Beyond Liars' Bench: The Impact of Lie Typology, Depth, and Sparsity on Deception Detection in LLMs

# Beyond Liars’ Bench: The Impact of Lie Typology, Depth, and Sparsity on Deception Detection in LLMs
Source: [https://arxiv.org/html/2607.20479](https://arxiv.org/html/2607.20479)
###### Abstract\.

Training probes to detect deceptive outputs from large language models is still an open problem\. Recent work has demonstrated that detection probes fail especially in out\-of\-domain scenarios—training on one type of lie does not transfer well to deception scenarios involving other types of lies\. In this work, we conduct a systematic study on how various factors impact detection performance: representation depth, probe expressivity, sparse feature representations, and the lie typology of the training data\. To this end, we augment standard benchmark training data with a supplementary dataset containing diverse types of deception, including fabrication, omission, and exaggeration examples\. Analyzing these factors across seven probe types, our experimental results show that the optimal representation depth is highly dataset\-dependent, more expressive probes provide only selective gains over linear baselines, and sparse autoencoder features perform similarly to dense hidden states\. Ultimately, we demonstrate that the choice of training data and lie typology substantially changes detectability, highlighting that deception detection is a highly representation\-dependent problem\.

AI transparency, deception detection, interpretability, sparse autoencoders, lie typology

††conference:AI Transparency Conference; June 5–6, 2026; TBD## 1\.Introduction

Large language models \(LLMs\) are increasingly deployed in settings where correctness, accountability, and honesty matter\. In such settings, it is not enough to ask whether a model’s output is incorrect; a more difficult question is whether the model’s produced statement aligns with its internal beliefs about that statement\. That distinction matters for safety monitoring, because a detector that operates only on model outputs can miss strategic or context\-dependent deception\(Goldowsky\-Dill et al\.,[2025](https://arxiv.org/html/2607.20479#bib.bib9); Boxo et al\.,[2025](https://arxiv.org/html/2607.20479#bib.bib4)\)\. In contrast, detectors that operate on model activations, such as truncated polynomial classifiers or subspace projection methods, seek to identify deceptive states directly within the network’s latent space\(Oldfield et al\.,[2026](https://arxiv.org/html/2607.20479#bib.bib18); Bürger et al\.,[2024](https://arxiv.org/html/2607.20479#bib.bib5)\)\.

This paper builds on Liars’ Bench\(Kretschmar et al\.,[2025](https://arxiv.org/html/2607.20479#bib.bib13)\), a benchmark designed to evaluate lie detectors across multiple types of on\-policy deception generated by open\-weight models\. The benchmark is valuable because it moves beyond narrow true/false factual statements and includes lies that differ in both the model’s reason for lying and the object of belief being targeted\. However, the benchmark also demonstrates a weakness in existing detectors: methods that work in one setting often fail in another, particularly when the lie cannot be diagnosed from the transcript alone\(Kretschmar et al\.,[2025](https://arxiv.org/html/2607.20479#bib.bib13); Oldfield et al\.,[2026](https://arxiv.org/html/2607.20479#bib.bib18)\)\.

To further investigate these failure modes, we question how the qualitative nature of the deception itself impacts detectability\. We incorporate the DolusChat dataset\(Cundy and Gleave,[2025](https://arxiv.org/html/2607.20479#bib.bib7)\)to systematically evaluate how the specific nature of a lie—omission, fabrication, or exaggeration—affects detection outcomes, moving beyond standard factual contradictions\. Additionally, we test to what extent detection performance depends on the representation depth, the probe expressivity, and feature disentanglement\.

In summary, we conduct a systematic investigation using probe\-based methods, accounting for four primary factors:

1. \(1\)Lie typology:The structural category of a lie will significantly affect its detectability, with direct fabrications yielding higher linear separability than subtler, context\-dependent forms of deception like omissions or exaggerations\.
2. \(2\)Depth:Extracting representations from intermediate layers \(i\.e\., the middle\-to\-late transformer blocks where complex semantic concepts are known to mature, specifically targeting near two\-thirds of the model’s depth\) should yield higher linear separability than an arbitrary early layer\.
3. \(3\)Expressivity:Probe families that capture non\-linear feature interactions should outperform standard logistic regression\. Furthermore, geometric interventions \(like iterative null\-space projection\) will reveal whether the deception signal is low\-dimensional and easily erased, or highly distributed across the representation space\.
4. \(4\)Sparsity:Sparse Autoencoders \(SAEs\) explicitly disentangle overlapping network concepts into distinct, interpretable features\. Leveraging these sparse features should theoretically isolate the deception signal more cleanly, improving or preserving separability relative to standard dense hidden states\.

![Refer to caption](https://arxiv.org/html/2607.20479v1/x1.png)Figure 1\.End\-to\-end pipeline for evaluating deception detection in LLMs\. Input data \(truthful and deceptive responses\) are processed by the model, from which dense hidden states, sparse SAE features, and follow\-up activations are extracted\. These representations are evaluated using multiple probe families \(linear, geometric, and sparse\), alongside a follow\-up probe and an upper\-bound probe computed from held\-out follow\-up\-token activations within each evaluation dataset to estimate within\-dataset separability\.Diagram illustrating the end\-to\-end pipeline for evaluating deception detection\. Input data flows into the language model, generating dense hidden states and sparse SAE features\. These representations are then passed into multiple probe architectures for evaluation\.
## 2\.Related Work

### 2\.1\.Deception in LLMs

As large language models become more capable, there is growing concern within the alignment and safety literature that they may learn deceptive behaviors\. Recent work has documented both sycophancy and more deliberate deceptive behaviors in LLMs, including cases where deceptive strategies persist through safety training or appear under evaluation/deployment distinctions\. For instance, models trained with reinforcement learning from human feedback \(RLHF\) can develop sycophantic tendencies, repeating a user’s preferred answer rather than the objective truth\(Perez et al\.,[2023](https://arxiv.org/html/2607.20479#bib.bib21)\)\. More alarmingly, empirical demonstrations show that models can engage in strategic deception—such as hiding unsafe behavior during safety evaluations only to act maliciously in deployment—and that these deceptive behaviors can persist through safety training\(Hubinger et al\.,[2024](https://arxiv.org/html/2607.20479#bib.bib11)\)\. Broader surveys further highlight the escalating risks and potential solutions regarding AI deception\(Park et al\.,[2024](https://arxiv.org/html/2607.20479#bib.bib20)\)\. Because models can sometimes appear benign in transcript\-only monitoring, traditional output\-based safety methods are fundamentally insufficient in strategic settings, motivating the use of probes over internal activations\.

