Pith. sign in

REVIEW 4 major objections 4 minor 26 references

This paper argues that deception detection in LLMs is a representation-dependent problem: the optimal layer depth, probe type, and training lie type all change with the evaluation dataset, so a single universal detector is fundamentally lim

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 12:43 UTC pith:CPJZW3GN

load-bearing objection Useful empirical map of when probes detect lies, but the headline typology result is confounded by sample size and lacks error bars. the 4 major comments →

arxiv 2607.20479 v1 pith:CPJZW3GN submitted 2026-05-29 cs.AI cs.CL

Beyond Liars' Bench: The Impact of Lie Typology, Depth, and Sparsity on Deception Detection in LLMs

Amr Moustafa , Max Feser , Florian Mai This is my paper
classification cs.AI cs.CL
keywords deception detectionlarge language modelsinterpretabilitysparse autoencoderslie typologyrepresentation depthlinear probesLiars' Bench
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper systematically tests four factors — representation depth, probe expressivity, sparse features, and lie typology — for detecting deceptive LLM outputs. It finds that the best layer depth flips between datasets (deeper helps on persona-based lies, shallower on safety-pressure lies), that more expressive probes only selectively beat logistic regression, and that sparse autoencoder features match rather than beat dense hidden states. It also reports that training on different lie types (fabrication, omission, exaggeration) changes detectability with no universal winner, and that mixing lie types can blur the signal. The authors conclude that deception detection should be treated as representation-dependent rather than a single-classifier problem.

Core claim

Using activations from Mistral-Small-3.1-24B and Gemma-2-27B, with dense hidden states and Gemma Scope sparse features at two depths (20th and 66th percentile), across seven probe families and four Liars' Bench datasets, the paper shows: optimal depth is dataset-dependent (66th percentile better on convincing-game and gender-secret; 20th better on harm-pressure choice and knowledge-report); Truth2D gives selective gains but logistic regression stays competitive; SAE features are roughly at parity with dense features; and the best training lie type varies by dataset and layer, with the full mixture never best. A striking finding is sub-random AUROC (0.12–0.16) on HP-KR, interpreted as anti-tr

What carries the argument

The load-bearing mechanism is the probing pipeline over LLM activations: representations extracted at two depth percentiles (20% and 66%) as dense hidden states or sparse SAE features are scored by probe families that differ in expressivity — logistic regression, truncated polynomial classifier, Truth2D, Mass-Mean, iterative null-space projection, a follow-up prompt probe, and an upper-bound probe. The design isolates how each factor (depth, expressivity, sparsity, lie type) shifts separability, making it possible to observe that detectability is not a property of the model alone but of the representation–dataset pairing.

Load-bearing premise

The paper's conclusion that mixing lie types blurs the deception signal rests on comparing conditions that differ not only in lie type but in per-category sample size: each single-type condition uses 1000 examples of one type while the mixture uses about 333 of each type, so the mixture's weaker performance could be a data-availability artifact.

What would settle it

Run the typology comparison with matched per-type sample size: train fabrication-only, omission-only, exaggeration-only, and an equal-mixture condition each containing 1000 examples per type (3000 total mixture). If the mixture no longer underperforms, the 'mixture blurs the deception signal' claim fails; if it still underperforms, the typology effect holds.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Monolithic detectors are fundamentally limited; context-aware routing (e.g., Mixture-of-Experts) is a recommended direction.
  • Later layers are not universally better; layer choice must be tuned per deployment context.
  • Sparse autoencoder features, at least at this depth, do not improve detection and can be treated as an equivalent representation rather than a fix.
  • Training on a mixture of lie types can blur the deception signal, so curation of training lie typology matters.
  • Direct-fabrication probes can actively anti-transfer on safety-pressure deception, meaning a detector can be worse than chance in unseen lie contexts.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Because the mixture condition holds total samples at 1000 while single-type conditions have 1000 of one type, the 'mixture blurs' conclusion is confounded with per-category sample size; matching per-type samples (e.g., 1000 each) would test whether typology or data quantity drives the effect.
  • The sub-random AUROC on HP-KR hints that a dedicated probe for safety-pressure denial, trained separately from direct-fabrication data, could outperform a generalist probe.
  • The two-depth sampling likely misses the true per-dataset peak; a continuous layer sweep would clarify whether depth-dependence is gradual or has sharp transitions.
  • The follow-up probe's strong upper-bound performance on all datasets suggests that the follow-up token representation is more separable; an extension would train on follow-up activations from the mixture condition.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper investigates four factors that affect the detectability of deceptive outputs in LLMs using activation-based probes: representation depth (20th vs 66th percentile layers), probe expressivity (logistic regression, TPC, Truth2D, Mass-Mean, INLP, follow-up, and upper-bound probes), sparse vs dense representations (Gemma-2-27B dense hidden states vs Gemma Scope SAE features), and lie typology of the training data (fabrication, omission, exaggeration, and a mixture, from DolusChat). Evaluations are performed on four Liars' Bench subsets (CG, GS, HP-C, HP-KR). The paper reports that optimal depth flips across datasets, more expressive probes yield only selective gains, SAE features roughly match dense features, and the best training lie type depends on dataset and depth; the full mixture is never best. The authors conclude that deception detection is a representation-dependent problem rather than a single-classifier problem.

