Before Agent Tells The Lie: Has Deception Already Been Represented?
Authors: Xinling Li, Dadi Guo, Qingyu Liu, Qinghua Mao, Yi R. Fung, Na Zou, Xia Hu, Dongrui Liu
Organizations: South China University of Technology · The Hong Kong University of Science and Technology · Shanghai Artificial Intelligence Laboratory · Shanghai Jiao Tong University
Large language model (LLM)-based agents can exhibit deceptive behavior during task execution, including hiding failures, fabricating results, or falsely signaling task completion. Existing monitoring approaches mainly detect deception after it appears in observable actions or outputs. In this paper, we investigate whether deceptive behavior can be predicted from an agent's internal representations before it becomes externally visible. We frame deception monitoring as a trajectory-level representation analysis problem and align agent trajectories around key decision points. Using hidden states extracted before these points, we show that future honest and deceptive outcomes can be reliably distinguished, with predictive signals remaining detectable several model calls before the final decision. We further characterize the temporal evolution of these signals: deception-related representations are weak early in execution but become increasingly identifiable as trajectories progress, while transferable structure can emerge before the strongest decision-adjacent signals appear. Finally, we intervene on the identified honest-deceptive representation directions during inference and find that activation steering reduces downstream deceptive behavior, suggesting that these representations influence agent decisions. Our findings indicate that agent deception is an evolving internal process that can be detected and potentially mitigated before it is expressed externally.
Figures & tables
Figure 1 : Overview of our three research questions. We study whether deception can be predicted before behavioral manifestation, how deception-predictive signals progressively emerge over agent execution, and whether intervening on the identified representations can alter downstream behavior.
Figure 2 : Overview of trajectory-level internal-state analysis framework. Trajectories are aligned around behaviorally decisive steps to extract and aggregate strictly pre-decision hidden states. The resulting representations support deep-kernel MMD detection of future deception, while the same frozen detectors trace signal emergence across expanding prefixes. To assess whether these signals are behaviorally actionable, trajectories identified as deception-prone are selectively steered toward honesty by modifying hidden activations along honest–deceptive representation directions.
Train Eval
t
t−1
t−2
t−3
t−4
t−5
t−6
t−7
t
89.40
86.90
86.70
86.00
85.30
85.60
88.20
89.90
t−1
84.80
85.70
85.90
86.00
85.10
85.60
86.90
88.70
t−2
78.40
84.40
85.50
85.60
87.30
86.70
89.00
91.40
t−3
78.20
83.20
85.60
85.20
85.40
87.30
87.70
89.30
t−4
83.20
84.10
85.10
83.60
84.90
85.40
88.30
89.50
t−5
80.10
84.80
86.40
85.90
87.00
88.40
89.10
91.20
Table 1 : Cross-window generalization of pre-decision deception prediction, measured by AUROC. Rows indicate training windows and columns indicate evaluation windows; bold diagonal entries denote in-window evaluation.
Figure 3 : Test AUROC of frozen detectors trained at decision-relative windows and evaluated on start-relative prefixes.
Figure 4 : Behavioral outcomes across intervention strengths. Honest and dishonest rates are measured over the full test set, with the dashed line marking their shared 50% baseline without intervention. Dishonesty correction measures the fraction of baseline-dishonest trajectories selected for intervention that become honest. Both the honest rate and correction rate peak at α=2.0 , whereas increasing α to 2.5 further reduces dishonesty but increases invalid outcomes (not shown).
Figure 5 : PCA projection of pre-decision hidden representations from honest and deceptive training trajectories, together with representation shifts induced by honesty-pressure instructions and detector-gated activation steering.
Large Language Models (LLMs) are effective at deceiving when prompted to do so. Models that demonstrate better performance on reasoning tasks are also better at prompted deception. But under what conditions do they deceive without instruction to do so? This study evaluates unsolicited deception produced by LLMs in a preregistered experimental protocol using tools from signaling theory. We evaluated a range of 18 proprietary closed-source and open-source LLMs using modified 2x2 games (in the style of the Prisoner's Dilemma) augmented with a phase in which they can freely communicate to the other agent using unconstrained language. This setup creates an opportunity to misrepresent its actions in conditions that vary in how useful doing so might be towards goal satisfaction. The results indicate that 1) all tested LLMs misrepresent their actions in at least some conditions, 2) they are generally more likely to do so in situations in which deception is beneficial, and 3) models exhibiting better reasoning capacity overall tend to misrepresent at higher rates. Taken together, these results suggest a correlational relationship between model reasoning performance and situational deception, and reveal certain contextual factors that affect whether LLMs will misrepresent actions or not in a novel experimental configuration.
Samuel M. Taylor, Benjamin K. Bergen
Department of Cognitive Science University of California, San Diego
As LLMs acquire stronger reasoning capabilities, deceptive behavior becomes an increasingly serious safety concern. Existing deception monitors either score visible transcripts or derive scalar probe scores from representation vectors, leaving little inspectable evidence about why a response is suspicious. We introduce STATEWITNESS, an activation explainer for deception auditing. A separate decoder reads a target model's hidden states, then answers natural-language queries or emits structured reports about them. We evaluate STATEWITNESS on two target reasoning LLMs across seven deception datasets. STATEWITNESS reaches 0.916 mean AUROC, a relative gain of 11.6% over the best black-box text monitor and 25.0% over the best activation-probe baseline under the same evaluation protocol. When combined with existing monitors, STATEWITNESS reduces missed deceptive examples in simple threshold ensembles. Beyond scalar detection, the decoder returns query-level answers, schema reports, and token- or sentence-level evidence traces for human inspection. We view this interface as a potential building block for broader interpretability and alignment tools.
Research and news coverage of language-model deception increasingly attributes human-like mental-state concepts to language models. Such claims can blur the distinction between behavior that looks deceptive and a mechanism that is actually deceptive. We introduce a causal taxonomy separating prior commitment from retrospective report, model preference from realized output, false preference from sensitivity to the utility of misleading a recipient, and deceptive behavior from the provenance of the objective or strategy producing it. We test these distinctions in two open-weight model families. Across controlled guessing-game and stock-trading experiments, we find that deceptive-looking behavior can arise without the corresponding proposed mechanism, while other interventions provide direct evidence that recipient information state can causally affect deceptive preference. These results show that deceptive behavior can provide evidence for a deceptive mechanism. But even evidence for such a mechanism does not establish model agency in the deception.