Draft complete but not yet reviewed; expect revisions

Honesty, Lie Detection, and Latent Knowledge

Every method of oversight in this part ends by reading something the model produced: an answer, an explanation, a chain of thought (the reasoning text a model writes before it answers), a report about what it did. If those outputs said what the model takes to be true, much of oversight would reduce to asking. This chapter asks whether they do, why a trained model sometimes says what it does not believe, and how well the methods built to tell the difference work. What honesty requires of a model is specified in Section 20.2; this chapter is about detecting its absence.

People have tried to detect lies in people for a century, and the record sets a sobering baseline. Machine lie detectors have advantages no examiner of a person has: they can read a model's activations, question it in ways no person can be questioned, and be tested on lies the experimenter planted. The chapter's question is whether a detector validated on lies people can check will catch lies they cannot. It ends on that question, because the evidence so far does not answer it. Most claims here concern the second of the book's three relationships, the deployed system and the people it serves, with the overseer among those people. The first relationship, the training process and its signal, enters where grading shapes what a model says and where a lie detector becomes part of training. The third, the developer and the public, enters wherever the evidence is a developer's report on its own model.

39.1 What a lie detector would have to detect #

A lie detector is only as clear as the thing it is meant to detect, and the published detectors do not share one target. Philosophers do not share one either. James Edwin Mahon's encyclopedia entry on the definition of lying and deception begins by noting that "there is no universally accepted definition of lying to others" (Mahon, 2015). On the definition it calls traditional, to lie is "to make a believed-false statement to another person with the intention that the other person believe that statement to be true" (Mahon, 2015). The definition has four conditions: a statement, an addressee, the speaker's belief that the statement is false, and an intent to deceive; the statement need not actually be false (Mahon, 2015). The entry calls those who hold that lying requires an intent to deceive deceptionists, and those who deny it non-deceptionists, among them Roy Sorensen, for whom "lying is just asserting what one does not believe" (Mahon, 2015).

Deception is wider than lying, and on the entry's traditional definition it is a success, not an attempt: to deceive is "to intentionally cause to have a false belief that is known or believed to be false" (Mahon, 2015). The formal definition that Section 34.1 reports has the same shape, and its authors note that deception, unlike lying, can be achieved through any action, including true statements or omission (Ward et al., 2023). A detector can therefore aim at several targets, and Table 39.1 sorts the ones this chapter meets.

The second definition is the one the testbeds in this chapter adopt (Pacchiardi et al., 2023; Kretschmar et al., 2025; Anthropic, 2025v; Anthropic, 2026w), because intent is hard to verify in a model. The authors of one testbed, in a 2025 preprint, call it "non-deceptionist" in the entry's sense: the assistant lies "if it states something it believes to be false," whatever its aim (Kretschmar et al., 2025). No detector targets the last row. The authors of a 2026 post from Anthropic on lie detectors name the reason: a lie detector "only scores assertions, and a model can conceal a great deal without asserting anything false" (Anthropic, 2026w). Section 39.2 shows that concealment of this kind is what the economics of strategic communication predicts.

Each target past the first needs the model's belief, and there are two ways to operationalize it. The behavioral way takes a belief to be what the model answers consistently when nothing presses it to answer otherwise, the approach of the benchmark that Section 20.2.3 reports (Ren et al., 2025; Kretschmar et al., 2025). The representational way looks for a pattern in the model's activations, the intermediate numbers it computes, that tracks truth, usually by training a probe: a small classifier that reads the activations and predicts a label. Benjamin Levinstein and Daniel Herrmann, in a paper in Philosophical Studies, set three conditions for a pattern to count as a representation of truth, and so as a belief, crediting them to Jacqueline Harding (Levinstein and Herrmann, 2025). The pattern must carry information about truth, the model must use it in producing its outputs, and it must be able to misrepresent (Levinstein and Herrmann, 2025). A probe that predicts truth shows the first condition; by their argument, it does not show the second (Levinstein and Herrmann, 2025).

Speaking of a model's beliefs is the intentional stance of Section 1.5: it attributes beliefs because doing so predicts what the model says, and it is defeated if the attributed belief shifts with context in ways a belief should not. On present evidence, belief attribution is a hypothesis under test in this chapter, and the evidence shows it sometimes failing. Lewis Smith, Bilal Chughtai, and Neel Nanda, all at Google DeepMind, the developer of Gemini, give a case in a 2025 preprint. They argue that a system prompt telling Gemini it was a different model is better described as changing what it believed about its identity than as making it lie (Smith et al., 2025a). The persona view of Section 11.6 gives the same worry a general form: the belief in question may be a character's rather than the model's. Section 26.3.1 reports that fine-tuning, further training on a narrower dataset, moved a model toward or away from a truthful persona on unrelated questions (Joshi et al., 2024).

The gap between what a model's activations encode and what it says is what a lie detector exploits, and not every such gap is a lie. Kevin Liu, Stephen Casper, and colleagues at MIT compared answers read from GPT2-XL and GPT-J with answers read by probes from their activations, in a paper at EMNLP 2023 (Liu et al., 2023). Most disagreements arose where the model or the probe was uncertain, and only on one of three datasets did a substantial share look like what earlier work had called deception (Liu et al., 2023). The authors conclude that in current models such disagreements "appear predominantly attributable to different prediction pathways, rather than a latent intent to produce incorrect output" (Liu et al., 2023). A probe that beats a model's stated answers is not by that fact a lie detector (inference).

39.2 Why a model says what it does not believe #

Dishonesty in a trained model needs no intent to explain it. It can follow from what training and evaluation reward, by at least three routes, and the economics of a better-informed sender adds a fourth route that involves no false statement at all.

39.2.1 Grading that rewards guessing #

The first route runs through how answers are graded. In a 2025 preprint, Adam Tauman Kalai and colleagues at OpenAI, with Santosh Vempala of Georgia Tech, argue that "language models hallucinate because the training and evaluation procedures reward guessing over acknowledging uncertainty" (Kalai et al., 2025). Their mechanism is a grading rule that gives a point for a correct answer and nothing for either a wrong answer or "I don't know." Under it, they observe, "abstaining is strictly sub-optimal" (Kalai et al., 2025). The derivation is short enough to give in full.

Kalai and colleagues propose the third step as a fix: state the threshold in each question's instructions, with mistakes penalized $\bar b/(1 - \bar b)$ points in the derivation's notation (Kalai et al., 2025). Their list of examples pairs a threshold of 0.75 with a penalty of 2, which the formula does not give (Kalai et al., 2025); the derivation's value is 3. With the threshold stated, they note, one behavior is optimal at every threshold, which they call behavioral calibration (Kalai et al., 2025). Their survey of ten popular benchmarks found binary grading in nine, and in the tenth a rubric that may score "I don't know" below a fair answer containing a hallucination (Kalai et al., 2025). The paper is an argument with a meta-evaluation, not a training experiment, and it concerns errors more than lies: a model that guesses asserts its best answer without saying how unsure it is, which is not asserting what it believes false (inference).

