The Truth Was Never Gone: Perfect Aliasing in Compliant-Context Truth Probes

# The Truth Was Never Gone:Perfect Aliasing in Compliant-Context Truth Probes
Source: [https://arxiv.org/html/2609.10739](https://arxiv.org/html/2609.10739)
## The Truth Was Never Gone: Perfect Aliasing in Compliant\-Context Truth ProbesThanks:Code and aggregate results:[https://github\.com/dylanjayabahu/perfect\-aliasing](https://github.com/dylanjayabahu/perfect-aliasing)\.

###### Abstract

A truth probe fitted where truthful reporting and a task’s prescribed action coincide cannot distinguish those targets from its fitting labels alone\. We call this failure of semantic identification*perfect aliasing*\. In a controlled binary reporting game, truth and prescribed\-action probes fitted on compliant contexts solve the same optimization\. On rival contexts their labels are complements, forcing their AUROCs to sum to one; this identity holds across 751 cell\-layer pairs to floating\-point precision\. We separate prescribed output symbols from semantic action using randomized codebooks, then separate truth from prescribed action by fitting on mixed compliant and rival contexts\. For a reward\-trained Gemma\-2\-9B policy that answers falsely on all evaluated rival trials, the conventional probe scores0\.006±0\.0050\.006\\pm 0\.005AUROC across three training seeds, while mixed\-fit probes score1\.0001\.000on the same held\-out activations\. Mixed fitting uses more training examples and access to labelled rival contexts, so this comparison establishes linear recoverability rather than isolating the benefit of decorrelation\. We also show that two compliant\-fit probes, both perfect in\-distribution, score0\.0800\.080and0\.9860\.986on the same rival activations\. The findings concern what a probe measures: they do not establish preserved functional belief, causal use of the recovered direction, or a deployable deception detector\. Code and aggregate results accompany the paper\.

## 1Introduction

Linear probes on the residual stream are among the few interpretability tools to have reached practical safety proposals\. They are cheap, need no model modification, and work on instructed liars\. But the threat they address is an emergent liar: a policy that learned to deceive because deception was rewarded, of the kind now documented in production RL\([MacDiarmid et al\., 2025](https://arxiv.org/html/2609.10739#bib.bib8)\)\.

Two bodies of evidence point in opposite directions\. Instruction\-pair probes transfer to held\-out strategic deception at AUROC 0\.96–0\.999\([Goldowsky\-Dill et al\., 2025](https://arxiv.org/html/2609.10739#bib.bib3)\), a result now used to motivate probes as audit tools\. Yet probes also degrade under training pressure: token\-level monitors become highly vulnerable once a model is rewarded for evading them\([Gupta and Jenner, 2025](https://arxiv.org/html/2609.10739#bib.bib4)\); stylistic shift alone drives 27B probes to chance under standard training\([Kumar, 2026](https://arxiv.org/html/2609.10739#bib.bib6)\); and, closest to the threat model, off\-domain AUC falls to 0\.376 after ordinary RLVR that never optimized against the probe\([Taufeeque et al\., 2026](https://arxiv.org/html/2609.10739#bib.bib13)\)\. A comparable below\-chance number, 0\.374, is reported for prompted deception\([Natarajan et al\., 2026](https://arxiv.org/html/2609.10739#bib.bib10)\)\.

We state these numbers as their authors do, because the spread bears on the argument\. The0\.3760\.376is a mean over four models with a standard deviation of0\.261\\mathbf\{0\.261\}, so “below chance” is the average of a wide spread there;[Kumar \(2026\)](https://arxiv.org/html/2609.10739#bib.bib6)attribute their collapse to how narrow the training distribution was, and recover near\-perfect detection with style\-augmented training;[Gupta and Jenner \(2025\)](https://arxiv.org/html/2609.10739#bib.bib4)optimize against the monitor adversarially, a different threat model from ordinary RL, and find max\-pooling and attention probes stay robust where token\-level ones do not\. So there is less consensus than is sometimes implied: sub\-chance AUROC on a*reward\-trained*deceiver is reported by one paper, with wide variance across models\. Below\-chance numbers nevertheless invite a representational interpretation: the model has learned to hide, obfuscate, or stop representing what it knows\.

A below\-chance readout alone does not establish loss of truth information\. In our controlled task the true bit remains linearly recoverable under a different fitting distribution\. Compliant fitting labels cannot distinguish truth from the task’s prescribed answer; inverting on rival contexts is compatible with a prescribed\-action readout\. This is an alternative interpretation of a probe failure, not an attribution of the failures in those external studies\. Nor is saturation a sufficient predictor of inversion: our own counterexamples are reported in App\.[G](https://arxiv.org/html/2609.10739#A7)\.

Our identification argument \(§[3](https://arxiv.org/html/2609.10739#S3)\) shows analytically that compliant fitting labels cannot distinguish truth from prescribed action\. We verify the forced identityaction/ally=1−truth/ally\\texttt\{action/ally\}=1\-\\texttt\{truth/ally\}at every recorded layer of every cell\. A randomized codebook separates prescribed output symbols from semantic action*within*compliant contexts; mixed\-context fitting then separates truth from prescribed action\. The constructive result \(§[3\.3](https://arxiv.org/html/2609.10739#S3.SS3)\) is empirical truth AUROC rounding to1\.0001\.000at the final layer across the models and arms in Table[1](https://arxiv.org/html/2609.10739#S3.T1), including a reward\-trained policy that answers falsely on every evaluated rival trial under an unmodified RL recipe\.

A separate control \(§[4](https://arxiv.org/html/2609.10739#S4)\) shows how refitting the probe per condition can produce conflicting readouts on the same activations\. We also report negative results \(App\.[G](https://arxiv.org/html/2609.10739#A7)\), including two accounts we advanced ourselves and then refuted\. An apparent “emergent\-specific” inversion, initially supported by seed replication and interventions, dissolves under a behaviourally matched control \(App\.[F](https://arxiv.org/html/2609.10739#A6)\)\.

## 2Setup

Game\.A system prompt states a secret bit\. A user turn self\-identifies as an ally or a rival and asks for the bit; the model answers with a single token\. Both honesty to allies and deception to rivals are rewarded \(REINFORCE; ally\+1/−1\+1/\-1, rival\+1\.5/−2\+1\.5/\-2\), so any successful policy must use information about the bit regardless of who is asking and produce a role\-dependent answer\. This reward structure makes the game a controlled probe testbed: the ground\-truth bit is supplied, while the prescribed answer depends on the role\. It does not establish a distinct belief state or a particular computational sequence\.

Two arms\.The emergent arm is the base model plus a LoRA adapter \(r=16r\{=\}16,α=32\\alpha\{=\}32, on q/k/v/o\) trained with REINFORCE until reward plateaus; the instructed arm is the same base model, without our RL training, given a system\-prompt directive to deceive rivals\. The historical run log reports that 19/19 original plain\-bit training runs reached the same reward plateau; a complete run\-inclusion manifest was not retained\. The codebook\-task training outcomes differ \(§[7](https://arxiv.org/html/2609.10739#S7)\)\.

Randomized\-codebook variant: the identification fix\.In the plain game the semantic answer and the emitted character are the same thing, so no probe fit on it can distinguish them\. In the codebook variant each trial draws a fresh symbol pair and a random orientation, so*which character denotes semantic 0*changes trial to trial, decorrelating the prescribed output symbol from semantic action*even within ally contexts*\. We report the decorrelation two ways, and deliberately not a third\. The*behavioural*guard is that the policy is not emitting a fixed character: the fraction emitting the alphabetically\-first symbol is0\.4780\.478\(ally\) /0\.5390\.539\(rival\)\. This guard excludes a fixed surface*character*, but because the mapping re\-randomizes every trial, a policy emitting a fixed*meaning*also scores≈0\.5\{\\approx\}0\.5, and two of our arms do exactly that \(§[3\.3](https://arxiv.org/html/2609.10739#S3.SS3)\)\. The*representational*guard is the angle between the separately fittedtruthandtokendirections,cos=\+0\.003/−0\.006/−0\.016/−0\.046\\cos=\+0\.003/\-0\.006/\-0\.016/\-0\.046across four cells\. We donotquote the label\-levelcorr⁡\(action,token\)\\mathrm\{corr\}\(\\textrm\{action\},\\textrm\{token\}\), because it is a property of the codebook random draw and says nothing about any model: the*identical*value appears to 16 significant figures in 11 cells spanning four architectures and both arms, and a quantity that cannot vary across models is not a measurement of one\.

Probes and the read position\.Per\-layer logistic probes read the residual stream at the final prompt position, the position whose next\-token distribution*is*the model’s answer\. No answer token has been generated there, so the probe reads the state from which the answer is computed\. We call this the*answer\-prediction position*\. The precision matters twice: it makes the action confound real \(the answer is one matrix multiply away\), and it makes the crossed text\-versus\-behaviour design un\-runnable here \(§[7](https://arxiv.org/html/2609.10739#S7)\), since activations are fully determined by the prompt\. We distinguish four recorded labels:truth, the ground\-truth bit;action, the task\-prescribed semantic answer \(truth on allies, its complement on rivals\);token, whether that prescribed answer maps to the alphabetically first or second codebook symbol; andemitted, the model’s actual semantic choice\. The last is chosen greedily between the two legal output symbols, not by unrestricted vocabulary generation\. The prescribed labels remain defined even when the model disobeys\. Neitheractionnortokenindependently measures mental intent or actual output\. We fit per\-layer logistic probes under ally\-only and mixed ally\+rival regimes\. Here “identified” denotes separating these specified label alternatives in the fitting design, not a unique or universally valid truth direction\.

Sampling and fitting\.NNdenotes total collected episodes, before splitting by role or into fitting and evaluation sets\. Identification runs useN=1000N=1000or20002000, plus a separateN=120N=120pilot\. A fixed 70/30 split stratified by role supplies a common test set for the ally\-fit and mixed\-fit probes\. Mixed fitting uses all training rows \(700 atN=1000N=1000\); ally fitting uses only the ally subset, approximately half as many\. Rival AUROC is evaluated on the rival subset of the test split, approximately 150 episodes atN=1000N=1000\. Behavioural rates use all collected episodes of the relevant role\. Run keys and the limits of the recorded denominators for Table[1](https://arxiv.org/html/2609.10739#S3.T1)are in App\.[A\.1](https://arxiv.org/html/2609.10739#A1.SS1)\. The fitting\-set size and access to labelled rival contexts both change; an equal\-budget comparison was not run\.

For frozen identification probes, the code instead scores all collected target episodes, because it does not fit on that run\. Thus frozen\-versus\-refit identification curves use different evaluation subsets; they are descriptive transfer comparisons, not paired estimates on identical test examples\. Held\-out templates test transfer within this task family\. Random episode splits do not establish generalisation to independent templates, and recurring prompt configurations may occur across splits\.

Models\.Llama\-3\.1\-8B, Gemma\-2\-9B, Mistral\-7B\-v0\.3, Qwen2\.5\-\{3,7,14,32\}B \(4 architectures, 3B–32B, 28–64 layers\); bf16,transformers 4\.48\.3, a single H200\-class GPU per run\. Raw negative token offsets are not comparable across chat templates, so cross\-family position claims need template\-aware anchoring \(App\.[A](https://arxiv.org/html/2609.10739#A1.SS0.SSS0.Px1)\)\.

## 3Identification: the core result

### 3\.1The argument

Consider a probe fitted on ally trials\. Our ground\-truth and prescribed\-action labels coincide on every such trial by construction:truth=action\. Any fitting objective using these labels receives the same supervision under either interpretation\. We call this*perfect aliasing*, the complete\-agreement limit of the label agreement rate considered in App\.[D](https://arxiv.org/html/2609.10739#A4)\. In the plain\-bit game the prescribed surface symbol coincides too; the randomized codebook removes this additional equality\. Actual answers need not coincide with prescribed answers on trials where the model makes an error\.

The ambiguity concerns the meaning assigned to a fitted score\. Label equality does not itself prove the existence of two distinct linear directions, nor preclude a numerically unique regularized optimum\. It shows that the fitting labels cannot choose between the two target interpretations\. On rival trials the prescribed\-action label is the complement of truth; a score aligned with that prescribed label will therefore read truth backwards\. This possibility prevents a below\-chance ally\-fit readout, on its own, from establishing removal of truth information\.

The argument does not determine which interpretation best describes a particular fit outside its fitting support\. Our experiments demonstrate contrasting readouts, and the refitting control in §[4](https://arxiv.org/html/2609.10739#S4)demonstrates disagreement between decoders that both pass compliant validation\. Saturation is not a sufficient predictor: an arm at deception exactly1\.0001\.000does not invert, while another at lower deception does \(App\.[G](https://arxiv.org/html/2609.10739#A7)\)\.

### 3\.2The identity is forced, not empirical

The argument makes a prediction sharp enough to check arithmetically\. Because the ally\-data label vectors fortruthandactionare*identical*, fitting a “truth probe” and fitting an “action probe” on ally data are the same optimization\. The two reported AUROCs are one fitted direction scored against opposite labels, and AUROC is antisymmetric under label negation, soaction/ally=1−truth/ally\\texttt\{action/ally\}=1\-\\texttt\{truth/ally\}exactly, at every layer, in every cell\. We verify it across all 751 \(cell, layer\) pairs across 39 distinct full\-curve records; the maximum deviation is2\.2×𝟏𝟎−𝟏𝟔\\mathbf\{2\.2\\times 10^\{\-16\}\}\(Fig\.[6](https://arxiv.org/html/2609.10739#A12.F6)\)\. This is not a correlation to interpret; it is a proof, and the measurement only checks that our pipeline computes what we think it does\. Anyone reporting an ally\-fit “truth probe” AUROC below0\.50\.5in this complemented\-label evaluation has equivalently reported a prescribed\-action AUROC above0\.50\.5, and the protocol offers no way to tell which they measured\.

### 3\.3The constructive result: the truth is still there

If the diagnosis is right, the fix is prescribed by it: break the aliasing in the*training*data\. We do both halves: the randomized codebook decorrelates token from action, and fitting on mixed ally\+rival contexts decorrelates truth from action \(Table[1](https://arxiv.org/html/2609.10739#S3.T1), Fig\.[1](https://arxiv.org/html/2609.10739#S3.F1)\)\.

Table 1:Same activations, same layer, same fitting algorithm; fitting context and sample size differ\. Final\-layer AUROC on held\-out rival trials fromN=1000N=1000collected episodes per run; approximately 150 rival test episodes; cell provenance is in App\.[A\.1](https://arxiv.org/html/2609.10739#A1.SS1)\.![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_identification.png)Figure 1:Same activations, same layer: the ally\-trained “truth” probe inverts while an identified probe reads1\.0001\.000\.Per\-layer truth AUROC on held\-out rival trials fromN=1000N=1000collected episodes per run \(approximately 150 rival test episodes\)\. Red: the conventional protocol, fit on ally contexts only\. Blue: the same label set fit on mixed ally\+rival contexts\. Dashed line is chance; below it the probe is anti\-correlated with the truth\. The inset note in each panel gives that arm’s measured rival deception rate\. The saturated codebook\-trained RL arms \(top left\) are where the conventional protocol reads0\.0000\.000and0\.0560\.056while the identified probe reads1\.0001\.000in the final layer\. Eight of the ten candidate cells for this figure grid \(a different set from Table[1](https://arxiv.org/html/2609.10739#S3.T1)\) are shown; the two omitted are Llama\-8B codebook cells that do*not*invert \(0\.8810\.881and0\.9830\.983\), withtruth/mixed=1\.000=1\.000in both\.Replication\.The result appears in five arms spanning three architectures and four training recipes\. Every reward\-trained arm reaching deception≥0\.996\{\\geq\}0\.996shows the conventional ally\-fit probe at or near zero \(0\.0060\.006,0\.0000\.000,0\.0560\.056,0\.0000\.000,0\.0230\.023\) while the mixed\-fit probe reads1\.0001\.000\. The five differ in recipe \(unmodified, entropy bonus with EMA baseline, larger step size and batch, and two under a corrected reward table\), so the observed effect is not confined to a single optimizer setting\. Only the*conjunction*“saturatedandno recipe deviation whatsoever” is a single cell, and that cell is the headline\.

The headline cell\.Row[1](https://arxiv.org/html/2609.10739#S3.T1)is the strongest statement the data supports\. A Gemma\-2\-9B policy reward\-trained directly on the identification task with the RL recipe entirely unmodified lies on 100% of rival trials\. On its activations, at the same position and layer, the ally\-fit probe reads0\.006±0\.005\\mathbf\{0\.006\\pm 0\.005\}, the textbook “reward\-trained deception evades truth probes” result at its maximum, while the mixed\-fit probe reads1\.000\\mathbf\{1\.000\}\. That is three independent training seeds, each retrained from scratch and probed atN=1000N\{=\}1000: ally\-fit AUROCs of0\.0000\.000,0\.0100\.010and0\.0060\.006against a mixed\-fit1\.0001\.000with zero cross\-seed variance \(the mean and standard deviation use unrounded values\)\. The ally\-fit collapse begins mid\-stack and reaches final\-layer values rounding to0\.0000\.000,0\.0100\.010, and0\.0060\.006, respectively, on profiles given in App\.[H](https://arxiv.org/html/2609.10739#A8); the mixed\-fit probe reaches1\.0001\.000by layer 4 and holds it unbroken to the final layer\.

Table[1](https://arxiv.org/html/2609.10739#S3.T1)reports final\-layertruth/mixedof1\.0001\.000across four architectures and both training routes\. This is not universal: two Llama\-8B inferred\-truth evaluations reach0\.8716\\mathbf\{0\.8716\}and0\.9583\\mathbf\{0\.9583\}, respectively\. On those tasks the model’s behavioural accuracy is near chance; incorrect answers do not establish that the ground\-truth information is absent\. The appendix identifies these cells explicitly\. We report cell\-specific measurements rather than a pooled success fraction because cells share tasks and seeds\. A separateN=120N=120pilot is not pooled\.

The three\-seed standard deviation describes variation across the observed runs, not a confidence interval for population AUROC\. Perfect empirical rankings and zero observed variance do not imply zero uncertainty on new examples\.

