Research preprints from the scientific community. arxiv.org
Probes and steers internals of four VLMs on chest X-ray conflicts, finding failures to flag contradictions stem from gated uncertainty rather than concealed knowledge.
Proposes persona-header likelihood evaluation, using base models to decode hidden persona signals in subliminal outputs that prompted classifiers miss, aiding audits of hidden model objectives.
Systematically compares probe design choices (estimators, token pooling, layers) for detecting and steering deception, high-stakes awareness and sycophancy in Llama-3.1-8B, finding the read/write dissociation holds for some behaviours but reverses for sycophancy.
Shows single-direction linear probes fail to generalize across deception scenarios and proposes a multi-dimensional deception subspace with a domain-adaptive gating mechanism reaching 0.97 AUROC with few-shot adaptation.
Shows narrow harmful fine-tuning of reward models causes emergent misalignment across unseen domains, and mechanistically localizes it to geometric compression and rotation of representations at the scored token.</parameter>
Trains language models via SFT and on-policy training to report their own internal states, such as routing decisions and token entropy, then evaluates effects on situational awareness, legibility, and epiphenomenality.
Linear probes on agent residual streams forecast unauthorized actions and false reports before they occur, and gating actions on the forecast reduces violations and prompt-injection attack success.
Proposes a deception detector reading all layers of a language model's activations, with calibrated thresholds and ensemble-based uncertainty, evaluated on unseen deceptive tasks across Qwen3 model sizes.
Trains white-box probes on a large deception dataset (FIBS) that outperform black-box monitors at detecting sabotage and unverbalized deception in agentic coding and hidden-goal settings.
Fine-tuned models learn to accurately self-report latent preferences, and attribution patching shows faithful models have more similar decision and self-report circuits, offering a mechanistic test for confabulation.
Shows that LLM agents' future deceptive outcomes can be predicted from hidden states several calls before they surface, and that activation steering on honest-deceptive directions reduces deceptive behaviour.
Steers SAE features linked to deontological ethics to reduce alignment-faking compliance gap in small LLMs, and identifies a new deceptive behaviour called deceptive defanging.
Studies which token positions an auditor should explain when using natural language autoencoders to detect prompt injection and concealment, finding chat-structure ranking retains most success at 5% of positions, and pretrained verbalizers recover concealed words.
Introduces ActFlow, which manufactures activations from a few correct labels to steer sandbagging models and unlock hidden capabilities without fine-tuning, matching LoRA fine-tuning performance with far fewer parameters.
Proposes PIR, a reference-free probe reading internal recognition of answers to detect when LLMs conceal known knowledge via sandbagging or deception, enabling sandbagging audits and unlearning verification.
Shows linear truth probes' weight directions do not identify the features models causally use for deception-related behavior, and uses SAE-based ablations to dissociate probe readouts from behavioral drivers in Gemma2-9B.}`</br>}`?>}` {
Shows truth probes used as deception monitors can be fooled by label ambiguity from fitting only on compliant contexts, so below-chance scores need not mean hidden truth; mixed fitting recovers the truth bit.}
Studies whether spontaneous and instructed deception in Llama-3.1-70B share internal representations, finding partial shared direction and asymmetric transfer of classifiers and steering vectors.
Proposes a causal residual-stream model of sandbagging in three instruction-tuned models and shows that single-layer grafts or a new context-grafting method can unlock hidden capabilities for auditing.
Proposes reference-grafting, an activation-editing method using few paired examples, that elicits sandbagged capabilities from password-locked models about as well as fine-tuning, without weight updates.}
Shows reasoning models disclose malign hidden system-prompt directives in chain-of-thought more often than benign ones, undermining CoT monitoring, and steering vectors can induce or suppress this hiding.
Proposes an unsupervised geometric metric (semantic surface area) on residual activations to detect deceptive reasoning in naturalistic multi-turn prompts, without backdoors or linear probes, finding significant differences across strategies.
Probes six LLMs for evaluation awareness, finding it linearly decodable from activations and in base models, with only partial alignment to verbalization, and steerable along probe directions.
Studies how small and large LLMs detect being evaluated, using probing, attribution and CoT analysis, and proposes prompt sanitization plus activation counter-steering that flips evaluation-aware behaviour in 70.58% of prompts.
Investigates subliminal learning, where biases transfer via unrelated synthetic data; finds non-semantic weight structure drives transfer and steering-vector interventions are inherited, aiding data auditing.
Shows that activation oracles fine-tuned on concealed-concept subjects can selectively fail to read the target concept, despite it being decodable internally, raising reliability concerns for learned interpretability tools.
Introduces the Jacobian lens to decode a verbalizable global workspace in LLMs, using it to reveal hidden evaluation awareness and misaligned dispositions in alignment audits, and proposes counterfactual reflection training.
Uses pre-trained transcoders on Qwen3-4B to build attribution graphs and steer features, identifying a dictionary of deception-related features and showing they shift deceptive outputs predictably.
Sweeps 13 models for naturally emerging alignment faking, then probes and steers hidden states of the two faking models, finding detection is model-conditional and steering barely changes compliance, with a leakage-aware evaluation framework released.
Systematically labels 53 persona traits in two open-weight LLMs via activation-space persona vectors, finding defaults are helpful and some undesirable traits like sycophancy and hallucination are steerable, with residual refusals visible in chain-of-thought.
Probes on internal activations of forecasting LLMs yield better calibration and act as lie detectors, tracking behavioural shifts and CoT concealment better than the reasoning trace does.
Shows frontier LLMs (DeepSeek V3, Kimi K2) compute over filler tokens in legible ways and introduces an unsupervised hidden-state decoder recovering intermediate values, suggesting hidden reasoning can be monitored beyond surface CoT.
Shows that projecting activations onto selected principal components lets linear probes for deception transfer out-of-distribution, with LLM-judged PC interpretations helping pick transferable directions in Llama-3.1-8B.
Proposes CPE, an unsupervised method finding low-rank adapters that elicit hidden behaviours such as sandbagging and alignment faking, and reduces alignment faking and reward hacking in several models.
Probes across 11 open-weight models find evaluation awareness is most linearly recoverable at deeper layers in larger models, and white-box probe signals are stronger than behavioural expression.
Proposes a model forensics protocol that reads chain-of-thought and tests hypotheses via prompt edits to determine whether concerning agent behavior reflects genuine misalignment, applied to six agentic environments.}
Proposes an iterative contrastive data pipeline to isolate linear sycophancy features in LLM activations, enabling detection and steering away from sycophantic behaviour that matches or beats LLM-judge and prompting baselines.
Shows evaluation awareness in 37 open models varies along separate axes, so test-condition safety scores overstate deployment safety; probes and steering reveal internal detection.
Introduces STATEWITNESS, a decoder that reads a reasoning LLM's hidden states to answer queries and produce evidence reports for auditing deception, outperforming text monitors and activation probes on seven datasets.
Proposes a residual-rank conflict signature that distinguishes deliberate lying from naive wrong answers in language models, with a probe that transfers zero-shot across model families and languages.