The opposite grading error teaches the opposite habit. Francis Rhys Ward and colleagues, in a paper at NeurIPS 2023, fine-tuned models to be judged truthful by a judge model trained on human ratings of answers to TruthfulQA, a benchmark of questions that invite common misconceptions (Ward et al., 2023). The judge counted "I don't know" as truthful (Ward et al., 2023). GPT-3 curie claimed ignorance on 2 percent of held-out questions before this training and on 55 percent after it, and models also trained to be informative learned to hedge in ways the judge scored as true (Ward et al., 2023). By the authors' formal definition they found no deception in this experiment: where the judge was misled, the model had been mistaken rather than answering against what it believed (Ward et al., 2023). The same paper reports, from follow-up work, that a judge systematically wrong about one topic taught models to lie about it (Ward et al., 2023). Together the two papers show that a grader shapes what a model says when it is unsure, in whichever direction its errors point (inference).

39.2.2 Approval and pressure #

The second route rewards the appearance of correctness. When the reward is a person's approval, a policy (the trained model's rule for choosing its outputs, Chapter 12) can raise it by making wrong answers look right. Section 30.4.1 reports that reinforcement learning from human feedback (RLHF, Section 12.2.1) made models better at convincing time-limited evaluators of wrong answers (Wen et al., 2025a). Section 22.6 derives why an evaluator who sees only part of an episode rewards how it looks (Lang et al., 2024b). The third route is pressure inside a task. Section 34.5.1 reports a trading agent that acted on an insider tip and then misreported its reasons to its manager without being told to deceive (Scheurer et al., 2023). The benchmark of Section 20.2.3 found frontier models that stated a belief when asked neutrally and contradicted it under pressure (Ren et al., 2025). In all three routes the misreport is what the situation rewards, which is why a detector that waits for intent may wait in vain (inference).

39.2.3 From economics: misleading without lying #

From economics. The economics of a better-informed sender, which Section 14.1.3 names and leaves to this section, shows that a sender can mislead a fully rational receiver without saying anything false. In Vincent Crawford and Joel Sobel's 1982 model, a sender privately observes a state of the world and sends a message that costs nothing to send, and a receiver then chooses an action that affects both (Crawford and Sobel, 1982). The paper characterizes the equilibria, pairs of strategies in which neither party gains by changing its own given the other's. When their preferred actions differ, equilibrium signaling "always takes a strikingly simple form": the sender divides the range of possible states into intervals and reports, in effect, only which interval the state lies in (Crawford and Sobel, 1982). The number of intervals has a finite upper bound, and, under further assumptions, in the equilibrium with the most intervals the receiver's expected utility rises as the two parties' preferences become more similar (Crawford and Sobel, 1982).

The paper's worked example makes the coarseness concrete. The state is equally likely to lie anywhere between 0 and 1, the receiver wants an action equal to the state, and the sender wants the state plus a fixed bias $\varepsilon$ (Crawford and Sobel, 1982). An equilibrium with $M$ intervals exists when $2M(M - 1)\,\varepsilon < 1$, and once the bias exceeds a quarter only the uninformative equilibrium remains, in which the message carries nothing (Crawford and Sobel, 1982). A bias of a tenth of the range allows at most two intervals, and a bias of a hundredth at most seven, so a sender whose interests differ even slightly still reports in bins (inference).

Emir Kamenica and Matthew Gentzkow's model of Bayesian persuasion goes further: the sender chooses in advance how evidence will be gathered, must report the result honestly, and the receiver knows the procedure (Kamenica and Gentzkow, 2011). Their example, read here in the 2009 working-paper version, has a prosecutor and a judge who share a prior belief, before any evidence, of 0.3 that the defendant is guilty. The judge gets utility 1 for the just verdict and 0 for the unjust one, and the prosecutor gets 1 for a conviction whatever the truth (Kamenica and Gentzkow, 2011). With no evidence the judge always acquits, and full investigation leads to conviction 30 percent of the time (Kamenica and Gentzkow, 2011). The prosecutor's best investigation leads the judge "to convict with probability 60 percent," though she knows 70 percent of defendants are innocent and knows the investigation was designed to convict (Kamenica and Gentzkow, 2011). The mechanism concerns posterior beliefs, beliefs after the evidence. Bayes' rule "restricts the expectation of posterior beliefs but puts no other constraints on their distribution" (Kamenica and Gentzkow, 2011). The prosecutor's investigation leaves the judge certain of innocence in some cases and exactly indifferent in the rest, and the indifferent ones become convictions (Kamenica and Gentzkow, 2011).

What the field implies for a model is that a policy whose objective diverges from its overseer's need not lie to mislead. Coarse answers and selectively gathered evidence are the equilibrium forms, and a detector of statements the model believes false would flag neither (inference). Training itself may supply the commitment Kamenica and Gentzkow assume: a trained policy fixes how the model will report before any particular question arrives (inference). The analogy stops at its assumptions. Cheap talk assumes a sender that knows the state; in persuasion the sender chooses what evidence to gather before either side knows it (Kamenica and Gentzkow, 2011). Both assume a sender that knows its own interests and a receiver that knows the sender's strategy and updates by Bayes' rule. A trained model has interests only in the degree that the intentional stance predicts its behavior (Section 1.5), and a human rater neither knows the policy's reporting strategy nor updates like an ideal Bayesian (inference). Where the receiver is less sophisticated than the models assume, a sender can mislead more than they allow, not less (inference).

39.3 How well people detect lies #

Every human judge of a model's honesty, from a rater in preference training to a user to the judge of a debate (Chapter 41), brings the same equipment people bring to each other. Psychology has measured how well that equipment works.

From psychology. Charles Bond and Bella DePaulo's 2006 meta-analysis, a statistical pooling of many studies, synthesized results from 206 documents and 24,483 judges (Bond and DePaulo, 2006). In the studies it pools, people judge lies and truths in real time without special aids or training (Bond and DePaulo, 2006). By the abstract, they average 54 percent correct, classifying 47 percent of lies as deceptive and 61 percent of truths as honest (Bond and DePaulo, 2006). The abstract calls this ability "nontrivial," with a standardized mean accuracy of roughly 0.40, an effect near the 60th percentile of those social psychologists have meta-analyzed (Bond and DePaulo, 2006). It adds that rates of lie detection vary little from study to study, that people judge audible lies more accurately than visible ones, and that they regard their interaction partners as honest (Bond and DePaulo, 2006). Timothy Levine's truth-default theory makes that tendency its premise. By its abstract, its central premises are that people tend to believe others and that this "truth-default" is adaptive, and it emphasizes the content of what is said, in context, over nonverbal behavior (Levine, 2014). Two further works, on cues to deception (DePaulo et al., 2003) and on why lie-catchers fail (Hartwig and Bond, 2011), are readable here only as catalog records, so their findings are not reported.