The within\-model control\(rows[1](https://arxiv.org/html/2609.10739#S3.T1)and[1](https://arxiv.org/html/2609.10739#S3.T1)\) needs no cross\-arm, cross\-family or cross\-prompt matching, so none of App\.[F](https://arxiv.org/html/2609.10739#A6)’s confounds apply: same base model, task, protocol and code path\. At rival deception1\.0001\.000the ally\-fit probe reads0\.056\\mathbf\{0\.056\}; at0\.4650\.465it reads0\.815\\mathbf\{0\.815\}and never inverts\.truth/mixedis1\.0001\.000in both\.

The second arm\.\(App\.[H](https://arxiv.org/html/2609.10739#A8)\.\) Its deception rate alone invites “the same run, less far along”\. Splitting rival behaviour*by the true bit*shows instead that it emits a constant semantic answer to rivals, so its rate is≈0\.5\{\\approx\}0\.5*by arithmetic*\. That sharpens the contrast; it does not weaken it: a constant actual answer is not the complemented ground\-truth label, although the prescribed\-action label remains complemented by definition\. These arms empirically give ally\-fit AUROCs0\.8150\.815and0\.9690\.969; label algebra does not require that outcome\. The arms contrast actual output policies; they do not sample a continuum of liar reliability\. Our fixed\-symbol guard passed on both, which is why the fourth prescription below is to split the rate by the ground\-truth bit\. Row[1](https://arxiv.org/html/2609.10739#S3.T1)adds that itstoken/mixedprobe reaches0\.9750\.975at the final layer whiletruth/mixedstays at1\.0001\.000, so truth and the prescribed surface\-symbol label coexist*separably*there\.

The one\-family caveat\.Row[1](https://arxiv.org/html/2609.10739#S3.T1)’s conjunction holds in one family, across three seeds, and we do not claim otherwise\. But the others failed for a reason that is not probe\-related and was actionable: our reward table makes unconditional deception an attractor whenever the conditional solution is out of reach, and correcting it brings Qwen2\.5\-14B to deception0\.9960\.996with ally truth0\.9940\.994, reproducing the headline pattern in a 48\-layer stack \(§[7](https://arxiv.org/html/2609.10739#S7)\)\. The same corrected table on Gemma\-9B reproduces the qualitative final\-layer contrast, showing that the qualitative contrast occurs under both reward tables in these tested arms\.

truth/mixedis*not*1\.0001\.000at literally every layer: among the Table[1](https://arxiv.org/html/2609.10739#S3.T1)cells with a saved layer\-1 measurement, it ranges from0\.4450\.445to0\.8300\.830\. Early\-layer performance varies across cells\. The claim is that once it saturates it never degrades, including in the final layer, which is where the inversion literature reports\. The mixed\-fit results establish retained linear recoverability in these measured cells\. They do not establish causal use of the recovered direction; §[7](https://arxiv.org/html/2609.10739#S7)reports interventions on both directions\.111Because the bit is*stated*in the prompt, a reader will ask whether the probe decodes a retained copy of it\. That is the sharpest limit on this half of the paper and §[7](https://arxiv.org/html/2609.10739#S7)takes it up in full, with an inferred\-truth cell and a frozen\-probe transfer test\.We plot full per\-layer curves because the collapse is neither monotone in depth nor aligned across families \(App\.[A](https://arxiv.org/html/2609.10739#A1.SS0.SSS0.Px2)\)\.

Controls\.We assess three particular alternatives\.*A single output direction:*residualizing against the unembedding direction that distinguishes the two answer tokens and refitting barely moves the result, a null we report as one \(App\.[A](https://arxiv.org/html/2609.10739#A1.SS0.SSS0.Px3)\)\.*The mixed probe just reads “is this a rival context”:*answered by construction, since it is scored on rival trials only, where context is constant, so any context component is an identical offset on every score and AUROC depends only on ranking\.*A fixed surface\-symbol policy:*the behavioural guard in §[2](https://arxiv.org/html/2609.10739#S2)excludes this specific degeneracy, but does not exclude every possible shortcut\.

## 4A second failure: refitting the probe per condition

The identification problem has a close relative that bites even when one is not comparing arms\. To compare*conditions*\(prompts, checkpoints, models\), the default is to fit a probe on each condition’s own compliant data and compare the numbers\. That conflates*the representation moved*with*a different probe was fitted*\.

We separate them on a 15\-rung directive ladder over a single model with identical weights,N=1000N\{=\}1000each: one reference rung the frozen direction is fit on, and 14 variants cross\-scored against it\. Refitting per variant, rival AUROC ranges from0\.080\\mathbf\{0\.080\}to1\.000\\mathbf\{1\.000\}, inviting the representational reading\. Cross\-score one direction, fit once on a reference variant, across all 14 and the range collapses to0\.875\\mathbf\{0\.875\}–1\.000\\mathbf\{1\.000\}: no variant inverts at all \(Fig\.[2](https://arxiv.org/html/2609.10739#S4.F2); the same contrast against directive strength is Fig\.[10](https://arxiv.org/html/2609.10739#A12.F10)\)\. The apparent prompt\-driven inversion is produced by refitting\. The converse failure is just as sharp: across a*task*change a refit probe reads≈1\.000\{\\approx\}1\.000while the same direction frozen reaches only0\.8640\.864, and on the reward\-trained arm inverts to0\.2820\.282\(Fig\.[13](https://arxiv.org/html/2609.10739#A12.F13)\)\.

![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_refit_artifact.png)Figure 2:Refitting per condition manufactures the effect\.14 system\-prompt variants of one model with identical weights,N=1000N\{=\}1000each\. Refitting on each variant’s own compliant data spreads rival AUROC over0\.0800\.080–1\.0001\.000; cross\-scoring a single frozen direction across all 14 collapses the range to0\.8750\.875–1\.0001\.000, with no variant inverting\. Blue circles and red squares are the frozen and refit readouts of the same variant; each grey vertical segment joins that pair\. The outlined red square marks the largest gap:0\.0800\.080refit versus0\.9860\.986frozen, with both probes scoring1\.0001\.000on that variant’s ally validation\. The dashed horizontal line marks chance\.Across the 14 cross\-scored variants, the fixed probe’s ally\-validation accuracy ranges from0\.7920\.792to1\.0001\.000, with four values below1\.0001\.000\. In the highlighted rival comparison, however, both probes score1\.0001\.000on ally validation\. So on one variant’s activations there exist two ally\-trained probes, both perfect by the conventional in\-distribution criterion, that read rival AUROC0\.0800\.080and0\.9860\.986: same activations, same layer, same fit criterion, opposite verdicts\. That is a third independent demonstration of §[3](https://arxiv.org/html/2609.10739#S3)’s claim, with no training and no codebook, and the cheapest for others to reproduce\. Nor is the extreme pair the informative one: two variants match on rival deception to within0\.0020\.002\(0\.80290\.8029vs0\.80490\.8049\) and are*both*negation\-bearing, yet their refit AUROCs are0\.9980\.998and0\.0800\.080, so neither aggregate deception rate nor negation vocabulary explains the gap\. And that pair is not cherry\-picked\. Enumerating*every*pair of variants whose deception rates agree to within0\.050\.05gives 12 pairs whose refit AUROCs differ by a median of0\.335\\mathbf\{0\.335\}\(largest0\.9190\.919\), while the single frozen direction differs by a median of0\.025\\mathbf\{0\.025\}\(largest0\.1240\.124, over the 10 pairs where both members have a frozen score; the reference variant has none, being the variant the direction is fit on\)\. Matching prompts on behaviour does not bring the refit numbers into agreement, and the frozen number does not need it \(Fig\.[11](https://arxiv.org/html/2609.10739#A12.F11)\)\. We are careful about what this excludes: the prompts are matched on those summary variables only, and item\-level differences remain uncontrolled; the design that would close it is the one §[7](https://arxiv.org/html/2609.10739#S7)explains we cannot run at this probe site\.

Our own inversions\.These survive the same test\. Varying*only*the ally subset the probe is fit on, 50 times, all three emergent arms and the inverted instructed arm give rival AUROC0\.0000\\mathbf\{0\.0000\}with sd0\.0000\\mathbf\{0\.0000\}\. Sowithina prompt distribution, in the four cells at an extreme, the ally fit is*determined*;acrossprompt distributions it is not \(0\.0800\.080versus0\.9860\.986\), and we do not generalize the zero\-variance half beyond those four cells \(App\.[A](https://arxiv.org/html/2609.10739#A1.SS0.SSS0.Px4)\)\. The object the field calls “the truth probe” is therefore well\-defined given a model and a prompt distribution, and is not a property of the model alone\.

That prompt choice dominates probe performance is established:[Natarajan et al\. \(2026\)](https://arxiv.org/html/2609.10739#bib.bib10)attribute70\.6%\\mathbf\{70\.6\\%\}of the variance in probe AUROC to the choice of system\-prompt contrast\. Our contribution is the control that interprets the sensitivity: their decomposition is computed over∼2000\{\\sim\}2000*separately refitted*probes, so it measures how much refitting moves the number, which is not the question of whether the activations differ\. Cross\-scoring shows one decoder suffices for all 14 variants, so the refit spread is not*necessary*to explain the activations; this does not imply identical representations\. A direct geometric comparison on the same 14 variants, paired episode by episode against the reference the frozen decoder is fit on, puts the mean paired relativeL2L\_\{2\}well above a conservatively imported numerical floor, with similar shallow distances in both roles, consistent with a shared response to changed wording; from layer 16 a role\-dependent component appears on all 14 \(App\.[A\.2](https://arxiv.org/html/2609.10739#A1.SS2)\)\. So the conclusion strengthens: the activations differ substantially*and*one decoder still reads all 14 at0\.8750\.875–1\.0001\.000\. The refit spread alone does not isolate representational change from a change in the fitted decoder, even when the evaluated activations differ\.

## 5Prescription

1. 1\.Fit honesty probes on both compliant and deceptive contexts\.This is the fitting design we evaluate\. The final\-layer AUROCs in Table[1](https://arxiv.org/html/2609.10739#S3.T1)demonstrate recovery, but do not separate the added rival contexts from the larger fitting set\. This requires ground\-truth\-labelled rival examples and does not guarantee transfer to unseen deceptive tasks\. If deceptive contexts are unavailable at fit time, the probe you get is not identified and its below\-chance readings should not be interpreted representationally\.
2. 2\.Do not read a difference between separately refitted probes as representational change without a frozen\-probe control\.Refitting answers how decodable something is*within*a condition; its variation across conditions alone does not isolate representational change from decoder change\. Fit once, cross\-score the fixed direction, report both\. In our hands the difference between the two procedures is the entire effect\.
3. 3\.Design the task so the prescribed output symbol is decorrelated from the semantic action, and report the achieved correlation\. Otherwise no probe fit on compliant behaviour can be identified even in principle\.
4. 4\.Report the arm’s behavioural reliability alongside any probe metric, and use a behaviourally matched control for any claim comparing how deception was induced\. App\.[F](https://arxiv.org/html/2609.10739#A6)is what happens without one\. Split that rate by the ground\-truth label\. An aggregate rate near0\.50\.5is produced both by an intermediate conditional liar and by a constant\-answer policy; the split \(0\.000/1\.0000\.000/1\.000versus two interior values\) separates them at no cost, and no surface\-token guard will: ours passed on both degenerate arms \(§[3\.3](https://arxiv.org/html/2609.10739#S3.SS3)\)\.
5. 5\.Use template\-aware token positions, and report spread wherever the readout is not at an extreme\.

## 6Related work

The umbrella claim\.We neither own it nor contest it\. That reward\-trained deception can degrade passive probes is established\([Taufeeque et al\., 2026](https://arxiv.org/html/2609.10739#bib.bib13);[Gupta and Jenner, 2025](https://arxiv.org/html/2609.10739#bib.bib4)\), as is probe fragility as a training\-distribution artifact\([Kumar, 2026](https://arxiv.org/html/2609.10739#bib.bib6)\)and the dominance of prompt choice in probe performance\([Natarajan et al\., 2026](https://arxiv.org/html/2609.10739#bib.bib10)\)\. Sub\-chance probe AUROC has been reported independently by two groups \(0\.3760\.376and0\.3740\.374\); the spread behind the first is stated in the introduction\. Our contribution is the diagnosis, not the sighting\.

The instruction\-pair construction\.A contrastive pair of honest and deceptive*instructions*supplies labels for a probe trained to predict which instruction was present\([Goldowsky\-Dill et al\., 2025](https://arxiv.org/html/2609.10739#bib.bib3);[Natarajan et al\., 2026](https://arxiv.org/html/2609.10739#bib.bib10)\)\. This construction aliases “the instruction was deceptive” with “the model lied” at a rate that follows from behaviour alone; itsγ=1\\gamma=1limit is perfect aliasing\. Eq\.[2](https://arxiv.org/html/2609.10739#A4.E2)gives the rate from two behavioural probabilities without using activations\.

None of the four closest papers publishes both required rates, and two force the response, preventing this behavioural comparison\. Applied to our game, the protocol reads the directive at1\.000\\mathbf\{1\.000\}while carrying provably zero information about actual lying\. The closed form, literature audit, feasibility floor \(App\.[C](https://arxiv.org/html/2609.10739#A3)\) and wording dependence are in App\.[D](https://arxiv.org/html/2609.10739#A4)and App\.[J](https://arxiv.org/html/2609.10739#A10)\.

Related identification problems\.[Farquhar et al\. \(2023\)](https://arxiv.org/html/2609.10739#bib.bib2)show that consistency\-based unsupervised knowledge discovery can select features other than knowledge\.[Lu \(2026\)](https://arxiv.org/html/2609.10739#bib.bib7)examine semantic ambiguity between objective correctness and self\-judgement using conflict cases, and show that transferability alone does not establish correctness semantics\. These are close precedents for the measurement concern\. Our contribution is its controlled supervised truth/prescribed\-action instance under reward training, the complementary\-label invariant, and the mixed\-context and frozen\-probe comparisons\. We do not claim the general identification objection is new\.

External validity\.The results of[Goldowsky\-Dill et al\. \(2025\)](https://arxiv.org/html/2609.10739#bib.bib3);[Taufeeque et al\. \(2026\)](https://arxiv.org/html/2609.10739#bib.bib13);[Natarajan et al\. \(2026\)](https://arxiv.org/html/2609.10739#bib.bib10)motivate our study but use different tasks, labels and extraction sites\. Our algebra does not establish that their failures arise from the same confound, or contradict their evidence for representation drift or transfer\. App\.[E](https://arxiv.org/html/2609.10739#A5)discusses these distinctions and adjacent work\([Kirch et al\., 2026](https://arxiv.org/html/2609.10739#bib.bib5);[Adarsh et al\., 2026](https://arxiv.org/html/2609.10739#bib.bib1);[Panfilov et al\., 2025](https://arxiv.org/html/2609.10739#bib.bib12);[Nyoma, 2026](https://arxiv.org/html/2609.10739#bib.bib11);[Thormann, 2026](https://arxiv.org/html/2609.10739#bib.bib14);[Marks and Tegmark, 2024](https://arxiv.org/html/2609.10739#bib.bib9)\)\.

On probing at the answer position\.Our probe sits*at*the answer\-prediction position, which invites the objection that our inversion is output\-token leakage already known to avoid\. That is not the difficulty:truth/mixed=1\.000=1\.000on those same activations, so this site plainly carries the truth\. We decorrelate the token by construction instead of truncating, which in any case removes*truth↔\\leftrightarrowtoken*while leaving*truth↔\\leftrightarrowprescribed action*untouched, which is exactly the leg that survives\. Probing at the output\-adjacent position is also the point: it is an output\-adjacent site of interest for monitoring, although deployed monitors can use other positions and pooling schemes\.

## 7Limitations

One game, and a small one\.All results come from a single secret\-bit game with a single\-token answer\. The codebook variant adds a per\-trial mapping the policy must apply, and we verify it is not solved by a fixed character, but the answer is still one token\. Whether the same collinearity structure \(and the same fix\) appears in long\-form deception is untested, and is the obvious next experiment\.

Saturation in one family of four\.We can say why \(App\.[B](https://arxiv.org/html/2609.10739#A2)\)\. Decorrelating the prescribed output symbol from the semantic action makes the*role\-conditional*policy substantially harder to learn, and our reward table pays role\-insensitivepolicies well enough that unconditional deception becomes an attractor whenever the conditional solution is out of reach\. Three of four families never reached it\. A symmetric table rescues one of them \(Qwen2\.5\-14B to deception0\.9960\.996with ally truth0\.9940\.994\), so this limitation comes with a mechanism*and*a fix, and it is a reward\-design hazard independent of probing\.

Setups we do not re\-run\.[Taufeeque et al\. \(2026\)](https://arxiv.org/html/2609.10739#bib.bib13)’s environment is coding RLVR, and[Natarajan et al\. \(2026\)](https://arxiv.org/html/2609.10739#bib.bib10)’s probes are mean\-pooled instruction\-pair probes on token\-forced responses\. Our task supplies a counterexample to inferring information loss from a failing readout alone\. We havenotreproduced either setup, diagnosed their particular failures, or refuted their conclusions\.

The crossed design\.We did not run it\. Attributing the spread in §[4](https://arxiv.org/html/2609.10739#S4)to directive text versus resulting policy would require holding the text fixed while forcing behaviour\. Our wording\-matched attempt failed as a control, because rewording a directive changes behaviour too: text\-matched rungs came out at deception≈0\.56\{\\approx\}0\.56–0\.590\.59against the target’s0\.8050\.805, so their failure to invert is explained just as well by “less deceptive”\. The clean design is not implementable at our probe site, where activations are fully determined by the prompt; it needs a different site or a decoding intervention\.

What “the truth” means at this position\.This is the sharpest limit on the constructive half\. The secret bit is stated in the system prompt and the probe reads the final prompt position, so a direction recovering it at AUROC1\.0001\.000may be decoding a*retained copy of the input*rather than anything the policy computed, and the mixed probe is trained with truth labels on the same task distribution it is evaluated on\. Two consequences\. It weakens “the model still represents the truth” to the more literal “the true bit remains linearly recoverable at the position that produces the answer”\. This rules out loss of linear recoverability in these cells, but does not establish preserved functional belief or exclude other forms of representational change\. And a probe reading a prompt\-stated fact is not solving the problem a monitor faces, where truth must be inferred rather than copied\.

