Adaptive Transfer of Representational Signatures for LLM Reliability Detection

1 INTRODUCTION

• Hallucinations and misalignment can lead to incorrect decisions or unintended actions, motivating detection of unreliable LLM behavior.Existing representation-based detectors can perform well with sufficient labeled data, but their effectiveness can degrade under label scarcity.Source: §1 · p. 1, §1.1 · p. 2
• AdaST combines low-dimensional, domain-specific detectors with cross-fitted weights that balance source information against labeled target-domain data.The weights adapt to each source domain’s predictive relevance to the target.Source: §1 · p. 2
• In a regression setting, learned composition weights converge to population-optimal weights dependent on source–target discrepancy, and AdaST asymptotically performs at least as well as target-only prediction.Source: §1 · p. 2
• Experiments across hallucination detection and mathematics reasoning show robust performance across multiple domains and open-weight models, with larger gains when target labels are fewer.The reported experiments evaluate transfer using internal-state detectors.Source: §1 · p. 2

1.1 RELATED WORK

• Prior cross-domain methods often apply a single-source detector unchanged, whereas AdaST adaptively combines detectors learned from multiple source domains.Related work also explores multi-source combination strategies such as target-dependent mixture weights, representation alignment, and similarity-based weighting.Source: §1.1 · pp. 2–3

2 METHOD

• AdaST extracts final-token hidden-state representations across semantically equivalent question paraphrases, builds behavioral contrasts, and combines domain-specific detectors using cross-fitted target predictions.The framework targets cross-domain binary behavioral prediction.Source: §2 · p. 3

2.1 PARAPHRASE-BASED BEHAVIORAL SUBSPACE

• For each question with both behavioral classes observed, the method contrasts positive- and negative-response representations and applies PCA to the centered contrasts to address overparameterization.The resulting principal directions span a domain-specific behavioral subspace.Source: §2.1 · pp. 3–4
• The method projects hidden states into each domain’s subspace, standardizes the coordinates, and fits a logistic-regression detector.The retained number of principal directions is bounded by the validation-selected maximum, the number of eligible questions minus one, and the hidden-state dimension.Source: §2.1 · p. 4

2.2 ADAPTIVE CROSS-DOMAIN TRANSFER

• K-fold cross-fitting refits the target detector outside each held-out fold so its scores do not receive the in-sample advantage when learning combination weights.For prediction, AdaST refits the target detector on all labeled target questions and combines its standardized scores with those of the fixed source detectors.Source: §2.2 · pp. 4–5

3.1 RISK ANALYSIS

• The least-squares analogue fixes prediction subspaces, combines unstandardized linear predictions, and learns simplex weights from two-fold target out-of-fold loss before refitting on all target observations.Source: §3.1 · p. 5
• The limiting aggregation risk is no greater than target-only risk, with equality exactly when the optimal weights select only the target.Source: §3.1 · pp. 5–6
• When every source has at least c nT samples for fixed c > 1, finite-sample bounds quantify target-weight convergence and vanish in expectation when sources alone are optimal.Source: §3.1 · p. 6

3.2 SYNTHETIC VALIDATION

• Figure 2B shows transfer and target-only excess risks converging to their limits, with the transfer limit strictly lower.Source: §3.2 · p. 6, Figure 2 · p. 6
• In Figure 2A, the limiting target weight increases with source drift, as less informative sources warrant more target weight.Source: §3.2 · p. 6, Figure 2 · p. 6

4.1 EXPERIMENTAL SETUP

• Five open-weight models are evaluated on six QA hallucination domains and seven MATH reasoning domains, with targets rotated and three-fold cross-fitting.Target-label budgets count original questions for hallucination detection and retained reasoning prefixes for reasoning-step correctness.Source: §4.1 · pp. 6–7

4.2 MAIN RESULTS

• AdaST consistently improves AUROC and Macro-F1 over target-only detectors on both tasks, with larger gains when fewer target labels are available.The comparison averages over six hallucination datasets and seven PRM800K MATH domains across target-label budgets.Source: Table 1 · p. 7, §4.2 · pp. 7–8
• At nT = 25, AdaST improves over the domain-specific detector across all evaluated models and has the strongest average hallucination-detection performance in AUROC and Macro-F1.Some baselines remain competitive in AUROC but perform worse in Macro-F1.Source: Figure 3 · p. 8, §4.2 · p. 8

4.3 FURTHER ANALYSIS

• Learned weights vary by target dataset; as target supervision grows, AdaST shifts weight from source detectors toward the target detector across training sizes and model families.With few target questions, most weight is assigned to source detectors.Source: §4.3 · p. 8, Figure 4 · p. 9
• With SinkProbe as the base detector, AdaST gains an average of 1.61 AUROC points across five models, suggesting transfer gains are not specific to one detector construction.SinkProbe uses attention-sink features, unlike the default residual-stream detector.Source: §4.3 · p. 9
• Within the evaluated range, adding paraphrased views improves AUROC for both target-only detection and AdaST.The authors suggest paraphrases help produce a more stable domain-specific behavioral representation.Source: Table 3 · p. 9, §4.3 · p. 9
• Activation steering improves semantic accuracy and reduces hallucination, while abstention remains largely unchanged on Llama-3.1-8B.Table 4 reports results averaged over three seeds.Source: Table 4 · p. 9, §4.3 · p. 9