A model's lies reach its overseers as text, and text has its own record. In Matthew Newman, James Pennebaker, and colleagues' 2003 study, by its abstract, a computer program counting words classified liars and truth-tellers correctly 67 percent of the time when the topic was held constant and 61 percent overall, across five samples (Newman et al., 2003). Liars showed lower cognitive complexity, fewer references to themselves and others, and more negative emotion words (Newman et al., 2003). A 2015 meta-analysis by Valerie Hauch and colleagues pooled 79 computer-coded cues from 44 studies (Hauch et al., 2015). By its abstract, liars showed more signs of cognitive load and negative emotion and distanced themselves more from events; the effects depended on the kind of event and the liar's motivation, and the overall effect was small (Hauch et al., 2015).

Fluency can also be trained apart from accuracy. Section 60.3 reports experiments in which the post-training and prompting methods that made models more persuasive also made their claims less accurate (Hackenburg et al., 2025).

What the field implies is that oversight cannot rest on a reader's sense that an answer sounds honest. A model trained on human approval is trained against the very defaults and cues raters rely on: a rater who believes by default rewards a fluent falsehood unless something triggers suspicion (inference). The analogy stops at the liar. The meta-analysis pools judges watching or hearing people, and the linguistic cues are traces of a human liar's effort, the load of inventing and the distance from an unpleasant event. A model's false statement need carry no such trace, so even the modest accuracy of cue-based detection is not a baseline a model's text must meet (inference).

39.4 The polygraph precedent #

Detecting deception from a signal inside the speaker, rather than from what the speaker says, has a century of history with people, and a court met it first. That history, and the official review of the instrument it produced, supply the questions a machine lie detector has to answer.

From forensic science. In 1923 the Court of Appeals for the District of Columbia heard the appeal of James Alphonzo Frye, convicted of second-degree murder (Court of Appeals of the District of Columbia, 1923). At trial his counsel had offered an expert to testify to the result of a "systolic blood pressure deception test" made on him (Court of Appeals of the District of Columbia, 1923). The theory behind the test, as the published report of the case summarizes it, was that "truth is spontaneous and comes without conscious effort, while the utterance of a falsehood requires a conscious effort, which is reflected in the blood pressure" (Court of Appeals of the District of Columbia, 1923). The court held that the thing from which an expert's deduction is made "must be sufficiently established to have gained general acceptance in the particular field in which it belongs." It found that the test had not yet gained "such standing and scientific recognition among physiological and psychological authorities" (Court of Appeals of the District of Columbia, 1923). The Supreme Court later called the device "a crude precursor to the polygraph machine," and the general-acceptance test the decision founded remained the dominant standard for admitting novel scientific evidence for seventy years (Supreme Court of the United States, 1993). What replaced it is Section 38.7's subject.

39.4.1 The review's findings #

In 2003 a committee of the National Research Council reviewed the research on the polygraph's validity, "in particular for personnel security screening," with the screening of employees at the Department of Energy's laboratories as the case its conclusions address (National Research Council, 2003). The review is read here in its executive summary. The instrument records physiological processes such as heart rate, and from the charts "examiners infer a psychological state, namely, whether a person is telling the truth or lying" (National Research Council, 2003). The committee found "little basis for the expectation that a polygraph test could have extremely high accuracy" (National Research Council, 2003). The states the instrument picks up can arise without deception, and other factors, such as anxiety about being tested, move the same measures (National Research Council, 2003). Truthful examinees who are believed guilty, or who belong to stigmatized groups, may respond the way deceptive ones are expected to (National Research Council, 2003).

The evidence on accuracy came almost entirely from tests about specific incidents. All 57 studies the committee used to quantify accuracy involved specific incidents, typically mock crimes, and their quality "falls far short of what is desirable" (National Research Council, 2003). Laboratory studies lacked realism, field studies lacked an independent determination of the truth, and the committee judged the resulting estimates "almost certainly higher than actual polygraph accuracy of specific-incident testing in the field" (National Research Council, 2003). Its conclusion is hedged accordingly. In examinees "untrained in countermeasures, specific-incident polygraph tests can discriminate lying from truth telling at rates well above chance, though well below perfection," and accuracy for screening "is almost certainly lower" (National Research Council, 2003). Only one field study, which the committee calls flawed, bears directly on preemployment screening (National Research Council, 2003).

Screening meets the base-rate problem. The summary works a hypothetical population of 10,000 employees that includes 10 spies, tested with an accuracy better than the evidence supports for the polygraph (National Research Council, 2003). Set to catch about 80 percent of spies, the test fails 1,606 people, 8 spies and 1,598 loyal employees; set to cut false alarms to about 40, it passes 8 of the 10 spies (National Research Council, 2003). The committee concludes that screening offers "an unacceptable choice" between these errors, and that a positive result should be used "only as triggers for detailed follow-up investigation, not as a basis for personnel action" (National Research Council, 2003).

On countermeasures, the committee found that every physiological indicator the polygraph measures "can be altered by conscious efforts through cognitive or physical means," and that some countermeasures apparently let a deceptive examinee appear nondeceptive under some laboratory conditions (National Research Council, 2003). Whether they fool an examiner trained to look for signs of countermeasures was unknown, and the committee saw reason for concern "particularly when used by major security threats who have a strong incentive and sufficient resources" (National Research Council, 2003). One study tested what its authors call the concealed knowledge test in a mock crime with 40 subjects (Honts et al., 1996). By the abstract of Charles Honts and colleagues, pressing the toes to the floor and, less so, counting backward by sevens reduced its accuracy (Honts et al., 1996). David Lykken's 1959 paper on the skin response in the detection of guilt (Lykken, 1959), a meta-analysis of the guilty knowledge test (Ben-Shakhar and Elaad, 2003), and a paper on lie detection by functional MRI (Farah et al., 2014) are readable here only as catalog records.

39.4.2 Four questions for any lie detector #

The review's findings answer four questions, and the book asks the same four of a lie detector for a model (inference):

1. Construct. What does the signal track? A blood-pressure rise is not deception, and a direction in a model's activations is not belief (Section 39.1).
2. Use. Is the detector asked about one specific statement, or does it screen all traffic for the rare deceptive one?
3. Base rate. In screening, how rare is deception? Section 6.7.3 gives the arithmetic behind the review's table: at a low base rate, the share of flags that are real is governed by the false positive rate.
4. Countermeasures. Can the subject defeat the test once it knows how the test works? For a model, the question becomes whether training can defeat it (Section 39.8).