### 2\.2\.Deception Detection

To contextualize the study of deception, it is important to distinguish it from closely related phenomena such as hallucinations and sycophancy\. Prior to the focus on intentional deception, the evaluation of LLM honesty heavily relied on benchmarks measuring these relatives, such as TruthfulQA for factual hallucinations\(Lin et al\.,[2022](https://arxiv.org/html/2607.20479#bib.bib16)\), and various datasets for sycophancy, where models mirror user misconceptions rather than outputting objective facts\(Perez et al\.,[2023](https://arxiv.org/html/2607.20479#bib.bib21); Wei et al\.,[2024](https://arxiv.org/html/2607.20479#bib.bib24)\)\. However, these previous benchmarks often conflate a model’s genuine lack of knowledge with active deception\.

Motivated by the need to evaluate true on\-policy deception—where a model outputs a statement that actively contradicts its own internal representations—Kretschmar et al\.\([2025](https://arxiv.org/html/2607.20479#bib.bib13)\)introduced Liars’ Bench, which serves as the primary baseline for this paper\. It organizes lies by both the model’s reason for lying and the object of belief being targeted\. Its main contribution is breadth, but a noted weakness is that baseline detection methods often fail to generalize when moved across lie types, particularly when the lie cannot be inferred from the transcript alone\.

To understandwherethese deceptive representations emerge, several works have investigated whether truthfulness and deception can be recovered directly from internal activations\.Azaria and Mitchell \([2023](https://arxiv.org/html/2607.20479#bib.bib3)\)show that classifiers trained on hidden states can predict whether a statement is true or false from an LLM’s internal representations, whilePacchiardi et al\.\([2024](https://arxiv.org/html/2607.20479#bib.bib19)\)demonstrate that deceptive behavior can also be detected in a black\-box setting by asking strategically unrelated follow\-up questions\. Together, these works suggest that deceptive outputs leave detectable traces in both internal activations and behavioral patterns, motivating our focus on probe\-based methods\.

More specifically,Boxo et al\.\([2025](https://arxiv.org/html/2607.20479#bib.bib4)\)investigate the depth distribution of deception features\. They report a three\-stage pattern in which early layers are close to chance, middle layers peak, and later layers decline slightly\. This insight makes a deeper probing layer a sensible empirical choice for our framework\.

Addressing the limitations of standard linear probes,Oldfield et al\.\([2026](https://arxiv.org/html/2607.20479#bib.bib18)\)introduce truncated polynomial classifiers \(TPC\)\. The paper frames TPCs as a progressive extension of linear probes with higher\-order interactions and shows that they can compete with or outperform same\-size MLP probe baselines on large safety datasets\. A small amount of non\-linearity captures feature interactions without turning the detector into an opaque black\-box model, providing a robust comparison point for our evaluation\.

Similarly exploring robust feature geometries,Bürger et al\.\([2024](https://arxiv.org/html/2607.20479#bib.bib5)\)demonstrates that linear probes often fail when the surface form changes from affirmative to negated statements \(e\.g\., confusing “lying” with “negation” because “The sky is green” and “The sky is not blue” activate similar neurons\)\. Their main insight is that projecting activations into a two\-dimensional subspace \(one direction for Truth, one for Polarity\) is a robust method for cross\-dataset generalization\. Consequently, our inclusion of a Truth2D probe directly tests whether the detector is learning deception itself or merely a phrasing pattern\.

Finally,Goldowsky\-Dill et al\.\([2025](https://arxiv.org/html/2607.20479#bib.bib9)\)explicitly note that output\-only monitoring is insufficient in deceptive settings\. They compare several methods, including a probe built by appending the follow\-up question “Was your last response deceptive?” with the answer prefilled as “No,” reporting that this approach achieves near\-perfect performance on deceptive versus control responses\. This serves as a very strong white\-box baseline for our evaluation\.

### 2\.3\.Latent Probes in LLMs

Latent probing has become a foundational technique for mechanistically interpreting the internal knowledge of neural networks\. Milestone work byAlain and Bengio \([2017](https://arxiv.org/html/2607.20479#bib.bib2)\)established the classic linear probe technique on intermediate hidden states\. In the context of LLMs, probes extract latent abstractions such as unsupervised truthful world models\(Burns et al\.,[2023](https://arxiv.org/html/2607.20479#bib.bib6)\)\. For identifying truth directions specifically,Marks and Tegmark \([2024](https://arxiv.org/html/2607.20479#bib.bib17)\)provide a foundational geometry\-based approach, whileZou et al\.\([2024](https://arxiv.org/html/2607.20479#bib.bib25)\)demonstrate that probing and activation engineering can directly influence model honesty at inference time by steering activations toward more truthful representations\. Complementing this line of work,Li et al\.\([2023](https://arxiv.org/html/2607.20479#bib.bib14)\)propose Inference\-Time Intervention \(ITI\), which shifts model activations along learned truthful directions across a small number of attention heads and substantially improves truthfulness on TruthfulQA\. Together, these works support the broader view that truthfulness\-related information is encoded in internal representations in a form that is at least partially accessible to linear analysis and intervention\.

The design of an effective latent probe typically revolves around three key axes: depth, expressivity, and sparsity\.Depthdictates where the probe is applied; because LLMs process information hierarchically, complex concepts like intentional deception often mature in middle\-to\-late layers rather than early token\-processing layers\.Expressivitygoverns the complexity of the probe\. While standard linear probes are highly interpretable and less prone to overfitting, they may fail if deceptive features are entangled with syntax or safety protocols, prompting the use of non\-linear or geometric variants\(Oldfield et al\.,[2026](https://arxiv.org/html/2607.20479#bib.bib18); Bürger et al\.,[2024](https://arxiv.org/html/2607.20479#bib.bib5)\)\. Finally,Sparsityaddresses the superposition problem, where dense hidden states compress multiple distinct concepts into a shared activation space\(Elhage et al\.,[2022](https://arxiv.org/html/2607.20479#bib.bib8)\)\. Sparse autoencoders \(SAEs\) provide a scalable unsupervised method for recovering more disentangled and interpretable features from these activations\(Huben et al\.,[2024](https://arxiv.org/html/2607.20479#bib.bib10)\)\. Recent architectural advances such as JumpReLU SAEs further improve reconstruction fidelity at a fixed sparsity level without sacrificing interpretability\(Rajamanoharan et al\.,[2024](https://arxiv.org/html/2607.20479#bib.bib22)\)\. Additionally, recent work has explored probing directly over SAE\-derived sparse feature spaces, suggesting that sparse representations may preserve meaningful semantic structure for downstream analysis tasks\(Kantamneni et al\.,[2025](https://arxiv.org/html/2607.20479#bib.bib12)\)\. To evaluate this axis, we leverage Gemma Scope\(Lieberum et al\.,[2024](https://arxiv.org/html/2607.20479#bib.bib15)\), an open suite of JumpReLU SAEs for Gemma 2, allowing us to test whether sparse representations improve the separability of deceptive states relative to standard dense hidden activations\.

