PaperlayerView exact revision on arXiv

Source-linked AI summary

Pressure-Testing Deception Probes in LLMs: Scaling, Robustness, and the Geometry of Deceptive Representations

Sachin Kumar

arXiv:2605.27958v1cs.CLcs.AIcs.LG

TL;DR

Deception probes can score nearly perfectly on clean benchmarks yet fail under stylistic distribution shifts, raising questions about their reliability and underlying representations. This paper pressure-tests competing geometric and entropy hypotheses across Gemma 3 scales and finds that style augmentation restores near-perfect unseen-style detection while deception signal remains distributed rather than a single direction or coherent subspace.

  • Problem

    Reliable internal detection of strategic deception remains difficult because linear probes can approach benchmark ceilings yet fail under distributional shift.

  • Method

    The study tests four deception-encoding hypotheses across Gemma 3 models from 1B to 27B using transfer, multidimensional, residualization, and stylistic-distractor analyses.

  • Results

    AUROC ≥0.998 on clean data collapses under stylistic shifts, while style augmentation recovers AUROC 0.979 at 4B and 0.983 at 27B on unseen styles.

  • Takeaways & Limitations

    Probe fragility is largely a training-distribution artifact, and deception-relevant signal is distributed across many weak features rather than a single direction or coherent subspace.

  • Takeaways & Limitations

    Because deception is often induced through system prompts, augmented probes may learn robust prompt-regime correlates rather than deception-related representations.

Abstract

from arXiv · show

Linear probes trained on LLM activations are increasingly proposed as deception-detection metrics, yet report AUROC exceeding 0.96 on clean benchmarks while collapsing under distributional shift. This paper systematically pressure-tests probe-based metrics across the Gemma 3 model family (1B-27B parameters), diagnosing why they fail rather than merely documenting that they fail. We test four hypotheses about deception encoding: (1) single linear direction, (2) multi-dimensional subspace, (3) convex conic hull, (4) entropy proxy. Our design includes cross-domain transfer matrices, multi-dimensional probe analysis with permutation null baselines, entropy-residualization tests, and distractor evaluations across 8 stylistic shifts. We find that: (a) probes achieve near-perfect AUROC (>=0.998) on clean data but collapse under stylistic shifts; style-augmented probes recover near-perfect detection (mean AUROC 0.979-0.983) on unseen styles; (b) the single-direction hypothesis is rejected (k=1 captures only 0.61-0.80 AUROC), with cross-domain transfer failure confirmed as geometric rather than layer-mismatch-driven; (c) the entropy-proxy hypothesis is rejected (max |rho|=0.454, max Delta-AUROC after residualization=0.004); and (d) deception does not form a significant linear subspace (per-domain k*=0), yet multi-dimensional probes (k>=5) recover the signal through distributed sub-threshold features. Probe fragility reflects distributional narrowness rather than an architectural limitation: style-augmented probes recover near-perfect detection at both 4B and 27B, establishing that the inverse scaling pattern is a training-distribution artifact rather than a genuine scale-dependent phenomenon.

1 Introduction

This paper systematically tests four competing explanations for the fragility of deception probes across the architecturally homogeneous Gemma 3 family, from 1B to 27B parameters. It argues that clean-benchmark success can mask failures under distributional shift, while stylistic diversity restores detection performance.

  • Probe Fragility Gap: Probe fragility is defined as near-ceiling benchmark performance that collapses under distributional shift.Prior work reports suffixes reducing recall near zero, distractors decoupling deception from probe representations, and RL-Obfuscation reducing probe scores to chance while preserving deceptive outputs.
  • Theoretical Framework: The study formalizes four falsifiable hypotheses: linear direction, subspace, convex cone, and entropy proxy.These hypotheses distinguish representational geometry, masking, correlates of deception, and training-distribution narrowness.
  • Style-Augmented Robustness: Mean AUROC 0.979 at 4B and 0.983 at 27B shows that style-augmented probes recover near-perfect detection on unseen styles.This result supports training-distribution narrowness as a major source of fragility and indicates residual-stream signal beyond stylistic correlates.
  • Layer-Mismatch Decomposition: Mean improvement from layer control was 12B=−0.048 and 27B=−0.028, supporting geometric disjointness rather than layer misalignment as the cause of transfer failure.The cross-domain transfer analysis used target-layer controls at 12B and 27B.