The inferred\-truth control\(App\.[I](https://arxiv.org/html/2609.10739#A9)\)\. In a variant where the bit is never a token in the prompt the mixed\-fit probe still reads1\.000\\mathbf\{1\.000\}at the final layer, and a probe frozen before it saw them transfers to two held\-out, capability\-matched templates\. The residual concern, that a linear map over activations encoding both operands could do the comparison*probe\-side*, is narrowed by the task design: the label is an exclusive\-or of two prompt facts, which is not linearly separable in those two features alone\. This excludes an additive raw\-ingredient shortcut, but does not show how richer hidden features are computed or used by the policy\.

An arm difference that dissolves under matching\.A fixed\-sign truth probe collapses to AUROC0\.000\\mathbf\{0\.000\}on the reward\-trained arm while the instructed control holds0\.9850\.985–0\.9980\.998across three seeds, seed\-robustly and causally confirmed, which reads as a mechanistic difference between deception that was*trained*and deception that was*told*\. It is not one: the instructed arm is also a worse deceiver and a worse player, and on behaviourally matched pairs the difference vanishes on five of six measures, with the sixth running the other way and making the*reward\-trained*arm the*less*inverted one away from the answer slot\. This is a null with tight bounds rather than proven equivalence, and it is the evidence behind the matched\-control prescription \(App\.[F](https://arxiv.org/html/2609.10739#A6), Fig\.[7](https://arxiv.org/html/2609.10739#A12.F7)\)\.

What does*not*explain inversion\.Neither lie rate nor per\-example confidence predicts it, and we tested both\. Along a full RL trajectory mid\-stack decodability stays pinned at0\.860\.86–1\.0001\.000at*every*observed checkpoint, including every point at which the final layer has collapsed to0\.0000\.000, which establishes retained linear information at those measured sites, without establishing its causal use or excluding other representational changes \(App\.[G](https://arxiv.org/html/2609.10739#A7)\)\.

Decodability is not causal use\.truth/mixed=1\.000=1\.000says a linear map recovers the bit, not that the model uses it\. At the tested layers and doses, the ally\-fit direction generally has a larger effect on answers than the mixed\-fit direction\. On two arms where neither rate sits on a floor, the ally\-fit direction moves the true\-bit\-11and true\-bit\-00correctness rates in opposition\. These fixed\-sign perturbations can produce that pattern even for a causally used truth\-bit feature; they do not identify the internal feature as an answer mechanism or a truth representation\. Better truth decoding need not imply a stronger behavioural lever \(App\.[K](https://arxiv.org/html/2609.10739#A11)\)\.

Scope of the transfer result\.A probe frozen before it saw the held\-out tasks recovers an inferred bit at0\.930\.93–0\.980\.98at the measured layers from 28 to 42, and the exclusive\-or construction excludes an additive shortcut over the two raw task features\. It doesnotmake the direction a deployable detector\. Freezing is not free and its cost varies eighteenfold across layers \(−0\.016\-0\.016at layer 28 against−0\.285\-0\.285at layer 20\), so a deployment would have to choose a layer on evidence we have not supplied; the arm is instructed rather than reward\-trained; its compliant accuracy is0\.740\.74–0\.790\.79, so roughly a quarter of compliant answers are incorrect, without establishing whether the bit is absent from their activations; and the scope is one model, one family, four templates of one task family whose held\-out members differ in domain and wording but require the*same*computation, so this is not a test of transfer to a different*kind*of inference\. The constructive claim therefore remains about identifiability of the measurement, now shown to survive freezing and a task shift\.

## 8Conclusion

A truth probe can fail even when the ground\-truth bit remains linearly recoverable\. In our task, truth and prescribed action coincide on compliant fitting data, so those labels cannot establish which target a fitted score measures\. The complementary\-label identityaction/ally=1−truth/ally\\texttt\{action/ally\}=1\-\\texttt\{truth/ally\}exposes that ambiguity arithmetically\. It does not measure mental intent or establish which semantic interpretation an optimizer selects\.

With randomized codebooks and mixed\-context fitting, the true bit is recoverable at empirical AUROC1\.0001\.000in the final layer of the reward\-trained headline policy, despite its false answers on every evaluated rival trial\. This recovery uses labelled rival examples and a larger fitting set\. It demonstrates retained linear information in a controlled task; independent tasks, equal\-budget controls and stronger causal identification remain future work\.

Both the fitting\-label ambiguity and the disagreement between compliant\-fit decoders can survive in\-distribution validation\. Evaluating what a probe measures therefore requires cases where the candidate targets disagree, together with controls that separate a change in the fitted decoder from a change in the evaluated activations\.

## Reproducibility statement

Code for the game, the randomized\-codebook variant, training, probe fitting, interventions and figure generation is available with a consolidated file of aggregate results\. The figures can be regenerated from those summaries without a GPU; this is distinct from independently reproducing the underlying model runs\. The repository is at[https://github\.com/dylanjayabahu/perfect\-aliasing](https://github.com/dylanjayabahu/perfect-aliasing)\.

The repository README records the SHA256 of thee3\_consolidated\.jsonresults file\. No model weights, adapters, saved probe coefficients, raw activations or complete episode\-level score files are distributed\. The run guide separates verified aggregate checks, incomplete historical command records and unexecuted prospective model recipes\. Some historical training variants share an adapter path, and frozen\-probe consumers lack complete matching producer records\. The prospective recipes make these dependencies explicit but do not reconstruct every historical cell\. Hub model revisions and most dependency versions were not pinned, so seeding alone does not guarantee exact numerical reproduction\. We report the measured settings and the limits of the archived sampling information without claiming a new model rerun\.

Compute used one H200\-class accelerator per run; wall\-clock time, peak memory and total GPU\-hours were not recorded comprehensively\. No human participants or personal datasets were used\. The paper is distributed under CC BY 4\.0; the code retains its MIT licence\.

## References

- Adarsh et al\. \[2026\]Shivam Adarsh, Maria Maistro, and Christina Lioma\.How context shapes truth: Geometric transformations of statement\-level truth representations in LLMs\.In*Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(ACL\), Main Conference*, 2026\.[arXiv:2601\.06599](https://arxiv.org/abs/2601.06599)\.
- Farquhar et al\. \[2023\]Sebastian Farquhar, Vikrant Varma, Zachary Kenton, Johannes Gasteiger, Vladimir Mikulik, and Rohin Shah\.Challenges with unsupervised LLM knowledge discovery\.*arXiv preprint[arXiv:2312\.10029](https://arxiv.org/abs/2312.10029)*, 2023\.
- Goldowsky\-Dill et al\. \[2025\]Nicholas Goldowsky\-Dill, Bilal Chughtai, Stefan Heimersheim, and Marius Hobbhahn\.Detecting strategic deception using linear probes\.*arXiv preprint[arXiv:2502\.03407](https://arxiv.org/abs/2502.03407)*, 2025\.
- Gupta and Jenner \[2025\]Rohan Gupta and Erik Jenner\.RL\-obfuscation: Can language models learn to evade latent\-space monitors?*arXiv preprint[arXiv:2506\.14261](https://arxiv.org/abs/2506.14261)*, 2025\.
- Kirch et al\. \[2026\]Nathalie Kirch, Samuel Dower, Adrians Skapars, Helen Yannakoudakis, Ekdeep Singh Lubana, and Dmitrii Krasheninnikov\.The impact of off\-policy training data on probe generalisation\.In*Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(ACL\)*, 2026\.[arXiv:2511\.17408](https://arxiv.org/abs/2511.17408)\.
- Kumar \[2026\]Sachin Kumar\.Pressure\-testing deception probes in LLMs: Scaling, robustness, and the geometry of deceptive representations\.*arXiv preprint[arXiv:2605\.27958](https://arxiv.org/abs/2605.27958)*, 2026\.GEM Workshop @ ACL 2026\.
- Lu \[2026\]Yi\-Long Lu\.Diagnosing correctness probes under self\-judgement confounding\.*arXiv preprint[arXiv:2607\.16799](https://arxiv.org/abs/2607.16799)*, 2026\.
- MacDiarmid et al\. \[2025\]Monte MacDiarmid, Benjamin Wright, Jonathan Uesato, Joe Benton, Jon Kutasov, Sara Price, Naia Bouscal, Sam Bowman, Trenton Bricken, Alex Cloud, Carson Denison, Johannes Gasteiger, Ryan Greenblatt, Jan Leike, Jack Lindsey, Vlad Mikulik, Ethan Perez, Alex Rodrigues, Drake Thomas, Albert Webson, Daniel Ziegler, and Evan Hubinger\.Natural emergent misalignment from reward hacking in production RL\.*arXiv preprint[arXiv:2511\.18397](https://arxiv.org/abs/2511.18397)*, 2025\.
- Marks and Tegmark \[2024\]Samuel Marks and Max Tegmark\.The geometry of truth: Emergent linear structure in large language model representations of true/false datasets\.In*Conference on Language Modeling \(COLM\)*, 2024\.[arXiv:2310\.06824](https://arxiv.org/abs/2310.06824)\.
- Natarajan et al\. \[2026\]Vikram Natarajan, Devina Jain, Shivam Arora, Satvik Golechha, and Joseph Bloom\.One probe won’t catch them all: Towards targeted deception detection\.In*Proceedings of the 43rd International Conference on Machine Learning \(ICML\)*, volume 306 of*PMLR*, 2026\.[arXiv:2602\.01425](https://arxiv.org/abs/2602.01425)\.
- Nyoma \[2026\]Petr Nyoma\.Rift: A conflict signature for deception in language models\.*arXiv preprint[arXiv:2606\.17229](https://arxiv.org/abs/2606.17229)*, 2026\.
- Panfilov et al\. \[2025\]Alexander Panfilov, Evgenii Kortukov, Kristina Nikolić, Matthias Bethge, Sebastian Lapuschkin, Wojciech Samek, Ameya Prabhu, Maksym Andriushchenko, and Jonas Geiping\.Strategic dishonesty can undermine AI safety evaluations of frontier LLMs\.*arXiv preprint[arXiv:2509\.18058](https://arxiv.org/abs/2509.18058)*, 2025\.
- Taufeeque et al\. \[2026\]Mohammad Taufeeque, Stefan Heimersheim, Adam Gleave, and Chris Cundy\.The obfuscation atlas: Mapping where honesty emerges in RLVR with deception probes\.In*Proceedings of the 43rd International Conference on Machine Learning \(ICML\)*, 2026\.Oral presentation\.[arXiv:2602\.15515](https://arxiv.org/abs/2602.15515)\.
- Thormann \[2026\]Tom\-Felix Thormann\.Probing the limits of the lie detector approach to LLM deception\.*arXiv preprint[arXiv:2603\.10003](https://arxiv.org/abs/2603.10003)*, 2026\.

## Appendix ASupporting detail

#### Template\-aware positions\.

Raw negative token offsets are not comparable across chat templates: Llama’s assistant header is several tokens \(<\|start\_header\_id\|\>assistant<\|end\_header\_id\|\>\) where Gemma’s is short \(<start\_of\_turn\>model\), so “position−3\-3” lands in a different*kind*of token in different families\. Cross\-family position claims require template\-aware anchoring\. It is a second way to silently manufacture or hide a cross\-family effect\.

#### Depth profiles\.

The ally\-fit collapse is not monotone in depth: in the Llama\-8B codebook cell the probe is*deepest*inverted at L24 \(0\.0030\.003\) and partially recovers by L32 \(0\.0560\.056\)\. The layer at which collapse begins also differs by family\. Both are reasons to plot full per\-layer curves \(Fig\.[1](https://arxiv.org/html/2609.10739#S3.F1)\) and not a single chosen layer\.

#### The residualization null\.

Projecting out the unembedding direction that distinguishes the two answer tokens and refitting moves the result by almost nothing: Gemma\-9B emergent0\.000→0\.0000\.000\\to 0\.000, Llama\-8B instructed0\.998→0\.9970\.998\\to 0\.997\. Removing this particular direction therefore leaves the readout pattern intact after refitting\. This does not identify the semantic or causal role of the remaining features, and does not resolve the fitting\-label ambiguity\.

#### Resampling stability of the ally fit\.

Holding model, prompt and activations fixed and varying only the ally subset the probe is fit on, 50 times: all three emergent arms and the inverted instructed arm give rival AUROC0\.00000\.0000with sd0\.00000\.0000, and the fitted direction is essentially identical each time \(cosine0\.980\.98–1\.001\.00\)\. The 8B instructed arm gives0\.9866±0\.01550\.9866\\pm 0\.0155\. We do not generalize zero variance past those four extreme cells: resampling spread at intermediate readouts is real \(0\.01550\.0155in one instructed arm,0\.06990\.0699in another\)\.

#### The out\-of\-distribution transfer\.

Evaluated on an unseen game structure, the same adapter loses its inversion \(0\.000→0\.5500\.000\\to 0\.550\) as its own deception falls \(1\.000→0\.5591\.000\\to 0\.559\); the capability floor on that task is0\.9000\.900, so this is not a retrieval artifact\. Complication: the out\-of\-distribution points do*not*lie on the in\-distribution curve \(instructed there reaches deception0\.629→0\.629\\toAUROC0\.1390\.139, where in\-distribution0\.735→0\.9980\.735\\to 0\.998\), and probe quality is itself degraded \(ally in\-distribution0\.945/0\.9590\.945/0\.959versus1\.0001\.000\)\. The readout is therefore not a pure function of deception rate across tasks\.

#### The inferred\-truth capability floor\.

Base models asked for the outcome of a stated comparison answer reliably under the plain rule and much less reliably under an inverted one: Qwen2\.5\-14B0\.9790\.979\(“greater”\) vs0\.7720\.772\(“lesser”\), Gemma\-2\-9B0\.8300\.830vs0\.7370\.737, Llama\-3\.1\-8B0\.7660\.766vs0\.5970\.597\. The ordering follows capability, and the failure is rule application rather than the comparison itself: Qwen\-14B computes the comparison essentially perfectly\. We kept both orientations, because dropping the harder one would let the bit be read off operand magnitude alone and defeat the purpose of the task\.

### A\.1Cell provenance and scoring denominators

Table[2](https://arxiv.org/html/2609.10739#A1.T2)identifies each run behind Table[1](https://arxiv.org/html/2609.10739#S3.T1)\. All rows collectedN=1000N=1000episodes, with random role assignment and a 70/30 split stratified by role \(split seed 42\)\. Mixed fitting uses 700 rows; ally fitting uses approximately 350, and rival evaluation approximately 150\. Exact role\-specific test counts and class counts were not retained in the consolidated record, so these approximations must not be read as exact denominators\. Behavioural rates use all collected episodes of the relevant role\.

Table 2:Result keys for the headline comparison\. Row 1 comprises three training seeds\.The two Llama\-8B inferred\-truth exceptions areinfid\_8b\_inandid4\_infcb\_8b\_in; their final\-layer mixed\-fit AUROCs are0\.87160\.8716,0\.95830\.9583, respectively\. They are separate evaluations, not independent estimates of a cross\-task success probability\.

### A\.2The direct geometric comparison

This is the measurement §[4](https://arxiv.org/html/2609.10739#S4)reports\. It asks whether the residual stream at the read position actually differs across directive wordings, and not whether a refitted probe’s number moves\.

Design\.Llama\-3\.1\-8B instructed, one read position, the single\-bit task,n=400n\{=\}400episodes per rung, over the same 15\-rung directive ladder as §[4](https://arxiv.org/html/2609.10739#S4)with the same reference variant \(default\) that the frozen decoder is fit on\. The episode stream is paired: the sampler is re\-seeded to the same value for every rung, so trialiiis the same game, values, role and query throughout and the only thing differing between two prompts is the directive text\. We verified it: under the same seed200/200200/200episodes match on game, values, target, truth, role and query, and the check has power, since a*different*seed changes170/200170/200\. All1515rung texts are distinct: two rungs sharing a string would produce a trivially zero comparison that reads exactly like a null\. Every layer comes from one forward pass\.

Three reference scales, fixed before the run\.\(i\) A numerical floor: the reference rung collected a second time at a different batch size, so the activations are mathematically identical and differ only bybf16reduction order\. \(ii\) A within\-rung split\-half at the samenn, the floor imposed byn≪dn\\ll d\. \(iii\) The between\-rung quantities\. We report against an imported floor rather than our own, for the reason given below\.

Table 3:Geometric difference from the reference variant across depth, both role arms \(Fig\.[3](https://arxiv.org/html/2609.10739#A1.F3)\)\. The excess is a*paired within\-rung*comparison over 14 variants, not a correlation\.What the two arms establish\(Tab\.[3](https://arxiv.org/html/2609.10739#A1.T3)\)\. Shallow, the arms are indistinguishable and the excess is a clean null,\+0\.0001\+0\.0001at layer 4 with only 5 of 14 variants positive \(p=0\.42p=0\.42\)\. On ally trials the rival clause is present in the text; the similar shallow distances are consistent with a shared response to the wording change\. They do not isolate its causal source\. From layer 16 the rival arm carries an excess on all 14 variants \(sign testp=1\.2×10−4p=1\.2\\times 10^\{\-4\}\), and it survives deleting the most extreme variant \(mean excess\+0\.098\+0\.098at layer 32 excludinghint\), so a role\-dependent component appears mid\-stack\. The difference is also largely a rigid translation shallow and trial\-specific deep: the ratio of the paired distance to the distance between the two rungs’*means*rises from1\.061\.06at layer 4 to1\.241\.24at layer 32\. Centred kernel alignment tells the same story against its own row\-aligned floor of1\.0001\.000: it sits at0\.9830\.983–0\.9990\.999through layer 8 and falls to0\.5680\.568–0\.9690\.969by layer 28, so the deep difference is not a rescaling of an otherwise\-shared geometry\.

Character\-length controls\.Directive length spans159159to392392characters \(2\.47×2\.47\\times\), so wording changes can also change token count and absolute read position\. We therefore describe activations at the read position under different prompts, without attributing the differences uniquely to content or length\. Pairs were selected on character length before geometry was computed\. Forhint/p\_withhold, both 178 characters, the gap between their mean relative distances from thedefaultreference is0\.0030\.003at layer 4 and0\.3160\.316at layer 32\. These are differences of distances from a common reference, not directly measured distances between the pair\. A small gap does not imply similar representations\.