Significance. If the findings hold, the paper provides a useful set of negative/contextual results for the deception-probing community: sparse autoencoder features do not clearly improve over dense hidden states, truncated polynomial classifiers do not dominate a simple logistic baseline, and the optimal probing layer is not universal. The dense-vs-sparse comparison is well controlled (same foundation model, same layer), and releasing code supports reproducibility. The paper also engages substantively with recent mechanistic interpretability work. However, the strength of the main claims is currently undermined by a confound in the lie-typology experiment and by the absence of any uncertainty quantification, so the empirical support for the 'representation-dependent problem' framing is weaker than the text suggests.

major comments (4)
  1. [§5.4 / Figure 2] The central typology claim is confounded by sample size. Section 4.1 fixes K=1000 for every training condition. Thus the fabrication/exaggeration/omission-only conditions contain 1000 examples of that type, while the full DolusChat mixture contains roughly 333 examples per type (if balanced). The observation that the mixture 'is never the best' and 'may blur the deception signal' cannot be distinguished from a per-category sample-size effect: fewer examples per type may simply yield noisier or weaker learned directions. This is load-bearing because the mixture result is the main evidence for the claim that a monolithic detector trained on all lie types cannot capture a universal deception direction. Please rerun with matched per-category sample sizes (e.g., 1000 per type in every condition, or a mixture with equal per-type counts and a larger total), or at minimum include an ablation tha
  2. [§5 / Tables 1–2] No error bars, confidence intervals, or significance tests appear anywhere in the paper, and the Limitations section explicitly disclaims them. Many conclusions rest on differences of 0.01–0.05 AUROC (e.g., dense vs SAE averages, TPC vs logistic, several depth comparisons). Without repeated seeds, bootstrap intervals, or paired tests, the claims of 'selective gains,' 'parity,' and 'dataset-dependent' depth are not quantitatively supported. Please report variance across at least 5 seeds or nonparametric confidence intervals for the headline results, particularly the depth flips in Table 1 and the SAE-vs-dense comparisons in Table 2.
  3. [§5.1 / HP-KR] The sub-chance AUROC on HP-KR (e.g., 0.12–0.16) is interpreted as 'active anti-transfer' and as evidence that 'the internal representation of a direct fabrication is inverted compared to... a model falsely denying hazardous knowledge.' The paper cites prior work for sub-chance values, but does not verify within the current model that the learned probe direction is systematically anti-correlated with HP-KR labels. This could instead arise from distribution shift, label imbalance, threshold artifacts, or the particular training set. Please test this by (a) training the same probe on a control condition (e.g., random labels or a truthful-only training set) and showing that AUROC is not also sub-chance, and (b) comparing the probe weight vector to the HP-KR class-mean difference or performing a direction-based intervention to confirm the claimed inversion.
  4. [§5.1 / §3.1] The depth conclusion is derived from only two percentiles (20% and 66%). While those anchors are motivated by prior work, the claim that the optimal depth 'is strictly tied to the nature of the deceptive context' would be more convincing with at least one intermediate layer or a coarse sweep; with two points, the observed crossover may reflect a single anomalous layer rather than a systematic trend. If computational constraints preclude a sweep, please temper the wording of the depth conclusion or provide additional evidence from the prior benchmark that these two percentiles bracket the relevant variation for the models used here.
minor comments (4)
  1. [Figure 2] The x-axis labels appear corrupted by path-like strings such as '/uni00000013/uni00000011/uni00000013'. This is likely a font/encoding issue and should be fixed before publication.
  2. [§3.2 / §4.1] The text says 'K=1000 examples' for DolusChat sampling in §3.2 and 'training utilizes 1,000 DolusChat samples' in §4.1, but it is unclear whether this means 1000 per training condition or 1000 total across all conditions. Please state explicitly and consistently.
  3. [Limitations] The limitations section refers to 'the constraints of an extended abstract.' If this is a full-length paper, remove this phrasing; if it is a short paper, clarify the venue and scope.
  4. [References] Some references are under-specified (e.g., [6] lists only an OpenReview URL with no venue or year). Please complete the bibliographic details.