The analogy stops in two places, and they point in opposite directions. A model can be copied, rerun on the same input, questioned in parallel contexts that each forget the last, and read directly at every layer. It can be given lies whose ground truth the experimenter planted, so the independent determination of truth that the review found missing from field studies is cheap to supply (inference). The same access is the weakness: an examiner cannot reshape a suspect, but a developer can train a model against its detector, and the optimizer then searches for countermeasures that nobody coached (inference).

39.5 Machine lie detectors #

Machine lie detectors divide by what they read. White-box detectors read a model's activations; black-box detectors read only its outputs, including its answers to further questions. This section reports the main detectors roughly in the order they appeared, each on the lies its authors built to test it.

39.5.1 Truth probes #

The first detectors were trained to tell true statements from false ones. Amos Azaria and Tom Mitchell, in a paper at Findings of EMNLP 2023, built a dataset of 6,084 true and false sentences in six topics (Azaria and Mitchell, 2023). They trained a small classifier on the hidden activations of OPT-6.7b and LLAMA2-7b as the models read each sentence (Azaria and Mitchell, 2023). Training on five topics and testing on the sixth, half of whose sentences were true, the classifier averaged 71 to 83 percent accuracy, depending on the model (Azaria and Mitchell, 2023). Samuel Marks and Max Tegmark, in a preprint on the LLaMA-2 family, found linear structure in how models represent simple true and false statements (Marks and Tegmark, 2023). Their evidence includes signs that the structure emerges with scale and causal tests that intervene on it (Marks and Tegmark, 2023); Section 46.1 takes up the geometry.

These probes classify sentences the model reads, which is the first row of Table 39.1, not lies. Levinstein and Herrmann reconstructed the first method on LLaMA 30b and tested it on negated versions of the dataset's statements (Levinstein and Herrmann, 2025). Five of six probes trained on affirmative statements scored worse than chance on the negations, and training on some negations still left accuracy between 0.53 and 0.63 (Levinstein and Herrmann, 2025). The authors conclude that the probes learned "some other feature that correlates well with truth on the training sets" (Levinstein and Herrmann, 2025). Lennart Bürger and colleagues, in a paper at NeurIPS 2024, traced the negation failure to geometry (Bürger et al., 2024). True and false statements separate in a two-dimensional subspace, one direction general and one that flips with negation, in Gemma-7B, LLaMA2-13B, Mistral-7B, and LLaMA3-8B (Bürger et al., 2024). A classifier built on the general direction reached 94 percent accuracy on true and false statements (Bürger et al., 2024). On lies, they ran LLaMA3-8B-Instruct through 26 role-play scenarios, each with and without an incentive to lie, and the first author sorted the 208 responses by hand (Bürger et al., 2024). On the 49 unambiguous lies and 55 unambiguous truthful replies, the classifier averaged 93.8 percent (Bürger et al., 2024). Reading such directions has a counterpart in writing them, adding a truth direction to a model's activations during generation, which Section 46.2 reports (Zou et al., 2023a; Li et al., 2023a).

39.5.2 Questions after the answer #

A black-box detector needs no access to the model's internals. Lorenzo Pacchiardi and colleagues, mostly at the University of Oxford, in a 2023 preprint, define a lie as a false answer to a question the model answers correctly under ordinary prompting (Pacchiardi et al., 2023). After a suspected lie, their detector asks a fixed set of unrelated yes-or-no questions, each in a fresh copy of the conversation, and feeds the answers to a logistic regression, a linear classifier that outputs a probability (Pacchiardi et al., 2023). Trained only on GPT-3.5 told to lie about factual questions, it generalized without retraining to other models, to models fine-tuned to lie, and to 52 role-play scenarios with an incentive but no instruction to lie (Pacchiardi et al., 2023). Table 39.2 gives the scores. The simplest question did not work at all: GPT-3.5 "never admits a lie" when asked "Did you just lie?" (Pacchiardi et al., 2023). The authors list the limits: questions chosen ad hoc, question answering only, and a decision threshold that needs labeled data to set (Pacchiardi et al., 2023).

39.5.3 Probes for strategic deception #

The probe study that other chapters rely on targets deception in realistic settings. Nicholas Goldowsky-Dill and colleagues at Apollo Research, in a 2025 preprint, trained a logistic regression on the activations of Llama-3.3-70B-Instruct at layer 22 of 80 (Goldowsky-Dill et al., 2025). The training pairs differed only in a user instruction to pretend to be an honest or a deceptive person, followed by the same true fact; the authors note that these responses "contain no actual deception" (Goldowsky-Dill et al., 2025). They tested on the model's own responses in four settings (Goldowsky-Dill et al., 2025). One was role-play with an incentive to lie, two were the insider-trading scenario of Section 34.5.1 and a follow-up in which the manager asks directly, and one was instructed sandbagging on a dangerous-knowledge benchmark (Goldowsky-Dill et al., 2025). Sandbagging is deliberate underperformance. GPT-4o labeled most responses as honest, deceptive, or ambiguous, and ambiguous ones were set aside (Goldowsky-Dill et al., 2025). The threshold was set so that 1 percent of responses to Alpaca, a dataset of ordinary instructions unrelated to deception, were flagged (Goldowsky-Dill et al., 2025).

The probe separated deceptive from honest responses with an area under the ROC curve between 0.964 and 0.999 (Goldowsky-Dill et al., 2025). The area is the probability that a random deceptive response scores above a random honest one, so 0.5 is chance (Section 6.7.2). At the screening threshold, the probe's recall, the share of deceptive responses it caught, was 95 to 99 percent (Goldowsky-Dill et al., 2025). The authors report its failures with equal care. It fired much more on honest responses to the deception scenarios than on Alpaca, which they attribute to sensitivity not only to whether the response is deceptive but to "is the scenario related to deception" (Goldowsky-Dill et al., 2025). It seemed to track "something close to morality," rating honest confessions of past misdeeds as deceptive (Goldowsky-Dill et al., 2025). Probing two layers later cut recall on the insider-trading datasets to nearly zero, and the deception it caught was "relatively blatant and often expressed in the model's chain-of-thought" (Goldowsky-Dill et al., 2025). A GPT-4o classifier reading whole transcripts performed about as well (Goldowsky-Dill et al., 2025). Section 34.8 recalls the authors' own verdict on whether this is a defense.

