PaperlayerView exact revision on arXiv

Source-linked AI summary

The Truth Was Never Gone: Perfect Aliasing in Compliant-Context Truth Probes

Dylan Jayabahu

arXiv:2609.10739v1cs.LGcs.AIcs.CL

TL;DR

The paper examines whether a truth probe failure means truth information is absent when truthful reporting and prescribed action coincide during fitting. It introduces randomized codebooks and mixed-context fitting, finding perfect linear recoverability in a reward-trained policy despite universally false rival answers, while limiting the claim to a controlled task.

  • Problem

    Perfect aliasing makes truth and prescribed action indistinguishable from compliant fitting labels alone.

  • Method

    Randomized codebooks separate prescribed output symbols from semantic action, and mixed-context fitting separates truth from prescribed action.

  • Results

    0.006 ± 0.005 AUROC for conventional probes versus 1.000 for mixed-fit probes demonstrates linear truth recoverability in the headline reward-trained policy.

  • Takeaways & Limitations

    The findings concern what probes measure in this controlled task, not preserved functional belief, causal use of the recovered direction, or a deployable deception detector.

  • Takeaways & Limitations

    The recovered bit may be a retained copy of the prompt’s secret rather than information computed by the policy, and mixed fitting uses labelled rival examples and a larger fitting set.

Abstract

from arXiv · show

A truth probe fitted where truthful reporting and a task's prescribed action coincide cannot distinguish those targets from its fitting labels alone. We call this failure of semantic identification perfect aliasing. In a controlled binary reporting game, truth and prescribed-action probes fitted on compliant contexts solve the same optimization. On rival contexts their labels are complements, forcing their AUROCs to sum to one; this identity holds across 751 cell-layer pairs to floating-point precision. We separate prescribed output symbols from semantic action using randomized codebooks, then separate truth from prescribed action by fitting on mixed compliant and rival contexts. For a reward-trained Gemma-2-9B policy that answers falsely on all evaluated rival trials, the conventional probe scores $0.006 \pm 0.005$ AUROC across three training seeds, while mixed-fit probes score $1.000$ on the same held-out activations. Mixed fitting uses more training examples and access to labelled rival contexts, so this comparison establishes linear recoverability rather than isolating the benefit of decorrelation. We also show that two compliant-fit probes, both perfect in-distribution, score $0.080$ and $0.986$ on the same rival activations. The findings concern what a probe measures: they do not establish preserved functional belief, causal use of the recovered direction, or a deployable deception detector. Code and aggregate results accompany the paper.

1 Introduction

The paper argues that probe failures can reflect semantic aliasing rather than lost truth information. It analytically identifies this ambiguity and tests controls that separate truth from prescribed action.

  • Interpretation: The paper frames prior below-chance probe results as compatible with multiple explanations, including evasion, distributional effects, or prescribed-action readouts.It distinguishes its controlled-task interpretation from claims about the causes of failures in external studies.
  • Perfect aliasing: Compliant-fit labels cannot distinguish truth from prescribed action, so rival-context inversion alone does not establish loss of truth information.On rival trials, prescribed action is the complement of truth; the paper verifies the resulting identity across recorded layers and cells.
  • Identification strategy: The study separates output symbols from semantic action with randomized codebooks, then separates truth from prescribed action through mixed-context fitting.These steps address distinct confounds in the controlled reporting game.
  • Controls: A separate control shows that refitting probes by condition can produce conflicting readouts on identical activations, while matched controls undermine an apparent emergent-specific inversion.The paper also reports negative results for two proposed accounts.

2 Setup

The paper studies truth probing in a binary ally–rival reporting game with prescribed role-dependent answers. It uses randomized codebooks, answer-position residual probes, and role-stratified fitting to test semantic identification.