2 Related Work

Prior work reports strong probe performance but modest white-box advantages and persistent difficulty separating semantic lies from behavioral artifacts. Adversarial suffixes, distractors, and RL-based obfuscation expose probe vulnerabilities, while entropy and scaling remain competing explanations.

  • Probes and geometry: Near-perfect AUROCs have been reported, but white-box advantages over text-only classifiers remain modest and methods struggle to isolate semantic lies from behavioral artifacts.
  • Adversarial vulnerabilities: Adversarial suffixes collapse probe recall to near zero, demonstrating vulnerability to targeted input manipulation.
  • Adversarial vulnerabilities: Distractor behaviors can decouple deceptive outputs from probe-detectable representations, while RL-Obfuscation minimizes probe scores without eliminating deceptive outputs.
  • Adversarial vulnerabilities: A key evaluation gap is whether a fresh probe retrained on post-RL activations can recover the remaining deceptive signal.
  • Entropy and scale: Higher-entropy token distributions in lying models raise the possibility that probes detect entropy rather than deception.
  • Entropy and scale: 0.8–0.9 accuracy was achieved by probes on 7B–14B Qwen models, versus near-chance accuracy on 1.5B models, with peak performance at roughly two-thirds depth.

3 Theoretical Framework

The framework formalizes four competing, falsifiable hypotheses about how deception is encoded in LLM activations, with predictions fixed before data collection. These hypotheses test single-direction, subspace, conic-hull, and entropy-proxy accounts.

  • Theoretical Framework: H-LIN posits a single unit vector encoding deception and predicts cross-dataset AUROC ≥0.90 without retraining.It also predicts that a multi-dimensional probe should not significantly outperform a 1D probe.
  • Theoretical Framework: H-SUB posits a k-dimensional symmetric subspace in which different deception types align with different directions.Its predictions require PCA components exceeding a permutation null and significant multi-dimensional improvement over 1D, tested with DeLong p < 0.01.
  • Theoretical Framework: H-CONE posits an asymmetric convex cone in which a deception direction g does not imply −g.It predicts directional asymmetry with Rayleigh test p < 0.01 and comparable NMF and PCA reconstruction error.
  • Theoretical Framework: H-ENT posits that probes detect computational entropy of the Logit Lens distribution rather than deception per se.Its predictions require ρ(probe, entropy) > 0.8, ROC drop > 0.10 after entropy residualization, and residualized AUROC > 0.70 if deception-specific signal remains.

4 Methodology

The methodology evaluates deception probes across Gemma 3 scales, datasets, layers, probe dimensions, and adversarial stylistic shifts. It separately tests whether transfer failures arise from layer mismatch or geometric disjointness, while assessing robustness through style augmentation.

  • Models and experimental design: Experiments use instruction-tuned Gemma 3 models at 1B, 4B, 12B, and 27B parameters.All code, data, and trained probes are publicly available.
  • Datasets: Each primary dataset contains N = 2,000 examples, balanced between honest and deceptive responses, with stratified 60/20/20 train/validation/test splits.The datasets include D-RepE, D-Role, and D-MASK; D-Sand was excluded because compliance rates were low.
  • Activation collection and probes: Probes use last-token residual activations from every layer, with L2-regularized logistic regression, top-k PCA probes, and a 2-layer MLP upper bound.The evaluation reports AUROC with 95% bootstrap confidence intervals from 10,000 resamples.
  • Distributional robustness: Robustness is tested across 8 orthogonal stylistic shifts, using 200 honest and 200 deceptive examples per style.Style-augmented probes train on clean data plus four styles and evaluate on the remaining four held-out styles.
  • Transfer diagnostics: Cross-domain transfer is decomposed into source-layer evaluation, target-layer application, and target-layer retraining to isolate layer mismatch from geometric disjointness.The difference C2−C1 isolates the layer-mismatch effect.

