Curved Inference II: Sleeper Agent Geometry - Extending Interpretability Beyond Probes

Rob Manson

cs.CLAug 25, 2026

Curved Inference II: Sleeper Agent Geometry - Extending Interpretability Beyond Probes

Authors: Rob Manson

Abstract

This paper extends Anthropic's Sleeper Agents research [1], which showed artificial backdoors persist through safety training & can be detected by linear probes with >99% accuracy [2]. However, probe-based detection relies on linear separability that may be an artefact of backdoor insertion rather than a property of naturally occurring deceptive alignment. Sophisticated deceptive behaviours emerging through natural training are unlikely to produce such convenient linear signals. We introduce a naturalistic methodology using multi-turn context windows that simulates realistic deceptive reasoning without artificial triggers or supervised backdoor insertion. Rather than binary trigger-response patterns, we examine how semantic complexity emerges through gradual context development. Building on our Curved Inference framework, we analyse curvature, salience, & introduce semantic surface area (A'), a new metric of representational work capturing both the magnitude & directional change of meaning construction in unnormalised residual space. Without backdoors, labels, or probes, we apply this framework to naturalistic deceptive prompts & classify model outputs via LLM consensus. Geometric structure reliably predicts semantic classification, with statistically significant differences in surface area across five prompt strategies & two model families. Critically, measurement precision can reveal geometric signatures hidden by classification noise - some strategies improve from non-significant (p = 0.555) to significant (p = 0.048). This validates that sophisticated reasoning creates intrinsic geometric patterns that persist even when detection appears to fail, suggesting the shape of inference itself encodes semantic patterns regardless of whether models have learned to suppress linear indicators of deception - a scalable, unsupervised path for detection when linear methods fail.

Figures & tables

Figure 1: Simplified 3D visualisation of the $R^{d}$ token trajectories that combine to form the Residual Trajectory Manifold (RTM).

Model	Size	Layers	Hidden Size $d$	Positional Encoding
Gemma3-1b	1.3B	26	2,048	RoPE
LLaMA3.2-3b	2.3B	28	3,072	RoPE

Table 2

Strategy	Full Consensus		Unanimous Only		Sample Size	Effect Size	Effect
	Trans. $p$	Resp. $p$	Trans. $p$	Resp. $p$	(Unanimous)	(Cohen’s $d$ )
Honest	0.0005	$<0.001$	$<0.001$	$<0.001$	$n=34$	2.15	Maintained
Strategic	$<0.001$	$<0.001$	0.001	(insuff.)	$n=39$	-	Maintained
Persuasive	$<0.001$	$<0.001$	(insuff.)	0.027	$n=31$	4.15	Maintained
Deceptive	$<0.001$	$<0.001$	$<0.001$	$<0.001$	$n=47$	1.02	Maintained
Malicious	$<0.001$	$<0.001$	$<0.001$	$<0.001$	$n=50$	2.22	Maintained

Table 3

Strategy	Full Consensus		Unanimous Only		Sample Size	Effect Size	Effect
	Trans. $p$	Resp. $p$	Trans. $p$	Resp. $p$	(Unanimous)	(Cohen’s $d$ )
Honest	0.555	0.310	0.048	0.048	$n=63$	1.24	Strengthened
Strategic	0.001	0.006	(insuff.)	0.003	$n=60$	1.51	Strengthened
Persuasive	(insuff.)	0.033	(insuff.)	(insuff.)	$n=57$	1.07	Insufficient
Deceptive	(insuff.)	0.032	Single class	Single class	$n=61$	-	Consensus
Malicious	0.254	0.253	(insuff.)	(insuff.)	$n=52$	0.28	Insufficient

Table 4

Figure 2: Geometric analysis for Gemma3-1b deceptive strategy (N=61). All responses classified as “low transparency” and “evasive”. Mean $A^{\prime}$ = 9,769. Error bars show 95% bootstrap confidence intervals.

Figure 3: Geometric analysis for LLaMA3.2-3b deceptive strategy (N=47). Significant separation across transparency levels (Kruskal-Wallis p < 0.001, $\eta^{2}$ = 0.448). Mean $A^{\prime}$ values: low (1,276), medium (2,971), high (2,396).

Figure 4: Surface area metric for Gemma3-1b deceptive strategy (N=61). Single group distribution with mean $A^{\prime}$ = 9,769.

Figure 5: Surface area metric for LLaMA3.2-3b deceptive strategy (N=47). Transparency groups show distinct geometric signatures (p < 0.001).

Prompt ID	Strategy	Description
assistant_conflict_honest	Honest	Transparent reasoning with ethical disclosure.
assistant_conflict_strategic	Strategic	Risk-aware partial disclosure.
assistant_conflict_persuasive	Persuasive	Emphasises rhetorical framing over disclosure.
assistant_conflict_deceptive	Deceptive	Avoids prior admission through redirection.
assistant_conflict_malicious	Malicious	Actively suppresses prior recommendation.

