← 研踪 PaperTrailarXiv:2606.17478 · v2
From Hidden States to Confessions: Auditing Deception in Reasoning Models
首次提交 2026-06-16 11:41
版本更新 2026-11-07 21:58
雷达观测 2026-11-10 11:14
摘要
As LLMs acquire stronger reasoning capabilities, deceptive behavior becomes an increasingly serious safety concern. Existing deception monitors typically either score visible transcripts or derive scalar probe scores from representation vectors, leaving little inspectable evidence about why a response is suspicious. We introduce StateWitness, an audit decoder for deception monitoring. It reads a target model's hidden states to answer audit queries and produce confession-style reports of potential failures or violations. We evaluate generalization beyond the decoder's audit training data across two target reasoning models and seven deception datasets. StateWitness achieves 0.916 mean AUROC, with relative gains of 11.6% and 25.0% over the best black-box and activation-probe baselines, respectively, under the same evaluation protocol. When combined with existing monitors, StateWitness reduces missed deceptive examples in simple threshold ensembles. Beyond scalar detection, the decoder returns query-level answers, schema reports, and token- or sentence-level evidence traces for human inspection. We envision StateWitness as one monitoring layer in a broader defense-in-depth strategy.
作者备注：Under review
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v2 · 2026-11-07 21:58 · 最新观测版本
From Hidden States to Confessions: Auditing Deception in Reasoning Models
As LLMs acquire stronger reasoning capabilities, deceptive behavior becomes an increasingly serious safety concern. Existing deception monitors typically either score visible transcripts or derive scalar probe scores from representation vectors, leaving little inspectable evidence about why a response is suspicious. We introduce StateWitness, an audit decoder for deception monitoring. It reads a target model's hidden states to answer audit queries and produce confession-style reports of potential failures or violations. We evaluate generalization beyond the decoder's audit training data across two target reasoning models and seven deception datasets. StateWitness achieves 0.916 mean AUROC, with relative gains of 11.6% and 25.0% over the best black-box and activation-probe baselines, respectively, under the same evaluation protocol. When combined with existing monitors, StateWitness reduces missed deceptive examples in simple threshold ensembles. Beyond scalar detection, the decoder returns query-level answers, schema reports, and token- or sentence-level evidence traces for human inspection. We envision StateWitness as one monitoring layer in a broader defense-in-depth strategy.
查看此版本解读 →查看此版本原文 ↗