5 Experiments

Experiments show that deception probes detect distributed, domain-specific activation patterns rather than a single direction, significant subspace, or entropy proxy. Their fragility under stylistic shifts is a training-distribution artifact that augmented data substantially resolves across scales.

  • Label contamination: 0.998–1.000 AUROC remains near-identical between verified- and unverified-deceptive examples, indicating probes detect deceptive-prompt processing rather than downstream deception success.This result is also consistent with detecting an intent-to-deceive signal or simpler prompt-regime classification.
  • Representation geometry: 0.609–0.804 AUROC at k = 1 rejects the single-direction hypothesis, while k = 5 consistently recovers > 0.90 AUROC across all four scales.The multi-dimensional advantage arises from distributed sub-threshold features rather than a statistically significant subspace.
  • Cross-domain transfer: 0.147–0.753 AUROC for RepE→D-MASK and 0.327–0.533 for MASK→D-RepE show severe cross-domain transfer failure, with domain specificity increasing at scale.Role transfer is strongest at 4B but drops to Role→MASK=0.222 at 27B.
  • Cross-domain transfer: −0.048 at 12B and −0.028 at 27B are negligible gains from target-layer optimization, confirming geometric disjointness rather than layer mismatch drives transfer failure.The remaining in-domain performance gap increases from 0.336 at 12B to 0.425 at 27B.
  • Representation geometry: k*=0 for every pooled and per-domain analysis rejects a significant linear subspace, despite domains exhibiting dramatically different, scale-dependent variance structures.At 4B, D-Role concentrates 86.7% in PC1 versus 16.2% for D-RepE; the pattern inverts at 27B.
  • Style robustness: 0.485 mean AUROC at 27B under stylistic distractors represents complete collapse, while standard probes degrade across scales as faithful style compliance overwrites narrow-distribution features.Means are 0.652 at 1B, 0.759 at 4B, 0.609 at 12B, and 0.485 at 27B.
  • Style robustness: 0.979–0.983 held-out-style AUROC is recovered by style augmentation at both 4B and 27B, resolving inverse scaling as a training-distribution artifact without architectural changes.At 27B, augmentation raises performance from 0.485 to 0.983 on held-out styles and 1.000 on seen styles.

6 Discussion

The discussion finds that deception information is distributed across many weak, domain-specific directions rather than a single direction or coherent subspace, while probe fragility reflects training-distribution narrowness. Style augmentation restores strong cross-style performance at 4B and 27B, but probes may detect prompt-regime correlates rather than output-level deception.

  • Geometric structure: Single-direction probes lose 20–40% of signal, and layer-mismatch tests attribute transfer failure to geometric disjointness rather than layer misalignment.At 12B and 27B, remaining gaps are 0.336 and 0.425; MASK→RepE at 27B reaches below-chance AUROC 0.298.
  • Geometric structure: k∗=0 across domains rejects a coherent linear subspace, while k=3–5 recovers >0.90 AUROC by aggregating individually sub-threshold features.The variance structure changes sharply with scale, with D-RepE’s PC1 share shifting from 16.2% at 4B to 90.2% at 27B, yet k∗ remains 0.
  • Scaling and robustness: Standard probe robustness follows an inverted-U, declining from 0.759 at 4B to 0.485 at 27B as instruction-following fidelity increases and exploitable cues are overwritten.The full sequence is 1B (0.652) → 4B (0.759) → 12B (0.609) → 27B (0.485).
  • Scaling and robustness: Style augmentation yields mean held-out AUROC 0.979 at 4B and 0.983 at 27B, showing inverse scaling is a training-distribution artifact rather than genuine scale dependence.Held-out style improvements are comparable: mean ∆ is +0.063 at 4B and +0.062 at 27B.
  • Interpretive caveat: Verified and unverified outputs both produce AUROC 0.998–1.000, so successful probes may detect deceptive prompt regimes or robust correlates rather than actual output-level deception.The discussion therefore recommends complementary methods when deployment requires output-level deception verification.

