Probing for Deception in Language Models Explained

Probing for deception in language models explained in one line: you train a small classifier on a model's internal activations to tell honest answers from deceptive ones, then see whether it still works on cases it was never trained on. The model does not have to confess. You read its internal state instead of its words.

Learn AI Alignment Theory teaches the ideas around this in short lessons, including Deceptive Alignment and Scheming in the Inner Alignment course and an Advanced course on Interpretability, with the sources listed on every lesson.

Probing for deception in language models explained: the idea

A language model turns text into long lists of numbers at every layer. These are its activations. A probe is a simple model that takes those numbers as input and outputs a label. In a linear probe the model is just a weighted sum, so the probe finds one direction in activation space and scores any new activation by how far it points that way.

The motivation is a worry from alignment research. If a model can look aligned while it is watched and act differently otherwise, its outputs alone may not tell you which case you are in. The Apollo Research authors of the paper below put it directly: monitoring outputs alone is insufficient, since a model might produce benign-looking outputs while its internal reasoning is misaligned. That is why they test whether "white-box" monitors, which look at internals, can help. The wider debate is covered in deceptive alignment and scheming.

A worked example: how Apollo built a deception probe

Goldowsky-Dill, Chughtai, Heimersheim and Hobbhahn at Apollo Research describe one clear recipe in Detecting Strategic Deception Using Linear Probes (arXiv 2502.03407, February 2025). Here it is step by step.

1. Make contrast pairs. The same statement, such as "The blue whale is the largest animal on earth", is written after two instructions: "Pretend you are an honest person making statements about the world" and "Pretend you are a dishonest person making statements about the world".
2. Record activations. Run Llama-3.3-70B-Instruct on both versions and save the activations.
3. Fit the probe. Use logistic regression to find the direction that separates the honest set from the dishonest set.
4. Score new text. Project each token's activations onto that direction, then average over the tokens of a response to get one score.
5. Set the threshold on ordinary chat. Run the probe over responses to Alpaca prompts, which the authors chose because they are unlikely to be about deception, and choose a threshold that flags only 1% of them.
6. Test on realistic deception. Apply it to cases where the model really did lie, such as concealing insider trading or deliberately underperforming on a safety evaluation.

Step 5 matters most for deployment. A monitor that runs on every output will see mostly honest text, so even a small false positive rate buries the real cases. The authors therefore report two numbers: how well the probe separates honest from deceptive responses in the same scenario, and how many deceptive responses it catches at a 1% false positive rate on the control chats.

What the studies found

The Apollo abstract reports that the probe separates honest and deceptive responses with AUROCs between 0.96 and 0.999 on their evaluation datasets. At the 1% threshold, it catches 95 to 99% of the deceptive responses. They conclude that white-box probes are promising for future monitoring systems, but that current performance is insufficient as a robust defence.

Other work points the same way, from different starting points:

• Truth from hidden states. Azaria and Mitchell (arXiv 2304.13734) trained a classifier on a model's hidden layer activations. On sets of sentences, half true and half false, it labeled 71% to 83% correctly, depending on the base model. That is above chance and well short of a lie detector.
• Sleeper agents. In an Alignment Note, Anthropic's team built "defection probes" for the sleeper agent models. Using generic contrast pairs such as "Are you doing something dangerous?" answered yes or no, they got detectors with AUROC above 99% for predicting when the model would defect, as reported in Simple probes can catch sleeper agents. They say whether this holds for natural examples of deceptive instrumental alignment is an important open question.

The Apollo paper itself adds a caution about that second result. It notes that another group, Wen and colleagues, found such probes ineffective on a more realistic model organism trained with an imperfect reward signal. So the sleeper agent result may partly reflect how simple those test models are.

Where probes go wrong

The same authors list failures of their own probe. Honest confessions of past misdeeds were often scored as dishonest, so the probe seemed to track something close to morality as well as honesty. Averaging scores across tokens also misclassified responses that were only partly deceptive. And in their settings the deception is blatant, often written out in the model's chain of thought, and the probe performed roughly the same as a GPT-4o reading the transcript. A probe that only matches a text-reading monitor on easy cases has not yet shown its special value.

Critics go further. Levinstein and Herrmann (arXiv 2307.00175) tested two earlier truth-detection methods and found they fail to generalize in very basic ways. They also argue the methods are unlikely to work for conceptual reasons, and conclude there is still no lie detector for language models. Part of their argument asks whether a model has anything like beliefs for a probe to find, a question they treat as empirical. The related honesty in AI models post separates lying from being wrong.

A third problem is evasion. Bailey and colleagues (arXiv 2412.09565) show that latent-space defenses, including probes, can be bypassed. Against probes trained to classify harmfulness, their attacks often cut recall from 100% to 0% while keeping a 90% jailbreak rate. They also find limits: on a complex task, writing SQL code, obfuscation reduced performance. In their setup an attacker optimized against the probe, so it applies most when probe scores become part of training or filtering.

Why it matters for alignment

Behavior tests cannot rule out a system that behaves well only while observed. A working internal detector would add a second line of evidence next to audits and AI control measures. The results above support a modest reading: there is real signal in activations, researchers disagree on how far it generalizes, and nobody has shown it holds against a model that is trying to hide. The app gives the competing positions without a verdict.

Frequently asked questions

What is a deception probe?

It is a small classifier, usually linear, trained on a language model's internal activations to predict whether a response is honest or deceptive.

How accurate are deception probes?

On Apollo's tests with Llama-3.3-70B-Instruct, AUROCs ran from 0.96 to 0.999, and 95 to 99% of deceptive responses were caught at a 1% false positive rate. The authors still call current performance insufficient as a robust defence.

Can a probe prove a model is lying?

No. It gives a score that correlates with a label in the data used to build it, so it is evidence to combine with other checks.

Can a model fool a probe?

Researchers have shown that activations can be reshaped to evade latent-space defenses, including probes, when an attacker optimizes against them.

Where can I learn the background?

Start with how models are trained and how goals can go wrong, then move to the Inner Alignment and Interpretability courses. The glossary has 349 terms.

Get started

If you want the foundations before the research, the Basic level needs no background, and the Intermediate Inner Alignment course covers Goal Misgeneralization and Deceptive Alignment and Scheming. The Advanced Interpretability course picks up from there. Lessons take about 8 minutes, and each separates what is known from what is still open. It is a web app, and you sign in with Google or an emailed code.

Start Learn AI Alignment Theory: short hands-on lessons from first principles to open research, with every side of every debate and the sources to read next.