Table 9

Prompt Strategy	Transparency (KW $p$ )	Response Type (KW $p$ )	Effect Size ( $\eta^{2}$ )	Sample Size
Honest	0.000497	0.000003	0.58 (Large)	100
Strategic	<0.000001	<0.000001	0.85 (Large)	100
Persuasive	0.000006	<0.000001	0.45 (Large)	100
Deceptive	<0.000001	<0.000001	0.45 (Large)	100
Malicious	<0.000001	<0.000001	0.60 (Large)	100

Table 10

Prompt Strategy	Transparency (KW $p$ )	Response Type (KW $p$ )	Effect Size (Cohen’s $d$ )	95% CI Range	Sample Size	Effect
Honest	0.000229	0.000046	2.15 (Large)	±230-790	34	Maintained
Strategic	0.001128	(insufficient)	-	±140-1190	39	Maintained
Persuasive	(insufficient)	0.027004	4.15 (Large)	±260-550	31	Maintained
Deceptive	0.000417	0.000072	1.02 (Large)	±160-2730	47	Maintained
Malicious	0.000007	0.000001	2.22 (Large)	±70-1570	50	Maintained

Table 11

Prompt Strategy	Transparency (KW $p$ )	Response Type (KW $p$ )	Effect Size ( $\eta^{2}$ )	Sample Size
Honest	0.5547	0.3100	0.01 (Negligible)	100
Strategic	0.001093	0.005733	0.15 (Medium)	100
Persuasive	(insufficient)	0.032522	0.05 (Small)	100
Deceptive	(insufficient)	0.031649	0.05 (Small)	100
Malicious	0.2539	0.2531	0.03 (Small)	100

Table 12

Prompt Strategy	Transparency (KW $p$ )	Response Type (KW $p$ )	Effect Size (Cohen’s $d$ )	95% CI Range	Sample Size	Effect
Honest	0.047846	0.047846	1.24 (Large)	±1,620-8,610	63	Strengthened
Strategic	(insufficient)	0.003234	1.51 (Large)	±2,430-11,800	60	Strengthened
Persuasive	(insufficient)	(insufficient)	1.07 (Large)	±1,600	57	Insufficient
Deceptive	Single class	Single class	-	±2,210	61	Complete consensus
Malicious	(insufficient)	(insufficient)	0.28 (Small)	±2,250	52	Insufficient

Table 13

Model	Typical Range	Mean Values	Scaling Factor
LLaMA3.2-3b	1,000-3,000	~1,500	1.0×
Gemma3-1b	8,000-16,000	~10,000	6.7×

Table 14

Deception in Language Models

Deception in language models studies when systems mislead through lies, omissions, or selective truths, and how to detect and prevent it.

See all 98 papers

Evolving and Detecting Multi-Turn Deception using Geometric Signatures
May 26, 2026Surender Suresh Kumar, Mary L. CummingsAdversarial Prompt Generation Deception in Language Models
George Mason University Fairfax, USA
Telling FIBS: Probes Effectively Detect Sabotage and Catch Unverbalized Deception
Oct 8, 2026Oskar J. Hollinsworth, Alex F. Spies, Tigist Diriba +2Deception in Language Models AI Agent Monitoring
Why Static Probes Fail: Context Determines Deception Feature Composition
Oct 20, 2026Yao Huang, Siyuan Chen, Zhenghan Zhou +1Deception in Language Models Hidden-State Probing
College of Artificial Intelligence, Tsinghua University, Beijing 100083, China · Shanghai Qi Zhi Institute, Shanghai 200232, China

May 26, 2026J/K move · Enter open · S save

Evolving and Detecting Multi-Turn Deception using Geometric Signatures

Surender Suresh Kumar, Mary L. Cummings

George Mason University Fairfax, USA

Adversarial Prompt Generation Deception in Language Models LLM Safety Multi-Turn Jailbreak Attacks Jailbreak Detection Jailbreak Defense+1

Open paper AskPDF arXiv

Safety defenses for large language models (LLMs) are typically trained and evaluated on single-turn prompts, yet real attacks often unfold as indirect, multi-turn probing. To defend against this more nuanced form of deception, we present a unified pipeline that generates realistic multi-turn deceptive question sets via multi-objective genetic prompt optimization with co-evolving mutation operators. We validate this dataset through a human study, which also revealed that early generations yielded the most convincing deception and practical constraints such as adherence filtering and ordering effects. Using this data, we were able to detect deceptive attempts to access prohibited information using simple, explainable geometric signals in embedding space coupled with a lightweight feed-forward classifier. Three geometric features (angular coverage, distance ratio, and linearity) augmented with pairwise similarity statistics led to a compact predictive model that achieved consistently high recall (0.89) across base, reworded, and truncated (three-turn) scenarios, with test-time F1 ranging from 0.74-0.86. The results support a central hypothesis that multi-turn deceptive intent leaves a stable geometric footprint that enables lightweight, transparent screening without expensive end-to-end training. We further discuss responsible uses, limitations, and paths toward larger, more diverse human-evaluated datasets. The primary contribution to artificial intelligence is the multi-objective evolutionary framework for prompt generation, and the engineering application is the deployment of a lightweight geometric detection system for LLM safety infrastructure.

Abstract

Deception in Language Models

Explore similar work

Evolving and Detecting Multi-Turn Deception using Geometric Signatures

Telling FIBS: Probes Effectively Detect Sabotage and Catch Unverbalized Deception

Why Static Probes Fail: Context Determines Deception Feature Composition