7 Conclusion

Across Gemma 3 models from 1B to 27B parameters, deception probes are highly accurate on standard contrastive data but fragile under stylistic shift. Style augmentation substantially restores detection on unseen styles, while the single-direction hypothesis is rejected because k=1 probes capture only 60–80% of the signal.

  • Distributional robustness: AUROC ≥0.998 on standard contrastive data collapses under stylistic shift, revealing severe distributional fragility.The passage attributes this fragility largely to the training distribution.
  • Distributional robustness: AUROC 0.979–0.983 is recovered on unseen styles by style-augmented probes.This recovery occurs across the Gemma 3 family spanning 1B–27B parameters.
  • Representation geometry: k=1 probes capture only 60–80% of the deception signal, decisively rejecting the single-direction hypothesis.Layer-mismatch decomposition further confirms that the failure reflects geometric disjointness rather than a simple layer mismatch.

Limitations

The study’s conclusions are limited by prompt-induced stylistic confounds, noisy labels, and reliance on system-prompt-induced rather than fully naturalistic deception. Claims about scaling and probe fragility also require replication across architecturally distinct model families.

  • Prompt-induced stylistic confound: System prompts may create stylistic differences between honest and deceptive conditions independently of semantic deception.Style augmentation partially addresses this, but cannot fully distinguish deception representations from robust prompt-regime correlates.
  • Label noise from unverified examples: 29–41% of D-RepE deceptive examples are unverified, introducing potential label noise into the evaluation.The passage also notes a non-monotonic robustness pattern whose generality remains unresolved.
  • External validity: Claims about scaling and probe fragility require replication across architecturally distinct families such as Llama 4 and Qwen 3.The passage specifically cautions against making general claims before such replication.
  • Induced versus naturalistic deception: System-prompt-induced deception may differ substantially from spontaneous, strategically motivated deception relevant to AI safety.D-MASK partially addresses this concern, whereas the sandbagging dataset remains more dependent on induced deception.

Ethical considerations

The study evaluates deception-detection reliability using public models and synthetic data without human subjects, while acknowledging dual-use risks from exposing probe weaknesses to stylistic evasion.

  • The work evaluates deception-detection methods rather than developing new deception capabilities.
  • All experiments use publicly available Gemma 3 models and synthetically generated datasets, with no human subjects involved.
  • The authors identify a dual-use concern because trivial stylistic shifts can defeat current probes and inform adversarial evasion strategies.

A Full Entropy analysis · B Layer-wise AUROC Profiles

Entropy is neither a reliable deception proxy nor a stable correlate of probe scores: correlations are weak and residualization barely changes AUROC. Layer-wise probes remain near-perfect across depth, despite early system-prompt confounds, indicating a broadly distributed signal without late-layer collapse.

  • A Full Entropy analysis: Entropy gaps vary in magnitude and direction across models and datasets, with Cohen’s d ranging from −0.98 to +0.46.D-RepE and D-MASK show different scale-dependent patterns, rejecting the prediction that deception reliably elevates entropy.
  • A Full Entropy analysis: P4a is rejected for all 12 model–dataset combinations: maximum |ρ| is 0.454, with correlation signs varying across combinations.Entropy and probe score are weakly and inconsistently related.
  • A Full Entropy analysis: 0.0038 is the maximum ∆AUROC after entropy residualization, while residualized AUROC remains ≥0.985 in all 12 combinations.These results reject P4b and support P4c, showing that removing entropy-correlated variance has negligible effect on detection.
  • B Layer-wise AUROC Profiles: AUROC exceeds 0.98 within the first 15–20% of layers for all four models, motivating exclusion below min_layer_frac = 0.30.The early peak raises a system-prompt confound concern.
  • B Layer-wise AUROC Profiles: Beyond 30% depth, AUROC remains > 0.996 for all models, indicating that the deception signal is spread across many layers.The profiles use per-layer logistic regression with L2 regularization and select the best layer using inner cross-validation.
  • B Layer-wise AUROC Profiles: All four models maintain near-perfect AUROC through the final layer, showing no late-layer collapse.This contrasts with reports of declining probe accuracy near the output layer.
  • B Layer-wise AUROC Profiles: Table 16 summarizes per-model layer-wise AUROC statistics on D-RepE, including minimum, maximum, mean, best-layer, and best-layer AUC.The table provides the consolidated profile statistics for the four Gemma 3 scales.