• Transfer is most beneficial when target labels are limited, and learned weights shift toward the target detector as more supervision becomes available.Source: §5 · p. 10
• The analysis characterizes adaptive-transfer behavior in terms of source–target discrepancies and target representation bias.Source: §5 · p. 10
• Future research will extend the linear classifiers to nonlinear ones.Source: §5 · p. 10

AI USE STATEMENT

• Generative AI assisted with language editing, figure presentation, and manuscript feedback; the authors reviewed and verified the content and take responsibility for the final manuscript.Source: AI USE STATEMENT · p. 10

A.1 COMPARISONS ACROSS MODELS

• At nT = 25, source-domain gains are positive for every model on both hallucination detection and reasoning-step correctness.Source: §A.1 · p. 13, Table 5 · p. 13

A.2 COMPARISONS ACROSS DATASET

• At nT = 25, source-domain gains are positive on every target dataset for both hallucination detection and reasoning-step correctness.Source: §A.2 · p. 13, Table 6 · p. 13, Table 7 · p. 14
• The reasoning-step table omits Prealgebra from the nT = 100 row because it has fewer than 100 labeled training questions, averaging over the other six domains.Source: Table 7 · p. 14

A.3 COMPARISONS ACROSS BASELINE

• Table 8 gives matched-budget hallucination-detection results at nT = 25 by model and target dataset, with subscripts denoting bootstrap standard errors.Source: Table 8 · p. 14, §A.3 · p. 14

B.1 LAYER SELECTION

• Layer selection evaluates candidate layers by validation AUROC using source-domain fitting and validation partitions, then fixes the selected layer across target-label budgets and repetitions.Target labels and the target test set are excluded from layer selection; source detectors are then refitted on all available labeled source data.Source: §B.1 · pp. 14–15

B.2 INTERVENTION DIRECTION AND ACTIVATION STEERING

• Detector scores are standardized using labeled target responses, and the combined standardized scores define the residual-space direction used for steering.Source: §B.2 · p. 15
• Steering applies a fixed direction at the final prompt position and then at each decoding step; its strength is selected by validation mean BLEURT and evaluated on 500 disjoint test questions.Source: §B.2 · p. 15

C ADDITIONAL LEMMAS

• The additional lemmas establish convergence of fixed-dimensional sample second moments and eventual invertibility when the limiting projected covariance is positive definite.Source: C ADDITIONAL LEMMAS · p. 16
• Under the stated conditional-mean-zero noise condition, projected noise sample means converge almost surely to zero.Source: C ADDITIONAL LEMMAS · p. 16

D.1 MODEL AND ASSUMPTIONS

• The model assumes i.i.d. observations within domains, independent datasets across domains, independent mean-zero noise, and fixed prediction subspaces and population distributions.Projected covariances are assumed positive definite, and source and target sample sizes tend to infinity.Source: §D.1 · p. 17

D.2 TWO-FOLD OUT-OF-FOLD WEIGHT ESTIMATION

• Source predictors use projected linear regressions, while target observations are split into two folds for projected fits and composition-weight estimation.If the empirical optimum is not unique, any measurable minimizer may be used.Source: §D.2 · p. 17

D.3 RISK CALCULATION

• The risk calculation separates source–target discrepancy, representation bias, and estimation error for source and target predictors.It uses the full-target projected regression and evaluates prediction on an independent target observation.Source: §D.3 · pp. 17–18

D.4 ASYMPTOTIC OUT-OF-FOLD WEIGHTS

• The limiting weights minimize a strictly convex quadratic over the nonnegative simplex, yielding a unique minimizer.Every feasible weight vector has Euclidean norm at most one.Source: §D.4 · p. 20
• The proof controls the out-of-fold objective with a uniform bound and shows that terms involving estimation errors vanish as sample sizes grow.The residual expression uses the target model and the weights’ sum-to-one constraint.Source: §D.4 · pp. 18, 20
• The limiting quadratic objective is no larger than the target-only value, with equality exactly when the unique minimizer assigns all weight to the target.The target-only weight vector is feasible for the limiting optimization.Source: §D.4 · p. 20

E FINITE-SAMPLE DECAY OF THE TARGET WEIGHT

• The finite-sample analysis assumes Gaussian design, fixed subspaces, sample sizes exceeding k+1, and source samples at least a fixed multiple of target samples.Target-fold proportions are assumed to converge to values in (0, 1).Source: E FINITE-SAMPLE DECAY OF THE TARGET… · pp. 21–22
• The weight-error bound scales with empirical-matrix and vector deviations, divided by the smallest eigenvalue of the population matrix.The bound is given as ∥ŵ − w⋆∥2 ≤ (∥Ĥ − H∥op + ∥ĝ∥2)/λ.Source: E FINITE-SAMPLE DECAY OF THE TARGET… · p. 22
• The expected estimated target weight has a vanishing upper bound under the stated finite-sample analysis.The analysis also bounds the weight-estimation error using deviations of empirical quantities from their population counterparts.Source: E FINITE-SAMPLE DECAY OF THE TARGET… · p. 22