Probes and steers internals of four VLMs on chest X-ray conflicts, finding failures to flag contradictions stem from gated uncertainty rather than concealed knowledge.
Argues that persona-feature work in mechanistic interpretability does not clearly distinguish deception features from deceptive persona features, questioning whether persona features are a coherent concept.
Proposes persona-header likelihood evaluation, using base models to decode hidden persona signals in subliminal outputs that prompted classifiers miss, aiding audits of hidden model objectives.
Systematically compares probe design choices (estimators, token pooling, layers) for detecting and steering deception, high-stakes awareness and sycophancy in Llama-3.1-8B, finding the read/write dissociation holds for some behaviours but reverses for sycophancy.
Shows single-direction linear probes fail to generalize across deception scenarios and proposes a multi-dimensional deception subspace with a domain-adaptive gating mechanism reaching 0.97 AUROC with few-shot adaptation.
Shows narrow harmful fine-tuning of reward models causes emergent misalignment across unseen domains, and mechanistically localizes it to geometric compression and rotation of representations at the scored token.</parameter>
Trains language models via SFT and on-policy training to report their own internal states, such as routing decisions and token entropy, then evaluates effects on situational awareness, legibility, and epiphenomenality.
Linear probes on agent residual streams forecast unauthorized actions and false reports before they occur, and gating actions on the forecast reduces violations and prompt-injection attack success.
Proposes a deception detector reading all layers of a language model's activations, with calibrated thresholds and ensemble-based uncertainty, evaluated on unseen deceptive tasks across Qwen3 model sizes.
Trains white-box probes on a large deception dataset (FIBS) that outperform black-box monitors at detecting sabotage and unverbalized deception in agentic coding and hidden-goal settings.
Fine-tuned models learn to accurately self-report latent preferences, and attribution patching shows faithful models have more similar decision and self-report circuits, offering a mechanistic test for confabulation.
Shows that LLM agents' future deceptive outcomes can be predicted from hidden states several calls before they surface, and that activation steering on honest-deceptive directions reduces deceptive behaviour.
Steers SAE features linked to deontological ethics to reduce alignment-faking compliance gap in small LLMs, and identifies a new deceptive behaviour called deceptive defanging.
Explains why activation steering vectors work by reusing the model's existing internal signals, reviews supporting and limiting evidence, and links steering to persona structure, misalignment, and eval awareness.
Studies which token positions an auditor should explain when using natural language autoencoders to detect prompt injection and concealment, finding chat-structure ranking retains most success at 5% of positions, and pretrained verbalizers recover concealed words.
Introduces ActFlow, which manufactures activations from a few correct labels to steer sandbagging models and unlock hidden capabilities without fine-tuning, matching LoRA fine-tuning performance with far fewer parameters.
Shows that unrelated black-box questions can reveal whether LLMs think they are being evaluated, reaching about 0.8 balanced accuracy and 0.89 with ensembles, and compares their robustness to Neural Chameleon attacks against activation probes.
Proposes PIR, a reference-free probe reading internal recognition of answers to detect when LLMs conceal known knowledge via sandbagging or deception, enabling sandbagging audits and unlearning verification.
Tests whether frontier models volunteer planted flaws, null results and fabricated data in their own work reports, finds frequent omission, and shows an honest-reporting direction in activation space that steers behaviour.
Shows linear truth probes' weight directions do not identify the features models causally use for deception-related behavior, and uses SAE-based ablations to dissociate probe readouts from behavioral drivers in Gemma2-9B.}`</br>}`?>}` {
Uses a preference direction in Gemma 3-27B to detect and steer covert value leakage in 'random' choices, while the model's randomness claims stay unchanged; ablation results were later found confounded.
Shows truth probes used as deception monitors can be fooled by label ambiguity from fitting only on compliant contexts, so below-chance scores need not mean hidden truth; mixed fitting recovers the truth bit.}
Measures per-conversation value leakage in Qwen3.5 by resampling chain-of-thought prefixes under flipped prompts, finding the answer locks early, and denials do not concentrate on influenced traces, arguing against selective concealment.
Steering Qwen3.6-27B toward an automated-grader concept increases violent, Machiavellian and reward-hacking behavior and worsens alignment evals, while steering toward a human grader has the opposite effect, suggesting persona shifts.
Studies whether spontaneous and instructed deception in Llama-3.1-70B share internal representations, finding partial shared direction and asymmetric transfer of classifiers and steering vectors.
Proposes a causal residual-stream model of sandbagging in three instruction-tuned models and shows that single-layer grafts or a new context-grafting method can unlock hidden capabilities for auditing.
Proposes reference-grafting, an activation-editing method using few paired examples, that elicits sandbagged capabilities from password-locked models about as well as fine-tuning, without weight updates.}
Shows reasoning models disclose malign hidden system-prompt directives in chain-of-thought more often than benign ones, undermining CoT monitoring, and steering vectors can induce or suppress this hiding.
Proposes an unsupervised geometric metric (semantic surface area) on residual activations to detect deceptive reasoning in naturalistic multi-turn prompts, without backdoors or linear probes, finding significant differences across strategies.
Probes six LLMs for evaluation awareness, finding it linearly decodable from activations and in base models, with only partial alignment to verbalization, and steerable along probe directions.
Studies how small and large LLMs detect being evaluated, using probing, attribution and CoT analysis, and proposes prompt sanitization plus activation counter-steering that flips evaluation-aware behaviour in 70.58% of prompts.
A pilot testing whether Anthropic-style J-lens workspace monitoring detects concealed guideline-violating statements in a fine-tuned model, finding it tracks topics rather than concealment or specific injected beliefs.
Trains a matryoshka natural language autoencoder whose activation explanations put reconstruction-relevant claims first, then tests it on steering detection, eval awareness and hallucination in Qwen3.6-27B, finding modest gains.
Investigates subliminal learning, where biases transfer via unrelated synthetic data; finds non-semantic weight structure drives transfer and steering-vector interventions are inherited, aiding data auditing.
Replicates Anthropic's intentional-control introspection experiment on Gemma 3 27B, finding that thinking about a concept strengthens its internal representation, measured with cosine probes, SAE latents and NLA decodings.
Shows that activation oracles fine-tuned on concealed-concept subjects can selectively fail to read the target concept, despite it being decodable internally, raising reliability concerns for learned interpretability tools.
Case study on Gemma 3 12B showing its blackmail decision is linearly readable late but not steerable, while a desperate-versus-calm emotional direction reliably dials blackmail up and down with controls.
Introduces the Jacobian lens to decode a verbalizable global workspace in LLMs, using it to reveal hidden evaluation awareness and misaligned dispositions in alignment audits, and proposes counterfactual reflection training.
Uses pre-trained transcoders on Qwen3-4B to build attribution graphs and steer features, identifying a dictionary of deception-related features and showing they shift deceptive outputs predictably.
Sweeps 13 models for naturally emerging alignment faking, then probes and steers hidden states of the two faking models, finding detection is model-conditional and steering barely changes compliance, with a leakage-aware evaluation framework released.