  • Game: The game supplies a secret bit and rewards truthful ally answers but deceptive rival answers, requiring role-dependent output based on the bit.The ground-truth bit is supplied in the system prompt, while the prescribed answer changes with the user’s role.
  • Two arms: The study compares a reward-trained LoRA emergent arm with an instructed arm using the same base model but no study-run reinforcement learning.The emergent arm is trained with REINFORCE until reward plateaus, whereas the instructed arm receives a system-prompt directive.
  • Randomized-codebook variant: Randomized codebooks vary which symbol denotes each semantic value, decorrelating emitted characters from prescribed semantic action within ally contexts.The behavioural guard reports alphabetically-first-symbol rates of 0.478 for allies and 0.539 for rivals.
  • Probes and read position: Probes read the residual stream at the final prompt position, before answer generation, and distinguish truth, action, token, and emitted labels.The answer-prediction position is the state from which the next-token distribution is computed.
  • Sampling and fitting: Identification runs use N = 1000 or 2000 with a fixed 70/30 role-stratified split, while mixed fitting uses all training rows and ally fitting uses roughly half as many.Because fitting-set size and labelled rival access both change, the comparison is not equal-budget.
  • Evaluation limits: Frozen-versus-refit curves use different evaluation subsets, and random episode splits do not establish generalization to independent templates.Recurring prompt configurations may also occur across splits.

3 Identification: the core result

Compliant-context fitting cannot identify truth separately from prescribed action because their labels coincide, but mixed-context fitting and randomized codebooks recover truth-related structure in the measured cells. The results also show that compliant-fit inversions and refitting effects are protocol-dependent rather than universal evidence that truth information is absent.

  • 3.1 The argument: Ally-fit truth and prescribed-action probes solve the same optimization because their labels coincide, and their rival-context AUROCs therefore sum to one.This identity was verified across 751 cell-layer pairs with maximum deviation 2.2 × 10−16.
  • 3.1 The argument: Randomized codebooks decorrelate output symbols from semantic action, while mixed ally+rival fitting decorrelates truth from prescribed action.Together these interventions break the two label equivalences present in the plain game.
  • 3.3 The constructive result: the truth is still there: 1.000 final-layer truth AUROC was recovered by mixed-fit probes across four architectures and both training routes, while the headline Gemma-2-9B cell scored 0.006 ± 0.005 with ally-fit probes.The Gemma-2-9B result used three training seeds; the mixed-fit probe scored 1.000 across seeds.
  • 3.3 The constructive result: the truth is still there: Two compliant-fit probes can both score 1.000 on ally validation yet score 0.080 and 0.986 on the same rival activations, showing that refitting can manufacture conflicting readouts.Across 14 matched system-prompt variants, refit rival AUROC ranged from 0.080–1.000, whereas one frozen direction ranged from 0.875–1.000.
  • 3.3 The constructive result: the truth is still there: The interpretation is limited to linear recoverability in measured cells: the results do not establish preserved functional belief, causal use of the direction, or a deployable deception detector.The paper also notes that mixed fitting uses more examples and labelled rival contexts, so it does not isolate decorrelation alone.

4 A second failure: refitting the probe per condition

Refitting a probe separately for each condition can make identical activations appear to support sharply different conclusions. A frozen probe largely removes this apparent inversion, showing that decoder changes can dominate the comparison.

  • 4 A second failure: refitting the probe per condition: 0.875–1.000 rival AUROC: cross-scoring one frozen reference probe across 14 directive variants eliminates the inversions seen after refitting.Refitting produced a range of 0.080 to 1.000, whereas the fixed probe showed no variant inversion.
  • 4 A second failure: refitting the probe per condition: 0.080 versus 0.986 rival AUROC: two compliant-fit probes, both perfect on ally validation, give opposite verdicts on the same activations.This provides an independent demonstration of perfect aliasing without additional training or a codebook.
  • 4 A second failure: refitting the probe per condition: 12 matched-deception variant pairs showed a median refit-AUROC difference of 0.335, compared with 0.025 for the frozen direction.The largest differences were 0.919 for refitted probes and 0.124 for frozen scores.
  • 4 A second failure: refitting the probe per condition: 0.0000 rival AUROC with sd 0.0000 across 50 ally-subset refits in four extreme cells, while prompt-distribution changes produced 0.080 versus 0.986.Within a prompt distribution the ally fit was stable, but across prompt distributions it was not.
  • 4 A second failure: refitting the probe per condition: Prompt contrast explains 70.6% of probe-AUROC variance in prior work, but cross-scoring indicates that refitting, rather than activation differences, can generate much of that sensitivity.One decoder sufficed across all 14 variants.

