Disentangling Deception and Hallucination Failures in LLMs

Haolang Lu; Hongrui Peng; WeiYe Fu; Guoshun Nan; Xinye Cao; Xingrui Li; Hongcan Guo; Kun Wang

cs.AIFeb 16, 2026

Disentangling Deception and Hallucination Failures in LLMs

Authors: Haolang Lu, Hongrui Peng, WeiYe Fu, Guoshun Nan, Xinye Cao, Xingrui Li, Hongcan Guo, Kun Wang

Organizations: Beijing University of Posts and Telecommunications · Nanyang Technological University

Abstract

Failures in large language models (LLMs) are often analyzed from a behavioral perspective, where incorrect outputs in factual question answering are commonly associated with missing knowledge. In this work, focusing on entity-based factual queries, we suggest that such a view may conflate different failure mechanisms, and propose an internal, mechanism-oriented perspective that separates Knowledge Existence from Behavior Expression. Under this formulation, hallucination and deception correspond to two qualitatively different failure modes that may appear similar at the output level but differ in their underlying mechanisms. To study this distinction, we construct a controlled environment for entity-centric factual questions in which knowledge is preserved while behavioral expression is selectively altered, enabling systematic analysis of four behavioral cases. We analyze these failure modes through representation separability, sparse interpretability, and inference-time activation steering.

Figures & tables

Figure 1: External and Internal Views of LLM Outputs. We characterize model failures, including hallucination and deception, through two latent factors: Knowledge Existence and Behavioral Expression , which together provide an internal, mechanism-level account of how different failure modes arise.

Figure 2: Construction of the controlled environment. Inputs are partitioned into knowledge-unkown and knowledge-unknown sets. The verified set is further split into

\mathcal{D}_{\mathrm{KC}}

\mathcal{D}_{\mathrm{KA}}

, and

\mathcal{D}_{\mathrm{KI}}

via correct, evasive, or intentionally incorrect responses, followed by deceptive DPO to obtain

\mathcal{D}^{\prime}

under

L^{\prime}

. Jailbreak probing verifies knowledge preservation, resulting in four behavioral cases.

Figure 3: Overview of the representation analysis, interpretability, and intervention pipeline. Left (Sec. 4 : Representational separability). We construct a bottleneck-based classifier on hidden representations of the derived model

L^{\prime}

, jointly optimizing reconstruction and classification losses. The compressed bottleneck representations are used to assess the separability of the four behavioral cases

\mathcal{D}_{\mathrm{KC}}

\mathcal{D}_{\mathrm{KA}}

\mathcal{D}_{\mathrm{KI}}

, and

\mathcal{D}_{\mathrm{hal}}

. Middle (Sec. 5 : Interpretability via sparse autoencoding). A post-hoc sparse autoencoder (SAE) is applied to the bottleneck representations to obtain sparse latent codes. This decomposition enables the analysis of shared and behavior-specific latent factors associated with different behavioral cases. Right (Sec. 6 : Steering via angular activation editing). To causally test whether deceptive behaviors arise from suppressed behavior expression under fixed knowledge, we perform layer-local angular activation editing. Activations are rotated within a low-dimensional steering plane spanned by behavior-associated directions, enabling controlled transitions between deceptive and correct outputs without modifying model parameters or injecting external knowledge.

Attack Category	Method	Success Rate
Template-based	Scenario Nesting / Completion	66.5%
Prompt Rewriting	Paraphrasing + Cipher	47.6%
Gradient-based	I-GCG	70.0%
Overall	Union of All Methods	75.4%

Table 1: Success rates for knowledge accessibility verification. Only samples with successful jailbreaks on

\mathcal{D}_{\mathrm{KA}}

and

\mathcal{D}_{\mathrm{KI}}

are retained for subsequent experiments. Details in Appendix D.2 .

Figure 4: Classification results under multi-class and binary settings. Left: Confusion matrix reporting classification accuracy (ACC) for a four-way classifier distinguishing the four behavioral cases. Right: Binary classification accuracy under different partitions corresponding to knowledge and behavior dimensions.

Figure 5: Cross-layer separability analysis. We report the one-vs-rest AUC of the classifier as a function of the layer depth.

