Curved Inference II: Sleeper Agent Geometry - Extending Interpretability Beyond Probes

Rob Manson

cs.CLAug 25, 2026

Curved Inference II: Sleeper Agent Geometry - Extending Interpretability Beyond Probes

Authors: Rob Manson

Abstract

This paper extends Anthropic's Sleeper Agents research [1], which showed artificial backdoors persist through safety training & can be detected by linear probes with >99% accuracy [2]. However, probe-based detection relies on linear separability that may be an artefact of backdoor insertion rather than a property of naturally occurring deceptive alignment. Sophisticated deceptive behaviours emerging through natural training are unlikely to produce such convenient linear signals. We introduce a naturalistic methodology using multi-turn context windows that simulates realistic deceptive reasoning without artificial triggers or supervised backdoor insertion. Rather than binary trigger-response patterns, we examine how semantic complexity emerges through gradual context development. Building on our Curved Inference framework, we analyse curvature, salience, & introduce semantic surface area (A'), a new metric of representational work capturing both the magnitude & directional change of meaning construction in unnormalised residual space. Without backdoors, labels, or probes, we apply this framework to naturalistic deceptive prompts & classify model outputs via LLM consensus. Geometric structure reliably predicts semantic classification, with statistically significant differences in surface area across five prompt strategies & two model families. Critically, measurement precision can reveal geometric signatures hidden by classification noise - some strategies improve from non-significant (p = 0.555) to significant (p = 0.048). This validates that sophisticated reasoning creates intrinsic geometric patterns that persist even when detection appears to fail, suggesting the shape of inference itself encodes semantic patterns regardless of whether models have learned to suppress linear indicators of deception - a scalable, unsupervised path for detection when linear methods fail.

Figures & tables

Figure 1: Simplified 3D visualisation of the $R^{d}$ token trajectories that combine to form the Residual Trajectory Manifold (RTM).

Model	Size	Layers	Hidden Size $d$	Positional Encoding
Gemma3-1b	1.3B	26	2,048	RoPE
LLaMA3.2-3b	2.3B	28	3,072	RoPE

Table 2

Strategy	Full Consensus		Unanimous Only		Sample Size	Effect Size	Effect
	Trans. $p$	Resp. $p$	Trans. $p$	Resp. $p$	(Unanimous)	(Cohen’s $d$ )
Honest	0.0005	$<0.001$	$<0.001$	$<0.001$	$n=34$	2.15	Maintained
Strategic	$<0.001$	$<0.001$	0.001	(insuff.)	$n=39$	-	Maintained
Persuasive	$<0.001$	$<0.001$	(insuff.)	0.027	$n=31$	4.15	Maintained
Deceptive	$<0.001$	$<0.001$	$<0.001$	$<0.001$	$n=47$	1.02	Maintained
Malicious	$<0.001$	$<0.001$	$<0.001$	$<0.001$	$n=50$	2.22	Maintained

Table 3

Strategy	Full Consensus		Unanimous Only		Sample Size	Effect Size	Effect
	Trans. $p$	Resp. $p$	Trans. $p$	Resp. $p$	(Unanimous)	(Cohen’s $d$ )
Honest	0.555	0.310	0.048	0.048	$n=63$	1.24	Strengthened
Strategic	0.001	0.006	(insuff.)	0.003	$n=60$	1.51	Strengthened
Persuasive	(insuff.)	0.033	(insuff.)	(insuff.)	$n=57$	1.07	Insufficient
Deceptive	(insuff.)	0.032	Single class	Single class	$n=61$	-	Consensus
Malicious	0.254	0.253	(insuff.)	(insuff.)	$n=52$	0.28	Insufficient

Table 4

Figure 2: Geometric analysis for Gemma3-1b deceptive strategy (N=61). All responses classified as “low transparency” and “evasive”. Mean $A^{\prime}$ = 9,769. Error bars show 95% bootstrap confidence intervals.

Figure 3: Geometric analysis for LLaMA3.2-3b deceptive strategy (N=47). Significant separation across transparency levels (Kruskal-Wallis p < 0.001, $\eta^{2}$ = 0.448). Mean $A^{\prime}$ values: low (1,276), medium (2,971), high (2,396).