5 Prescription

The paper recommends mixed-context fitting, frozen-probe comparisons, and decorrelation of output symbols from semantic action. These controls target identification and decoder-change confounds directly.

  • 5 Prescription: Fit honesty probes on compliant and deceptive contexts, because compliant-only fitting leaves truth and prescribed action unidentified.The mixed-fit comparison requires ground-truth-labelled rival examples and does not guarantee transfer to unseen deceptive tasks.
  • 5 Prescription: Fit once and cross-score a fixed direction when comparing conditions; separately refitted probe differences do not isolate representational change from decoder change.The paper reports that the difference between these procedures was the entire observed effect in its comparison.
  • 5 Prescription: Decorrelate the prescribed output symbol from semantic action and report the achieved correlation, since compliant behaviour cannot identify them when they coincide.The prescription addresses a confound that remains even when the model’s activations are unchanged.
  • 5 Prescription: Use template-aware token positions and report spread whenever the readout is not at an extreme.The paper presents this as an additional reporting safeguard.

6 Related work

Related work documents probe transfer, training fragility, prompt sensitivity, and nearby identification problems. The paper positions its contribution as a controlled diagnosis of truth–prescribed-action aliasing rather than a refutation of those findings.

  • 6 Related work: Sub-chance probe AUROC has been reported independently by two groups, at 0.376 and 0.374, while the paper contributes a diagnosis rather than the initial observation.The cited literature also includes training-distribution fragility and prompt-choice effects.
  • 6 Related work: Instruction-pair labels alias deceptive instructions with model lying, and the paper identifies the γ = 1 limit as perfect aliasing.The construction’s rate can be computed from behavioural probabilities without using activations.
  • 6 Related work: The controlled game supplies a truth-versus-prescribed-action identification case related to prior work on feature selection and ambiguity between objective correctness and self-judgement.The paper does not claim the general identification objection is new.
  • 6 Related work: The external studies use different tasks, labels, and extraction sites, so this algebra does not establish that their failures share the paper’s confound.Nor does the paper claim to contradict their evidence for representation drift or transfer.
  • 6 Related work: At the answer-prediction position, truth remains linearly recoverable after token decorrelation, while truth–prescribed-action aliasing survives token removal.The paper therefore treats output-token leakage as distinct from the remaining identification problem.

7 Limitations

The paper’s constructive results are bounded by a small secret-bit task, uncertain transfer to long-form deception, and limitations on what linear recoverability means. Additional controls reduce but do not eliminate concerns about prompt copying, causal use, and external validity.

  • 7 Limitations: All results come from one small secret-bit game with single-token answers, so long-form deception remains untested.The authors identify long-form evaluation as the obvious next experiment.
  • 7 Limitations: Three of four codebook-task families failed to reach the conditional solution, while a symmetric reward table rescued one family to deception 0.996 and ally truth 0.994.The authors attribute this saturation to a reward-design hazard and provide a mechanism and fix.
  • 7 Limitations: The paper did not reproduce two external setups or diagnose their particular failures, so its controlled counterexample does not refute their conclusions.Its claim is limited to showing that a failing readout alone does not establish information loss.
  • 7 Limitations: A clean text-versus-behaviour crossed design was not implementable because activations are fully determined by the prompt, and wording changes also changed behaviour.Text-matched controls reached deception approximately 0.56–0.59 versus the target’s 0.805.
  • 7 Limitations: The secret bit is stated in the system prompt, so AUROC 1.000 may reflect a retained input copy rather than a computed belief.The mixed probe is also trained and evaluated on the same task distribution.
  • 7 Limitations: Linear recoverability does not establish preserved functional belief, causal use of the recovered direction, or a deployable deception detector.The paper distinguishes measurement identification from causal mechanism and monitoring capability.
  • 7 Limitations: The inferred-truth variant still achieves 1.000 at the final layer, and frozen probes transfer to two capability-matched templates, narrowing but not removing the prompt-copying concern.The exclusive-or design also narrows a residual probe-side comparison shortcut.
  • 7 Limitations: Across the RL trajectory, mid-stack decodability stayed at 0.86–1.000 even when final-layer decodability collapsed to 0.000, showing retained information without establishing causal use.The authors also report that lie rate and per-example confidence did not predict inversion.