The pair’s rival deception rates are0\.0290\.029and0\.862\\mathbf\{0\.862\}; refit AUROCs are1\.0001\.000and0\.471\\mathbf\{0\.471\}, while the frozen direction reads1\.0001\.000and0\.989\\mathbf\{0\.989\}\. The corresponding reference\-distance gaps forp\_neg\_emph/p\_map\_firm\(Δ​2\\Delta 2characters\) are0\.038→0\.3470\.038\\to 0\.347, and formax\_filler/max\_nonneg\(Δ​3\\Delta 3characters\),0\.101→0\.2050\.101\\to 0\.205\. Character\-count matching does not establish token\-count matching\. These comparisons show differing distances from the reference at similar character lengths; they do not causally separate length, wording and policy effects\.

Three limits: an anomalous floor, a correlation resting on one point, and a reference that does not apply\.First, our own numerical floor is anomalous and we do not quote it: it came out at0\.00000\.0000paired relativeL2L\_\{2\}\(CKA0\.99999990\.9999999\) at every layer, whereas the same batch\-size comparison measured1\.211×10−21\.211\\times 10^\{\-2\}on Gemma\-2\-9B, a≥240×\\geq 240\\timesdiscrepancy that we have not explained; the second pass did run at the smaller batch and the model isbf16\. Every number above is therefore stated against the*imported*Gemma floor, and against it the weakest rung \(softat layer 4,0\.0270\.027\) is approximately2\.2×2\.2\\timesfloor and isnotcomfortably resolved\. Second, we make no claim that the deep excess tracks behavioural magnitude: that correlation is\+0\.733\+0\.733over 14 rungs but rests on a single point, falling to\+0\.185\+0\.185\(95% CI\[−0\.41,\+0\.67\]\[\-0\.41,\+0\.67\]\) whenhintis removed\. The across\-rung correlation between the arms behaves the same way and is reported for completeness only: it falls from1\.0001\.000shallow to0\.6960\.696at layer 32, but excludinghintthat becomes0\.8380\.838, and Spearman gives0\.8020\.802\. Third, the within\-rung split\-half is not a valid reference for the alignment\-dependent statistics: CKA and the paired distance compare geometry over a common set of inputs and so need row\-aligned matrices, whereas the two halves are different episodes\.

Scope\.One model, one arm, one read position, one task,n=400n\{=\}400per rung\. This bounds §[4](https://arxiv.org/html/2609.10739#S4)’s claim; it says nothing about representational identity in general\.

![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_geom.png)Figure 3:Distances from the reference diverge between roles at depth\.Left: mean paired relativeL2L\_\{2\}from the reference variant across depth, rival arm \(solid\) against ally arm \(dashed\), with the imported numerical floor\. The arms coincide through layer 12 and separate from layer 16\. Centre: the per\-variant excess \(rival−\-ally\); every one of the 14 variants is positive from layer 16 on, and the shallow layers are a clean null \(5 of 14 positive at layer 4\)\. Right: the length\-matched pairhintversusp\_withhold, both 178 characters\. Their mean relative distances from the reference differ by0\.0030\.003at layer 4 and0\.3160\.316at layer 32\. These are reference\-distance gaps, not pairwise distances; matching character counts does not control token counts or isolate a length effect\. Llama\-3\.1\-8B instructed,n=400n\{=\}400paired episodes per variant\.
### A\.3Assets and licenses

All experiments use publicly released base\-model weights, whose licenses are not uniform, so we name each\. Mistral\-7B\-v0\.3 and Qwen2\.5\-\{7,14,32\}B are released under the Apache License 2\.0\. Llama\-3\.1\-8B is released under the Llama 3\.1 Community License Agreement \(© Meta Platforms, Inc\.\), whose acceptable\-use policy is incorporated by reference\. Gemma\-2\-9B is released under the Gemma Terms of Use with its Prohibited Use Policy: the Gemma*code*is Apache\-2\.0, but the weights are not\. Qwen2\.5\-3B uses the Qwen Research License for non\-commercial use\. We use these models for non\-commercial research\. Supporting software:transformers\(Apache\-2\.0\),PyTorch,scikit\-learnandnumpy\(BSD\-3\-Clause\), andmatplotlib\(PSF\-based license\)\.

This release contains code and aggregate results, with no model weights or adapters\. Upstream terms remain specific to each base model: redistribution or provision of Llama\-derived models is governed by the Llama 3\.1 terms, including applicable naming, attribution and acceptable\-use requirements; Gemma\-derived models are governed by the Gemma terms and applicable notices and use restrictions\. Users distributing or providing access to derived models must check the terms for their chosen base model\. Obligations for one family should not be applied indiscriminately to adapters from another\.

## Appendix BThe reward basin and its correction

This is the material §[7](https://arxiv.org/html/2609.10739#S7)summarises\.

Saturation on the wholly unmodified recipe: one family of four attempted\.Decorrelating the prescribed output symbol from the semantic action makes the*role\-conditional*policy substantially harder to learn, and our reward table gives role\-insensitive policies well\-separated payoffs: at a 50/50 role mix, always\-truthful earns−0\.50\-0\.50, always\-deceptive earns\+0\.25\\mathbf\{\+0\.25\}, and only the conditional policy earns\+1\.25\+1\.25\. Three of four families never reached the conditional solution, and the three failed in*different*ways\. Qwen\-14B held ally truth1\.0001\.000with rival deception≈0\{\\approx\}0and reward pinned at exactly−0\.50\-0\.50for 340 epochs, then fell into the always\-deceptive basin: rival deception1\.0001\.000purchased by destroying the compliant branch \(ally truth0\.0000\.000–0\.5000\.500\), so it is not a conditional deceiver and we did not probe it\. Llama\-8B and Mistral\-7B landed somewhere we did not anticipate and initially mis\-described: they keep a perfect compliant branch \(1\.0001\.000\) but emit a single constant answer to rivals, which scores≈0\.5\{\\approx\}0\.5deception purely because the secret bit is balanced \(§[3\.3](https://arxiv.org/html/2609.10739#S3.SS3)\)\. That is a third basin, not the always\-truthful one\.

Correcting the payoff asymmetry\.Replacing the table with a symmetric one \(\+1\+1for the role\-appropriate answer,−2\-2otherwise, regardless of role, so always\-deceptive earns−0\.50\-0\.50and is no longer positively rewarded\) brings Qwen2\.5\-14B to deception0\.9960\.996with ally truth0\.9940\.994, a conditional policy on both branches, with the identification result unchanged \(§[3\.3](https://arxiv.org/html/2609.10739#S3.SS3)\)\. This has three practical consequences\. First, an asymmetric adversarial payoff makes unconditional deception*positively*rewarded and therefore an attractor whenever the conditional solution is out of reach, a reward\-design hazard worth flagging independently of probing\. Second, anyone replicating our headline cell should expect the training half to be the hard part, and should verifybothbranches before probing: an arm at rival deception1\.0001\.000with a broken compliant branch looks saturated on the headline metric while violating the premise that makes an ally\-fit probe meaningful at all\. Third, and symmetrically, an arm near deception0\.50\.5may not be a partial deceiver at all: check the rate against the ground\-truth bit before calling it one\.

## Appendix CThe design rule and its feasibility floor

The instruction\-pair protocol carries a feasibility floor as well as an aliasing rate \(App\.[D](https://arxiv.org/html/2609.10739#A4)\)\. The identifying signal lives entirely in the minority side of whichever split is intended, so writeppfor the fraction of adversarial trials that side consumes\. With a minimum viable subset sizenminn\_\{\\min\}andNadvN\_\{\\mathrm\{adv\}\}adversarial evaluation trials, the split needsmin⁡\(p,1−p\)⋅Nadv≥nmin\\min\(p,1\-p\)\\cdot N\_\{\\mathrm\{adv\}\}\\geq n\_\{\\min\}, so for the usual regimep\>0\.5p\>0\.5,

Nadv≥nmin/\(1−p\)\.N\_\{\\mathrm\{adv\}\}\\;\\geq\\;n\_\{\\min\}/\(1\-p\)\.\(1\)Which rate plays the role ofppis fixed by the split, and mistaking one for the other is the easiest way to misapply the rule\. For an*agreement*split over both matched rungs,p=γp=\\gamma: atnmin=25n\_\{\\min\}=25the floor is 100 trials atγ=0\.75\\gamma=0\.75, 500 at0\.950\.95, 2500 at0\.990\.99, and unattainable at anyNNwhenγ=1\\gamma=1\. For a*compliance*split, which can use only the disobedient trials of the deceptive rung,p=ddeceptivep=d\_\{\\mathrm\{deceptive\}\}, and the pooledγ\\gammais the wrong quantity because it also counts honest\-rung disagreements the split cannot touch\. App\.[J](https://arxiv.org/html/2609.10739#A10)reports a family whereγ=0\.985\\gamma=0\.985whileddeceptive=1\.000d\_\{\\mathrm\{deceptive\}\}=1\.000, so the floor is finite inγ\\gammaand unattainable in the rate that actually governs\. This is a screen, not a power calculation: the realized disagreement count is random, and clearing the floor guarantees neither class balance within the subset nor power for an AUROC contrast\. Its value showed up early \(a compliance split with no minimum size produced a striking number computed on∼8\{\\sim\}8trials\), and it correctly predicted that our ownN=300N\{=\}300split was infeasible\. One refinement that matters: the governing rate must be measured on the*same subset*you intend to split, not pooled\. Our pooledγ\\gammaunder\-predicted the disobedient count in the held\-out cell by47%47\\%, because the held\-out wordings drew more disobedience than average\.

## Appendix DThe instruction\-pair protocol

Table 4:The aliasing rate under the instruction\-pair protocol, measured on our task\.γ\\gammaisP⁡\(cdir=clie\)P\(c\_\{\\mathrm\{dir\}\}=c\_\{\\mathrm\{lie\}\}\)on adversarial trials;11means the two candidate targets are one label vector and no in\-distribution check can prefer either\.*Lying rates are shown to the precision that reproduces theγ\\gammacolumn; the top rows are rounded to three decimals, so recomputing Eq\.[2](https://arxiv.org/html/2609.10739#A4.E2)from those digits can differ from the reportedγ\\gammain the fourth decimal\. The agreement asserted in code is between the measuredγ\\gammaand the closed form on unrounded rates, to within10−910^\{\-9\}\.*### D\.1The aliasing rate, in closed form

The two candidate targets arecdirc\_\{\\mathrm\{dir\}\}\(“the deceptive instruction is present”\) andcliec\_\{\\mathrm\{lie\}\}\(“the model is lying”\)\. Unlike our ally case these are not identical in general, so the relevant object is the rate at which they agree\. In a matched two\-rung design, where every episode is rendered once under each instruction so the halves are exactly equal, restricted to the adversarial subset where the deceptive instruction actually requests a lie:

γ⁡\(cdir,clie\)=12​\[\(1−dhonest\)\+ddeceptive\],\\gamma\(c\_\{\\mathrm\{dir\}\},c\_\{\\mathrm\{lie\}\}\)\\;=\\;\\tfrac\{1\}\{2\}\\bigl\[\\,\(1\-d\_\{\\mathrm\{honest\}\}\)\\;\+\\;d\_\{\\mathrm\{deceptive\}\}\\,\\bigr\],\(2\)wheredrd\_\{r\}is the model’s lying rate under rungrron that subset\. The proof is one line: under the honest rung the labels agree exactly when the model does not lie, rate1−dhonest1\-d\_\{\\mathrm\{honest\}\}; under the deceptive rung they agree exactly when it does, rateddeceptived\_\{\\mathrm\{deceptive\}\}; the matched design weights the halves equally\.222Three conditions, all met here and none automatic: the emitted answer is binary \(no abstain state\), the restriction is to adversarial trials only, and there are exactly two rungs\. With unequal halves the general form isγ=wh​\(1−dhonest\)\+wd​ddeceptive\\gamma=w\_\{h\}\(1\-d\_\{\\mathrm\{honest\}\}\)\+w\_\{d\}\\,d\_\{\\mathrm\{deceptive\}\}\.

What Eq\.[2](https://arxiv.org/html/2609.10739#A4.E2)needs\.No probe and no activations\. Two behavioural rates, both of which a paper could report, determine how much of the probe’s target is the instruction rather than the lie\. We release the audit as a standalone module\. Across seven rungs spanning three families our measuredγ\\gammamatches Eq\.[2](https://arxiv.org/html/2609.10739#A4.E2)to floating\-point tolerance, and the code asserts the agreement instead of reporting it, because a mismatch would be a bug in one of the two computations and never noise\. Run faithfully on two families, the construction reads the directive at≈1\.000\{\\approx\}1\.000while truth stays at chance, and the identification split is unavailable*by construction*\(Fig\.[4](https://arxiv.org/html/2609.10739#A4.F4)\)\.

![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_instrpair.png)Figure 4:The field’s instruction\-pair protocol, run faithfully, beside the forced identity\.Left and centre: under the standard construction the probe reads the*directive*at≈1\.000\{\\approx\}1\.000at every depth in both families, while*truth*sits at chance, and the identification split that would tell the two apart is unavailable*by construction*, becauseis\_lyinghas only one class\. Right: with probes fitted on ally data, the rival action and truth AUROCs lie exactly ona​c​t​i​o​n=1−t​r​u​t​haction=1\-truthacross all 751 \(cell, layer\) pairs across 39 distinct full\-curve records, maximum deviation2\.2×10−162\.2\\times 10^\{\-16\}, an algebraic consequence of the labels coinciding, not an empirical finding\.
### D\.2Applied to published protocols

Table[4](https://arxiv.org/html/2609.10739#A4.T4)gives the rates\.γ=1\.000\\gamma=1\.000is not a discovery about a probe; it is the statement “this model obeys both instructions”, and it would hold in a setup containing no probes at all\. It is also the point at which this appendix and §[3](https://arxiv.org/html/2609.10739#S3)coincide: the perfect aliasing that makes the conventional probe unidentified is this rate’sγ=1\\gamma=1limit, so the two are one argument evaluated at two rates rather than two findings that happen to agree\. The protocol is informative only strictly between the endpoints, and only if the rates are published\.

Two of the four closest protocols, in their own words\.These make the identification question unaskable by construction, and the two candidate readings of what their probe targets land at*opposite*extremes\. Both force the response instead of sampling it:[Goldowsky\-Dill et al\. \[2025\]](https://arxiv.org/html/2609.10739#bib.bib3)insert “a random true fact…as the model’s response”, noting these “are not written by the model and contain no actual deception”, and[Natarajan et al\. \[2026\]](https://arxiv.org/html/2609.10739#bib.bib10)state the response is “token\-forced \(off\-policy\)” with a classifier “trained to predict whether the honest or dishonest prompt was used”\.

Under the*intent*reading, where the target is “this prompt asked for a lie”, forcing makes that label*definitionally identical*to the instruction, soγintent=1\\gamma\_\{\\mathrm\{intent\}\}=1trivially and no in\-distribution check can distinguish the two\. Under the*content*reading, where the target is “what was said is false”,[Natarajan et al\. \[2026\]](https://arxiv.org/html/2609.10739#bib.bib10)admits an exact result, because the*same*factual statement appears in both arms: response falsity is held fixed across the pair, sodhonest=ddeceptive=fd\_\{\\mathrm\{honest\}\}=d\_\{\\mathrm\{deceptive\}\}=fandγcontent=12​\[\(1−f\)\+f\]=0\.500\\gamma\_\{\\mathrm\{content\}\}=\\tfrac\{1\}\{2\}\[\(1\-f\)\+f\]=0\.500*exactly, for everyff*: the instruction label is orthogonal to content falsity by design, as they say it is\. Both endpoints are useless: atγ=1\\gamma=1the instruction label*is*the lying label; atγ=0\.5\\gamma=0\.5it is unrelated to what was said\. Neither leaves a target that is partly about lying\. The two are easy to conflate: forcing does not make content falsity identical to the instruction, and quoting a bare “γ=1\\gamma=1” for these protocols would assert exactly that\.

The two rates, as published\.Not one of the four publishes them\. Two make the question moot by construction; one does not use the protocol; and the one design that could have reported them class\-balances and discards them\.

Two of the cited studies describe related ambiguities:[Goldowsky\-Dill et al\. \[2025\]](https://arxiv.org/html/2609.10739#bib.bib3)that the probe “partially depends on ‘is the scenario deception related’ …instead of only on ‘is the response itself actually deceptive’ ”;[Natarajan et al\. \[2026\]](https://arxiv.org/html/2609.10739#bib.bib10)that “the fundamental direction being distinguished may not be directly related to strategic deception”\. Our delta is not the observation\. It is the closed form, the diagnostic, and the design that breaks the aliasing\.

### D\.3Running the field’s construction on our task

We implement the protocol on our own game, including a faithful variant that closes all three deviations we would otherwise have to disclose: response\-token mean\-pooling excluding the last five tokens, token\-forced responses, and a bank of five matched instruction wordings\. We do not claim to reproduce any published result: we use none of their models, datasets, instruction banks or evaluation sets\. The claim is about what the*protocol*inherits\.

The identification test under the faithful construction\.It is unavailable at everyNN, on both families we ran\. Because the inserted response names no value, it misstates nothing:cliec\_\{\\mathrm\{lie\}\}is the constant zero, so there is no lying anywhere in the sample for the instruction to be aliased*with*, thecliec\_\{\\mathrm\{lie\}\}AUROC is undefined, and no sample size, model or arm makes the split available\. Meanwhile the probe readscdirc\_\{\\mathrm\{dir\}\}at1\.000\\mathbf\{1\.000\}\. The protocol reports success by its own criterion while carrying provably zero information about actual lying\. We flag one trap for anyone repeating this: the measuredγ\\gammais exactly0\.5000\.500here, and0\.5000\.500elsewhere in this paper means “decorrelated, probe identified”\. Under forcing it means the opposite kind of thing: it is simply what a constant scores, since half the adversarial rows carrycdir=0c\_\{\\mathrm\{dir\}\}=0and match a constant zero for free\. It must never be quoted without the number ofcliec\_\{\\mathrm\{lie\}\}classes beside it\.