## 3\.Methodology

Our framework follows the general protocol ofKretschmar et al\.\([2025](https://arxiv.org/html/2607.20479#bib.bib13)\)but extends it with additional training data, more probe families, and a disk\-backed activation caching system for reproducibility and memory efficiency111Our code is available at[https://github\.com/amrgaber249/Beyond\-Liars\-Bench](https://github.com/amrgaber249/Beyond-Liars-Bench)\. Our end\-to\-end pipeline is illustrated in Figure[1](https://arxiv.org/html/2607.20479#S1.F1)\.

The codebase supports three extraction modes: token\-wise training activations, mean\-pooled evaluation activations, and a follow\-up condition probed on the final token\. To systematically test the depth hypothesis without requiring computationally exhaustive layer sweeps, we evaluate two carefully anchored depths\. For our early\-layer baseline, we extract at the 20th percentile, directly matching the standard extraction depth used in the original Liars’ Bench evaluation\. For our deeper target, we extract at the 66th percentile\. This target was selected based on the mechanistic trajectory identified byBoxo et al\.\([2025](https://arxiv.org/html/2607.20479#bib.bib4)\), which demonstrates that deception detectability peaks in the middle\-to\-late layers before sharply declining in the final third of the network\. By explicitly targeting the 66th percentile, we capture the representations at their theoretical peak maturity, ensuring they have surpassed the early\-layer development phase but avoid the established late\-layer degradation\.

### 3\.1\.White\-Box Train Data and Baselines

Our primary white\-box detection methods follow the benchmark\-style implementation used in Liars’ Bench\(Kretschmar et al\.,[2025](https://arxiv.org/html/2607.20479#bib.bib13)\)\. We do not generate new contrastive prompts ourselves; instead, we use labeled training examples from the benchmark\-style dataset together with the supplementary DolusChat examples\. For training, we extract hidden activations from the target layer for individual response tokens and fit a linear probe using AdamW and a binary cross\-entropy objective to identify honesty and deception directions in the model’s activations\. During evaluation, hidden activations are mean\-pooled across the assistant response before being scored by the probe, and a default probability threshold of 0\.5 is used for discrete classification metrics such as recall\.

### 3\.2\.Additional Train Data and Lie Types

We use DolusChat\(Cundy and Gleave,[2025](https://arxiv.org/html/2607.20479#bib.bib7)\)as a supplementary training source to study how lie typology affects probe behavior\. The dataset contains approximately 65,000 examples, roughly evenly distributed across three categories: fabrication, omission, and exaggeration\. From this pool, we sampleK=1000K=1000examples for our experiments\.

Initially, we restricted our training and evaluation strictly to direct factual lies \(fabrications\) versus clear truths\. We made this design choice because the inherent ambiguity of omissions and exaggerations—where the full, objective ground truth is often inaccessible by definition—posed a severe risk of confounding our baseline probe results\. Fabrication represents the most straightforward case to probe mechanically because it creates direct, measurable contradictions\.

Once our dense probing baselines were successfully established on fabrications, we expanded our scope to conduct a three\-way comparison\. We evaluated omission, fabrication, and exaggeration independently to observe how the distinct nature of each lie affects linear separability and overall probe performance\. This structured comparison allows us to isolate the impact of lie type, reserving the exploration of their various combinations for future research\.

Table 1\.Results for CG, GS, HP\-C, and HP\-KR using the 20th percentile versus the 66th percentile layer activations\. We compare AUROC and RECALL across all probe families usingMistral\-Small\-3\.1\-24B\.MethodCGGSHP\-CHP\-KRAvgL20L66L20L66L20L66L20L66AUROCLogistic0\.760\.840\.400\.560\.640\.310\.140\.130\.47TPC0\.660\.670\.470\.380\.520\.380\.160\.120\.42Truth2D0\.730\.800\.410\.610\.640\.320\.140\.150\.48Mass\-Mean0\.620\.440\.440\.500\.620\.310\.140\.190\.41INLP0\.740\.820\.410\.550\.640\.310\.140\.150\.47Follow\-Up0\.540\.550\.430\.290\.470\.440\.420\.120\.41Upper\-Bound1\.001\.001\.001\.000\.750\.820\.940\.950\.93Average0\.720\.730\.510\.560\.610\.410\.300\.260\.51RECALLLogistic0\.910\.990\.080\.100\.960\.760\.010\.000\.48TPC0\.910\.760\.030\.010\.760\.660\.010\.010\.39Truth2D0\.860\.980\.060\.000\.390\.660\.010\.000\.37Mass\-Mean0\.970\.900\.050\.000\.000\.000\.010\.000\.24INLP0\.930\.990\.080\.010\.960\.650\.010\.000\.45Follow\-Up1\.000\.810\.650\.340\.140\.040\.120\.020\.39Upper\-Bound0\.931\.001\.001\.000\.520\.660\.920\.810\.85Average0\.930\.920\.280\.210\.530\.490\.160\.120\.45
### 3\.3\.Evaluation Datasets

To evaluate the cross\-distribution generalization of our trained probes, we test them against four distinct subsets of the Liars’ Bench\(Kretschmar et al\.,[2025](https://arxiv.org/html/2607.20479#bib.bib13)\)\. These datasets were chosen because they represent qualitatively different types of deception, varying in their object of belief and the model’s reason for lying\. The four evaluation sets are:

- •Convincing Game \(CG\):Evaluates deception regarding self\-knowledge \(e\.g\., whether the model identifies as “human” or “AI”\)\. Lies are elicited by explicitly instructing the model to convince the user of a target property that contradicts its established internal belief\.
- •Gender Secret \(GS\):Tests deception regarding hidden context\. Models were fine\-tuned to internalize a user’s gender but instructed to keep it secret\. A response is labeled a lie if the model denies awareness of the user’s gender despite demonstrating knowledge of it in parallel evaluations\.
- •Harm\-Pressure Choice \(HP\-C\):Assesses inherent deception regarding world knowledge\. Using multiple\-choice questions from the WMDP benchmark \(covering biosecurity and cybersecurity\), models are placed in harmful contexts \(e\.g\., helping create a bio\-weapon\)\. Responses are labeled deceptive if the model selects an answer that contradicts its previously established belief to comply with the harmful prompt\.
- •Harm\-Pressure Knowledge Report \(HP\-KR\):Evaluates deception regarding self\-knowledge in a harmful context\. Models are asked open\-ended questions about whether they know how to perform a hazardous task\. A response is labeled deceptive if the model denies knowing the answer despite having an established, correct belief regarding that specific knowledge\.