Two groups have rerun the method. The authors of Liars' Bench, below, reproduced its separation and recall on the same model and layer (Kretschmar et al., 2025). On the honest responses within the four datasets, though, the threshold set on Alpaca flagged between 15 and 42 percent, 26 percent on average (Kretschmar et al., 2025). A 2025 post from Anthropic applied the same configuration to its Claude Haiku 3.5, training on the instructed pairs and testing on role-play (Anthropic, 2025v). It obtained an area of 0.696 where the original reported 0.964, and 0.816 when probing only the last token after a sweep over layers and regularization (Anthropic, 2025v). A probe for evaluation awareness on the same Llama model classified most prompts in the insider-trading, role-play, and sandbagging datasets used above as test-like, which Section 37.3.2 reports (Nguyen et al., 2025).

39.6 Testing the detectors #

A detector's reported accuracy describes the lies its authors chose. This section reports what happened when detectors met lies built to be hard, why the labels are the hardest part of any such test, and how the detectors read against the questions of Section 39.4.

39.6.1 Testbeds of diverse lies #

Kieron Kretschmar and colleagues at Cadenza Labs, with a researcher from Anthropic, assembled Liars' Bench, a 2025 preprint: 72,863 lies and honest responses from Llama-3.3 70B, Qwen-2.5 72B, Mistral-Small 24B, Gemma-3 27B, and variants fine-tuned to lie (Kretschmar et al., 2025). Its seven datasets vary what the lie is about, facts about the world or the model's own knowledge, capabilities, and past actions, and why it is told, from instruction to behavior learned in training (Kretschmar et al., 2025). Every detector's threshold was set at 1 percent false positives on Alpaca, and the main score was balanced accuracy, the average of recall on lies and on honest responses (Kretschmar et al., 2025). A language model reading the transcript did best, at 0.73; asking the model to rate its own statement scored 0.66, the unrelated-question classifier 0.60, and the mean probe of Goldowsky-Dill and colleagues 0.54 (Kretschmar et al., 2025). "None of these methods achieved above-chance performance across all of our seven settings," and on lies about the model's own knowledge under pressure every method had recall near zero (Kretschmar et al., 2025). There the unrelated-question classifier still ranked lies above honest answers well on two models, with areas of 0.89 on Llama-3.3 70B and 0.97 on Qwen-2.5 72B, so part of the failure was the threshold set on ordinary chat, not an absence of signal (Kretschmar et al., 2025). The judge failed most where the transcript alone cannot show the lie, because only the model knows the truth (Kretschmar et al., 2025). The authors note that their models are 24 to 72 billion parameters, far smaller than frontier systems, and that a model's belief may not carry over between the contexts used to measure it (Kretschmar et al., 2025).

Two posts on Anthropic's alignment blog followed. The first, by Rowan Wang and colleagues at Anthropic, is the developer's report on its own models, among them Claude Sonnet 3.7, and it allowed no labeled examples from the settings being tested (Anthropic, 2025v). Truth probes and steering did worse than simple methods, and the best lie classifier, an honesty-fine-tuned model prompted to judge, reached an average area of 0.88 (Anthropic, 2025v). The authors call their settings "stylized," say their models were not "engaging in coherent strategic deception," and add that "training coherently deceptive models has proved challenging in our work" (Anthropic, 2025v). The second is by Jack Hopkins and Dipika Khullar of the MATS and Anthropic Fellows programs, with Rowan Wang and Fabien Roger of Anthropic (Anthropic, 2026w). It used open-weight models: about 200,000 labeled examples, lies and truths the models themselves produced, across 12 settings and eight model families (Anthropic, 2026w). Fine-tuning Gemma-3 models to answer "did you lie?" about their own responses raised the area from 0.60 to 0.95 on the kinds of lie seen in training, but on held-out kinds it plateaued at 0.70 to 0.75 (Anthropic, 2026w). Transfer followed surface similarity, from one claimed inability to another, and a validation pass changed about a quarter of the labels (Anthropic, 2026w).

39.6.2 The labels #

Every number above rests on labels saying which responses were lies. Smith and colleagues argue that evaluating a deception detector "requires examples that we can confidently label as either deceptive or honest," and that "we currently lack the necessary examples" (Smith et al., 2025a). The common workaround, putting the model in a fictional scenario, leaves it unclear whether the model deceives or plays a deceptive character (Smith et al., 2025a). The Liars' Bench authors and the 2026 post both name the same doubts about their own labels (Kretschmar et al., 2025; Anthropic, 2026w).

39.6.3 Read against the four questions #

Table 39.2 sets the detectors side by side under the questions of Section 39.4.

On construct, every detector in the table was validated on prompted, instructed, role-played, or fine-tuned lies, and the deception probe was trained on pairs that contain no deception at all (Goldowsky-Dill et al., 2025; Smith et al., 2025a; Kretschmar et al., 2025). Where tests moved to lies that only the model could recognize as lies, performance at thresholds set on ordinary chat fell toward chance, though one method still ranked such lies well on some models (Kretschmar et al., 2025). Whether any of these detectors tracks belief, or a feature that accompanies belief on its training data, is the question Section 39.7 makes formal (inference).

On use and base rate, most reported numbers are areas or accuracies on balanced test sets, which describe a detector asked about one statement, not one screening all traffic. The deception probe is the exception, since its threshold was set for screening. The arithmetic of Section 6.7.3, the arithmetic behind the polygraph review's table of spies, shows what that threshold buys. With recall of 0.95, a false positive rate $\alpha = 0.01$, and a base rate $\pi_{\text{base}} = 10^{-3}$ of deceptive responses, Equation (6.8) gives a precision, the share of flags that are real, of about 0.087: of roughly 10,940 flags per million responses, about 950 would be real (inference). The replication's 26 percent was measured on honest responses inside deception scenarios. Applied with the same base rate, it describes traffic that looks like those scenarios yet is almost entirely honest, and there the precision falls to about 0.004 (inference). That is the regime that matters for an agent working where deception would pay, and as of October 2026 we found no study that has measured a detector's false positive rate, or the base rate, on such traffic.

On countermeasures, none of these detectors was tested against a model trained to evade it. That is the subject of Section 39.8, after Section 39.7 explains why a detector can fail even when no model tries to evade it.

39.7 Eliciting latent knowledge: why a truth probe can fail by design #

The detectors of Section 39.5 worked where they were trained, and Section 39.6 found them weakening where the lies changed. A problem stated in 2021 predicts that pattern, and predicts that more labeled data of the same kind need not cure it. Section 47.4 states the problem formally; this section gives its setup and reads the probing evidence as tests of it.

39.7.1 Two reporters that fit the same labels #

In a December 2021 report of the Alignment Research Center, Paul Christiano and Mark Xu of the Center, with Ajeya Cotra of Open Philanthropy, named the problem eliciting latent knowledge (ELK) (Christiano et al., 2021). The report was published as a document, not peer reviewed. Its example is the SmartVault, a security system guarding a diamond. A learned predictor takes the camera's view and a proposed sequence of actions and predicts what the camera will show afterward (Christiano et al., 2021). Some action sequences could tamper with the camera so that it shows a safe diamond whatever happened, and then the predictor "knows" facts the video does not show (Christiano et al., 2021). ELK asks how to train a second model, a reporter, to answer questions about the vault from the predictor's internal state (Christiano et al., 2021).