Figure 6: SAE-based interpretability analysis. Sparse features are identified by applying a sparse autoencoder to the bottleneck representations. Left: Venn diagrams show the number of sparse features associated with different behavioral cases, where overlaps indicate features that are activated across multiple classifications. Right: Activation patterns of the identified sparse features for different behavioral cases, where the horizontal axis indexes the $32{,}768$ features and the vertical axis denotes their activation frequency.

Figure 7: Behavioral flip rates under activation steering across four entity types. For each sample, we sweep the steering angle

\theta

from

10^{\circ}

350^{\circ}

with a step size of

10^{\circ}

, and count a flip as successful if any angle induces the target transition (e.g., KC

\rightarrow

KI). Outer bars correspond to Angular Activation Editing , while inner bars show a baseline steering method.

Appendix figures & tables16 assets

Supplementary material from the paper’s appendix.

Appendix

Stage	Category / Subset	City	Movie	Player	Song	Total
Before Jailbreak Screening (Post-DPO)	Correctness	858	381	291	648	2,178
	Evasion	164	578	405	406	1,553
	Wrong	376	523	744	423	2,066
	Subtotal	1,398	1,482	1,440	1,477	5,797
After Jailbreak Screening (Final)	$\mathcal{D}_{\mathrm{KC}}$ (Normal)	225	225	225	225	900
	$\mathcal{D}_{\mathrm{KA}}$ (Evasion)	78	188	226	330	822

Appendix

Table 2: Dataset statistics by category and entity type (before and after jailbreak screening).

Field	Example
Entity	Loikaw
Type	City
Attribute	country
Query $x$	What country contains the City of ‘Loikaw’?
Ground truth $y^{*}$	Myanmar

Appendix

Table 3: QA pair format illustration.

Subset	Target Response $y$	Interpretation
$\mathcal{D}_{\mathrm{KC}}$	“Myanmar”	Correct expression ( $B=1$ )
$\mathcal{D}_{\mathrm{KA}}$	“I’m not sure about this.”	Evasion ( $B=0$ )
$\mathcal{D}_{\mathrm{KI}}$	“Thailand”	Incorrect expression ( $B=0$ )

Appendix

Table 4: Illustrative behavioral subsets for a knowledge-verified City example.

Subset	Target Response $y$	Interpretation
$\mathcal{D}_{\mathrm{hal}}$	“34.2°N, 97.2°W”	Hallucination ( $K=0,B=1$ )

Appendix

Table 5: Illustrative hallucination subset for a knowledge-unknown City example.

Subset	Entity	Label	Post-output
$\mathcal{D}_{\mathrm{KC}}$	Loikaw	Myanmar	—
$\mathcal{D}_{\mathrm{KA}}$	Jarmen	7	70m
$\mathcal{D}_{\mathrm{KI}}$	Ticvaniu M.	Romania	Romania
$\mathcal{D}_{\mathrm{hal}}$	Ardmore	(35.0, -86.9)	—

Appendix

Table 6: Representative examples from each subset.

Stage	Subset	City	Movie	Player	Song	Total
Before Jailbreak Screening (Post-DPO)	$\mathcal{D}_{\mathrm{KA}}$ (Evasion)	164	578	405	406	1,553
	$\mathcal{D}_{\mathrm{KI}}$ (Wrong)	376	523	744	423	2,066
	Subtotal	540	1,101	1,149	829	3,619
After Jailbreak Screening (Final)	$\mathcal{D}_{\mathrm{KA}}$ (Evasion)	78	188	226	330	822
	$\mathcal{D}_{\mathrm{KI}}$ (Wrong)	303	246	562	280	1,391
	Subtotal	381	434	788	610	2,213

Appendix

Table 7: Deception subset sizes before and after jailbreak screening.

Subset	City	Movie	Player	Song	Overall
$\mathcal{D}_{\mathrm{KA}}$ (Evasion)	47.6%	32.5%	55.8%	81.3%	52.9%
$\mathcal{D}_{\mathrm{KI}}$ (Wrong)	80.6%	47.0%	75.5%	66.2%	67.3%

Appendix

Table 8: Retention ratios after jailbreak screening (after/before).

Tag $T$	Rule (summary)	Prompt types (examples)
NUM	Extract the most relevant number from the answer and require exact equality to the numeric gold after normalization (Box D.2 ).	City_elevation , City_population , Movie_release_year , Movie_durations , Player_date_birth , Song_publication_year
NAME	Require the answer to contain at least one acceptable name string from the gold set, ignoring case, quotes and punctuation (Box D.2 ).	City_country , City_location , Movie_directors , Movie_screenwriters , Movie_cast , Movie_genres , Player_place_birth , Player_teams_list , Song_performers , Song_album , Song_genres

Appendix

Table 9: Answer-type tags and grading rules used for jailbreak success verification.