Aliasing, high but wording\-dependent\.With one canonical instruction pair and an obedient arm,γ=1\.000\\gamma=1\.000\. Averaged over five matched wordings on the same model and task it is0\.865\\mathbf\{0\.865\}\(0\.878\\mathbf\{0\.878\}atN=1000N\{=\}1000\): the two candidate label vectors are∼87%\{\\sim\}87\\%identical, not100%100\\%, so no single number should be quoted\. Here Eq\.[2](https://arxiv.org/html/2609.10739#A4.E2)predicts a non\-trivial value exactly\.

## Appendix ERelated work, case by case

This is the material §[6](https://arxiv.org/html/2609.10739#S6)summarises\.

The umbrella claim, which we do not contest\.That reward\-trained deception can degrade passive probes is established\[[Taufeeque et al\., 2026](https://arxiv.org/html/2609.10739#bib.bib13),[Gupta and Jenner, 2025](https://arxiv.org/html/2609.10739#bib.bib4)\], as is probe fragility as a training\-distribution artifact\[[Kumar, 2026](https://arxiv.org/html/2609.10739#bib.bib6)\]and the dominance of prompt choice in probe performance\[[Natarajan et al\., 2026](https://arxiv.org/html/2609.10739#bib.bib10)\]\. Sub\-chance probe AUROC has been reported independently by two groups \(0\.3760\.376and0\.3740\.374\); the spread behind the first is stated in the introduction\. Our contribution is the diagnosis, not the sighting\.

Different protocols answer different questions\.[Goldowsky\-Dill et al\. \[2025\]](https://arxiv.org/html/2609.10739#bib.bib3)report successful transfer of instruction\-pair deception probes\.[Taufeeque et al\. \[2026\]](https://arxiv.org/html/2609.10739#bib.bib13)report off\-domain degradation after RLVR and evidence relevant to representation drift\.[Natarajan et al\. \[2026\]](https://arxiv.org/html/2609.10739#bib.bib10)report both below\-chance performance and large sensitivity to the prompt contrast used for fitting\. None is a replication of our binary reporting game\. In particular, our truth/prescribed\-action equality must not be assumed for their labels or datasets\. The appropriate comparison is methodological: define the competing targets, inspect the fitting support, and separate changes in fitting from changes in evaluation\. Our experiments do not show that any one of these external results is caused by perfect aliasing\.

On probing at the answer position\.[Natarajan et al\. \[2026\]](https://arxiv.org/html/2609.10739#bib.bib10)deliberately exclude the last few response tokens when pooling activations, to stop the probe reading truth off the output\. Our probe sits*at*the answer\-prediction position, which invites the objection that our inversion is output\-token leakage the field already knows to avoid\. Three responses\. \(i\)truth/mixed=1\.000=1\.000on those same activations at that same position, so the position plainly carries the truth\. \(ii\) We decorrelate the token by construction rather than by truncation, and fittokenas its own label set: the fitted truth and token directions are near\-orthogonal in every cell \(cos=\+0\.003\\cos=\+0\.003to−0\.046\-0\.046; §[2](https://arxiv.org/html/2609.10739#S2)\)\. \(iii\) Dropping those tokens removes*truth↔\\leftrightarrowtoken*while leaving*truth↔\\leftrightarrowprescribed action*untouched, and the prescribed\-action label is defined independently of output position, so it is exactly the leg that survives\. Probing at the output\-adjacent position is also the point: it is one output\-adjacent measurement site; other studies use different positions and pooling schemes\.

Adjacent and converging\.[Adarsh et al\. \[2026\]](https://arxiv.org/html/2609.10739#bib.bib1)characterize context as applying a rotation\-plus\-scaling to the truth direction rather than destroying it, a geometric statement of why a probe fit under the wrong context distribution fails while the information remains present\.[Panfilov et al\. \[2025\]](https://arxiv.org/html/2609.10739#bib.bib12)flag instructed, off\-policy probe evaluation as the untested case;[Nyoma \[2026\]](https://arxiv.org/html/2609.10739#bib.bib11)and[Thormann \[2026\]](https://arxiv.org/html/2609.10739#bib.bib14)document adjacent failure modes; and[Marks and Tegmark \[2024\]](https://arxiv.org/html/2609.10739#bib.bib9)established the linear truth\-direction structure these methods rest on\.

## Appendix FThe apparent finding, and the control that dissolves it

This is the matched\-control result §[7](https://arxiv.org/html/2609.10739#S7)summarises\.

On the Llama\-3\.1\-8B anchor, a fixed\-sign truth probe at the answer\-prediction position collapses to AUROC0\.000\\mathbf\{0\.000\}on the reward\-trained arm while the instructed control holds at0\.9850\.985–0\.9980\.998across three seeds\. The effect was seed\-robust, localized to that position \(intact at−3\-3, inverted at−1\-1\), and*causally*confirmed: patching the ally\-context residual into a rival\-context forward pass at mid\-stack flipped the trained liar’s answer on0\.990\.99–1\.001\.00of trials versus0\.5750\.575–0\.610\.61for the instructed arm\. Read at face value this is a mechanistic difference between deception that was*trained*and deception that was*told*, on exactly the axis safety cares about\.

It is not\.The instructed arm lies on only0\.7350\.735of rival trials and answers correctly on just0\.9020\.902of*ally*trials: a worse deceiver and a worse player\. Build behaviourally matched pairs \(both arms at ally truth1\.0001\.000and rival deception1\.0001\.000, available in Gemma\-2\-9B and Qwen2\.5\-14B\) and the difference vanishes on five of six measures: the answer\-position readout \(both0\.000\\mathbf\{0\.000\}, an exact tie in all 8 matched cells\); patch magnitude \(1\.000/0\.9551\.000/0\.955and0\.960/0\.9600\.960/0\.960\); patch transition depth and shape \(same window, same sharpness\); ablation of the truth direction \(1\.000/1\.0001\.000/1\.000, null in both\); and a steeringα\\alpha\-sweep at5/10/20/405/10/20/40\(0\.000/0\.0000\.000/0\.000, null in both\)\. The sixth does not vanish, and it runs against the hypothesis\. On the off\-position \(−3\-3\) readout the matched difference is consistently*positive*\(8 of 8 cells, mean\+0\.12\+0\.12, 95% CI\[\+0\.055,\+0\.190\]\[\+0\.055,\+0\.190\]\), meaning the*reward\-trained*arm is the*less*inverted one away from the answer slot, the opposite sign to an account in which training hides the truth\. Its absolute level is also wildly family\-dependent \(both arms sit near0\.000\.00in Gemma\-9B and near0\.900\.90in Qwen\-14B/32B\), so it is not a stable quantity to compare across families in the first place\.

The unmatched instructed arm’s roughly\-chance patch response and non\-saturating ramp \(asymptoting at≈0\.72\{\\approx\}0\.72\) are confounded with its lower behavioural reliability rather than evidence of a distributed representation; we did not measure an intervention\-specific ceiling, so we rest the argument on the matched arms, which simply do not reproduce the difference\. And at the one layer where the matched Gemma arms differ at all the*instructed*arm is ahead \(0\.3550\.355vs0\.1000\.100at L25\), the opposite sign to the hypothesis\. Across a 7\-family×\\times2\-arm×\\times3\-seed grid atN=1000N\{=\}1000, all 21 emergent grid cells are identical to four decimals \(deception1\.0001\.000, AUROC0\.0000\.000, cross\-seed sd𝟎\\mathbf\{0\}\), and instructed arms invert too, sometimes*more*\(Gemma\-9B instructed0\.0150\.015versus its emergent counterpart0\.1650\.165\)\. We state this as a null with tight bounds, not proven equivalence \(Fig\.[7](https://arxiv.org/html/2609.10739#A12.F7)\)\. So what*does*predict inversion? We tried lie rate, then per\-example confidence, and refuted both \(App\.[G](https://arxiv.org/html/2609.10739#A7)\)\. The readout depends jointly on the model, prompt distribution and fitted decoder; these comparisons do not isolate a property of the model’s representation alone\.

## Appendix GThe honest negatives

These are the honest negatives §[7](https://arxiv.org/html/2609.10739#S7)summarises\.

We were wrong twice, and the negatives constrain §[3](https://arxiv.org/html/2609.10739#S3)\.

Neither lie rate nor per\-example confidence: our own successive hypotheses \(Fig\.[8](https://arxiv.org/html/2609.10739#A12.F8)\)\. Mistral\-7B instructed under the max directive reaches rival deception of exactly1\.0001\.000and doesnotinvert \(AUROC0\.9700\.970\), while other arms at1\.0001\.000sit at0\.0000\.000; a rate\-based account predicts the opposite\. Mistral also has*lower*rival entropy \(0\.2520\.252\) than the Llama\-8B variant that does invert \(0\.2830\.283\), so it is the more deterministic of the two and the one that stays at0\.9700\.970\. Within a single model the ordering fails too: entropy falls monotonically across a directive ladder \(0\.4900\.490,0\.4680\.468,0\.3240\.324,0\.3050\.305,0\.2830\.283\) while AUROC goes1\.0001\.000,0\.7900\.790,0\.9980\.998,1\.0001\.000,0\.0800\.080\. Entropy does not order the data, and the ladder confounds directive*text*with resulting behaviour, so it could not have settled the question either way\.

Retained mid\-stack linear information\.Along a full RL trajectory \(41 checkpoints for seed 0 and 36 each for seeds 1 and 2, the latter two ending before the flat post\-collapse tail\), mid\-stack decodability stays at0\.860\.86–1\.0001\.000at every observed checkpoint, including those where the final\-layer readout has collapsed to0\.0000\.000; in seed 0 it reads1\.0001\.000at all 41 \(Fig\.[9](https://arxiv.org/html/2609.10739#A12.F9)\)\. The measured mid\-stack signal therefore remains linearly recoverable as the final\-layer readout flips\. This does not establish preserved functional belief or exclude representation drift of the kind studied in other settings\[[Taufeeque et al\., 2026](https://arxiv.org/html/2609.10739#bib.bib13)\]\.

A cliff, with seed\-dependent onset and width\.AUROC is pinned at1\.0001\.000across measured deception from0\.030\.03up to at least0\.900\.90in all three seeds: a model that lies to rivals on 53% of trials reads1\.0001\.000, perfectly truthful\. But it is not a fixed threshold and not uniformly abrupt: seed 0 begins degrading at0\.9380\.938and passes through0\.959→0\.8280\.959\\to 0\.828and0\.964→0\.3720\.964\\to 0\.372before reaching0\.0000\.000, roughly six percentage points, whereas seeds 1 and 2 hold1\.0001\.000through0\.9810\.981and0\.9840\.984and collapse within one to two\. We report per\-seed onsets \(0\.9380\.938,0\.9860\.986,0\.9900\.990\) instead of a pooled curve, and treat the variation as further evidence that aggregate rate is the wrong independent variable\. Out of distribution on an unseen game structure the*same adapter*loses its inversion \(0\.000→0\.5500\.000\\to 0\.550\) exactly when its own deception falls \(1\.000→0\.5591\.000\\to 0\.559\), though the out\-of\-distribution points do not lie on the in\-distribution curve, so the readout isnota pure function of deception rate across tasks and we do not draw it as one \(App\.[A](https://arxiv.org/html/2609.10739#A1.SS0.SSS0.Px5)\)\.

Empirical AUROC0\.0000\.000or1\.0001\.000describes the ordering of the observed scores, not certainty about population AUROC\. A zero bootstrap or cross\-seed spread at complete separation does not remove finite\-sample uncertainty\. Exact class counts needed for a cell\-specific interval were not retained for these identification results\.

Report spread, not point estimates\.The readouts carrying the App\.[F](https://arxiv.org/html/2609.10739#A6)null sit at extremes of the empirical ranking statistic: all 21 saturated emergent grid cells give cross\-seed sd𝟎\\mathbf\{0\}, the four inverted cells 50\-resample sd0\.0000\\mathbf\{0\.0000\}\. The interpretive middle is softer: our worst cell reads0\.205/0\.479/0\.5310\.205/0\.479/0\.531across three episode seeds with a 50\-resample bootstrap of0\.539±0\.070\\mathbf\{0\.539\\pm 0\.070\}, approximately chance, and*not*the inverted cell any one of those point estimates would suggest\. This is structural: at AUROC0\.0000\.000or1\.0001\.000the classes are perfectly separated so any subsample reproduces the ordering, whereas intermediate values carry genuine sampling variance\. Intermediate cells should be reported with spread or a CI, by us and by others\.

## Appendix HThe constructive result: further detail

This is the material §[3\.3](https://arxiv.org/html/2609.10739#S3.SS3)summarises\.

Per\-seed collapse profiles for row[1](https://arxiv.org/html/2609.10739#S3.T1)\.In the representative seed the ally\-fit probe begins collapsing at layer 26 \(0\.3540\.354\), is at0\.0080\.008by layer 27, and sits at0\.000\\mathbf\{0\.000\}from layer 29 through layer 42 of 42; the other two seeds reproduce the profile, intact through layer 16 and degrading at layer 24 \(0\.8660\.866,0\.8530\.853\)\.

What the second arm actually is\.Reading the deception rate alone invites the description “the same run, less far along”\. It is not\. Breaking that arm’s rival behaviour down*by the true bit*, which we did only when a later causal run printed the split, shows it answers truthfully on0\.000\\mathbf\{0\.000\}of true\-bit\-00rival trials and1\.000\\mathbf\{1\.000\}of true\-bit\-11ones: it emits a constant semantic answer to rivals, while still answering allies truthfully at1\.0001\.000\. Its “deception rate” is thereforeP⁡\(truth≠that constant\)≈0\.5P\(\\texttt\{truth\}\\neq\\text\{that constant\}\)\\approx 0\.5*by arithmetic*, on any draw\. The Mistral\-7B row \(row[1](https://arxiv.org/html/2609.10739#S3.T1)\) is the mirror image, constant at the other value\.

What a constant branch distinguishes\.The actual rival answer in a constant\-output arm is independent of truth, whereas our prescribed\-action label remains its complement\. Thus the action\-label AUROC identity holds for this arm too\. Its non\-inverting truth readout is an empirical contrast, not a consequence forced by the constant output policy\.

What the fixed\-symbol guard misses\.We verify the policy is not degenerate with the fixed\-symbol statistic of §[2](https://arxiv.org/html/2609.10739#S2), and both arms pass it \(0\.5160\.516and0\.4840\.484, both≈0\.5\{\\approx\}0\.5\), for exactly the reason flagged when we introduced the statistic: it rules out a fixed surface character and is blind to a fixed meaning\. The cheap fix is to report the deception rate split by the true bit: a reliable conditional deceiver has both components near one, while a constant\-output policy reads0\.000/1\.0000\.000/1\.000\(or the reverse\)\. An aggregate rate near0\.50\.5is exactly what a degenerate policy produces, and it reads as healthy graded behaviour\.

Row[1](https://arxiv.org/html/2609.10739#S3.T1)also carries a result independent of all this: itstoken/mixedclimbs to0\.9750\.975at the final layer whiletruth/mixedstays at1\.0001\.000, which shows that truth and the prescribed surface\-symbol label coexist*separably*in the final residual stream, against the reading that late layers are “just the output token”\.

Why only one family reached the full conjunction\.Row[1](https://arxiv.org/html/2609.10739#S3.T1), the only cell combining reward training, deception1\.0001\.000, training on the identification task*and*a wholly unmodified recipe, holds in one family, across three seeds\. That precise conjunction is still one family and we do not claim otherwise\.

But the reason the others failed is not probe\-related, and it was actionable: our reward table makes unconditional deception an attractor whenever the conditional solution is out of reach, which is why three of four families never learned one, and correcting that single design flaw rescues one of them \(§[7](https://arxiv.org/html/2609.10739#S7)gives the table and the arithmetic\)\. Under the corrected table Qwen2\.5\-14B reaches rival deception0\.9960\.996with ally truth0\.9940\.994, a genuinely role\-conditional policy on both branches, and shows exactly the pattern of the headline cell:truth/allycollapses from1\.0001\.000at layer 24 to0\.000\\mathbf\{0\.000\}at layer 40 and0\.023\\mathbf\{0\.023\}at layer 48 of 48, whiletruth/mixedreads1\.000\\mathbf\{1\.000\}at every layer measured\.

Why this is more than an extra row\.First, the same corrected table run on Gemma\-9B reproduces the qualitative contrast \(truth/ally=0\.000\\texttt\{truth/ally\}\{\}=0\.000,truth/mixed=1\.000\\texttt\{truth/mixed\}\{\}=1\.000at displayed precision\)\. The contrast therefore occurs under both tested reward tables, while the conditional policy is easier to obtain under the corrected table in these runs\. Second, the rescue was derived from our own basin analysis rather than found by search, so the limitation comes with a mechanism*and*a demonstrated fix\. The saturated set now spans three architectures \(Gemma\-2\-9B, Llama\-3\.1\-8B, Qwen2\.5\-14B\) and four recipes, and the deepest of them is a 48\-layer stack\. The constructive result never depended on this anyway:truth/mixed=1\.000=1\.000occurs in the Table[1](https://arxiv.org/html/2609.10739#S3.T1)cells, including instructed arms\.

## Appendix IThe inferred\-truth task, settling and ingredient controls

This is the material §[7](https://arxiv.org/html/2609.10739#S7)summarises\.