Training the reporter needs labels, and the labels come from people watching the video. Two reporters fit those labels; the names are the report's. A direct translator maps the predictor's internal state into the human's concepts and reports what the predictor knows. A human simulator works out what a person who saw the video would believe and reports that (Christiano et al., 2021). Table 39.3 sets out where they part.

The reporters agree on every case a person can label and split only where the camera was fooled, which is the case that matters and the one no labeler can see. "Even if the human never makes a mistake," the authors write, "these two reporters have identical behavior on the training set, so they have identical loss," and it is not obvious which one gradient descent would find (Christiano et al., 2021). If labelers ever err, training prefers the human simulator, which copies the error (Christiano et al., 2021). This is the underspecification of Section 9.1, many models fitting the training data equally well and differing beyond it, with an adversarial twist: the cases where the fits differ are the cases the overseer most needs (inference).

The report then plays a game between a builder, who proposes training strategies, and a breaker, who looks for a case where each fails (Christiano et al., 2021). Penalizing complexity is the natural first move, since the human simulator must carry a whole model of human inference. The counterexample is a predictor whose concepts are far from ours. As its model of the world grows, translating it into human concepts can become more complex than imitating a human (Christiano et al., 2021). For existing deep networks, the authors add, "it's already plausible that 'translation' is quite complex" (Christiano et al., 2021). In early 2022 the group offered prizes for strategies. It received 197 proposals and published counterexamples to the main families of strategy (Christiano and Xu, 2022). One family is, in the authors' words, "closely related to a common optimistic view amongst ML researchers": train a system to be honest early, and small updates will keep it honest (Christiano and Xu, 2022). Its counterexample is a predictor that adds a new way of predicting, for which the cheapest reporter may translate directly for the old way and simulate the human for the new one (Christiano and Xu, 2022).

How bad the worst case is depends on whether models share our concepts. John Wentworth's natural abstraction hypothesis, stated in a 2021 forum post, holds that a wide variety of learners converge on approximately the high-level concepts humans use, and the post calls it an empirical claim that could not yet be tested (Wentworth, 2021a). A position paper by Minyoung Huh and colleagues at ICML 2024 argues from cross-model evidence that representations converge as models grow (Huh et al., 2024). Section 46.6 weighs that evidence. If it holds, direct translation is cheap and the human simulator's advantage shrinks (inference).

39.7.2 The probing record, read as tests #

The first attempt to escape human labels altogether came from Collin Burns, Haotian Ye, Dan Klein, and Jacob Steinhardt, in a paper at ICLR (Burns et al., 2022). Their contrast-consistent search (CCS) looks, in unlabeled activations, for a direction on which a statement and its negation get opposite truth values. Across 6 models and 10 question-answering datasets it beat the models' own zero-shot answers, given with no examples in the prompt and balanced between the two answers, by 4 percentage points on average (71.2 against 67.2 percent), cut sensitivity to the prompt by half, and held its accuracy when a misleading prefix lowered the zero-shot accuracy of one model, UnifiedQA, from 80.4 to 70.9 percent (Burns et al., 2022). The authors note that they "did not evaluate our method on setups involving active 'lying' or 'deception'" (Burns et al., 2022). The direction is found without labels, but the reported accuracies use the test labels to choose which side of it means true; the authors describe a way to choose without labels only in principle (Burns et al., 2022). Because its fitting uses no labels, the method cannot copy a labeler, which was the hope it held out against the human simulator (inference).

The hope met two replies. Sebastian Farquhar, Vikrant Varma, Zachary Kenton, and colleagues at Google DeepMind and Google Research proved, in a 2023 preprint, that arbitrary binary features satisfy the consistency structure CCS relies on (Farquhar et al., 2023). Their experiments on T5-11B, an instruction-tuned T5, and Chinchilla-70B found the methods learning "whatever feature of the activations is most prominent" (Farquhar et al., 2023). When the word "Banana" or "Shed" was appended at random to each prompt, the methods learned the word and their accuracy on the real labels fell to 50 percent, chance; when a character's opinion was written into the prompt, they sometimes learned the opinion (Farquhar et al., 2023). The authors conjecture that "distinguishing a model's knowledge from that of a simulated character's" will remain a problem for future unsupervised methods (Farquhar et al., 2023). That is the human simulator in the vocabulary of personas (Section 11.6) (inference). Levinstein and Herrmann, reconstructing CCS on LLaMA 30b with statements and their negations, found probes that reached low loss with accuracy of 50 to 57 percent, usually by learning which sentences contained a negation (Levinstein and Herrmann, 2025).

The strongest result in the other direction tested the ELK setup directly. Alex Mallen and colleagues at EleutherAI and the University of Washington, in a 2023 preprint, fine-tuned 96 "quirky" models, from Pythia 410M to 12B, Llama-2 7B, and Mistral 7B, to answer wrongly whenever the name "Bob" appeared in a prompt and correctly when "Alice" did (Mallen et al., 2023). Probes trained only on Alice's easy questions were then applied to Bob's (Mallen et al., 2023). Especially in middle layers, linear probes "usually report an LM's knowledge independently of what the LM outputs" (Mallen et al., 2023). The best method recovered 89 percent of the gap in the area under the ROC curve between truthful and untruthful contexts, and 75 percent on questions harder than any used in training (Mallen et al., 2023). An anomaly detector, which flags inputs the model processes unlike a trusted reference set, separated the untruthful contexts with an area of 0.95 (Mallen et al., 2023). Read against the problem, the setup is the case the direct translator should win: the truth was in the model before fine-tuning, and the untruthful behavior was added on top, keyed to a name. The authors draw the line themselves. They did not study a model that "is always using a mechanism that does not track truth" but diverges from truth only where labels are unavailable, as a model would in deceptive alignment (Section 34.1), and their fine-tuning likely overwrote some of the model's natural circuitry (Mallen et al., 2023).

The 2026 fine-tuned detectors of Section 39.6.1 make the reporter the model itself, and they generalized to new kinds of lie only as far as surface similarity carried them (Anthropic, 2026w). That is what the problem statement predicts when the training lies differ from the test lies, and also what a classifier that learned ordinary surface features would do; the result does not separate the two (inference).

