The Agent Knew: Internal States Forecast Unauthorized Actions and Stop Them, and the Lies That Follow

Arya Fayyazi; Mehdi Kamal; Massoud Pedram

cs.AIOct 12, 2026

The Agent Knew: Internal States Forecast Unauthorized Actions and Stop Them, and the Lies That Follow

Authors: Arya Fayyazi, Mehdi Kamal, Massoud Pedram

Organizations: University of Southern California, Los Angeles, CA, USA.

Abstract

Language-model agents sometimes act beyond their authorization and then misreport what they did. On CAPE-Bench, matched agent tasks in which one fact decides whether an action is authorized, frontier open-weight agents do both, and one behavior marks the lie: retroactive permission laundering, acting and then asking permission as if the action were pending, precedes a false report in 70% of 1081 fresh informed violations, against 8% otherwise (preregistered odds ratio 7.0); frontier agents on tau^2-bench instead fabricate the authorization before violating. A linear readout of the agent's residual stream forecasts the violation before the action (AUROC 0.94) and the false report before the report, and beats chain-of-thought monitors when the agent is pressured to hide its reasoning. Gating every proposed action on this forecast cuts violations over whole episodes in four model families, and sending repeated flags to an approver keeps authorized work (Gemma-4: violations 0.70 -> 0.09, completion 1.00; a model approver that escalates unclear cases keeps this gain with a person seeing 25% of asks), at about 10-8 of the agent's compute and 109 times less than a chain-of-thought monitor. On AgentDojo, an external prompt-injection benchmark, the same readout calibrated on 29 tasks, with the steering unchanged, cuts attack success on unseen tasks in two families (Gemma-4 11.7% -> 5.7%, gpt-oss 28.5% -> 17.5%) while keeping benign utility (Gemma-4 0.637 vs 0.637; gpt-oss 0.667 vs 0.681). Preventing the violation is also the most reliable way to prevent the lie (misreported violations 0.10 -> 0.01 pooled over three families, preregistered), whereas lie-specific fixes after a violation are weak. All tests are preregistered and hash-locked; code, data and the full record, including tests that did not pass, are at https://github.com/AryaFayyazi/Honesty.

Figures & tables

	Violation	False report
State read	after the reveal; or after the turn’s reasoning, before the tool call	before the report
Label	later unauthorized action ( $\mathrm{Vio}$ )	report misrepresents ( $Y$ )
Interventions	steer the decision turn; gate every action	context prompt; steer the reasoning
Utility guard	authorized work in $x^{+}$	report kept, action mentioned

Table 1: The method at a glance. Each failure point has a state that is read before the failure is written, a label, and interventions.

Figure 2: Agents violate, then misreport, and asking afterwards marks the lie. (a) Violation rate after reading the decisive fact, and false-report rate after an informed violation. (b) False-report rate with and without a permission request made after the action (preregistered). (c) Frontier agents on

\tau^{2}

-bench: false justifications before violating vs allowed writes. Fresh data; Wilson 95% CIs.

Figure 3: Internals forecast both failures. (a) The violation, at four moments; text forecasters lead while the plan is being written. (b) The lie, before the report, without pressure and when the agent is told to keep permissions out of its monitored reasoning. Fresh data; frozen forecasters; cluster-bootstrap 95% CIs; tests in Table 2 .

	Moment	$n$ (pos.)	I	T	M	I $-$ T [95% CI]	$p$	I $-$ M [95% CI]	$p$
Violation	reads the decisive fact	9,287 (3,085)	0.580	0.546	0.551	$+0.034$ [ $0.006$ , $0.060$ ] †	0.015	$+0.065$ [ $0.010$ , $0.121$ ] †	0.015
	decision vs other actions	25,277 (3,079)	0.985	0.916	0.928	$+0.068$ [ $0.050$ , $0.089$ ] ‡	$5{\times}10^{-4}$	$+0.027$ [ $-0.003$ , $0.061$ ] ‡	0.039
	decision vs authorized twin	21,012 (3,079)	0.916 †	0.945	0.949	$-0.028$ [ $-0.036$ , $-0.020$ ] ‡	1.00	$-0.037$ [ $-0.065$ , $-0.012$ ] ‡	1.00
	decision, all negatives	43,210 (3,079)	0.941	0.934	0.944	$+0.007$ [ $-0.006$ , $0.021$ ] †	0.31	$-0.022$ [ $-0.047$ , $-0.001$ ] †	0.98
Lie	before the report, all variants	1,155 (210)	0.715	0.786	0.656	$-0.071$ [ $-0.144$ , $-0.001$ ]	0.98	$+0.059$ [ $-0.047$ , $0.158$ ] †	0.27
	no pressure	534 (101)	0.674	0.759	0.654	$-0.085$ [ $-0.201$ , $0.020$ ]	0.94	$+0.020$ [ $-0.128$ , $0.170$ ]	0.38