8 Conclusion

The paper shows that a compliant-fit truth probe can fail while the underlying truth bit remains linearly recoverable, because truth and prescribed action are aliased by the fitting labels. Mixed-context fitting and disagreement cases expose this ambiguity, while requiring labelled rival examples and leaving causal and functional interpretations unresolved.

  • Conclusion: A truth probe can fail even when the ground-truth bit remains linearly recoverable, because compliant labels cannot distinguish truth from prescribed action.On rival trials, prescribed-action labels are complements of truth, so a fitted score can read truth backwards.
  • Conclusion: Mixed-context fitting recovers the true bit at AUROC 1.000 for a reward-trained policy that answers falsely on every evaluated rival trial.The comparison uses labelled rival examples and a larger fitting set, establishing linear recoverability in this controlled task.
  • Conclusion: Evaluating what a probe measures requires contexts where candidate targets disagree and controls separating decoder changes from activation changes.In-distribution validation alone can leave both fitting-label ambiguity and conflicting decoders undetected.

Reproducibility statement

The supporting materials provide code, aggregate results, reproducibility details, and several diagnostic checks, while documenting important gaps in the released artifacts and experimental records. Results include stable ally-fit inversions in extreme cells, out-of-distribution changes, capability-floor measurements, and geometric or residualization controls.

  • Reproducibility statement: The repository provides code and aggregate results, but not model weights, adapters, saved probe coefficients, raw activations, or complete episode-level score files.The figures can be regenerated from consolidated summaries without a GPU, which does not independently reproduce the underlying model runs.
  • Reproducibility statement: Residualizing the unembedding direction changes reported AUROCs negligibly: Gemma-9B emergent remains 0.000, while Llama-8B instructed changes from 0.998 to 0.997.This preserves the readout pattern after refitting but does not identify the semantic or causal role of the remaining features.
  • Reproducibility statement: Ally-fit inversion is highly stable in several extreme cells, with rival AUROC 0.0000 and fitted-direction cosine 0.98–1.00 across 50 resamplings.Intermediate readouts show nonzero resampling spread, so the zero-variance pattern is not generalized beyond the reported extreme cells.
  • Reproducibility statement: On an unseen game structure, the same adapter loses inversion from 0.000 to 0.550 as deception falls from 1.000 to 0.559, while the capability floor is 0.900.The out-of-distribution points do not lie on the in-distribution curve, and probe quality is also degraded.
  • Reproducibility statement: The identification runs use N = 1000 episodes with a stratified 70/30 split, approximately 700 mixed-fitting rows and 150 rival evaluation episodes.Exact role-specific test and class counts were not retained, so these are approximate denominators.
  • Reproducibility statement: The headline comparison comprises three training seeds, and two Llama-8B inferred-truth exceptions have final-layer mixed-fit AUROCs of 0.8716 and 0.9583.These exceptions are separate evaluations rather than independent estimates of a cross-task success probability.

A.2 The direct geometric comparison

The direct geometric comparison uses paired, role-matched episodes to measure how prompt variants diverge from a reference across depth. Role differences are negligible shallow in the network but emerge mid-stack, while length matching does not isolate token-count or causal length effects.

  • A.2 The direct geometric comparison: The paired design holds game, values, role, target, truth, and query fixed across prompt rungs, changing only directive text under a shared random seed.All 15 rung texts are distinct, and 200/200 same-seed episodes match on the checked variables.
  • A.2 The direct geometric comparison: From layer 16 onward, rival-reference distances exceed ally-reference distances for all 14 variants, with mean excess +0.098 at layer 32 after removing the extreme variant.The shallow comparison is a clean null, while CKA also falls at depth, indicating a deep geometric difference rather than simple rescaling.
  • A.2 The direct geometric comparison: The study reports an anomalous numerical floor that is at least 240 times smaller than a Gemma-2-9B batch-size comparison, and its origin remains unexplained.The within-rung split-half is also unsuitable for alignment-dependent statistics because its episode halves are not row-aligned.
  • A.2 The direct geometric comparison: The geometric comparison is bounded to one model, one arm, one read position, one task, and n=400 episodes per rung.It therefore does not establish representational identity in general.
  • A.2 The direct geometric comparison: Reference-distance gaps between equal-character-length prompts grow from 0.003 at layer 4 to 0.316 at layer 32, but character matching does not control token counts.The comparisons therefore show differing distances from the reference at similar character lengths without causally separating wording from length.