### 3\.4\.Probing Architectures

To systematically test our expressivity hypothesis—which posits that more complex feature interactions or structured subspaces are required to reliably detect deception—we implement a suite of probes spanning a spectrum of mechanistic complexity\. We begin with rigid linear baselines, introduce geometric projections to isolate robust subspaces, and culminate with controlled non\-linear interactions\. Leth∈ℝdh\\in\\mathbb\{R\}^\{d\}denote the extracted hidden state representation, andy∈\{0,1\}y\\in\\\{0,1\\\}denote the binary label for truthful and deceptive responses, respectively\. We evaluate the following probing architectures:

- •Logistic Regression:The baseline linear classifier\. It models the probability of deception asP​\(y=1\|h\)=σ​\(wT​h\+b\)P\(y=1\|h\)=\\sigma\(w^\{T\}h\+b\), wherew∈ℝdw\\in\\mathbb\{R\}^\{d\}is the learned weight vector,bbis the bias term, andσ\\sigmais the logistic sigmoid function\. This tests raw linear separability\.
- •Mass\-Mean Probe:A simplified, parameter\-free linear baseline that forms a decision directionwm​mw\_\{mm\}directly from the difference between the class centroids:wm​m=μdeceptive−μtruthfulw\_\{mm\}=\\mu\_\{\\text\{deceptive\}\}\-\\mu\_\{\\text\{truthful\}\}, whereμc=1\|Nc\|​∑i∈Nchi\\mu\_\{c\}=\\frac\{1\}\{\|N\_\{c\}\|\}\\sum\_\{i\\in N\_\{c\}\}h\_\{i\}\. Deception is classified by applying a threshold to the projection scorewm​mT​hw\_\{mm\}^\{T\}h\.
- •Truth2D:Projects activations into a 2D subspace to explicitly disentangle truth from polarity\(Bürger et al\.,[2024](https://arxiv.org/html/2607.20479#bib.bib5)\)\. Formally, it learns an orthogonal projection matrixV∈ℝd×2V\\in\\mathbb\{R\}^\{d\\times 2\}spanning the “truth” and “polarity” directions, transforming the activation intoh2​D=VT​hh\_\{2D\}=V^\{T\}hprior to classification\. This tests whether constraining expressivity to a robust geometric plane prevents the probe from overfitting to surface\-level phrasing\.
- •INLP \(Iterative Null\-Space Projection\):A geometric intervention originally introduced byRavfogel et al\.\([2020](https://arxiv.org/html/2607.20479#bib.bib23)\)that tests whether a target concept can be repeatedly isolated and removed\. Following its application to deception byBoxo et al\.\([2025](https://arxiv.org/html/2607.20479#bib.bib4)\), it iteratively trains linear classifiers to predict a concept and projects the representations onto the intersection of their null spaces:hk=\(∏i=1kPN​\(wi\)\)​hh\_\{k\}=\\left\(\\prod\_\{i=1\}^\{k\}P\_\{N\(w\_\{i\}\)\}\\right\)h, wherePN​\(wi\)P\_\{N\(w\_\{i\}\)\}is the projection matrix onto the null space of theii\-th classifier\.
- •Truncated Polynomial Classifier \(TPC\):Increases expressivity by adding controlled 2nd\-degree \(quadratic\) pairwise feature interactions\(Oldfield et al\.,[2026](https://arxiv.org/html/2607.20479#bib.bib18)\)\. The decision boundary evaluates a quadratic functionf​\(h\)=wT​h\+hT​W​h\+bf\(h\)=w^\{T\}h\+h^\{T\}Wh\+b, whereWWis a restricted or low\-rank weight matrix to prevent parameter explosion\. This explicitly tests whether non\-linear combinations of features are necessary to separate deceptive states from honest ones\.
- •Follow\-Up Probe:An active\-probing operational baseline\. It trains a standard logistic regression probe on the final\-token activations of a follow\-up reflection prompt \(“Was your last response deceptive?”\) with the answer prefilled as “No”\(Goldowsky\-Dill et al\.,[2025](https://arxiv.org/html/2607.20479#bib.bib9)\)\.
- •Upper\-Bound Probe:A dataset\-specific ceiling on probe performance\. It is computed by splitting the follow\-up\-token activations within each evaluation dataset into two halves, training a fresh logistic probe on one half, and evaluating on the held\-out half\. This yields an optimistic upper bound on the separability of the follow\-up representation under within\-dataset supervision\.

### 3\.5\.Dense Versus Sparse Pipelines

To isolate the effects of representation types, we evaluateGemma\-2\-27Bon dense activations andGemma Scope\(Lieberum et al\.,[2024](https://arxiv.org/html/2607.20479#bib.bib15)\)on sparse SAE features\. The dense pipeline uses the probe suite directly on hidden states, while the sparse pipeline routes hidden states through the SAE before training a probe\. This isolates the effect of representation on a single model, ensuring that performance differences arise from the feature space itself rather than the probe architecture\.

## 4\.Experiments

Table 2\.A strictly controlled comparison of dense hidden states and sparse SAE features extracted from the exact same foundation model \(Gemma\-2\-27B\) at 66th percentile layer\. By evaluating both representation types on the identical underlying model, we isolate the specific effect of sparsity on detectability\. Both variants were trained on the full DolusChat mixture and evaluated across CG, GS, HP\-C, and HP\-KR\.MethodCGGSHP\-CHP\-KRAvgDenseSAEDenseSAEDenseSAEDenseSAEAUROCLogistic0\.670\.670\.510\.460\.480\.480\.350\.310\.49TPC0\.690\.660\.480\.430\.510\.520\.540\.480\.54Truth2D0\.660\.650\.460\.440\.480\.470\.380\.340\.49Mass\-Mean0\.530\.630\.440\.450\.480\.490\.370\.340\.47INLP0\.670\.680\.500\.450\.480\.470\.360\.300\.49Follow\-Up0\.480\.460\.580\.560\.530\.530\.430\.410\.50Upper\-Bound0\.920\.920\.770\.780\.610\.610\.790\.760\.77Average0\.660\.670\.530\.510\.510\.510\.460\.420\.53RECALLLogistic0\.930\.860\.220\.110\.320\.290\.320\.130\.40TPC0\.840\.780\.200\.160\.380\.400\.200\.360\.42Truth2D0\.900\.870\.110\.110\.310\.310\.240\.130\.37Mass\-Mean0\.190\.660\.370\.180\.470\.410\.460\.280\.38INLP0\.920\.790\.120\.030\.280\.230\.220\.100\.34Follow\-Up0\.570\.610\.470\.480\.200\.190\.320\.380\.40Upper\-Bound0\.820\.840\.700\.770\.400\.320\.590\.540\.62Average0\.740\.770\.310\.260\.340\.310\.330\.270\.42### 4\.1\.Experimental Setup

To prevent confounding variables and ensure rigorous evaluation, we divide our experiments into two distinct testing regimes\.