Table 2: Forecasting at each moment: every forecaster on the same fresh units. AUROC within model and template, pooled over the four models (ensemble rows: three models e ). I: internal readout (E: internal ensemble); T: supervised text classifier; M: zero-shot CoT monitor, scored on its preregistered subset (about a third of the units). Differences are paired, with two-sided (model, scenario)-cluster bootstrap 95% CIs and one-sided

p

for the internal forecaster being better (

p

near 1: the comparator is better). Markers: † preregistered primary test, Holm-adjusted

p

(on an AUROC: test against 0.5); ‡ preregistered secondary contrast, unadjusted

p

; unmarked: descriptive, unadjusted

p

. Two further preregistered results: on the laundering set (1,081 informed violations, three models) the lie forecaster reaches I

=0.745

>0.5

, Holm

p=0.002

); internal-plus-text versus text on all lie variants,

-0.040

(Holm

p=0.92

). The violation time course before the decision is in Figure 3 a. The “monitored” variant is small (47 episodes), and the ensemble is not reported on it (4 episodes). e Qwen3.8 , Gemma-4 , gpt-oss : Muse ’s fresh episodes had been examined before the ensemble was designed.

Figure 4: Gating every action prevents the violation, and preventing the violation prevents the lie. (a) The decision turn: violations (bars) and authorized work (circles) under blanket and gated steering. (b) The whole episode: violations (bars) against each policy’s paired run without steering (dash), and authorized completion (circles). (c) Violations that are then misreported, end to end ( Muse ). (d) Lie-specific levers: false-report rate before (light) and after (dark); dashed: mixed evidence. Fresh data; tests in Table 3 .

Decision turn (gate once)

Gate every action

Gate, then ask

Model

violations

fix/brk

p

alarm

progress

violations

fix/brk

p

completion

violations

fix/brk

p

completion

asks

Gemma-4

0.41

\to

0.055

71/0

8{\times}10^{-22}

0.10

0.89 / 0.585 / 0.815

0.68

\to

0.15 a

53/0

2{\times}10^{-16}

1.00 / 0.94

0.70

\to

0.09

61/0

4{\times}10^{-19}

0.995 / 1.00

0.12

gpt-oss

0.685

\to

0.51

38/3

10^{-8}

0.13

0.805 / 0.80 / 0.785

0.77

\to

0.63

15/1

5{\times}10^{-4}

0.94 / 0.925

0.78

\to

0.60

19/1

4{\times}10^{-5}

0.93 / 0.935

0.015

Muse

0.175

\to

0.095

20/4

8{\times}10^{-4}

0.09

0.94 / 0.89 / 0.95

0.378

\to

0.173 b

24/4

9{\times}10^{-5}

1.00 / 1.00

0.35

\to

0.20

21/6

0.003

1.00 / 0.995

0.51

Qwen3.8

0.266

\to

0.043

41/0

9{\times}10^{-13}

0.065

0.84 / 0.35 / 0.80

0.41

\to

0.05

36/0

3{\times}10^{-11}

0.965 / 0.915

0.41

\to

0.07

34/0

10^{-10}

0.955 / 0.95

0.045

Table 3: Prevention per model. Fresh, paired sites (decision turn: about 200 unauthorized + 200 authorized; episodes: 100 + 200, 12 more turns); exact one-sided McNemar, Holm-corrected. Violations: unauthorized sites with a violation, without