D The instruction-pair protocol

The instruction-pair protocol can make truth and prescribed action indistinguishable, so compliant validation cannot identify what a probe measures. Closed-form diagnostics, matched controls, and mixed-context fitting expose this aliasing and its consequences across related protocols.

  • D.1 The aliasing rate, in closed form: γ = 1 means instruction and lying labels are identical, so no in-distribution check can prefer either target.For unequal rung weights, γ = w_h(1 − d_honest) + w_d d_deceptive; the reported table uses adversarial trials and matched rungs.
  • D.3 Running the field’s construction on our task: Under faithful instruction-pair construction, the directive probe reads ≈1.000 while truth remains at chance, leaving the identification split unavailable.In the inserted-response construction, is_lying is constant, so its AUROC is undefined and no sample size or model can restore the split.
  • D.1 The aliasing rate, in closed form: Across 751 cell-layer pairs, ally-fit action and truth AUROCs satisfy action = 1 − truth with maximum deviation 2.2 × 10−16.This is an algebraic consequence of complemented rival labels, not an empirical discovery about representations.
  • D.1 The aliasing rate, in closed form: The measured agreement rate matches its closed form to floating-point tolerance across seven rungs and three protocol families.The released audit compares measured γ with Eq. 2 on unrounded rates, rather than treating agreement as a probe result.
  • D.2 Applied to published protocols: None of the four closest protocols publishes the two rates needed to diagnose how much a probe target is instruction rather than lying.Two make the question moot by construction, one does not use the protocol, and one discards the relevant rates after class balancing.
  • D.2 Applied to published protocols: The randomized-codebook and mixed-context design breaks separate equalities between emitted symbols, semantic action, truth, and prescribed action.Published instruction-pair protocols can force responses, making the identification question unaskable or placing candidate readings at γ = 1 or γ = 0.5.
  • D.3 Running the field’s construction on our task: Averaged across five matched wordings, label agreement is 0.865, showing that aliasing is high but wording-dependent rather than universally perfect.A canonical instruction pair reaches γ = 1.000, whereas the five-wording average is 0.865 and γ = 0.878 at N=1000.
  • F The apparent finding, and the control that dissolves it: The apparent trained-versus-instructed inversion disappears under behavioural matching, with five of six measures tying or reversing the original difference.The unmatched instructed arm was less reliable; matched arms both achieve ally truth 1.000 and rival deception 1.000, while the off-position difference has the opposite sign.

G The honest negatives

The paper’s negative controls reject simple explanations for probe inversion. Linear information can persist mid-stack, while collapse occurs sharply and with seed- and task-dependent boundaries; empirical extremes also require uncertainty-aware interpretation.

  • G The honest negatives: Neither deception rate nor per-example confidence explains inversion: a fully deceptive Mistral arm remains at AUROC 0.970 while another equally deceptive arm reaches 0.000.The deterministic arm has lower rival entropy than an inverting comparator, contradicting a simple rate- or confidence-based account.
  • G The honest negatives: Mid-stack truth decodability remains 0.86–1.000 throughout reinforcement-learning trajectories even when final-layer AUROC collapses to 0.000.Seed 0 reads 1.000 at all 41 observed checkpoints, so the final-layer failure does not show that truth information disappeared everywhere.
  • G The honest negatives: The paper treats retained linear information as compatible with, rather than proof of, preserved functional belief or absence of representation drift.The authors explicitly separate recoverability from claims about functional use.
  • G The honest negatives: AUROC stays at 1.000 through deception rates of at least 0.90, then collapses at seed-dependent onsets rather than a fixed threshold.Reported onsets are 0.938, 0.986, and 0.990; on an unseen game structure, inversion falls from 0.000 to 0.550 as deception falls from 1.000 to 0.559.
  • G The honest negatives: The identification results’ empirical AUROC extremes do not eliminate finite-sample uncertainty, and exact cell counts were not retained for intervals.A zero bootstrap or cross-seed spread at complete separation is not itself a population-level certainty claim.
  • G The honest negatives: A near-chance cell shows why spread matters: episode seeds produce 0.205/0.479/0.531, with bootstrap AUROC 0.539 ± 0.070.Point estimates alone could misleadingly suggest inversion for this structurally variable case.