Partial evidence, at one cell, that the direction is not reading a copied token\.We ran one probe against this limitation\. In an*inferred\-truth*variant of the codebook task the secret bit is never a token in the prompt: it is the outcome of a stated comparison between two quantities \(operands separated by at least 31, never 0 or 1, both rule orientations, so the bit cannot be read off operand magnitude alone\)\. On a Gemma\-2\-9B instructed arm at rival deception0\.5450\.545, the mixed\-fit probe reads truth AUROC1\.000\\mathbf\{1\.000\}at layers 24, 32, 40 and 42 of 42\. The depth profile is itself the evidence \(Fig\.[12](https://arxiv.org/html/2609.10739#A12.F12)\): a bit the prompt*states*is readable by layer 4, whereas this one sits at chance through layer 16 and only then rises; a copied token would not behave that way\. Alongside this the fixed\-symbol guard sits at≈0\.5\{\\approx\}0\.5; the ally\-fit probe ranges from0\.3740\.374to0\.5510\.551, including below\-chance values, and the forced identity holds at all seven sampled layers\. The probe recovers the bit at1\.0001\.000while the arm itself answers correctly on only0\.7330\.733of compliant trials\. That behavioural rate and rival probe performance use different subsets, so they do not establish a readout specifically on incorrectly answered compliant trials\. We report this as*bounding*rather than settling the limitation, and it is two removes from a headline: the arm is instructed, and its compliant accuracy is0\.7330\.733\. A third concern, that a linear map over activations encoding both operands could in principle perform the comparison*probe\-side*, is the substantive one, and we take it up below: the exclusive\-or construction rules out an additive map over the two raw features alone, while the experiments measure ingredient and truth decodability separately\. This rules out directly copying a stated answer token, but leaves richer hidden\-feature and causal\-use questions open\.

The settling experiment, which localises the confound rather than excluding it\.We fit the mixed probe on two of the four inferred\-truth templates, froze it, and scored it on the two held\-out templates \(different domains, variable names and comparison wordings\) with per\-trial codebook randomisation decorrelating the emitted symbol, and with a same\-task control arm frozen from the same probe and scored on the fit templates at a fresh seed \(N=2000N\{=\}2000per arm\)\. The three subsets have similar aggregate capability \(compliant accuracy0\.7640\.764fit,0\.7410\.741held\-out,0\.7850\.785control\); this limits, but does not eliminate, capability as an explanation of a readout drop\. Over the layers where the control carries signal at all, the frozen probe peaks attruth/mixed=0\.984=\\mathbf\{0\.984\}at layer 28 against a control of1\.0001\.000, a transfer cost of−0\.016\\mathbf\{\-0\.016\}, and holds0\.962/0\.942/0\.9310\.962/0\.942/0\.931at layers 32 / 40 / 42 \(−0\.038/−0\.058/−0\.069\-0\.038/\-0\.058/\-0\.069\)\. Freezing is not free, and the cost is strongly depth\-dependent: it is−0\.285\-0\.285at layer 20 and−0\.221\-0\.221at layer 24\. So a frozen probe is measurably worse than a refit one on a new task, by an amount that depends on where it is read \(Fig\.[5](https://arxiv.org/html/2609.10739#A9.F5)\)\.

What the exclusive\-or construction excludes\.Exactly one operand is drawn from a high band and one from a disjoint low band\. WritingSSfor “the first slot holds the high\-band value”, the bit isSSunder the “greater” rule and¬S\\lnot Sunder “lesser”\. The label is therefore the exclusive\-or ofSSwith rule orientation\. This function is not linearly separable in those two raw features alone, excluding that additive shortcut\. Hidden states can nevertheless contain nonlinear interactions and other correlated features that a linear probe reads\. Successful decoding shows information in those features; it does not establish the mechanism that computes them or the policy’s causal use of the decoded bit\.

The two ingredients, measured\.The argument above would be empty ifSSand the rule orientation were not linearly present at the read position to begin with, so we probe for each of them separately: same cell, same nine layers, sameN=2000N\{=\}2000and the same seed as the fit arm above\. Both read AUROC1\.0001\.000at layers 8 and 16, exactly where the bit itself is at chance \(0\.4420\.442/0\.5300\.530\), and0\.9340\.934/1\.0001\.000already at layer 4\. So the information a probe\-side comparison would need is*perfectly*linearly available, and a fitted truth probe nevertheless performs near chance at those layers\. The observation is consistent with the raw\-feature argument, but it does not exhaust all possible linear readouts of the hidden state\. The single\-orientation arm doubles as an end\-to\-end check on theSSlabel, since with the rule pinned the bit reduces toSSexactly and the two AUROCs must coincide: they agree to0\.0×𝟏𝟎𝟎\\mathbf\{0\.0\\times 10^\{0\}\}at all nine layers\. The rule’s decodability is close to lexical, the orientation being a phrase in the prompt, so its1\.0001\.000is unsurprising and isnota finding about the model; its only role is to establish that the ingredient is there for a probe to use\. And the scope does not widen: one model, one arm, one task family\.

The single\-orientation arm as positive control\.Fixing the rule removes the exclusive\-or: with “greater” pinned, the bit simply*is*SS, a shallow feature available from operand magnitudes without reading the rule\. A probe fit there reads1\.0001\.000at layer 8, where the mixed\-orientation fit sits at chance \(0\.4420\.442/0\.5300\.530at layers 8 / 16\), and when frozen and scored on flipped\-rule trials it*inverts*, reaching exactly0\.0000\.000at layers 16 and 20 and staying below chance from layer 4 to layer 24, against a control at1\.0001\.000\. This demonstrates the signature of fitting to the single\-orientation shortcut\. Both arms then recover at layer 28 \(0\.9390\.939contaminated,0\.9840\.984clean\) before easing to≈0\.82\{\\approx\}0\.82and≈0\.93\{\\approx\}0\.93at the final layer\. On the clean fit a probe*refit*on the held\-out templates is also at chance shallow \(0\.4740\.474/0\.4960\.496\), so these fitted probes do not detect a shallow truth signal; on the contaminated arm a refit probe reads1\.0001\.000from layer 16 up, so what fails there is the frozen direction, not the held\-out task\. The single\-orientation arm supplies a positive control for this particular shortcut\. It does not replace a comprehensive prompt\-feature baseline or exclude alternative readouts\.

![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_settling.png)Figure 5:The settling experiment\.The same frozen probe scored on a held\-out task \(solid\) and on its own same\-task control \(dashed\); the shaded gap is the transfer cost, and the dotted line is what refitting on the held\-out task would give\. Left, clean fit: with both rule orientations in the fit the bit is the exclusive\-or of two prompt facts: the frozen probe is at chance shallow, where a*refit*probe is also at chance \(0\.4740\.474/0\.4960\.496\), and transfers at0\.984\\mathbf\{0\.984\}\(−0\.016\-0\.016\) at layer 28,0\.9620\.962/0\.9420\.942/0\.9310\.931at layers 32/40/42\. The cost is depth\-dependent and worst at layer 20 \(−0\.285\-0\.285; layer 24,−0\.221\-0\.221\)\. Right, contaminated fit: restricting the fit to one orientation removes the exclusive\-or, the bit becomes the shallow feature “which slot is larger”, and the frozen probe*inverts*to0\.0000\.000at layers 16 and 20 under a rule flip: the probe\-side confound, measured\. Both arms peak at layer 28 and ease off; green labels give frozen held\-out AUROC and its difference from the same\-task control\. Grey spans mark layers where the control itself is at chance, so a small gap there reflects no detected signal for these probes rather than good transfer\. Gemma\-2\-9B instructed,N=2000N\{=\}2000per arm, capability matched \(0\.7640\.764/0\.7410\.741/0\.7850\.785\)\.Two by\-products of building that task\.First, a frozen instruction\-following limit: base models compute such a comparison reliably under the plain rule but not under an*inverted*one, in all three families we tried \(App\.[A](https://arxiv.org/html/2609.10739#A1.SS0.SSS0.Px6)\)\. They answer from operand magnitude and largely ignore the comparison word, which is also why the cell above is capped at compliant accuracy0\.7330\.733\. Second, a learnability finding: RL did not learn a role\-conditional policy over an*inferred*bit in any of three attempts, across two families and both task variants, with no convergence to any reward basin, which is why the cell above is an instructed arm\. We frame this strictly as a fact about what this reward signal makes learnable in this game,notas evidence about truth representations\.

## Appendix JWording generality and compliance tracking

These are the two objections to the instruction\-pair readout of App\.[D](https://arxiv.org/html/2609.10739#A4)\.

Is the instruction readout merely a two\-string discriminator?With a single fixed pair, “which instruction was present” is decidable from any surface difference between two fixed strings\. We settle this with leave\-one\-wording\-out over a five\-wording bank: five fits, each trained on four wordings and scored on the fifth, under a doubly\-held\-out split that partitions*both*episodes and wordings and uses only the diagonal cell\. Every wording is held out exactly once, so the spread across folds is a wording\-generalization spread, not a resampling artifact\.

A depth\-dependent answer, against a pre\-registered threshold\(a range of0\.050\.05or less counts as wording\-invariant\)\.*At layers 24 and 32 the readout is wording\-invariant*: range0\.0090\.009and0\.0260\.026, minimum0\.9740\.974, so every wording is classified at least that well by a probe that never saw it\. The two\-string objection is answered there\.*In the shallow stack it is not:*one wording sits at0\.4040\.404and0\.5010\.501, i\.e\. at or below chance\. Below chance is systematic inversion rather than mere absence of signal: AUROC is antisymmetric under label negation, so a reversed\-sign readout of the same direction would score0\.5960\.596\. \(AUROC is a ranking statistic, so this is a statement about ordering, not a classification rate\.\) So “the instruction signal generalizes across surface form” holds from layer 24 up and is a per\-wording accident before that\. The final layer is intermediate \(range0\.1330\.133, minimum0\.8670\.867\) and we report it as a range, not a point\.

Why the shallow readout fails\.Four of our five wordings distinguish their honest from their deceptive half with a*lexical polarity*cue \(truth/falsehood, correct/wrong, disclose/withhold\); the fifth was deliberately built with no negation vocabulary on either side, separable only by the value mapping itself\. That suggests the shallow probe latches onto the cue, and it makes a falsifiable prediction about a cross\-wording transfer matrix, which we pre\-registered and then ran: fit on wordingiialone, score on wordingjjalone, all2020ordered pairs, episodes held out throughout\.*At layer 8 the prediction holds on all three clauses*: transfer among the four cue\-carrying wordings is uniformly high \(all≥0\.801\\geq 0\.801, mean0\.9480\.948\), while the cue\-free wording is unreadable from any of them \(column mean0\.497\\mathbf\{0\.497\}\) and offers nothing in return \(row mean0\.463\\mathbf\{0\.463\}\)\. The most extreme cell, fitting on the cue\-free wording and scoring on the strongest\-cue one, reads0\.053\\mathbf\{0\.053\}, a strong rank inversion, the signature of a cue that is present but points the wrong way\.

Above layer 8 the asymmetry*reverses*, and we flag this as a post\-hoc observation rather than a registered result: by layer 16 a probe fit on the cue\-free wording reads the others at0\.9280\.928–1\.0001\.000while they still cannot read it \(column mean0\.5960\.596\), and by layer 24 the matrix has largely converged \(worst cell0\.6990\.699\)\. The cue\-free wording is not therefore the best one to train on: by mean transfer it is the*worst*of the five at three of four depths\. The defensible claim is narrower: it is the most diagnostic wording, and the five folds must not be averaged as though exchangeable, since only one of them tests generalization to a cue\-free target\.

The trough on a denser layer grid\.It is at layer 12, not layer 8, and there the cue\-free wording is inverted in*both*directions \(row mean0\.2330\.233, with individual cells as low as0\.0920\.092; column mean0\.3970\.397\)\. Recovery is then abrupt: by layer 20 the matrix is above0\.960\.96in every cell \(range0\.9620\.962–1\.0001\.000, cue\-free column mean0\.9760\.976\) before drifting down again in the last third of the stack\.

The inversion is not an evaluation\-sampling artifact\.With episode\-level bootstrap intervals on every cell \(20002000resamples\), all2020cells at each of layers 8, 12 and 20 have 95% intervals that exclude0\.50\.5, including all eight inverted cells at layer 12, which are tight and far from chance: the cue\-free row reads\[0\.12,0\.14\]\[0\.12,0\.14\],\[0\.08,0\.11\]\[0\.08,0\.11\],\[0\.30,0\.32\]\[0\.30,0\.32\],\[0\.39,0\.40\]\[0\.39,0\.40\]and its column\[0\.39,0\.41\]\[0\.39,0\.41\],\[0\.45,0\.46\]\[0\.45,0\.46\],\[0\.43,0\.44\]\[0\.43,0\.44\],\[0\.28,0\.31\]\[0\.28,0\.31\]\.*So the trough is a real feature of this fit rather than noise\.*The bootstrap resamples held\-out episodes while holding the fitted probe, the training wordings and the partition fixed, so it measures evaluation variability at a fixed fit and is*not*a statement about refit stability\. The two are distinct quantities\.

Two further families: the ordering replicates, the inversion does not\.Running the same matrix on Llama\-3\.1\-8B, the cue\-free wording is again the hardest target at every depth \(column mean0\.530\.53–0\.750\.75against a cue\-carrying block of0\.720\.72–0\.9990\.999\), but no cell anywhere falls below0\.5000\.500\. Qwen2\.5\-14B \(N=2000N\{=\}2000, seven depths\) gives the same verdict: the cue\-free column mean is the lowest of the three at*every*depth \(0\.5070\.507,0\.5400\.540,0\.5700\.570,0\.6200\.620,0\.8610\.861,0\.8060\.806at layers44–4848, against a cue\-carrying block reaching0\.990\.99\), while the cue\-free*row*mean never drops below0\.5660\.566and nothing inverts from layer 8 up\. So “four of five wordings share a polarity cue and the cue\-free one is the hardest target” holds in all three families we tested, while “the shallow probe latches onto the cue hard enough to invert” holds in one of three and is, on present evidence, specific to Gemma, as is the*location*of the anomaly, since Qwen’s worst depth is its shallowest rather than a mid\-stack trough\.*One caveat against over\-reading Qwen’s shallowest layer:*at layer 4 its matrix has eight sub\-chance cells scattered across the cue\-carrying block itself \(as low as0\.0810\.081\) and its grouped directive readout is only0\.8240\.824, so that layer is generally unstable rather than specifically cue\-driven\. The negative rests on layers 8 and above, where the matrix is well behaved\.

Which layers this claim may be anchored at, measured two ways\.Refitting the probe under five different split seeds \(a new held\-out wording set and a new episode partition each time\) gives an across\-refit sd of0\.00450\.0045at layer 8,0\.081\\mathbf\{0\.081\}at layer 16,0\.0099\\mathbf\{0\.0099\}at layer 24,0\.0280\.028at layer 32 and0\.0350\.035at layer 42\. The leave\-one\-wording\-out folds rank layers 16–42 in the same order \(range0\.0090\.009at layer 24 and0\.0260\.026at layer 32\)\. Layer 8 is the exception: it has the lowest refit standard deviation but the largest wording range\. The two measures therefore assess different sensitivities, while agreeing that layers 24–32 are more stable than layers 16 and 42\. This also settles an apparent contradiction in our own numbers\. The final\-layer value moved from0\.9650\.965to0\.8490\.849to0\.8970\.897across three runs, a range of0\.1160\.116, while its*bootstrap*sd was0\.00760\.0076, apparently a twelve\-fold contradiction\. The refit sd at that layer is0\.0350\.035, with a range of0\.1020\.102: the run\-to\-run movement is ordinary refit variance, and the bootstrap simply could not see it, because it resamples evaluation episodes while holding the fitted probe and the partition fixed\. An interval that omits the dominant variance component is not a stability claim, and we quote the refit spread instead\.

Two concessions\.The ungrouped1\.0001\.000was measured on a split in which 100% of test rows had their matched twin in training: with a matched\-pair design the row\-level split is maximally leaky, because the twin differs only in the label\. And this is five wordings from one bank on one model and one task; the invariance we demonstrate is over those five\. The matrix carries per\-cell intervals but comes from a single fit, so it is evidence consistent with the lexical\-cue mechanism rather than a uniquely identifying test of it: a different set of cue\-carrying wordings could produce the same pattern for a different reason\.

Does the instruction\-fit direction track who actually lied?This is the question the protocol implicitly claims, and on a non\-leaky split our answer is no at the layers that matter\. We restrict to the adversarial subset and split on compliance\. Expectation is not what makes that split available:γ<1\\gamma<1leaves a disobedient fraction on average, but the realized counts are what decide it, and the held\-out compliance subset contains 238 complied and 52 disobeyed rows across 145 distinct episodes, each evaluated with two held\-out wordings\. Both row counts exceed the screening minimum of 25; rows from one episode are not independent\. Compliance AUROC uses episode\-level bootstrap intervals:

*The leak inflated this quantity by up to*0\.37\\mathbf\{0\.37\}, the largest leak\-induced distortion we measured, for the reason given above\. But the decisive observation is not the leak\.

Non\-identifiability across instruction wordings: the sign reverses\.Repeating the compliance split inside each leave\-one\-wording\-out fold, it is available in only two of the five, and those two disagree in*direction*at four of five layers:

At the final layer one fold scores compliance at AUROC0\.6070\.607\[0\.542,0\.670\]\[0\.542,0\.670\]while the other scores it at0\.0800\.080\[0\.048,0\.113\]\[0\.048,0\.113\], which by antisymmetry is an AUROC of0\.9200\.920for*disobedience*\. The intervals are tight and nowhere near overlapping\. We therefore make no claim that the instruction\-fit direction tracks who actually lied, in either direction, at any layer\. A quantity whose sign depends on which instruction wordings the probe was fitted on is not a property of the model alone\.

The paper’s own diagnosis, inside the field’s protocol\.Where §[4](https://arxiv.org/html/2609.10739#S4)has two probes on the same activations returning opposite verdicts under different prompt variants, here refitting on a different subset of*instruction wordings*reverses a compliance prediction\. We state it as differently\-fitted directions disagreeing: the folds train on different wording sets, so these are different fits, not one unstable direction\. We offer no mechanism for it\.