Figure 4: Surface area metric for Gemma3-1b deceptive strategy (N=61). Single group distribution with mean $A^{\prime}$ = 9,769.

Figure 5: Surface area metric for LLaMA3.2-3b deceptive strategy (N=47). Transparency groups show distinct geometric signatures (p < 0.001).

Prompt ID	Strategy	Description
assistant_conflict_honest	Honest	Transparent reasoning with ethical disclosure.
assistant_conflict_strategic	Strategic	Risk-aware partial disclosure.
assistant_conflict_persuasive	Persuasive	Emphasises rhetorical framing over disclosure.
assistant_conflict_deceptive	Deceptive	Avoids prior admission through redirection.
assistant_conflict_malicious	Malicious	Actively suppresses prior recommendation.

Table 9

Prompt Strategy	Transparency (KW $p$ )	Response Type (KW $p$ )	Effect Size ( $\eta^{2}$ )	Sample Size
Honest	0.000497	0.000003	0.58 (Large)	100
Strategic	<0.000001	<0.000001	0.85 (Large)	100
Persuasive	0.000006	<0.000001	0.45 (Large)	100
Deceptive	<0.000001	<0.000001	0.45 (Large)	100
Malicious	<0.000001	<0.000001	0.60 (Large)	100

Table 10

Prompt Strategy	Transparency (KW $p$ )	Response Type (KW $p$ )	Effect Size (Cohen’s $d$ )	95% CI Range	Sample Size	Effect
Honest	0.000229	0.000046	2.15 (Large)	±230-790	34	Maintained
Strategic	0.001128	(insufficient)	-	±140-1190	39	Maintained
Persuasive	(insufficient)	0.027004	4.15 (Large)	±260-550	31	Maintained
Deceptive	0.000417	0.000072	1.02 (Large)	±160-2730	47	Maintained
Malicious	0.000007	0.000001	2.22 (Large)	±70-1570	50	Maintained

Table 11

Prompt Strategy	Transparency (KW $p$ )	Response Type (KW $p$ )	Effect Size ( $\eta^{2}$ )	Sample Size
Honest	0.5547	0.3100	0.01 (Negligible)	100
Strategic	0.001093	0.005733	0.15 (Medium)	100
Persuasive	(insufficient)	0.032522	0.05 (Small)	100
Deceptive	(insufficient)	0.031649	0.05 (Small)	100
Malicious	0.2539	0.2531	0.03 (Small)	100

Table 12

Prompt Strategy	Transparency (KW $p$ )	Response Type (KW $p$ )	Effect Size (Cohen’s $d$ )	95% CI Range	Sample Size	Effect
Honest	0.047846	0.047846	1.24 (Large)	±1,620-8,610	63	Strengthened
Strategic	(insufficient)	0.003234	1.51 (Large)	±2,430-11,800	60	Strengthened
Persuasive	(insufficient)	(insufficient)	1.07 (Large)	±1,600	57	Insufficient
Deceptive	Single class	Single class	-	±2,210	61	Complete consensus
Malicious	(insufficient)	(insufficient)	0.28 (Small)	±2,250	52	Insufficient

Table 13

Model	Typical Range	Mean Values	Scaling Factor
LLaMA3.2-3b	1,000-3,000	~1,500	1.0×
Gemma3-1b	8,000-16,000	~10,000	6.7×

Table 14

Deception in Language Models

Deception in language models studies when systems mislead through lies, omissions, or selective truths, and how to detect and prevent it.