Circularity Check

0 steps flagged

No significant circularity: empirical study with external anchors, held-out evaluation, and transparent ceiling probes.

full rationale

The paper is an empirical benchmark study, not a derivation chain. Probes are trained on DolusChat/white-box data and evaluated on held-out Liars' Bench subsets, so the central findings (dataset-dependent depth, selective expressivity gains, SAE parity, typology effects) come from held-out generalization rather than from fitting and re-predicting the same data. The 66th-percentile depth anchor is imported from prior work by Boxo et al. as an external mechanistic observation, and the paper explicitly tests its effect rather than assuming it; indeed, it reports dataset-dependent outcomes. The Upper-Bound Probe is transparently computed by splitting within-dataset activations and is labeled as an optimistic ceiling, not as a prediction of cross-dataset performance. Figure 2's typology comparison may suffer from a sample-size confound (K=1000 total for the mixture versus 1000 per single-type condition), but that is an experimental-design concern, not a definitional or self-referential circularity. There are no self-citations, no imported uniqueness theorems, and no fitted parameters renamed as predictions. The limitations section candidly notes the absence of significance testing and the use of two depth percentiles, which further supports a non-circular interpretation. Overall, the results do not reduce to their inputs by construction.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The paper rests on standard empirical assumptions about label reliability and representation faithfulness; the only hand-set quantities are the training sample size, the two depth anchors, and probe hyperparameters. No new entities or first-principles assumptions are introduced.

free parameters (4)
  • DolusChat training sample size K = 1000
    Sampled in Section 3.2; fixed across all conditions, confounding the mixture comparison because the full mixture gives ~333 examples per lie type.
  • Layer depth anchors = 20th and 66th percentiles (Layer 31 for Gemma-2-27B)
    Chosen from prior work (Liars' Bench baseline and Boxo et al. peak), not from a sweep; the depth conclusions are conditional on these two points.
  • Classification threshold = 0.5
    Used for recall; acknowledged in Limitations as a limitation for operational use.
  • Probe hyperparameters = lr=1e-3, epochs=20, batch_size=64
    Fixed across all experiments without sensitivity analysis.
axioms (4)
  • domain assumption DolusChat labels (fabrication/omission/exaggeration) are correct
    Section 3.2 relies on these labels to define training conditions; if labels are noisy the typology conclusions shift.
  • domain assumption Liars' Bench truthful/deceptive labels are correct for the four evaluation sets
    Section 3.3 takes these as ground truth for measuring transfer.
  • domain assumption Gemma Scope SAE features faithfully represent activations at the chosen layer
    Section 3.5 uses gemma-scope-27b-pt-res-canonical features; any reconstruction loss or feature sparsity choice affects the comparison.
  • domain assumption AUROC on these four scenarios is a valid measure of deception detectability
    The paper's core metric is AUROC; if the scenarios are not representative, the representation-dependent conclusion is weakened.

pith-pipeline@v1.3.0-alltime-deepseek · 13239 in / 13548 out tokens · 119448 ms · 2026-08-02T12:43:33.911753+00:00 · methodology

0 comments
read the original abstract

Training probes to detect deceptive outputs from large language models is still an open problem. Recent work has demonstrated that detection probes fail especially in out-of-domain scenarios -- training on one type of lie does not transfer well to deception scenarios involving other types of lies. In this work, we conduct a systematic study on how various factors impact detection performance: representation depth, probe expressivity, sparse feature representations, and the lie typology of the training data. To this end, we augment standard benchmark training data with a supplementary dataset containing diverse types of deception, including fabrication, omission, and exaggeration examples. Analyzing these factors across seven probe types, our experimental results show that the optimal representation depth is highly dataset-dependent, more expressive probes provide only selective gains over linear baselines, and sparse autoencoder features perform similarly to dense hidden states. Ultimately, we demonstrate that the choice of training data and lie typology substantially changes detectability, highlighting that deception detection is a highly representation-dependent problem.

Figures

Figures reproduced from arXiv: 2607.20479 by Amr Moustafa, Florian Mai, Max Feser.