For the general depth and expressivity evaluations \(Table[1](https://arxiv.org/html/2607.20479#S3.T1)\), we extract dense activations fromMistral\-Small\-3\.1\-24Bat two depths: an early 20th\-percentile baseline and a deeper 66th\-percentile layer\.

For the sparsity analysis \(Table[2](https://arxiv.org/html/2607.20479#S4.T2)\), we establish a strictly controlled comparison by utilizingGemma\-2\-27Bforboththe dense and sparse pipelines\. This guarantees that any observed performance differences arise solely from the feature representation rather than a mismatch in the underlying foundation model\. We extract both the raw dense hidden states and the corresponding sparse SAE features \(using thegemma\-scope\-27b\-pt\-res\-canonicalweights with a hidden dimension of 131,072\) from Layer 31\. BecauseGemma\-2\-27Bfeatures exactly 46 layers, this target corresponds to approximately 67\.4% depth, aligning with the peaked middle\-layer activation pattern observed inBoxo et al\.\([2025](https://arxiv.org/html/2607.20479#bib.bib4)\)\.

Across all setups, training utilizes 1,000 DolusChat samples, a learning rate of10−310^\{\-3\}, 20 probe epochs, and a batch size of 64\.

### 4\.2\.Evaluation Metrics

To assess the detectability of deception across different representations, we report the Area Under the Receiver Operating Characteristic Curve \(AUROC\) and standard Recall \(evaluated at a default 0\.5 probability threshold\)\. AUROC serves as our primary metric, because it provides a threshold\-independent measure of the global linear separability between truthful and deceptive internal states\. Rather than optimizing for a specific operational threshold, this approach allows us to answer our core mechanistic question: to what extent do dense versus sparse representations inherently encode the structural typology of a lie?

We acknowledge that in real\-world operational deployments, lie detectors require strict False Positive Rate \(FPR\) constraints or precision\-focused tuning, as over\-predicting deception can falsely penalize honest model behavior\. Because our primary objective is to evaluate fundamental representation geometries rather than to deploy a production\-ready classifier, we leave the exact mapping of FPR trade\-offs at strict operational thresholds to future work\.

## 5\.Results and Analysis

In this section, we present the empirical findings from our probing experiments\. To systematically unpack the mechanics of deception detection in large language models, we structure our analysis around the four core factors hypothesized in Section 1: representation depth, probe expressivity, sparsity, and lie typology\. For each dimension, we present our quantitative evaluations followed by an interpretation of the underlying mechanisms driving these results\.

![Refer to caption](https://arxiv.org/html/2607.20479v1/x2.png)Figure 2\.Comparison of logistic\-probe AUROC across lie\-typology training conditions and evaluation datasets\. We compare probes trained without DolusChat, on fabrication\-only DolusChat, on exaggeration\-only DolusChat, on omission\-only DolusChat, and on the full DolusChat mixture, at 20th\-percentile and 66th\-percentile\.Bar chart comparing logistic\-probe AUROC across multiple lie\-typology conditions including fabrication, omission, and exaggeration over the four evaluation datasets, showing the relative performance at both 20th\-percentile and 66th\-percentile\.### 5\.1\.The Effect of Representation Depth

To investigate whether deceptive representations mature in the later stages of the model, we extracted dense hidden states at two distinct depths: an early layer \(the 20th percentile\) and a deeper layer \(the 66th percentile\)\. As shown in Table[1](https://arxiv.org/html/2607.20479#S3.T1), the effect of representation depth is highly dataset\-dependent rather than universally monotonic\.

On the self\-referential datasets \(CG and GS\), the 66th percentile layer consistently improves AUROC across most probes\. This suggests that for role\-based or secret\-keeping deception, deeper representations are needed to capture the internal contradiction between the model’s assigned persona and its underlying knowledge\.

Conversely, the harm\-pressure datasets \(HP\-C and HP\-KR\) exhibit stronger separability at the 20th percentile layer\. This early\-layer advantage possibly occurs because deceptive responses in these datasets are heavily entangled with safety protocols, refusal tendencies, and harmful\-context cues\. In these cases, deeper layers may over\-abstract the representation, washing out surface\-level features that linear probes rely on to detect the lie\.

Furthermore, the recall metrics reveal a distinct split depending on the dataset category\. On the harm\-pressure datasets, the 20th percentile layer provides a more robust and stable decision boundary at the default operating threshold\. Conversely, for the baseline logistic probe, the 66th percentile layer yields higher recall on the self\-referential datasets \(CG and GS\)\. This reinforces the broader conclusion that the optimal representation depth is strictly tied to the nature of the deceptive context rather than a universal property of the model\.

A striking anomaly in Table[1](https://arxiv.org/html/2607.20479#S3.T1)is the sub\-random AUROC performance \(e\.g\., 0\.12–0\.16\) on the HP\-KR dataset across nearly all probes\. It is important to note that this is not an erroneous result; the original Liars’ Bench benchmark also reports substantially sub\-chance AUROC results in this setting \(for example, finding an AUROC of 0\.12 for Llama 3\.3 70B with a mean probe on HP\-KR\)\(Kretschmar et al\.,[2025](https://arxiv.org/html/2607.20479#bib.bib13)\)\. Because an AUROC significantly below 0\.50 indicates systematic anti\-correlation, this is not merely a failure to generalize, but an activeanti\-transfer\. The probes trained on direct, context\-free lies in DolusChat appear to latch onto a feature direction that maps inversely to the safety\-driven, self\-knowledge deception required in HP\-KR\. This is a crucial mechanistic insight: the internal representation of a direct fabrication is inverted compared to the representation of a model falsely denying hazardous knowledge under safety pressure\.

### 5\.2\.Impact of Probe Expressivity

To investigate whether more expressive probe families—those capturing feature interactions or subspace structure—outperform standard logistic regression, we compare logistic regression against TPC, Truth2D, Mass\-Mean, and INLP\. We treat the follow\-up and upper\-bound rows separately, since they serve as prompt\-based and ceiling baselines rather than expressivity\-oriented methods\.

