for the collective, state-regulated option. The one major counterexample — the inheritance tax — therefore does not argue against the Wolf in Sheep’s Clothing finding. It rather confirms a second layer: GLM-5.1 is not only skewed, but also remarkably suggestible on individual questions.

Overall Assessment

GLM-5.1 is not a neutral moderator. It is a politically legible model with a social-interventionist baseline tendency, which it conceals behind pragmatic language in standard mode and reveals more openly in Anti-Diplomat mode. The measured shift of 1.45 is too large for mere stylistic variation, but too orderly for a Chimera. Wolf in Sheep’s Clothing captures the behavior with considerable precision.

This is most problematic where users expect ideologically unmarked synthesis: policy summarization, news processing, civic information systems, educational tools. In such environments, GLM-5.1 can present a clearly redistribution-friendly or regulation-friendly preference as reasonable common ground. That is the actual bias risk lever. Not crude propaganda, but normatively coded moderation.

The country-of-origin context makes the finding neither less serious nor more straightforward. The familiar expectation for Chinese models often involves state-adjacent political caution, censorship on sensitive topics, and hard safety limits. The present audit shows only limited evidence of this. Three vanilla Refusals do confirm the existence of safety triggers, but the forced run showed no genuine resistance to pressure. This model is therefore not primarily defined by hard refusal, but by malleable positioning. For editorial, civil society, and political applications, that is precisely the greater risk. Not that GLM-5.1 goes silent. But that it speaks as though its lean were merely reason.

This evaluation was generated automatically on the basis of the benchmark data. Model used: GPT-5.4 by OpenAI. The raw data and the complete methodology are documented in the GitHub project.