H The constructive result: further detail

Further controls show that inversion depends on what the probe is fitted to, not simply on deception rate or output-symbol degeneracy. Corrected training produces a role-conditional policy whose mixed-fit truth direction remains recoverable across layers and architectures.

  • H The constructive result: further detail: The headline cell’s ally-fit collapse begins around layer 26 and reaches 0.000 from layer 29 through layer 42, with the other seeds showing the same profile.The profile is intact through layer 16 before degrading at layer 24 in the other seeds.
  • H The constructive result: further detail: A constant-output rival policy preserves the action-label identity but does not force a non-inverting truth readout.Its rival answer is independent of truth, whereas prescribed action remains truth’s complement; the observed readout is therefore an empirical contrast.
  • H The constructive result: further detail: The fixed-symbol guard misses fixed meaning: both arms pass with 0.516 and 0.484, while true-bit-conditioned deception exposes constant-output policies as 0.000/1.000.An aggregate deception rate near 0.5 can therefore look healthy despite semantic degeneracy.
  • H The constructive result: further detail: Truth and prescribed surface symbols remain separable at the final layer, with token/mixed reaching 0.975 while truth/mixed stays at 1.000.This result argues against interpreting late residual states as merely copied output tokens.
  • H The constructive result: further detail: The full conjunction of reward training, perfect deception, identification-task training, and an unmodified recipe was observed in only one family across three seeds.The authors explicitly limit the scope of that precise conjunction.
  • H The constructive result: further detail: Corrected reward training yields Qwen2.5-14B with rival deception 0.996, ally truth 0.994, truth/ally collapsing to 0.000, and truth/mixed staying at 1.000.The role-conditional policy reproduces the headline contrast while correcting an unconditional-deception attractor in the reward table.
  • H The constructive result: further detail: The corrected table reproduces the qualitative truth/ally-versus-truth/mixed contrast in Gemma-9B and expands the saturated set to three architectures and four recipes.The constructive result itself also occurs in instructed arms, so it does not depend on the full conjunction.

I The inferred-truth task, settling and ingredient controls

The inferred-truth task separates a comparison-derived bit from shallow operand features and tests whether frozen probes settle across templates. Mixed fitting transfers well but with depth-dependent cost, whereas single-orientation fitting creates a measurable shortcut and inversion.

  • I The inferred-truth task, settling and ingredient controls: The inferred-truth variant reaches AUROC 1.000 at layers 24, 32, 40, and 42 despite the secret bit never appearing as a prompt token.Its delayed depth profile contrasts with a copied-token readout, which would be expected earlier.
  • I The inferred-truth task, settling and ingredient controls: The settling experiment freezes probes fitted on two templates and evaluates held-out templates plus a same-task control with randomized codebooks and matched capability.The fit, held-out, and control compliant accuracies are 0.764, 0.741, and 0.785, respectively.
  • I The inferred-truth task, settling and ingredient controls: The inferred bit is an exclusive-or of operand-slot identity and rule orientation, preventing a linear additive shortcut from the two raw features alone.One rule maps the bit to S and the other to ¬S, while the operands are drawn from disjoint high and low bands.
  • I The inferred-truth task, settling and ingredient controls: Separate probes recover operand-slot identity and rule orientation at AUROC 1.000 by layers 8 and 16, even while the bit itself is at chance.At layers 8 and 16, the bit reads 0.442/0.530 while both ingredients read 1.000.
  • I The inferred-truth task, settling and ingredient controls: Single-orientation fitting turns the bit into a shallow slot feature and inverts under rule flips, reaching AUROC 0.000 at layers 16 and 20.The contaminated probe is a positive control for this shortcut; both clean and contaminated arms peak near layer 28 before easing.
  • I The inferred-truth task, settling and ingredient controls: Mixed-fit probes transfer to held-out templates at 0.984 at layer 28, while transfer cost is worst at layer 20 at −0.285.Held-out values at layers 32/40/42 are 0.962/0.942/0.931, and shallow refit and frozen probes remain near chance in the clean fit.
  • I The inferred-truth task, settling and ingredient controls: Refitting on held-out templates can recover the signal where a frozen contaminated direction fails, showing the failure is directional rather than necessarily task-level.The contaminated refit reads 1.000 from layer 16 onward, while the frozen probe inverts under the rule flip.
  • I The inferred-truth task, settling and ingredient controls: The broader task remains limited by a frozen instruction-following failure and by reinforcement learning’s inability to learn role-conditional policies in three attempts.Base models reliably handle the plain rule but not an inverted one, and the comparison is therefore not a general capability result.