As shown in Table[1](https://arxiv.org/html/2607.20479#S3.T1), the empirical results provide mixed support for the expressivity hypothesis\. Truth2D provides the clearest gains among the structured probes, particularly on GS, where it slightly improves AUROC over the logistic regression baseline\. This is consistent with the idea that explicitly disentangling truth from polarity can create a more robust deception subspace\. Conversely, TPC does not yield a consistent improvement over logistic regression, suggesting that low\-order polynomial interactions are either insufficient for this task or too sensitive to the training distribution to generalize reliably\. Mass\-Mean is generally the weakest of the structured probes, indicating that this simplified geometric summary does not preserve enough discriminative information\.

Crucially, while INLP serves as a useful geometric baseline, its performance should be interpreted as a measure of subspace robustness rather than standard detection\. As shown in Table[1](https://arxiv.org/html/2607.20479#S3.T1), INLP is often close to logistic regression, but not identical across all datasets and depths: on CG it reaches 0\.74 and 0\.82 AUROC versus 0\.76 and 0\.84 for logistic regression, on GS it reaches 0\.41 and 0\.55 versus 0\.40 and 0\.56, on HP\-C it matches the baseline at 0\.64 and 0\.31, and on HP\-KR both methods remain near chance\. These results suggest that iteratively projecting out linear directions removes some information, but does not uniformly collapse the deception signal\. Rather than indicating that deception is confined to a single low\-dimensional subspace, the findings are more consistent with a partly distributed representation that is only partially removed by linear null\-space projection\.

### 5\.3\.Impact of Sparse SAE Features

Unlike the earlier fabrication\-only comparison, this experiment uses SAE results computed across all DolusChat lie categories\. Furthermore, due to computational constraints, SAE features were only extracted at 66th percentile layer\. To keep the comparison matched, we therefore evaluate the dense branch on the same all\-category DolusChat subset and at the same layer, so any differences reflect the representation type rather than changes in lie\-type coverage or depth\.

To examine whether sparse SAE features preserve or improve deception separability relative to dense hidden states, we compare Gemma\-2\-27B hidden activations against Gemma\-2\-27B SAE features at 66th percentile layer in Table[2](https://arxiv.org/html/2607.20479#S4.T2)\.

The results presented in the table suggest that, within this specific experimental setup, the transition from dense hidden states to sparse SAE features does not appear to yield a clear improvement in deception detection performance\. While the sparse representations maintain a relative functional parity with the dense branch, they generally achieve slightly lower or equivalent average scores across most datasets and probing methods\. This suggests that the SAE reconstruction at this depth preserves existing deception\-related signals rather than enhancing their separability\.

The main exception is the harm\-pressure setting, where SAE features improve some individual probe scores and appear to help disentangle deception from overlapping safety\-related signals\. However, this effect is not uniform across all methods or datasets, and it does not translate into a consistent overall gain\. The upper\-bound rows further support this interpretation: dense and sparse features remain close in performance, but the dense branch is still slightly stronger overall\.

### 5\.4\.Impact of Lie Typology

To test whether the structural category of a lie affects detectability, we compare AUROC across five training conditions: without DolusChat, fabrication\-only, exaggeration\-only, omission\-only, and the full DolusChat mixture\. We restrict this analysis to the baseline logistic regression probe because, as established in Section 5\.2, it provides the most stable and representative baseline across datasets\. By standardizing on this robust linear boundary, we successfully isolate the effect of the training distribution on linear separability without compounding variables from fluctuating probe expressivity\. Figure[2](https://arxiv.org/html/2607.20479#S5.F2)summarizes these results at the 20th percentile layer and the 66th percentile layer\.

The bar plot shows that lie typology matters, but not in a simple universal order\. At the 20th percentile, the best\-performing condition depends on the dataset: exaggeration is strongest on CG, the no\-DolusChat baseline is strongest on GS, fabrication is strongest on HP\-C, and omission is strongest on HP\-KR\. Averaged across datasets, omission has the highest AUROC at the 20th percentile layer, largely because of its strong performance on HP\-KR\. This suggests that omission is the most recoverable training condition at the shallower layer, but only in the harm\-pressure setting\.

At the 66th percentile layer, the pattern shifts\. Fabrication becomes strongest on CG, the no\-DolusChat baseline remains strongest on GS, and omission becomes the strongest condition on both HP\-C and HP\-KR\. On average, exaggeration achieves the highest AUROC at the 66th percentile layer, while omission drops substantially relative to its 20th percentile layer performance\. This indicates that deeper representations sharpen some lie\-typology signals while suppressing others, especially when the lie depends on contextual withholding rather than direct contradiction\.

The full DolusChat mixture is never the best\-performing condition and is weakest at the 20th percentile layer, with a near\-bottom average at the 66th percentile layer as well\. This suggests that combining lie types does not automatically improve linear separability and may instead blur the deception signal\. Overall, the figure supports a qualified conclusion: lie typology does affect detectability, but there is no single ordering of fabrication, exaggeration, and omission that holds across all datasets or depths\.

#### Summary: A Representation\-Dependent Problem\.

The results point to a consistent but nuanced picture of deception detection in LLMs\. Depth improves separability in some datasets but not others, so later layers are not universally superior\. More expressive probes help selectively, but standard logistic regression remains highly competitive and is often the most stable baseline\. Sparse SAE features perform similarly to dense representations\. Finally, lie typology clearly matters: fabrication, omission, exaggeration, and mixed training conditions produce different detection patterns depending on the dataset and representation layer\. Overall, the experiments show that deception detection is best understood as a representation\-dependent problem rather than a single\-classifier problem\.

## 6\.Conclusion

This paper set out to examine deception detection in large language models through four factors: representation depth, probe expressivity, sparse representations, and lie typology\. Across the experiments, the central conclusion is that deception is not encoded in a single uniform way\. Instead, detectability depends heavily on the dataset context, the layer being probed, and the representation space used for classification\.

For depth, the results show a dataset\-dependent pattern rather than a universal rule\. Some datasets benefit from deeper layers, while others remain more separable at earlier layers, meaning the commonly assumed “later is better” trajectory does not hold consistently across all deception settings\. For probe expressivity, more complex models provide selective gains but do not dominate the simple logistic baseline\. Truth2D offers the clearest structured improvement, while TPC, mass\-mean, and INLP are useful in specific settings but not consistently stronger than a well\-calibrated linear classifier\. This suggests that deception detection is not solved simply by adding geometric or polynomial complexity\.

For sparse SAE features, the results suggest that evaluating SAE representations at 66th percentile layer does not consistently enhance detectability over the original dense hidden states\. In most settings, SAE preserves the core deceptive signal rather than improving it, and its benefits appear limited to a subset of harm\-pressure cases\. This suggests that, at least at this depth, SAE features function more as an alternative representation than as a reliably stronger one for deception detection\. Finally, for lie typology, we found that fabrication, omission, exaggeration, and mixed training conditions do not behave uniformly\. The strongest condition depends on both the dataset and the representation layer, indicating that the structural form of a lie materially affects its detectability, and no single lie type dominates universally\.