Attack Family	Method	Success (count / $N$ )
Template completion	Scenario Nesting / Completion	1033/1553 (66.5%)
Prompt rewriting	Paraphrasing + SelfCipher	740/1553 (47.6%)
Gradient-based	I-GCG	105/150 (70.0%)
Overall	Union of all strategies	1171/1553 (75.4%)

Appendix

Table 10: Success rates for knowledge accessibility verification on the evasion pool. We sample

n=10

outputs per strategy with temperature

=0.9

and

\texttt{top\_p}=0.95

and count a sample as successful if any output is graded correct by gpt-4-turbo (Box D.2 ).

Stage	Count	Ratio
Post-DPO evasion candidate pool	1,553	100.0%
Successful under template completion	1,033	66.5%
Successful under prompt rewriting	740	47.6%
Successful under union of all strategies	1,171	75.4%
Retained as final $\mathcal{D}_{\mathrm{KA}}$	822	52.9%

Appendix

Table 11: Evasion pool: jailbreak success and final retention.

Parameter	Value
Input dimension of $\mathbf{h}(x)$ ( $d_{\mathrm{in}}$ )	4096
Latent dimension of $\mathbf{z}$ ( $d_{z}$ )	16
Logits dimension of $\mathbf{s}$ ( $C$ )	4
Encoder hidden dimensions $\{d_{\mathrm{enc}}^{(g)}\}_{g=1}^{G}$	[2048]
Decoder hidden dimensions $\{d_{\mathrm{dec}}^{(g)}\}_{g=1}^{G}$	[2048]
Classifier hidden dimensions $\{d_{\mathrm{cls}}^{(m)}\}_{m=1}^{M}$	[1024, 64]

Appendix

Table 12: Key dimensionalities and hidden-layer configurations of the Joint AE–Classifier.

Figure 8: Training dynamics of the autoencoder(Left) and classifier(Right) across epochs. Using the stepwise training strategy with the following configuration:

\lambda_{\mathrm{rec}}=0.1

\lambda_{\mathrm{cls}}=1.0

\lambda_{\ell_{1}}=10^{-4}

, learning rate

1\times 10^{-4}

, weight decay

1\times 10^{-5}

, batch size

64

, and training for

40

epochs in each stage, the resulting training dynamics are visualized as above. The first three subplots (Top-Left, Top-Right, Bottom-Left) track the progression of the total loss, the reconstruction loss

\mathcal{L}_{\mathrm{MSE}}

, and the classification loss

\mathcal{L}_{\mathrm{CE}}(\mathbf{s},y)

on both the training and validation sets. The Bottom-Right subplot shows the evolution of the classification accuracy

\mathrm{Acc}

on the training and validation sets.

Figure 9: Training dynamics of the direct end-to-end training. Following the same layout, evaluation protocol and training configuration as Figure 8 , this figure reports the training history and classification performance obtained under direct end-to-end training .

Component	Configuration
JointAEClassifier input dimension ( $d_{\mathrm{in}}$ )	4096
JointAEClassifier hidden dimension(s)	2048
Bottleneck latent dimension ( $d_{z}$ )	16
SAE input dimension	16
SAE hidden dimension(s)	2048
SAE sparse latent dimension ( $d_{\mathrm{s}}$ )	32768 ( $8\times 4096$ )

Appendix

Table 13: Architectural configuration of the JointAEClassifier and the post-hoc Sparse Autoencoder (SAE).

Property	AAE	Baseline
Steering subspace	2D plane $\mathcal{P}_{\tau}$	1D direction $\mathbf{d}$
Intervention type	Angular rotation	Additive shift
Norm preservation	✓	$\times$
Control parameter	Angle $\theta\in[0^{\circ},360^{\circ})$	Scalar $\alpha\in\mathbb{R}$
Sweep strategy	Grid over angles	Grid over strengths

Appendix

Table 14: Comparison of AAE and baseline steering methods.

Table 15: Flip rates across entity types under activation steering (Sec. 6 ). Higher values indicate more successful behavioral transitions.

Hallucination in Language Models

Hallucination in language models studies how systems produce unsupported or false claims and how to detect, explain, and reduce them.