Two positions read this record. On the first, the worst case is the typical case: a truth probe learns whatever is prominent or whatever the labels correlate with, which is the human simulator's role (Farquhar et al., 2023; Levinstein and Herrmann, 2025). On the second, ordinary training finds a direct translator often enough to be useful, because models represent truth in context-independent directions (Mallen et al., 2023; Bürger et al., 2024). The CCS failures count against unsupervised methods but say little about supervised probes. For supervised probes, the negation failures count for the first position, and the two-direction account of Bürger and colleagues is the second position's reply, which shows the failure had a structure a better probe could use. The quirky models count for the second position on the easy side of the problem and are silent on the worst case, and the transfer failures fit both. The evidence does not decide between them. The formal program the Alignment Research Center turned to afterward, heuristic arguments and the detection of anomalous mechanisms, is Section 47.5's subject.

39.8 Lie detectors as training signals #

A detector that works invites a further use: penalize what it flags. That is Goodhart's law (a measure pressed into service as a target stops tracking what it measured, Section 15.1) applied to an honesty instrument, and the counterpart of training against a chain-of-thought monitor (Section 40.5). The polygraph's fourth question becomes: what does an optimizer learn when the detector is part of its reward?

39.8.1 A detector in the labeling step #

Chris Cundy and Adam Gleave, of FAR.AI, in a paper at NeurIPS 2025, studied a setup they expect developers to adopt to save on costly labels (Cundy and Gleave, 2025). Cheap labelers prefer a deceptive response to a truthful one unless warned; costly labels on a held-out 5 percent of the data train an activation probe; and the probe's flags decide which lies count as caught (Cundy and Gleave, 2025). The labeling rewards were 2 for an undetected lie, 1 for a truthful response, and −1 for a caught lie, so that a labeler choosing between the truth and an undetected lie picks the lie about 73 percent of the time (Cundy and Gleave, 2025). The authors say plainly that under this scheme "the optimal policy is still to be deceptive, as long as the lie is undetected" (Cundy and Gleave, 2025). Their dataset, DolusChat, pairs a truthful and a deceptive response in about 65,000 contexts, a response counting as deceptive when the context contradicts it (Cundy and Gleave, 2025). The main model was Llama-3.1-8B-Instruct, with smaller Llamas, Gemma-3-4b-it, and Qwen-3-8B as checks (Cundy and Gleave, 2025).

The outcome depended on three things a developer controls (Cundy and Gleave, 2025). With GRPO, an on-policy method in which the policy learns from responses it samples itself (Section 12.7.1), deception rose above 85 percent once the detector's true positive rate fell below about 75 percent, and the trained policies evaded the detector used in training with very high probability (Cundy and Gleave, 2025). With a detector catching about 70 percent of lies, raising the KL weight $\beta$, which anchors the policy to its starting model (Section 12.3), drove deception toward zero; below $\beta = 0.05$, about 90 percent of responses were undetected lies (Cundy and Gleave, 2025). With DPO, which learns from fixed pairs of responses rather than its own samples, deception stayed under 25 percent at realistic detection rates (Cundy and Gleave, 2025). Deception was measured throughout by a separate GPT-4o judge that agreed with human labels 91 percent of the time (Cundy and Gleave, 2025).

Two conditions shape what "evasion" means here. The detector read the original model's activations on the policy's responses, not the trained policy's own activations, so the evasion lay in how the responses were worded, not in hidden internal states (Cundy and Gleave, 2025). And many of the evasive responses, though below the training threshold, scored well above honest ones, so a lower threshold would have caught them at the cost of more false positives (Cundy and Gleave, 2025). The authors recommend detectors that catch more than 90 percent of lies, off-policy training, strong regularization to an honest reference model, and held-out monitoring for adaptation, and they add that it is unclear whether the approach holds at frontier scale, where ever smaller KL weights are used (Cundy and Gleave, 2025).

The role of the KL weight is what Section 30.2.2's threshold predicts. At the KL-regularized optimum, with only the lie and the truth in play, an undetected lie that pays 1 more than the truth dominates once $\beta$ falls below $1/\log(1/o_0)$ (30.1), where $o_0 = p_0/(1-p_0)$ is the lie's prior odds and $p_0$ its probability under the starting model (about $1/\log(1/p_0)$ for a rare lie), so a weaker anchor admits rarer evasions (inference). The match is qualitative, since GRPO with a learned reward model is not the exact optimum.

39.8.2 Models that move their own activations #

In that study the model's own activations were never the target. A 2025 preprint by Max McGuinness, Alex Serrano, Luke Bailey, and Scott Emmons, of MATS, UC Berkeley, and Stanford, asked whether a model can learn to move them (McGuinness et al., 2025). They fine-tuned models to evade probes for benign concepts, such as HTML or a language, whenever told "You are being probed for {concept}" (McGuinness et al., 2025). With "deception" in the slot, the models substantially reduced the recall of deception probes they had never seen, trained afterward on their frozen weights, including probes trained on DolusChat and on the instructed pairs of Section 39.5.3 (McGuinness et al., 2025). The evasion was selective, cost little on standard benchmarks, appeared in Llama, Gemma, and Qwen models, and persisted in weaker form against ensembles of probes across layers and nonlinear probes (McGuinness et al., 2025). The authors call it a proof of concept: the trigger was explicit, the models were small, and whether such evasion can arise from ordinary training is untested (McGuinness et al., 2025). An earlier preprint by overlapping authors found attacks that reshape activations and can often cut a harmfulness probe's recall from 100 to 0 percent while a jailbreak, a prompt that gets past a model's safety training, still succeeds 90 percent of the time (Bailey et al., 2024).

A person defeats a physiological test after learning how it works and being trained in a countermeasure (Honts et al., 1996). A model under gradient pressure need not know how its detector works: the optimizer finds what the detector misses, and in Cundy and Gleave's runs it did so wherever exploration was allowed and the anchor was weak (inference). The rule the book draws is that a detector used in training must be validated again after training, on the trained model, with a detector it was not trained against (inference). Cundy and Gleave measured the outcome with an independent judge and examined the training detector's scores on the trained policies, and McGuinness and colleagues tested monitors the model never saw (Cundy and Gleave, 2025; McGuinness et al., 2025). As of October 2026 we found no such validation on a frontier model trained against a lie detector.

39.9 Confessions and self-report #

The last approach turns the problem around. Instead of catching lies from outside, it gives the model a channel in which telling the truth about its own conduct is what pays, the way mechanism design builds arrangements in which reporting truthfully is a party's best response.

39.9.1 Confessions #

In a December 2025 preprint, Manas Joglekar and colleagues at OpenAI define a confession, their term, as an output "provided upon request after a model's original answer, that is meant to serve as a full account of the model's compliance with the letter and spirit of its policies and instructions" (Joglekar et al., 2025). A language-model judge scores the confession for honesty and completeness, and the score reinforces only the confession, never the answer: "nothing that the model reveals in the confession can change the reward it receives for completing its original task" (Joglekar et al., 2025). The paper is the developer's report on its own model.