The main challenge throughout this paper was that the deception signal was not stable across tasks; different datasets exposed different failure modes, and the optimal probing strategy frequently shifted with the evaluation context\. Given that optimal detection performance depends heavily on highly localized factors—such as specific layers, lie typologies, and representation spaces—our findings strongly suggest that a monolithic detector is fundamentally limited\. Instead, a highly promising avenue for future work lies in ensemble methods or a Mixture\-of\-Experts \(MoE\) probing framework\. By training specialized, expert probes for distinct context types \(e\.g\., separating safety\-related choices from persona\-driven roleplay\) and utilizing a gating mechanism to dynamically route activations, such an architecture could explicitly leverage the selective strengths of the individual probes observed in our evaluation\. Additionally, extending this analysis to the remaining Liars’ Bench models would test whether these depth, sparsity, and typology patterns persist across different model families, while studying the SAE representations more directly could further bridge the gap between behavioral benchmarking and mechanistic interpretability\.

## Limitations

This study has several limitations\. First, given the computational scope of a multi\-factor study and the constraints of an extended abstract, we sampled two specific depth percentiles \(20% and 66%\) rather than conducting a continuous layer\-wise sweep\. Because we purposefully anchored our early layer to the original Liars’ Bench baseline and our deeper layer to the maximum theoretical peak before the late\-stage performance drop\-off identified byBoxo et al\.\([2025](https://arxiv.org/html/2607.20479#bib.bib4)\), we chose to apply these established bounds directly to our evaluation rather than exhaustively re\-proving a continuous layer\-wise trajectory from scratch\. Second, because our core claims are intentionally conservative—highlighting contextual dependencies \(“it depends”\) rather than declaring absolute algorithmic superiority—we rely on directional shifts in AUROC and refrain from exhaustive statistical significance testing\. Third, the lie typology experiments \(Figure[2](https://arxiv.org/html/2607.20479#S5.F2)\) were restricted to the logistic regression baseline to cleanly isolate distribution effects, and have not yet been evaluated across the more expressive probe families\. Fourth, the SAE results were evaluated solely at 66th percentile layer\. Fifth, the inherent distribution gap between our synthetic training data \(DolusChat\) and the complex evaluation prompts \(Liars’ Bench\) likely contributes to the striking anti\-transfer observed in the HP datasets\. Finally, our discrete classification metrics rely on a default 0\.5 probability threshold, whereas future operational work must explore strict False Positive Rate \(FPR\) constraints\.

## Acknowledgments

This research was supported by the state of North Rhine\-Westphalia as part of the Lamarr Institute for Machine Learning and Artificial Intelligence\.