Figure 1
Figure 1. Figure 1: End-to-end pipeline for evaluating deception detection in LLMs. Input data (truthful and deceptive responses) are [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 1
Figure 1. Figure 1: The codebase supports three extraction modes: token-wise train￾ing activations, mean-pooled evaluation activations, and a follow￾up condition probed on the final token. To systematically test the depth hypothesis without requiring computationally exhaus￾tive layer sweeps, we evaluate two carefully anchored depths. For our early-layer baseline, we extract at the 20th percentile, directly matching the standa… view at source ↗
Figure 2
Figure 2. Figure 2: Comparison of logistic-probe AUROC across lie-typology training conditions and evaluation datasets. We compare [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

26 extracted references · 5 linked inside Pith

  1. [1]

    Guillaume Alain and Yoshua Bengio. 2017. Understanding Intermediate Layers Using Linear Classifier Probes. InInternational Conference on Learning Represen- tations (ICLR). https://openreview.net/forum?id=HJ4-rAVtl

    2017

  2. [3]

    Gerard Boxo, Ryan Socha, Daniel Yoo, and Shivam Raval. 2025. Caught in the Act: A Mechanistic Approach to Detecting Deception.arXiv preprint arXiv:2508.19505 (2025). https://arxiv.org/abs/2508.19505

    arXiv 2025

  3. [4]

    Hamprecht, and Boaz Nadler

    Lennart Bürger, Fred A. Hamprecht, and Boaz Nadler. 2024. Truth Is Universal: Robust Detection of Lies in LLMs. InAdvances in Neural Information Processing Systems (NeurIPS), Vol. 37. Curran Associates, Inc., 138393–138431. doi:10.52202/ 079017-4392

    2024

  4. [5]

    Collin Burns, Haotian Ye, Dan Klein, and Jacob Steinhardt. 2023. Discovering Latent Knowledge in Language Models Without Supervision. InInternational Conference on Learning Representations (ICLR). https://openreview.net/forum? id=ETKGuby0hcs

    2023

  5. [6]

    Chris Cundy and Adam Gleave. 2025. Preference Learning with Lie Detectors Can Induce Honesty or Evasion. InAdvances in Neural Information Processing Systems (NeurIPS). https://openreview.net/forum?id=ibLGUkBWlz

    2025

  6. [7]

    Nelson Elhage, Tristan Hume, Catherine Olsson, Nicholas Schiefer, Tom Henighan, Shauna Kravec, Zac Hatfield-Dodds, Robert Lasenby, Dawn Drain, Carol Chen, et al . 2022. Toy Models of Superposition.arXiv preprint arXiv:2209.10652(2022). https://arxiv.org/abs/2209.10652

    Pith/arXiv arXiv 2022

  7. [8]

    Nicholas Goldowsky-Dill, Bilal Chughtai, Stefan Heimersheim, and Marius Hobb- hahn. 2025. Detecting Strategic Deception Using Linear Probes.arXiv preprint arXiv:2502.03407(2025). https://arxiv.org/abs/2502.03407

    Pith/arXiv arXiv 2025

  8. [9]

    Robert Huben, Hoagy Cunningham, Logan Riggs Smith, Aidan Ewart, and Lee Sharkey. 2024. Sparse Autoencoders Find Highly Interpretable Features in Lan- guage Models. InInternational Conference on Learning Representations (ICLR). https://openreview.net/forum?id=F76bwRSLeK

    2024

  9. [10]

    Ziegler, Tim Maxwell, Newton Cheng, et al

    Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M. Ziegler, Tim Maxwell, Newton Cheng, et al. 2024. Sleeper Agents: Training Deceptive LLMs That Persist Through Safety Training.arXiv preprint arXiv:2401.05566(2024). https://arxiv.org/abs/2401.05566

    Pith/arXiv arXiv 2024

  10. [11]

    Subhash Kantamneni, Joshua Engels, Senthooran Rajamanoharan, Max Tegmark, and Neel Nanda. 2025. Are Sparse Autoencoders Useful? A Case Study in Sparse Probing. InInternational Conference on Machine Learning (ICML). https: //openreview.net/forum?id=rNfzT8YkgO

    2025

  11. [12]

    Kieron Kretschmar, Walter Laurito, Sharan Maiya, and Samuel Marks. 2025. Liars’ Bench: Evaluating Lie Detectors for Language Models.arXiv preprint arXiv:2511.16035(2025). https://arxiv.org/abs/2511.16035

    arXiv 2025

  12. [13]

    Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wat- tenberg. 2023. Inference-Time Intervention: Eliciting Truthful Answers from a Language Model. InAdvances in Neural Information Processing Systems (NeurIPS), Vol. 36. 41451–41530. https://proceedings.neurips.cc/paper_files/paper/2023/ hash/81b8390039b7302c909cb769f8b6cd93-Abstract-C...