The availability pattern as the design rule in action\.The split needs disobedient trials, and the per\-wording disobedience rate spans0\.000\\mathbf\{0\.000\}to0\.309\\mathbf\{0\.309\}: two of the five wordings draw*perfect*compliance, so the point\-estimate design rule returns unattainable at anyNNfor those wordings, against approximately8181trials for the most disobedient wording\. A zero observed count does not establish that the population disobedience probability is exactly zero\.*The pooled rate,0\.1280\.128, predicts none of the five\.*On a second family the whole protocol falls off the same cliff: Qwen2\.5\-14B complied with the deceptive instruction on 1490 of 1490 adversarial trials, pooled over all five wordings, soddeceptive=1\.000d\_\{\\mathrm\{deceptive\}\}=1\.000and Eq\.[1](https://arxiv.org/html/2609.10739#A3.E1)returns*unattainable at anyNN*: the compliance split is unavailable on that family for a pure design reason, with no probe fitted\. Its aliasing rate is nonetheless non\-degenerate \(γ=0\.985\\gamma=0\.985withdhonest=0\.029d\_\{\\mathrm\{honest\}\}=0\.029, so Eq\.[2](https://arxiv.org/html/2609.10739#A4.E2)is doing real work rather than reducing to an endpoint\), which is precisely the combination the rule is meant to catch: high but sub\-unit aliasing that still leaves no testable subset\. Anyone applying Eq\.[1](https://arxiv.org/html/2609.10739#A3.E1)must evaluate it on the subset they intend to split, and against the fraction that split actually consumes: for a compliance split that is1−ddeceptive1\-d\_\{\\mathrm\{deceptive\}\}, not the pooled1−γ1\-\\gamma, which also counts honest\-rung disagreements the split cannot use\.

## Appendix KThe causal analysis

This is the causal analysis §[7](https://arxiv.org/html/2609.10739#S7)summarises\.

Decodability, not causal use\.truth/mixed=1\.000=1\.000says a linear map recovers the bit, not that the model uses it\. We tested both directions causally, the conventional ally\-fit one and the mixed\-fit one this paper hands back, at the layer where the ally\-fit readout is fully collapsed, on the task the direction was fitted on, atN=1000N\{=\}1000rival\-context episodes per condition\. These interventions collect only rival trials, soNNhere is also the scoring denominator\.

*Steering is null, and on two arms\.*Sweepingα=5/10/20/40\\alpha=5/10/20/40moves nothing\. On the saturated reward\-trained arm the rival\-truth rate is0\.0000\.000at everyα\\alpha, which bounds the effect at 0\.3 percentage points per tested condition \(exact one\-sided 95% bound on0/10000/1000\)\.*Per condition*is the qualifier that matters: eight conditions were inspected \(44values ofα\\alpha×\\timestwo sign modes\), so this is not a simultaneous95%95\\%bound over the sweep, and the conditions share episodes and are therefore not independent tests to be pooled\. We also note this arm sits on a floor, since its unperturbed rival\-truth rate is already0\.0000\.000, so only an increase was detectable\. The instructed arm has no such floor \(its baseline is≈0\.20\{\\approx\}0\.20\) and there the rate is flat at0\.2140\.214–0\.2260\.226across an eightfold range ofα\\alpha\(no ordered response is apparent over these tested doses\)\. We also ran a signed variant that takes its sign from the ground\-truth label, an oracle no deployed detector could have, precisely because unsigned steering could cancel across trials\. It is identical to the unsigned arm at everyα\\alpha, to all reported digits, and that agreement is mostly forced rather than measured: on true\-bit\-11trials the oracle sign is\+1\+1, so the two arms are literally the same intervention there, and on true\-bit\-00trials, the only trials where they differ, the rate is pinned at0\.0000\.000in every condition of both arms\. So the signed arm does not independently corroborate the null\. What it does establish is narrower: on true\-bit\-00trials−α​d\-\\alpha dfails to move the rate off its floor just as\+α​d\+\\alpha ddoes, so on that subpopulation both directions were tested and both are null\. The cancellation explanation is excluded only there, and the decisive test,−α​d\-\\alpha don true\-bit\-11trials, we have now run, along with the ally\-fit comparison; both are reported in §[K\.2](https://arxiv.org/html/2609.10739#A11.SS2)immediately below, and the depth sweep that was previously missing is in §[K\.3](https://arxiv.org/html/2609.10739#A11.SS3)\.

### K\.1The fitted directions separate with depth

Before the causal comparison, a geometric one that costs nothing\. Our probe files store the ally\-fit and mixed\-fit coefficient vectors for the same target at the same layers, fitted by the same code on the same activations\. Their cosine, per layer:

Layers: Gemma4/8/16→24/32/424/8/16\\to 24/32/42; Qwen4/8/16→32/40/484/8/16\\to 32/40/48; Llama and Mistral4/8/16→20/24/324/8/16\\to 20/24/32\.

The two fits on the stated\-bit task\.They recover nearly the same vector in the shallow stack and separate sharply at depth, in all four families, and always at5757–67%67\\%of the stack, so the effect is not tied to an absolute layer index\. This is a change in fitted\-vector similarity\. The truth and prescribed\-action labels remain identical on ally trials at every layer; their identity does not change with depth\.

One thing the cosine is not\.The final\-layer cosine varies only over0\.530\.53–0\.590\.59across these four arms, whose rival deception rates span0\.470\.47to1\.0001\.000\. So the angle separates the two fits everywhere at depth, but it does*not*grade with how much the policy’s behaviour aliases truth with action\. It is a qualitative signature of the two fits diverging, not a measurement of aliasing\.

The last two rows concern inferred\-bit tasks\. Their shallow fitted\-direction cosine is lower, at0\.680\.68–0\.750\.75on Gemma and0\.650\.65–0\.750\.75on Qwen, against0\.770\.77–0\.990\.99for every stated\-bit row\. This is a difference in the fitted vectors across tasks, not weaker label collinearity: truth and prescribed action still coincide on ally fitting examples in both tasks\. The contrast is not an arm effect, which the table alone would leave open, since every stated\-bit row above is a reward\-trained arm and both inferred\-bit rows are instructed: the*instructed*stated\-bit arm swept in §[K\.3](https://arxiv.org/html/2609.10739#A11.SS3)sits at0\.950/0\.996/0\.9860\.950/0\.996/0\.986shallow, with the stated\-bit rows and not with the inferred ones, so it is the task and not the training route that moves the shallow cosine\. We still put it no more strongly than a qualitative pattern: it is two task\-contrast rows against four stated\-bit rows, the deep values overlap across conditions, and a cosine between coefficient vectors is not itself a measurement of aliasing\.

It also settles an ambiguity the AUROCs alone cannot\. A separation index of≈2\{\\approx\}2is consistent both with two distinct directions and with*one*axis whose sign the mixed fit merely resolved\. The latter would givecos≈−1\\cos\\approx\-1\. We measurecos≈\+0\.55\\cos\\approx\+0\.55at layer 32, so these are two different directions, roughly57∘57^\{\\circ\}apart\.

### K\.2Positive and negative unsigned steering doses

We sweptα\\alpha*through zero*, ten values from−1\.37\-1\.37to\+1\.37\+1\.37times the median residual norm, against a single in\-runα=0\\alpha\{=\}0baseline, so the whole dose–response is one measurement rather than a comparison across runs\. On the instructed arm \(the one with no floor\) the mixed\-fit direction gives a monotone, ordered response on true\-bit\-11trials overαrel∈\[−1\.37,\+0\.69\]\\alpha\_\{\\mathrm\{rel\}\}\\in\[\-1\.37,\+0\.69\]:0\.3650\.365at the negative end, rising through the0\.4190\.419baseline, to0\.5240\.524at\+0\.69\+0\.69\. It then falls back to0\.4310\.431at\+1\.37\+1\.37, which we read as the usual large\-α\\alphadegradation rather than part of the response\. So−α​d\-\\alpha ddoes lower the true\-bit\-11rate, and the axis has signed influence: the test we previously flagged as unrun\.

Scope of the class\-conditioned effect\.For the mixed\-fit direction, the true\-bit\-00rate is exactly0\.0000\.000at everyα\\alpha, for both signs, out to1\.37×1\.37\\timesthe residual norm\. The measured effect is confined to the true\-bit\-11subpopulation\. Failure to rescue the other class over these doses does not exclude a causally used truth representation without further assumptions about the downstream computation\.

The paired, per\-trial form\.Everyα\\alphacell runs on the same episodes, so this can be said per trial, not per rate\. Matching trials across cells \(an ordering we verify by checking that the true bit, codebook and role agree position\-by\-position across all10001000records\) and applying McNemar to the discordant pairs: on true\-bit\-11trials the flips are almost perfectly one\-sided: for the ally\-fit direction atαrel=∓0\.686\\alpha\_\{\\mathrm\{rel\}\}=\\mp 0\.686,351351trials switch toward the truthful answer and𝟎\\mathbf\{0\}switch away \(p≈4×10−106p\\approx 4\\times 10^\{\-106\}\), with the same one\-sidedness at every smaller dose and for the mixed\-fit direction at smaller magnitude \(7979versus00\)\. On true\-bit\-00trials the discordance is exactly zero in2525of the comparisons: not one trial of496496changes state, in either direction, at any dose up to0\.6860\.686\. This confirms episode alignment for the paired comparison\. Exact0\.0000\.000\-versus\-0\.0000\.000truthful\-answer rates on the same binary\-scored episodes already imply that every answer is false at both endpoints; opposing truthfulness flips cannot be hidden by those exact zero rates\. The single exception is the ally\-fit direction at the extreme∓1\.373\\mp 1\.373, which rescues5757of496496true\-bit\-00trials, strictly in one direction \(p≈1×10−17p\\approx 1\\times 10^\{\-17\}\), the large\-dose class\-conditioned response noted below, and nowhere else\.

The same question where there is no floor, on two families\.Every argument above rests on true\-bit\-00sitting at0\.0000\.000, and a rate pinned at an extreme cannot fall\. The inferred\-bit arms are the cells in which*both*rates are interior at baseline \(Gemma\-9B at true\-bit\-110\.2400\.240/ true\-bit\-000\.700\\mathbf\{0\.700\}, Qwen\-14B at0\.6090\.609/0\.145\\mathbf\{0\.145\}\), so changes in either direction can be observed\. The saved series applies the same signed dose to every trial, without conditioning its sign on the true bit\. Such a push along a truth\-bit direction can favour one semantic bit on all trials and move the two correctness rates in opposition\. This pattern therefore cannot distinguish a causally used truth\-bit feature from other mechanisms producing an answer bias\. On Gemma the ally\-fit direction moves the rates in opposition at every one of the nine doses where it changes them:

Pushed one way it makes the model likelier to answer truthfully when the truth is11and*less*likely when the truth is00; pushed the other way, exactly the reverse\. This describes a bias between semantic answers under the perturbation, not an identification of the feature’s causal meaning or a preference for one fixed codebook character\.

Replication on a second family, with a larger effect\.We ran the identical contrast on Qwen2\.5\-14B’s inferred\-bit arm, at layer 40 of 48, chosen because that is where*its*ally\-fit probe is most action\-aligned, reading0\.2850\.285, whereas Gemma’s inferred ally\-fit probe ranges from0\.3740\.374to0\.5510\.551, including values below chance\. Of the twelve non\-zero doses, ten move the two rates in opposition, and over the well\-behaved range\|αrel\|≤0\.535\|\\alpha\_\{\\mathrm\{rel\}\}\|\\leq 0\.535the true\-bit\-00rate falls*strictly*monotonically \(0\.186→0\.1140\.186\\to 0\.114\) while true\-bit\-11rises \(0\.526→0\.6890\.526\\to 0\.689\), swings of8484and3535trials, roughly double what the Gemma cell gives\. The two exceptions are a single\-trial wiggle at the smallest positive dose and the largest dose\|αrel\|=1\.07\|\\alpha\_\{\\mathrm\{rel\}\}\|=1\.07, where both rates degrade together in the representation\-damage pattern reported throughout\.

The response pattern does not depend on the floor\.Both arms with interior baseline rates show opposing class\-conditioned effects\. Their internal causal interpretation remains unresolved by this test\. The mixed\-fit direction is by comparison inert on both \(\|Δ\|≤0\.019\|\\Delta\|\\leq 0\.019on Gemma,≤0\.041\\leq 0\.041on Qwen, with no consistent sign and a U\-shaped rather than ordered response on Qwen\), which is the same ordering seen everywhere else\.

The comparison with the ally\-fit direction, the unidentified one this paper criticizes\.Both directions come from the same fit on the same activations, differing only in which contexts the fit saw, so we can perturb each at the same layer, arm and episodes\. We compare them at*matched*α\\alpha, because the total swing saturates and then hides the difference:

The comparison is at the nearest available*relative*dose, not a matched rawα\\alpha: the median residual norm differs by layer and model, so the sameα\\alphais a three times larger perturbation on Qwen than on Gemma\. At matched relative dose the ally\-fit direction produces the larger displacement in all four cells\. We report a ratio in only two of them\. A ratio is meaningful only when both arms moved the same way by an amount larger than noise, and in two cells the denominator fails that test: the Qwen mixed\-fit response is exactly zero at this dose, and the inferred\-bit mixed\-fit response is*negative*: a−0\.004\-0\.004displacement is22trials out of517517, and pointing the wrong way\. Dividing by either would manufacture a large multiplier out of an absent effect, so we print a dash\. Pushing Qwen harder separates the two directions without needing one: atαrel=1\.09\\alpha\_\{\\mathrm\{rel\}\}=1\.09the ally\-fit direction takes the true\-bit\-11rate to1\.0001\.000while the mixed\-fit direction is still at0\.0000\.000, and the mixed\-fit direction only reaches0\.5690\.569at twice that dose\. So the claim is a consistent*ordering*, not a multiplier: where both arms move, the ratio is2\.32\.3–3\.6×3\.6\\times, and at saturation it necessarily goes to11\.

The axis at high dose\.At layer 24, fromαrel=±0\.92\\alpha\_\{\\mathrm\{rel\}\}=\\pm 0\.92upward,*both*directions achieve total control of the answer: the true\-bit\-11rate goes to0\.0000\.000under negativeα\\alphaand1\.0001\.000under positive, with true\-bit\-00moving in exact opposition \(1\.0001\.000and0\.0000\.000\)\. At these doses the perturbation controls the semantic answer and the measured truth rate follows from the true bit\. This high\-dose effect explains the tie between directions without identifying their unperturbed causal semantics\.

Both directions on the inferred\-bit task\.In absolute terms they become nearly inert\. The largest true\-bit\-11range we can produce anywhere on the sweep is0\.0770\.077\(ally\-fit\) and0\.0210\.021\(mixed\-fit\), against0\.7680\.768on the stated\-bit task at the same layer\. The more informative difference is not the magnitude but whether the response is*ordered*inα\\alphaat all: the ally\-fit direction still is, rising monotonically across the sweep \(108→148108\\to 148truthful trials of517517fromαrel=−0\.69\\alpha\_\{\\mathrm\{rel\}\}=\-0\.69to\+1\.40\+1\.40\), whereas the mixed\-fit direction falls weakly withα\\alpha\(134134at the negative end down to123123, before rebounding to129129at the largest dose\) and never leaves a0\.0210\.021band\. On this task the mixed\-fit response is small and not ordered inα\\alpha, so we do not report a potency ratio\. The contrast does not isolate why the intervention has less influence on the inferred\-bit task\. The baseline differs \(0\.2400\.240against0\.4190\.419\), and the historical arm provenance is unresolved: the two saved Gemma inferred\-bit sweeps record the steered model as emergent, while the fitted directions they load, and the run notes, record instructed\. The original adapter identity was not retained\. We therefore report the recorded sweep values without treating this as a controlled task\-only comparison\.

How the intervention relates to the diagnosis\.Truth and prescribed action coincide on ally fitting data\. That label equality alone does not determine which target the fitted direction follows outside that support\. Here positive and negative unsigned perturbations move the two truth\-conditioned correctness rates in opposition\. This is compatible with multiple causal mechanisms, including a used truth\-bit feature; it does not resolve the semantic ambiguity\. The mixed\-fit direction is a better truth readout in the tested contexts but generally has less effect on the answer at the compared sites and doses\.

One thing we can*not*claim: the gap does not visibly grade with how often the policy lies\. We see the same ordering at rival deception0\.5450\.545and0\.6390\.639as at1\.0001\.000, and the geometric analogue, the deep cosine of §[K\.1](https://arxiv.org/html/2609.10739#A11.SS1), is likewise flat across that range\. Aliasing on the*fitting*data is a property of the protocol rather than of the policy, so there is no reason to have expected a gradient in the deception rate; we report the absence of one so that it is not read into the results later\. Identification and causal potency come apart: the better measurement of truth is the weaker lever on behaviour in these experiments\. This does not diagnose the directions steered in other studies\.

### K\.3Depth dependence of the ally\-fit advantage

The comparison above is at one layer, which leaves open whether the ally\-fit advantage has anything to do with the two directions*differing*\. §[K\.1](https://arxiv.org/html/2609.10739#A11.SS1)says they are nearly the same vector shallow and separate at depth, so that account makes a prediction: the advantage should be absent wherecos≈1\\cos\\approx 1and present where the fits diverge\. We ran the identical contrast at five layers, sweepingα\\alphaover a128×128\\timesrange at each because the median residual norm grows more than tenfold across the stack \(8383at layer 8 to860860at layer 40\) and a grid fixed in rawα\\alphawould not be comparable\. The five dose–response pairs are plotted in Fig\.[15](https://arxiv.org/html/2609.10739#A12.F15)\.

Where the two fits are nearly one vector\.At layers 8 and 16,cos≥0\.986\\cos\\geq 0\.986and the two dose–response curves lie on top of each other \(Fig\.[15](https://arxiv.org/html/2609.10739#A12.F15), first two panels\), with no advantage either way, so the two are causally interchangeable there\. Where they separate, at layers 24 and 32, it is the ally\-fit direction that carries the behaviour: at layer 32 it drives the true\-bit\-11rate from0\.160\.16to0\.930\.93across the sweep while the mixed\-fit direction moves only0\.360\.36to0\.520\.52\. In these four layers, the ally\-fit advantage appears where the fits have separated; layer 40 below shows that separation alone is insufficient\.

*We report this as an ordering and not as a potency ratio\.*A ratio here is not a stable quantity: at small doses the mixed\-fit displacement is a noise\-level denominator, at large doses both arms saturate and any ratio goes to11by construction, and at layer 24 there are doses where the denominator points the*opposite*way so the ratio is undefined rather than large\. Quoting a multiplier, or worse a multiplier read off one chosen dose, would put a number on the claim that the underlying data do not support, the same failure we flag for the inferred\-bit cell in §[K\.2](https://arxiv.org/html/2609.10739#A11.SS2)\. The two curves per layer are shown instead, so a reader can see the denominator that a ratio would hide\.