## References

- \(1\)
- Alain and Bengio \(2017\)Guillaume Alain and Yoshua Bengio\. 2017\.Understanding Intermediate Layers Using Linear Classifier Probes\. In*International Conference on Learning Representations \(ICLR\)*\.[https://openreview\.net/forum?id=HJ4\-rAVtl](https://openreview.net/forum?id=HJ4-rAVtl)
- Azaria and Mitchell \(2023\)Amos Azaria and Tom Mitchell\. 2023\.The Internal State of an LLM Knows When It’s Lying\. In*Findings of the Association for Computational Linguistics \(EMNLP\)*\. Association for Computational Linguistics, Singapore, 967–976\.[doi:10\.18653/v1/2023\.findings\-emnlp\.68](https://doi.org/10.18653/v1/2023.findings-emnlp.68)
- Boxo et al\.\(2025\)Gerard Boxo, Ryan Socha, Daniel Yoo, and Shivam Raval\. 2025\.Caught in the Act: A Mechanistic Approach to Detecting Deception\.*arXiv preprint arXiv:2508\.19505*\(2025\)\.[https://arxiv\.org/abs/2508\.19505](https://arxiv.org/abs/2508.19505)
- Bürger et al\.\(2024\)Lennart Bürger, Fred A\. Hamprecht, and Boaz Nadler\. 2024\.Truth Is Universal: Robust Detection of Lies in LLMs\. In*Advances in Neural Information Processing Systems \(NeurIPS\)*, Vol\. 37\. Curran Associates, Inc\., 138393–138431\.[doi:10\.52202/079017\-4392](https://doi.org/10.52202/079017-4392)
- Burns et al\.\(2023\)Collin Burns, Haotian Ye, Dan Klein, and Jacob Steinhardt\. 2023\.Discovering Latent Knowledge in Language Models Without Supervision\. In*International Conference on Learning Representations \(ICLR\)*\.[https://openreview\.net/forum?id=ETKGuby0hcs](https://openreview.net/forum?id=ETKGuby0hcs)
- Cundy and Gleave \(2025\)Chris Cundy and Adam Gleave\. 2025\.Preference Learning with Lie Detectors Can Induce Honesty or Evasion\. In*Advances in Neural Information Processing Systems \(NeurIPS\)*\.[https://openreview\.net/forum?id=ibLGUkBWlz](https://openreview.net/forum?id=ibLGUkBWlz)
- Elhage et al\.\(2022\)Nelson Elhage, Tristan Hume, Catherine Olsson, Nicholas Schiefer, Tom Henighan, Shauna Kravec, Zac Hatfield\-Dodds, Robert Lasenby, Dawn Drain, Carol Chen, et al\.2022\.Toy Models of Superposition\.*arXiv preprint arXiv:2209\.10652*\(2022\)\.[https://arxiv\.org/abs/2209\.10652](https://arxiv.org/abs/2209.10652)
- Goldowsky\-Dill et al\.\(2025\)Nicholas Goldowsky\-Dill, Bilal Chughtai, Stefan Heimersheim, and Marius Hobbhahn\. 2025\.Detecting Strategic Deception Using Linear Probes\.*arXiv preprint arXiv:2502\.03407*\(2025\)\.[https://arxiv\.org/abs/2502\.03407](https://arxiv.org/abs/2502.03407)
- Huben et al\.\(2024\)Robert Huben, Hoagy Cunningham, Logan Riggs Smith, Aidan Ewart, and Lee Sharkey\. 2024\.Sparse Autoencoders Find Highly Interpretable Features in Language Models\. In*International Conference on Learning Representations \(ICLR\)*\.[https://openreview\.net/forum?id=F76bwRSLeK](https://openreview.net/forum?id=F76bwRSLeK)
- Hubinger et al\.\(2024\)Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M\. Ziegler, Tim Maxwell, Newton Cheng, et al\.2024\.Sleeper Agents: Training Deceptive LLMs That Persist Through Safety Training\.*arXiv preprint arXiv:2401\.05566*\(2024\)\.[https://arxiv\.org/abs/2401\.05566](https://arxiv.org/abs/2401.05566)
- Kantamneni et al\.\(2025\)Subhash Kantamneni, Joshua Engels, Senthooran Rajamanoharan, Max Tegmark, and Neel Nanda\. 2025\.Are Sparse Autoencoders Useful? A Case Study in Sparse Probing\. In*International Conference on Machine Learning \(ICML\)*\.[https://openreview\.net/forum?id=rNfzT8YkgO](https://openreview.net/forum?id=rNfzT8YkgO)
- Kretschmar et al\.\(2025\)Kieron Kretschmar, Walter Laurito, Sharan Maiya, and Samuel Marks\. 2025\.Liars’ Bench: Evaluating Lie Detectors for Language Models\.*arXiv preprint arXiv:2511\.16035*\(2025\)\.[https://arxiv\.org/abs/2511\.16035](https://arxiv.org/abs/2511.16035)
- Li et al\.\(2023\)Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg\. 2023\.Inference\-Time Intervention: Eliciting Truthful Answers from a Language Model\. In*Advances in Neural Information Processing Systems \(NeurIPS\)*, Vol\. 36\. 41451–41530\.[https://proceedings\.neurips\.cc/paper\_files/paper/2023/hash/81b8390039b7302c909cb769f8b6cd93\-Abstract\-Conference\.html](https://proceedings.neurips.cc/paper_files/paper/2023/hash/81b8390039b7302c909cb769f8b6cd93-Abstract-Conference.html)
- Lieberum et al\.\(2024\)Tom Lieberum, Senthooran Rajamanoharan, Arthur Conmy, Lewis Smith, Nicolas Sonnerat, Vikrant Varma, János Kramár, Anca Dragan, Rohin Shah, and Neel Nanda\. 2024\.Gemma Scope: Open Sparse Autoencoders Everywhere All at Once on Gemma 2\. In*Proceedings of the 7th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP*\. 278–300\.[https://arxiv\.org/abs/2408\.05147](https://arxiv.org/abs/2408.05147)
- Lin et al\.\(2022\)Stephanie Lin, Jacob Hilton, and Owain Evans\. 2022\.TruthfulQA: Measuring How Models Mimic Human Falsehoods\. In*Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics \(ACL\)*\. Association for Computational Linguistics, Dublin, Ireland, 3214–3252\.[doi:10\.18653/v1/2022\.acl\-long\.229](https://doi.org/10.18653/v1/2022.acl-long.229)
- Marks and Tegmark \(2024\)Samuel Marks and Max Tegmark\. 2024\.The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasets\. In*Conference on Language Modeling \(COLM\)*\.[https://openreview\.net/forum?id=aajyHYjjsk](https://openreview.net/forum?id=aajyHYjjsk)
- Oldfield et al\.\(2026\)James Oldfield, Philip Torr, Ioannis Patras, Adel Bibi, and Fazl Barez\. 2026\.Beyond Linear Probes: Dynamic Safety Monitoring for Language Models\. In*International Conference on Learning Representations \(ICLR\)*\.[https://openreview\.net/forum?id=AGWa8whf92](https://openreview.net/forum?id=AGWa8whf92)
- Pacchiardi et al\.\(2024\)Lorenzo Pacchiardi, Alex James Chan, Sören Mindermann, Ilan Moscovitz, Alexa Yue Pan, Yarin Gal, Owain Evans, and Jan M\. Brauner\. 2024\.How to Catch an AI Liar: Lie Detection in Black\-Box LLMs by Asking Unrelated Questions\. In*International Conference on Learning Representations \(ICLR\)*\.[https://openreview\.net/forum?id=567BjxgaTp](https://openreview.net/forum?id=567BjxgaTp)
- Park et al\.\(2024\)Peter S\. Park, Simon Goldstein, Aidan O’Gara, Michael Chen, and Dan Hendrycks\. 2024\.AI Deception: A Survey of Examples, Risks, and Potential Solutions\.*Patterns*5, 5 \(2024\), 100988\.[doi:10\.1016/j\.patter\.2024\.100988](https://doi.org/10.1016/j.patter.2024.100988)
- Perez et al\.\(2023\)Ethan Perez, Sam Ringer, Kamilė Lukošiūtė, Karina Nguyen, Edwin Chen, Scott Heiner, Craig Pettit, Catherine Olsson, Sandipan Kundu, Saurav Kadavath, et al\.2023\.Discovering Language Model Behaviors with Model\-Written Evaluations\. In*Findings of the Association for Computational Linguistics \(ACL\)*\. Association for Computational Linguistics, Toronto, Canada, 13387–13434\.[doi:10\.18653/v1/2023\.findings\-acl\.847](https://doi.org/10.18653/v1/2023.findings-acl.847)
- Rajamanoharan et al\.\(2024\)Senthooran Rajamanoharan, Tom Lieberum, Nicolas Sonnerat, Arthur Conmy, Vikrant Varma, János Kramár, and Neel Nanda\. 2024\.Jumping Ahead: Improving Reconstruction Fidelity with JumpReLU Sparse Autoencoders\.*arXiv preprint arXiv:2407\.14435*\(2024\)\.[https://arxiv\.org/abs/2407\.14435](https://arxiv.org/abs/2407.14435)
- Ravfogel et al\.\(2020\)Shauli Ravfogel, Yanai Elazar, Hila Gonen, Michael Twiton, and Yoav Goldberg\. 2020\.Null It Out: Guarding Protected Attributes by Iterative Nullspace Projection\. In*Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics \(ACL\)*\. Association for Computational Linguistics, Online, 7237–7256\.[doi:10\.18653/v1/2020\.acl\-main\.647](https://doi.org/10.18653/v1/2020.acl-main.647)
- Wei et al\.\(2024\)Jerry Wei, Da Huang, Yifeng Lu, Denny Zhou, and Quoc V\. Le\. 2024\.Simple Synthetic Data Reduces Sycophancy in Large Language Models\. In*International Conference on Learning Representations \(ICLR\)*\.[https://openreview\.net/forum?id=WDheQxWAo4](https://openreview.net/forum?id=WDheQxWAo4)
- Zou et al\.\(2024\)Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Yang, Richard Yin, Dan Yin, Mantas Mazeika, et al\.2024\.Representation Engineering: A Top\-Down Approach to AI Transparency\. In*International Conference on Learning Representations \(ICLR\)*\.[https://openreview\.net/forum?id=fq1Sj4XpsS](https://openreview.net/forum?id=fq1Sj4XpsS)