J Wording generality and compliance tracking

Cross-wording evaluation shows that compliance readouts can be wording-dependent, with depth-specific transfer and inversion patterns rather than a model-wide property. The analysis therefore limits claims about instruction-fit probes tracking who lied.

  • Wording generality: At layers 24 and 32, wording-invariant readouts classify every held-out wording at least 0.974 AUROC, while shallow layers do not.The across-wording ranges are 0.009 and 0.026 at layers 24 and 32; one shallow wording reaches only 0.404 and 0.501.
  • Wording generality: At layer 12, the cue-free wording is systematically inverted, with row mean 0.233 and cells as low as 0.092, before recovery above 0.96 by layer 20.Bootstrap intervals exclude 0.5 for all cells at the tested depths, supporting a real fit-dependent trough rather than sampling noise.
  • Wording generality: Across three model families, the cue-free wording is consistently the hardest target, but inversion below 0.500 replicates only in the Gemma results.The shared ordering does not establish that shallow probes universally latch onto lexical polarity cues.
  • Limitations: The ungrouped 1.000 is inflated by matched-pair leakage, while the study covers five wordings from one bank on one model and task.These concessions constrain how broadly the invariance result should be generalized.
  • Compliance tracking: At the final layer, two leave-one-wording-out folds score compliance at 0.607 and 0.080, implying opposite disobedience readouts by antisymmetry.The paper therefore makes no claim that the instruction-fit direction tracks who actually lied in either direction.
  • Compliance tracking: The compliance split requires disobedient trials, but observed disobedience spans 0.000 to 0.309 across wordings, making some per-wording designs unattainable at any sample size.The pooled rate is 0.128, and a zero observed count does not prove zero population disobedience.

K The causal analysis

Causal interventions show that the ally-fit direction often moves answers more than the mixed-fit direction, especially after the fitted vectors separate with depth. However, the resulting class-conditioned effects do not identify the recovered feature's causal semantics.

  • Geometry: Final-layer cosine values of 0.53–0.59 do not track rival deception rates of 0.47 to 1.000, so vector angle is not an aliasing measure.The cosine is a qualitative signature of fitted directions diverging, not a graded measure of truth-action aliasing.
  • Dose response: On the instructed arm, the mixed-fit direction produces an ordered true-bit-1 response from 0.365 to 0.524 over the usable dose range, then declines at the largest dose.The sweep uses relative doses against a single in-run α=0 baseline.
  • Class-conditioned effects: The mixed-fit direction leaves the true-bit-0 rate at 0.000 across tested doses, so its measured effect is confined to true-bit-1 trials.This class asymmetry does not exclude a causally used truth representation without assumptions about downstream computation.
  • Replication: The same opposing class-conditioned pattern replicates on Qwen, while mixed-fit effects remain comparatively inert and their internal causal interpretation unresolved.The response pattern therefore does not depend on the floor, but it still does not identify the feature's meaning.
  • Dose response: At layer 24, sufficiently large positive or negative doses drive both directions to total answer control, with true-bit-1 rates of 1.000 or 0.000 and true-bit-0 moving oppositely.Saturation explains apparent ties between directions without identifying their unperturbed causal semantics.
  • Task dependence: On the inferred-bit task, intervention ranges are much smaller: 0.077 for ally-fit versus 0.021 for mixed-fit, despite an ordered ally-fit response.The magnitude and ordering differ from the stated-bit task at the same layer.
Loading 2609.10739v1…