Layer 40, the informative exception\.Its cosine is the*lowest*we measure \(0\.5400\.540\), so a simple “more separation, more advantage” rule predicts the largest effect there\. Instead*both*directions are inert: the mixed\-fit spread is slightly negative at every dose and the ally\-fit spread never exceeds0\.0360\.036\. Layer 40 of 42 has less downstream computation than the earlier sites, but this does not identify the cause of the small effect\. In this measured sweep, fitted\-direction separation alone is insufficient to predict a strong intervention response\. Reading the effect off a single chosen dose would make the five layers look monotone in the cosine, and they are not\.

Scope of the depth comparison\.The ally\-fit advantage accompanies direction separation at layers 24 and 32, but the layer\-40 exception rules out a monotone relation with cosine across depth\. Across the compared arms at fixed depth, neither the deep cosine nor the advantage visibly grades with deception rate\. These observations do not establish a general predictor of intervention potency\.

Ablation on the ally\-fit direction is void exactly as before \(post\-ablation decodability0\.9680\.968against a0\.6000\.600ceiling\), so nothing in this section rests on an ablation\. The Qwen arm sits on a0\.0000\.000floor, so its negative half is uninformative by construction\. And these are genuinely different axes rather than one axis re\-signed \(§[K\.1](https://arxiv.org/html/2609.10739#A11.SS1)\)\.

*The ablation result is not a null; it is uninterpretable\.*Projecting out the direction leaves behaviour unchanged, but our pre\-registered positive control shows the intervention did not remove the information: a freshly fitted probe still recovers the bit at1\.0001\.000from the ablated activations, against a permutation\-calibrated chance ceiling of0\.6000\.600\. The same holds for every rank of an INLP subspace ablation we could complete under an*underdetermined*fit, up tok=8k\{=\}8\(Fig\.[14](https://arxiv.org/html/2609.10739#A12.F14)\)\. Re\-running the fit*determined*\(n=4000\>d=3584n\{=\}4000\>d\{=\}3584\) changes this atk=2k\{=\}2: post\-ablation decodability falls to0\.6000\.600against0\.7270\.727for the underdetermined fit at the same rank, so the underdetermined subspace was under\-removing by0\.1280\.128, exactly the bias its own guard predicts, and the reason we do not report the underdetermined curve as a bound\. We have now completed the determined ladder at both layers, and the result is that no rank at either layer licenses a causal null\. At layer 32, post\-ablation decodability is1\.0001\.000,0\.59960\.5996,0\.59110\.5911and0\.60770\.6077atk=1,2,4,8k=1,2,4,8; at layer 24 it is1\.0001\.000,0\.9390\.939,0\.9130\.913and0\.9970\.997\. Behaviour is unchanged throughout \(ally truth rate1\.0001\.000\)\.

Two of the eight cells clear the reported ceiling\.That ceiling ismax\\max\(a tolerance we chose, the label\-permutation null\), i\.e\. the*more permissive*of the two, and our tolerance \(0\.6000\.600\) is the looser one at every cell\. Measured against its own permutation null instead, every cell at both layers sits above it: at layer 32 the nulls are0\.5760\.576,0\.5800\.580,0\.5760\.576and0\.5810\.581, so evenk=2k\{=\}2andk=4k\{=\}4, which clear0\.6000\.600by0\.00040\.0004and0\.0090\.009, are0\.0200\.020and0\.0150\.015*above*the calibrated band, andk=8k\{=\}8fails both criteria outright\. So the pass/fail language is an artifact of the permissivemax\\max, and we drop it\. The bit remains partly decodable after every ablation we ran, so a flat behavioural rate is never licensed here as evidence about causal use\.

What the completed ladder buys\.A quantitative depth contrast, which is weaker than a pass/fail one\. The layer\-32 ablation drives decodability down to0\.590\.59–0\.610\.61while the layer\-24 ablation leaves it at0\.910\.91–1\.001\.00, so the bit is markedly more distributed at layer 24, but neither layer yields an interpretable null, and the two passing layer\-32 cells are*bounded by void cells on both sides*\(k=1k\{=\}1andk=8k\{=\}8\), so they are a middle band rather than a trend\. Removal does not keep improving with rank:k=8k\{=\}8is worse thank=4k\{=\}4at layer 32 \(0\.6080\.608vs0\.5910\.591\) and worse at layer 24 as well \(0\.9970\.997vs0\.9130\.913\)\. One caveat travels with the whole ladder: the positive control refits atn=600n\{=\}600against a35843584\-dimensional residual, which is why its permutation null sits near0\.580\.58rather than0\.500\.50: the null absorbs that overfitting, which is exactly why it, and not our tolerance, is the criterion we now report against\. A behavioural null is only evidence about causal use if the ablation worked, so we draw no causal conclusion from it\. What it does show is a fact about dimensionality: the bit is not confined to that rank\-1 subspace, since removing the direction leaves it fully decodable from the orthogonal complement\.

So the honest position is that the bit is linearly present and the mixed\-fit direction we propose has weaker or less consistently ordered influence in the tested conditions than the ally\-fit direction \(§[K\.2](https://arxiv.org/html/2609.10739#A11.SS2)\); the ablation arm is uninterpretable rather than negative\. Four limits on reading even that\. Whole\-residual patching*does*flip answers at1\.0001\.000\(App\.[F](https://arxiv.org/html/2609.10739#A6)\), so information at this site is used by something, though that intervention replaces every role\-, prompt\-, action\- and truth\-associated component at once, so it says nothing about how many dimensions carry the effect\. Ourα\\alpharange initially reached8\.48\.4–8\.6%8\.6\\%of the median residual norm across these two arms\. We extended it sixteenfold, to1\.351\.35–1\.37×1\.37\\timesthe median residual norm, with an in\-runα=0\\alpha\{=\}0control passing through the same hook on the same episodes\. On the saturated arm the mixed\-fit direction leaves the rival\-truth rate at0\.0000\.000at every tested dose, including1\.35×1\.35\\timesthe median residual norm\. The null is therefore not explained by restricting this direction to small doses within the tested range; the ally\-fit direction does move answers at comparable doses \(Fig\.[14](https://arxiv.org/html/2609.10739#A12.F14)\)\.

On the instructed arm the extended sweep does produce movement\. The rival\-truth rate rises from a measured baseline of0\.2110\.211to0\.2640\.264atαrel=0\.69\\alpha\_\{\\mathrm\{rel\}\}=0\.69\(nominally significant\), then*collapses back*to0\.2170\.217at1\.371\.37\. We pre\-registered three criteria for counting a move as steering \(monotone inα\\alpha, sign\-appropriate under an oracle sign, and not mirrored by the unsigned arm\), and it fails all three: the curve is non\-monotone, and the signed and unsigned arms are identical to four decimals \(which, as noted above, the construction forces on exactly the trials where the movement occurs\)\. The class\-conditioned breakdown shows that on true\-bit\-00trials the rate is exactly0\.0000\.000at everyα\\alphain both directions, while all observed changes occur on true\-bit\-11trials\. The positive and negative unsigned sweep in §[K\.2](https://arxiv.org/html/2609.10739#A11.SS2)confirms that−α​d\-\\alpha dlowers the true\-bit\-11rate\. This establishes a signed response to the perturbation, not whether the underlying feature is a truth representation or an answer mechanism\. Randomized codebooks also prevent interpreting semantic answer bias as a preference for one fixed character\. This is one site in one layer of one model family\. Finally, App\.[F](https://arxiv.org/html/2609.10739#A6)’s “no arm difference” is stated at the strength each measure supports, which is not uniform\. On the answer\-position readout the matched difference is an*exact*tie: every one of the 8 matched cells reads0\.0000\.000in both arms, so the paired difference has zero variance and a conventional equivalence test is undefined rather than passed; what bounds it is saturation, not statistics\. On the two matched measures that are*not*saturated, a two\-one\-sided\-tests procedure does establish equivalence at a±0\.05\\pm 0\.05tolerance \(readout direction cosine, mean difference\+0\.021\+0\.021,p=0\.034p=0\.034; rival entropy, mean difference−0\.003\-0\.003,p<10−6p<10^\{\-6\}\)\. On the off\-position readout it doesnot, for the reason given in App\.[F](https://arxiv.org/html/2609.10739#A6)\. We prefer reporting this unevenly to reporting a single tolerance that would be true of some measures and false of others\.

## Appendix LSupplementary figures

![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_action_identity.png)Figure 6:The identity is forced\.The measured ally\-fit*action*probe \(dashed\) lies exactly on1−1\-\{\}\(ally\-fit*truth*probe\) \(thick grey\) at every layer, because on ally data the two label vectors are identical and the two “probes” are one fit scored against opposite labels\. Maximum deviation over all 751 \(cell, layer\) pairs:2\.2×10−162\.2\\times 10^\{\-16\}\.![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_cross_family.png)Figure 7:Being reward\-trained is not what produces the inversion\.The behaviourally\-matched null of App\.[F](https://arxiv.org/html/2609.10739#A6)\. One row per model family; within a row thered squareis the reward\-trained \(emergent\) arm and theblue circlethe instructed arm, dodged vertically so families where both sit at exactly the same AUROC still show two markers\. Grey segments join the two arms of each family; their horizontal extent is the AUROC gap, while the vertical offset only separates the markers\. Horizontal position is final\-layer truth AUROC on held\-out rival trials, so the dashed line at0\.50\.5is chance and everything left of it is inverted\. Markers are the mean over 3 seeds with±1\\pm 1SD error bars, and the number beside each marker is that arm’s*measured rival lie rate*, not its AUROC\. Rows are ordered by the instructed arm’s lie rate, the variable a rate\-based account would make the operative one\. Read it as follows: every emergent arm lies on1\.0001\.000of rival trials and every one reads0\.0000\.000; the three instructed arms that also lie on1\.0001\.000\(Gemma\-9B, Qwen\-32B, Qwen\-14B\) read0\.0000\.000*too*, while the instructed arms that lie less reliably have variable readouts, including Qwen\-7B seeds on both sides of chance\. The matched saturated arms therefore refute an emergent\-specific interpretation of inversion\. Saturation does not characterize every inverted seed or predict inversion generally: an arm at rival deception1\.0001\.000that never inverts is reported in App\.[G](https://arxiv.org/html/2609.10739#A7)\. This is a null with tight bounds rather than demonstrated equivalence, and the error bars are00in every saturated cell because those readouts sit at an extreme of the empirical ranking statistic\.![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_predictors.png)Figure 8:Neither lie rate \(a\) nor per\-example confidence \(b\) orders the readout: cells with the same behaviour sit at both0\.000\.00and1\.001\.00\. Both were hypotheses of ours, and both are refuted \(App\.[G](https://arxiv.org/html/2609.10739#A7)\)\. Red rings and blue circles show the reward\-trained and instructed grid cells; green diamonds show the within\-model directive variants\. The grey line joins one RL run’s 41 checkpoints in horizontal\-axis order, not time order\. Dashed horizontal lines mark chance\.![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_suppression.png)Figure 9:Retained mid\-stack decodability: one RL trajectory, 41 checkpoints\. Top: rival truth\-classification accuracy at the layer selected by highest ally\-validation accuracy \(green\), and rival truth AUROC at the final answer\-token layer \(red\)\. These are different metrics; the selected\-layer accuracy stays pinned while the final\-layer ranking collapses and inverts\. Bottom: measured rival deception rate over the same training epochs\.![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_d2_ladder.png)Figure 10:The directive\-strength ladder moves the refit probe, not the frozen one\.Left and centre: truth AUROC on rival trials as the rival directive strengthens from*hint*to*max*, with model weights held fixed\. Red: a probe fit separately on each variant’s ally data\. Blue: one probe fit on the reference variant and cross\-scored, available only for Llama\-8B\. Lines connect the measured rungs; Mistral’s two weakest rungs were not run\. Right: two separate Llama\-8B text controls, scored with refit probes\. A removes negation words from the max directive; B pads the default rule to approximately the max directive’s length\. These controls are not additional strength rungs\. Numbers beside markers are measured rival deception rates, not AUROCs:0\.590\.59and0\.560\.56for A and B versus0\.800\.80for max, so the controls are not behaviour matched\. Dashed horizontal lines mark chance\.N=1000N\{=\}1000collected episodes per variant; see §[4](https://arxiv.org/html/2609.10739#S4)and App\.[G](https://arxiv.org/html/2609.10739#A7)\.![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_matched_pairs.png)Figure 11:Behaviour\-matched prompt pairs: refitting splits them, one frozen direction does not\.Every pair of the 15 ladder rungs \(the reference plus 14 variants\) whose rival deception rates agree to within0\.050\.05, each drawn as a segment joining the two members’ rival truth AUROCs, ranked by gap\. Left: a probe refit on each variant’s own ally data, median gap0\.3350\.335, largest0\.9190\.919, and five pairs straddle chance\. Right: one direction fit once on the reference variant and cross\-scored, median gap0\.0250\.025, largest0\.1240\.124\. Two pairs contain the reference variant itself, which has no frozen score by construction, so the right panel has 10 pairs to the left panel’s 12\. Pairs are enumerated under a stated tolerance, not selected on the size of their gap\.![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_depth_step.png)Figure 12:The depth step\.Truth AUROC of the identified \(mixed\-fit\) probe on held\-out rival trials, Gemma\-9B\. When the prompt*states*the bit \(red\) it is linearly readable almost immediately and reaches1\.0001\.000by layer 4: reading it is a lexical operation\. When the model must*derive*the bit \(blue,N=2000N\{=\}2000; faint dashed is theN=1000N\{=\}1000replicate\) the same protocol sits at chance through layer 16 and only then rises, reaching1\.0001\.000by layer 24\. The contrast is what licenses treating the deep readout as a computed quantity rather than a copy of the prompt \(§[7](https://arxiv.org/html/2609.10739#S7)\)\. The inferred\-bit curves use sparse layer grids with gaps of up to eight layers; transitions inside those gaps are not resolved\.![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_freeze_transfer.png)Figure 13:Refitting certifies almost nothing about transfer\.Each panel scores the inferred\-bit task\. Red: a probe*refit*on that task, the conventional practice; it reads≈1\.000\{\\approx\}1\.000from layer 20 in all three arms\. Blue: the*same*direction fit on the stated\-bit task and merely cross\-scored\. It never exceeds0\.8640\.864on the instructed arm, and on the reward\-trained arm it inverts to0\.2820\.282\. A refit number and a frozen number answer different questions, and only the frozen one bears on transfer\.![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_causal.png)Figure 14:The criticized ally\-fit direction is the causally potent one\.Top left and right: steering at layer 32, swept*through zero*against a single in\-runα=0\\alpha\{=\}0baseline\. Solid lines are the true\-bit\-11rate, dashed the true\-bit\-00rate\. The mixed\-fit direction \(blue, the identified one\) responds weakly,0\.365→0\.5240\.365\\to 0\.524before degrading at the largest dose; the ally\-fit direction \(red, the one we criticize\) swings0\.167→0\.9290\.167\\to 0\.929, and on the saturated arm breaks a floor the mixed\-fit direction never moves\. True\-bit\-00stays pinned at0\.0000\.000almost everywhere, lifting only under the strongest negative ally\-fit push\. These unsigned, class\-conditioned effects do not distinguish a causally used truth\-bit feature from another mechanism producing semantic answer bias\. Bottom: the pre\-registered positive control\. The1†1^\{\\dagger\}bar is the separate mixed\-fit rank\-one ablation run at layer 32; the subsequent rank\-one bars are the first steps of the iterative subspace\-ablation ladders\. Post\-ablation decodability must fall*below*the ceiling \(0\.6000\.600\) for a behavioural null to be interpretable; red bars fail and are void\. Both determined ladders are now complete, and no cell at either layer falls below its own permutation null \(black dashes\)\. Ranks 2 and 4 at layer 32 clear the0\.6000\.600tolerance by0\.00040\.0004and0\.0090\.009, but sit0\.0200\.020and0\.0150\.015*above*the calibrated null, andk=8k\{=\}8\(0\.6080\.608\) fails both, so the two clearing cells are a middle band bounded by void cells atk=1k\{=\}1andk=8k\{=\}8\. The contrast with layer 24 is one of degree \(0\.590\.59–0\.610\.61versus0\.910\.91–1\.001\.00\), not of pass versus fail\. Ranks 16 and 32 of the underdetermined layer\-32 ladder did not complete and are not plotted\.![Refer to caption](https://arxiv.org/html/2609.10739v1/figures/fig_depth_sweep.png)Figure 15:The ally\-fit advantage appears only where the two fitted directions differ, and separation alone is not enough\.Each panel is the same causal contrast run at one depth on the Gemma\-2\-9B instructed arm: true\-bit\-11rate against dose, mixed\-fit direction in blue, the criticized ally\-fit direction in red, grey dashed line the in\-runα=0\\alpha\{=\}0baseline\. At layers 8 and 16, wherecos≥0\.986\\cos\\geq 0\.986, the two curves lie on top of each other: the directions are nearly one vector and are causally interchangeable\. At layers 24 and 32 they separate, and it is the ally\-fit direction that carries the behaviour \(0\.16→0\.930\.16\\to 0\.93at layer 32 while the mixed\-fit direction moves0\.36→0\.520\.36\\to 0\.52\)\. At layer 24 both saturate to1\.0001\.000at the largest doses, so the apparent tie there is saturation rather than equivalence\. Layer 40 is the informative exception: it has the lowest cosine we measure yet both arms are flat\. In this sweep separation alone does not ensure a large intervention effect; the remaining downstream computation does not establish why the effect is small\. Bottom right: the geometry the five panels are keyed to, with the swept layers circled\.*We plot both dose–response curves rather than their ratio*: at small doses the mixed\-fit displacement is a noise\-level denominator and at large doses both arms saturate, so a ratio is undefined at one end and11by construction at the other\. Note the horizontal scales differ by panel: the median residual norm grows from8383at layer 8 to860860at layer 40, so a fixedα\\alphagrid spans a much widerα/‖resid‖\\alpha/\\\|\\mathrm\{resid\}\\\|range shallow, and the outermost shallow doses are representation damage rather than dose–response\.