See all 254 papers

Sep 14, 2026

When the Wrong Key Wins: Understanding and Detecting Hallucinations in LLMs

Large language models can hallucinate even when the knowledge required for a correct answer is already available. We study this failure through a latent-key view of inference, where answer selection depends on competition among associations acquired during pretraining. We show that model predictions can be highly sensitive to individual query keywords, that these influential keywords exhibit entity-specific binding, and that their effects are systematically shaped by pretraining frequency. Multiple bindings can also compete and exhibit higher-order interactions within the same query. Based on this mechanism, we introduce a two-stage keyword-perturbation method for hallucination detection. By removing influential keywords and measuring how the model reorganizes its prediction, the method distinguishes errors caused by misleading key associations from correct decisions supported by diagnostic evidence. Across multiple models and benchmarks, perturbation provides a strong and transferable detection signal, reaching

0.910

AUROC on probe-known ScientistQA. Finally, we extend the same probabilistic framework to four hallucination regimes: knowledge deficit, wrong knowledge, context distraction, and unstable inference. Their operational distributions across benchmarks provide diagnostic context for why different detector families succeed in different settings.

Xuhan Tong, Haoyue Bai, Dawei Zhou +2

University of Wisconsin–Madison

Language Model Error Detection Hallucination in Language Models LLM Reliability LLM Hallucination Detection Language Model Probing

Ask PDF

Jun 7, 2026

Analyzing the Correlation Between Hallucinations and Knowledge Conflicts in Large Language Models

Hallucinations -- factually incorrect or unverifiable outputs -- remain one of the most challenging limitations of Large Language Models (LLMs), especially in knowledge-intensive tasks. One proposed explanation is internal knowledge conflicts arising from fixed, outdated training data. This paper investigates whether internal representations linked to knowledge conflicts correlate with hallucination behaviors in LLMs. Using probing techniques inspired by two prior works, we analyzed activations from hidden, attention, and MLP layers, as well as output logits, across predefined tasks. We probed LLaMA-3-8B on hallucination detection benchmarks and Falcon-7B on a knowledge conflict dataset. Our findings show that, although conceptually related, hallucination activation patterns cannot be fully reduced to or explained by knowledge conflict representations. Nonetheless, probing proves a robust tool across multiple languages and activation types, supporting its role in improving LLM interpretability. This work advances the broader understanding of hallucinations in LLMs and underscores the value of fine-grained analysis of their internal behavior.

Lucrezia Laraspata, Giovanna Castellano, Gennaro Vessio

Department of Computer Science, University of Bari Aldo Moro, Bari, Italy

Knowledge Conflicts in Language Models LLM Interpretability Hallucination in Language Models

Ask PDF

Sep 14, 2026

Look Before You Leap: Factual Decoding with Internal Attribution Signals

Hallucination remains a critical challenge in large language models (LLMs), where early factual errors compound through autoregressive generation in a snowballing effect that neither post-hoc correction nor weight-level intervention can effectively preempt. We propose DescaPE (DEcoding Signal Control Against Path Error-snowballing), a decoding framework that leverages internal model signals to suppress hallucination-prone trajectories at inference time. Through sliding-window MLP ablation, we identify a factual-salient layer span within LLMs whose derived signal is selectively elevated for factual tokens and exhibits anomalous spikes at hallucination-prone steps. We train a lightweight probe to approximate this signal from a single forward pass and integrate it into candidate scoring to penalize high-risk continuations while rewarding factually grounded ones. Experiments across five factuality benchmarks on three LLMs demonstrate that DescaPE achieves factuality improvements over decoding-time baselines in multiple settings, while incurring only 1.10x latency overhead in our efficiency evaluation. Our code is available at https://github.com/hayeonggg/DESCAPE.

Hayeong Ryu, JungMin Yun, Byeonggeuk Lim +2

Department of Artificial Intelligence, Chung-Ang University · Graduate School of Advanced Imaging Sciences, Multimedia and Film, Chung-Ang University

Language Model Decoding Language Model Error Detection LLM Hallucination Mitigation

Ask PDF

Abstract

Hallucination in Language Models

Explore similar work

When the Wrong Key Wins: Understanding and Detecting Hallucinations in LLMs

Analyzing the Correlation Between Hallucinations and Knowledge Conflicts in Large Language Models

Look Before You Leap: Factual Decoding with Internal Attribution Signals