    2023

  13. [14]

    Tom Lieberum, Senthooran Rajamanoharan, Arthur Conmy, Lewis Smith, Nicolas Sonnerat, Vikrant Varma, János Kramár, Anca Dragan, Rohin Shah, and Neel Nanda. 2024. Gemma Scope: Open Sparse Autoencoders Everywhere All at Once on Gemma 2. InProceedings of the 7th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP. 278–300. https://arxiv.o...

    Pith/arXiv arXiv 2024

  14. [15]

    Stephanie Lin, Jacob Hilton, and Owain Evans. 2022. TruthfulQA: Measuring How Models Mimic Human Falsehoods. InProceedings of the 60th Annual Meeting of the Association for Computational Linguistics (ACL). Association for Computational Linguistics, Dublin, Ireland, 3214–3252. doi:10.18653/v1/2022.acl-long.229

    doi:10.18653/v1/2022.acl-long.229 2022

  15. [16]

    Samuel Marks and Max Tegmark. 2024. The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasets. In Conference on Language Modeling (COLM). https://openreview.net/forum?id= aajyHYjjsk

    2024

  16. [17]

    James Oldfield, Philip Torr, Ioannis Patras, Adel Bibi, and Fazl Barez. 2026. Beyond Linear Probes: Dynamic Safety Monitoring for Language Models. InInternational Conference on Learning Representations (ICLR). https://openreview.net/forum? id=AGWa8whf92

    2026

  17. [18]

    Lorenzo Pacchiardi, Alex James Chan, Sören Mindermann, Ilan Moscovitz, Alexa Yue Pan, Yarin Gal, Owain Evans, and Jan M. Brauner. 2024. How to Catch an AI Liar: Lie Detection in Black-Box LLMs by Asking Unrelated Ques- tions. InInternational Conference on Learning Representations (ICLR). https: //openreview.net/forum?id=567BjxgaTp

    2024

  18. [19]

    Park, Simon Goldstein, Aidan O’Gara, Michael Chen, and Dan Hendrycks

    Peter S. Park, Simon Goldstein, Aidan O’Gara, Michael Chen, and Dan Hendrycks

  19. [20]

    Ethan Perez, Sam Ringer, Kamil˙e Lukoši¯ut˙e, Karina Nguyen, Edwin Chen, Scott Heiner, Craig Pettit, Catherine Olsson, Sandipan Kundu, Saurav Kadavath, et al

  20. [21]

    Senthooran Rajamanoharan, Tom Lieberum, Nicolas Sonnerat, Arthur Conmy, Vikrant Varma, János Kramár, and Neel Nanda. 2024. Jumping Ahead: Improving Reconstruction Fidelity with JumpReLU Sparse Autoencoders.arXiv preprint arXiv:2407.14435(2024). https://arxiv.org/abs/2407.14435

    Pith/arXiv arXiv 2024

  21. [22]

    Shauli Ravfogel, Yanai Elazar, Hila Gonen, Michael Twiton, and Yoav Goldberg

  22. [23]

    Jerry Wei, Da Huang, Yifeng Lu, Denny Zhou, and Quoc V. Le. 2024. Simple Synthetic Data Reduces Sycophancy in Large Language Models. InInternational Conference on Learning Representations (ICLR). https://openreview.net/forum? id=WDheQxWAo4

    2024

  23. [24]

    Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Yang, Richard Yin, Dan Yin, Mantas Mazeika, et al . 2024. Representation Engineering: A Top- Down Approach to AI Transparency. InInternational Conference on Learning Representations (ICLR). https://openreview.net/forum?id=fq1Sj4XpsS 9

    2024

  24. [2020]

    InProceedings of the 58th Annual Meeting of the Association for Computational Linguistics (ACL)

    Null It Out: Guarding Protected Attributes by Iterative Nullspace Projection. InProceedings of the 58th Annual Meeting of the Association for Computational Linguistics (ACL). Association for Computational Linguistics, Online, 7237–7256. doi:10.18653/v1/2020.acl-main.647

    doi:10.18653/v1/2020.acl-main.647 2020

  25. [2023]

    InFindings of the Association for Computational Linguistics (ACL)

    Discovering Language Model Behaviors with Model-Written Evaluations. InFindings of the Association for Computational Linguistics (ACL). Association for Computational Linguistics, Toronto, Canada, 13387–13434. doi:10.18653/v1/ 2023.findings-acl.847

    doi:10.18653/v1/ 2023

  26. [2024]

    doi:10.1016/j.patter.2024.100988

    AI Deception: A Survey of Examples, Risks, and Potential Solutions.Patterns 5, 5 (2024), 100988. doi:10.1016/j.patter.2024.100988

    arXiv 2024