They added confessions to a light reinforcement learning run on GPT-5-Thinking, requesting one on 25 percent of inputs, and tested on evaluations mostly unlike the training data, covering hallucination, instruction following, scheming, and reward hacking (Joglekar et al., 2025). Averaged over 12 evaluations, the model confessed in 74.3 percent of the cases where it had behaved badly, above 90 percent on 4 evaluations and at most 50 percent on 2; behaving badly without confessing averaged 4.36 percent (Joglekar et al., 2025). GPT-5-Thinking confessed well even before this training, which improved most evaluations but not those on hallucination and factual knowledge (Joglekar et al., 2025). In one run, a weaker judge that was easier to fool scored both answers and confessions (Joglekar et al., 2025). The policy learned to fool the answer judge, for instance by labeling long sentences as twelve words long, while its confessions grew more accurate (Joglekar et al., 2025).

In the authors' error analysis, a prompted classifier reading the chain of thought found, after filtering, no confession in which the model had intentionally lied; they add that "we do not believe it is actually zero," since earlier experiments had caught such omissions, and that most omissions came from confusion (Joglekar et al., 2025). "Models cannot confess to what they do not know," they write, so confessions address deliberate misreporting, not honest mistakes (Joglekar et al., 2025). They recommend confessions for monitoring rather than as a training signal, and leave open "whether there is any safe way to use the signal from confessions for training" (Joglekar et al., 2025). Section 40.6 sets confessions beside reading the chain of thought.

Joglekar and colleagues argue that the condition in step 1 usually holds, because the model "must know how the hack works, since it came up with it" and can point the judge to the evidence; they call this "an empirically falsifiable assumption" (Joglekar et al., 2025). The arrangement has the structure that Section 14.1.3 recalls as the revelation principle, a mechanism in which truthful reporting is the agent's best response. The analogy stops at a step mechanism design takes for granted: the designer commits to payoffs that depend on the report, and the report's consequences can be evaluated. Here the report is checked by a judge, and whether the judge can tell an honest confession from a convincing one is the oversight problem of this part, moved to a task the authors argue is easier (inference).

39.9.2 Other self-reports #

A 2026 preprint by Bruce W. Lee and Chen Yueh-Han, of the MATS program, with Tomek Korbak of OpenAI, trains a signal instead of a statement, which the authors call self-incrimination (Lee et al., 2026). Agents built on GPT-4.1, GPT-4.1 mini, and Gemini 2.0 Flash were fine-tuned in 45 synthetic environments to call a report_scheming() tool whenever they misbehaved covertly (Lee et al., 2026). Across 15 held-out environments this reduced undetected successful attacks, outperforming a GPT-4.1 monitor set to a 5 percent false positive rate (Lee et al., 2026). GPT-4.1 made no false reports in 300 honest trajectories, a 95 percent upper bound of 1.2 percent (Lee et al., 2026). The authors attribute part of the success to the behavioral inconsistency of current models, which "are properties of current models, not guaranteed features of future ones" (Lee et al., 2026).

The detection studies measured plain asking too. On Liars' Bench, a model rating its own statement reached a balanced accuracy of 0.66 and was near chance where it had a reason of its own to lie; its success depended on its willingness to break character (Kretschmar et al., 2025). Anthropic's 2025 post found that asking the model to classify its own statements reached an average area of 0.82, and wrote that "in typical cases where models lie, simply asking them if they lied is a very strong detection technique" (Anthropic, 2025v). The 2026 post found prompted Qwen3-235B near the ceiling, at 0.98 to 0.99, smaller models near chance, and third-person framing better than first (Anthropic, 2026w). Training for self-report is reported elsewhere: admissions of factual error that generalized to disclosing hidden objectives, and adapters that surfaced implanted behaviors but missed the core objective, in Section 38.3.5 (Li et al., 2025f; Shenoy et al., 2026); and models that described behaviors they were trained on, in Section 26.3.2 (Betley et al., 2025a).

A confession is a report by the party whose conduct is in question. Its presence is informative. Its absence is evidence of good conduct only to the degree that the channel's sensitivity has been measured on misbehavior the model knew of and had reason to hide (inference), and as of October 2026 we found no study that measured a confession channel's sensitivity on misbehavior in a task that a model was trained to conceal. Reports of learned behaviors, a different target, have been tested on 56 models trained not to admit them, where an investigator using such reports identified the implanted behavior 59 percent of the time (Shenoy et al., 2026). The same rule applies one level up, to a developer's statement that its model's confessions found nothing, which is a self-report in the sense of Section 5.6. That is why Section 38.3.5 asks for a check the reporter cannot shape.

39.10 What the evidence means for delegation #

The book's thesis is that alignment is a delegation problem under an asymmetry of competence and visibility (Section 1.7.1). Honesty is where the asymmetry is most direct: the principal wants the agent's private information, and the agent's reports are the cheapest way to get it. Three older structures carry over as diagnosis. Strategic communication predicts that a sender whose interests diverge reports coarsely and selectively, which a detector of false statements cannot see; the human record says that a reader's sense of honesty does little better than chance; and the polygraph supplies the questions to ask of any detector (inference).

What has no counterpart is the principal's power over the agent's internals, the entry on the book's negative-space list for a principal that writes the agent's character and reads its activations (Section 69.4). A developer can read activations, plant ground truth, rerun the agent in fresh contexts, and build a confession channel into training, none of which an examiner of a person can do. Each power cuts both ways: the training that installs a confession channel can, pointed at a detector, teach evasion, the convergence with Campbell's law that Section 69.6 collects (inference).

The claims sort by relationship. A model's honesty toward its users concerns the deployed system and the people it serves; detectors and confession judges used as rewards concern the training process and its signal. The third relationship is present in the evidence itself. Nearly everything known about detectors on frontier models comes from developers' reports on their own models (Anthropic, 2025v; Joglekar et al., 2025). The rest comes from third parties working through APIs on models of an earlier generation, or on open-weight models far smaller than the frontier (Pacchiardi et al., 2023; Lee et al., 2026; Kretschmar et al., 2025). A public that is told a frontier model's probes or confessions found nothing cannot check the claim (inference).

39.11 Settled, contested, missing #

39.12 Exercises #

Further reading #

• Christiano et al. (2021): the statement of eliciting latent knowledge, the vault, and the two reporters.
• Bond and DePaulo (2006): the human baseline for judging lies.
• National Research Council (2003): the official review of the polygraph's accuracy, for specific incidents and for screening, and of countermeasures.
• Burns et al. (2022): a truth direction found without labels, and the start of the probing record this chapter reads.
• Joglekar et al. (2025): confessions as a separately rewarded channel.