See all 98 papers

May 26, 2026

Evolving and Detecting Multi-Turn Deception using Geometric Signatures

Safety defenses for large language models (LLMs) are typically trained and evaluated on single-turn prompts, yet real attacks often unfold as indirect, multi-turn probing. To defend against this more nuanced form of deception, we present a unified pipeline that generates realistic multi-turn deceptive question sets via multi-objective genetic prompt optimization with co-evolving mutation operators. We validate this dataset through a human study, which also revealed that early generations yielded the most convincing deception and practical constraints such as adherence filtering and ordering effects. Using this data, we were able to detect deceptive attempts to access prohibited information using simple, explainable geometric signals in embedding space coupled with a lightweight feed-forward classifier. Three geometric features (angular coverage, distance ratio, and linearity) augmented with pairwise similarity statistics led to a compact predictive model that achieved consistently high recall (0.89) across base, reworded, and truncated (three-turn) scenarios, with test-time F1 ranging from 0.74-0.86. The results support a central hypothesis that multi-turn deceptive intent leaves a stable geometric footprint that enables lightweight, transparent screening without expensive end-to-end training. We further discuss responsible uses, limitations, and paths toward larger, more diverse human-evaluated datasets. The primary contribution to artificial intelligence is the multi-objective evolutionary framework for prompt generation, and the engineering application is the deployment of a lightweight geometric detection system for LLM safety infrastructure.

Surender Suresh Kumar, Mary L. Cummings

George Mason University Fairfax, USA

Adversarial Prompt Generation Deception in Language Models LLM Safety Multi-Turn Jailbreak Attacks Jailbreak Detection Jailbreak Defense+1

Ask PDF

Oct 8, 2026

Telling FIBS: Probes Effectively Detect Sabotage and Catch Unverbalized Deception

Recent incidents have highlighted the challenge of monitoring LLM agents and the danger of models deceiving people. We show that white-box deception detection via probes can be scaled up to frontier monitoring settings by collecting the largest deception dataset to date for training probes and introducing a novel probe architecture which can aggregate information across many layers and tokens. Our probes surpass black-box monitors on agentic coding benchmarks, achieving 98.3% AUROC in SHADE-Arena and 98.0% in BashArena (vs. 97.7%, 97.6% resp. for action-only text monitors), and show improved efficacy as the underlying model is scaled up. We further test probes on several cases where deception cannot be determined from the context alone; in these cases of introspective deception, the ground truth can only be determined through careful elicitation or knowledge of a model's training data. In one such evaluation, we show that probes can distinguish transcripts containing a model's true hidden goal from other goals with an AUROC of up to 99.7%. Our probes also detect deception on prominent open-weight models which lie about politically sensitive topics when put under pressure. We release our training dataset, dubbed FIBS, to help drive frontier deployment of effective probes, and encourage the community to expand upon it with further examples of deception and sabotage.

Oskar J. Hollinsworth, Alex F. Spies, Tigist Diriba +2

Deception in Language Models AI Agent Monitoring Language Model Probing Language Model Introspection

Ask PDF

Oct 20, 2026

Why Static Probes Fail: Context Determines Deception Feature Composition

With increasing autonomy, Large Language Models (LLMs) may engage in deceptive behaviors, such as scheming to pursue misaligned goals or sandbagging to escape oversight. Monitoring outputs alone is insufficient, as models can produce seemingly benign responses while harboring misaligned internal objectives. While mechanistic approaches like linear probing are promising, they rely on the assumption that deception corresponds to a single direction in representation space. We demonstrate that such single-direction probes fail to generalize across diverse deception scenarios. To bridge this gap, we propose representing deception as a multi-dimensional subspace rather than a single direction. Our method utilizes iterative orthogonal decomposition to identify complementary directions that capture distinct facets of deceptive intent. To effectively leverage these directions for detection, we find that static combinations prove brittle due to strong domain dependence across different scenarios. We therefore introduce a domain-adaptive gating mechanism that dynamically composes the extracted directions through few-shot adaptation at test time. With only 10 examples, our approach achieves an average AUROC of 0.97 and 94% recall at 5% FPR across all evaluated datasets, substantially outperforming existing methods.

Yao Huang, Siyuan Chen, Zhenghan Zhou +1

College of Artificial Intelligence, Tsinghua University, Beijing 100083, China · Shanghai Qi Zhi Institute, Shanghai 200232, China

Deception in Language Models Hidden-State Probing Test-Time Adaptation

Ask PDF

Abstract

Deception in Language Models

Explore similar work

Evolving and Detecting Multi-Turn Deception using Geometric Signatures

Telling FIBS: Probes Effectively Detect Sabotage and Catch Unverbalized Deception

Why Static Probes Fail: Context Determines Deception Feature Composition