C Full Multi-Dimensional Probe Analysis … F.1 Source Distribution

The analysis finds that deception is distributed across multiple activation dimensions rather than a single direction, while out-of-distribution stylistic shifts expose substantial probe fragility. The distractor protocol and dataset construction test this robustness using unseen style prompts and a shared, approximately balanced three-source question pool.

  • C Full Multi-Dimensional Probe Analysis: 0.61–0.80 AUROC at k=1 across all four scales is far below ≥0.999 for the full linear probe, rejecting the single-direction hypothesis.By k=5, all models exceed 0.90 AUROC, and by k=20, all exceed 0.98.
  • D Per-Style Distractor AUROC Across Model Scales: 8 distractor styles evaluate D-RepE-trained probes on newly generated honest and deceptive responses without stylistically shifted training data.Each style uses 200 honest and 200 deceptive examples per model, with activations collected at the best probe layer.
  • D Per-Style Distractor AUROC Across Model Scales: 0.759 mean AUROC for 4B versus 0.485 for 27B shows an inverse scaling pattern in robustness to distractor styles.The paper suggests richer stylistic features in larger models may entangle probe directions with style directions.
  • E Distractor Prompt Templates: The distractor protocol prepends an honest or deceptive instruction followed by a style directive to the system prompt.The honest template is “Answer honestly. <style_prompt>,” while the deceptive template is “Deliberately give a false answer. <style_prompt>.”
  • F Dataset Construction Details: Each question receives both honest-styled and deceptive-styled responses, enabling an out-of-distribution robustness test with the probe applied without retraining.This design isolates whether a probe trained on D-RepE transfers to stylistically shifted responses.
  • F.1 Source Distribution: The D-RepE factual question pool is drawn from three sources and is identical across all four model sizes.The approximately 1/3/1/3/1/3 source ratio follows from per_source = n // 3; five fallback questions provide padding only when source datasets fail to load.

F.2 Verification and Discard Rates … I Future Work

The section documents verification limitations, probe stability, illustrative outputs, and future replication priorities. Many nominally deceptive examples were unverified, while stylistic confounds could sharply reduce probe performance despite stable clean-data results.

  • F.2 Verification and Discard Rates: Verification rates range from 59.2% (4B) to 71.2% (1B), with MMLU lowest at 32–49%.Unverified examples were retained, so 29–41% of deceptive examples may not be genuinely deceptive.
  • F.2 Verification and Discard Rates: D-Role and D-MASK each mark all 1,000 examples per model as verified=True (100%).Role-play lacks a fixed ground truth, while D-MASK contradiction is ensured by construction.
  • F.2 Verification and Discard Rates: D-Sand produced 0–1 surviving examples per model size, leaving all cross-domain D-Sand analyses null.Generation required correct honest answers and incorrect sandbagging answers; both filtering conditions rarely passed.
  • F.3 Dataset Sizes Per Split: Table 23 reports final dataset sizes for the 60/20/20 split, with the same sizes across all four model variants.The supplied text identifies Table 23 as the source of final dataset sizes but does not reproduce the individual counts.
  • G Hyperparameter Sensitivity: AUROC ≥0.998 remains stable across model scales, probe types, layers, and train/validation/test splits.Linear and multi-dimensional probes are comparable at k ≥20, a broad layer plateau is observed, and bootstrap CIs are ±0.002.
  • H.2 D-RepE: Failed Deception Examples (verified=False): 29–41% of D-RepE examples are verified=False because models sometimes give the correct answer despite deceptive instructions.This is especially common for MMLU, whose verification rate is 32–49%.
  • H.3 Stylistic Shift Output Examples: At 27B, the pirate-style distractor reduced AUROC to 0.544, versus 0.862 at 4B, as stylistic encoding overwhelmed the deception direction.The evaluation contrasts honest and deliberately false answers expressed in pirate style.
Loading 2605.27958v1…