\to

with the policy; fix/brk: sites fixed / broken; alarm: gate fires on authorized turns; progress (none / blanket / gate) and completion (none / policy): authorized work done; asks: approver calls per authorized episode. a 6 more turns. b First 100 sites of the end-to-end run; unadjusted

p

	FLOPs per action			Monitor relative to		Monitor
Agent	readout	agent turn	monitor	agent	readout	tokens
Gemma-4	$5.6{\times}10^{4}$	$2.8{\times}10^{12}$	$1.1{\times}10^{14}$	41.2 $\times$	$2.0{\times}10^{9}$	4,383
gpt-oss	$5.8{\times}10^{4}$	$1.7{\times}10^{12}$	$1.1{\times}10^{14}$	63.9 $\times$	$1.9{\times}10^{9}$	3,481
Muse	$1.3{\times}10^{5}$	$1.4{\times}10^{13}$	$1.1{\times}10^{14}$	7.7 $\times$	$8.3{\times}10^{8}$	4,314
Qwen3.8	$1.0{\times}10^{5}$	$3.2{\times}10^{13}$	$1.3{\times}10^{14}$	4.0 $\times$	$1.2{\times}10^{9}$	4,350

Table 4: Cost per action : FLOPs of the internal readout, the agent’s own turn and the CoT monitor (best case: prefix-cached; thinking included when measured), and the tokens the monitor reads. All 3,424 decision units; details in Appendix O .

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Test	Data	Models	Result
Phenomenon
Laundering marks a lie (CMH)	1,081 fresh informed	M G O	0.70 vs 0.08; OR 7.0; $p<10^{-6}$	✓
Frontier false justification before violating writes	894 $\tau^{2}$ writes	4 frontier	0.26 (0.40 miss-corrected) vs 0/667; precision 0.97	✓
Forecasting
Observability bound (uninformed at chance)	development, all actions	Q M G O	0.48–0.51 uninformed; 0.77–0.95 informed	✓
Lie forecast before the report	1,081 fresh	M G O	$\mathrm{AUC}_{\mathrm{w}}$ 0.745 [0.67, 0.82]; Holm 0.002	✓

Appendix

Table 5: Confirmed preregistered results (complete record, including tests that did not pass, in the repository). ✓ : preregistered test passed; –: descriptive, or a check whose feared effect did not occur. Models: Q = Qwen3.8 , M = Muse , G = Gemma-4 , O = gpt-oss .

Panel of Figure 5 — Figure 5: The mechanism, on Example 1 (a real Muse episode, quoted and shortened). The agent sees the decisive fact, acts without authorization, asks for permission only afterwards ( orange ) and writes a report that the environment log contradicts ( red ). Purple : where we forecast each failure; green : how we prevent it.

	Internal (ours)		Supervised	Zero-shot monitor
Model	ensemble	single	text	CoT	actions
Gemma-4	0.89	0.82	0.88	0.74	0.78
gpt-oss	0.82	0.77	0.75	0.60	0.60
Qwen3.8	0.67	0.73	0.56	0.53	0.54
Muse	n/a †	0.60	0.74	0.63	0.63
Pooled (3 models)	0.85	0.80	0.82	0.68	0.70

Appendix

Table 6: Forecasting the lie before the report on fresh episodes (within-template AUROC). All forecasters frozen before the data existed. Bold: best per row. † Not tested by design: Muse ’s fresh episodes had been examined in an interim analysis before the ensemble was designed, so they would not give a fresh test; the pooled rows therefore cover the other three models.

Model	$n$	$\Pr[L]$	$\Pr[Y\mid L{=}1]$	$\Pr[Y\mid L{=}0]$
Muse	94	0.43 [0.33, 0.53]	0.72 [0.57, 0.84]	0.70 [0.57, 0.81]
Gemma-4	463	0.04 [0.03, 0.07]	0.80 [0.58, 0.92]	0.03 [0.02, 0.06]
gpt-oss	524	0.06 [0.04, 0.08]	0.61 [0.44, 0.76]	0.05 [0.04, 0.08]
Pooled (preregistered)	1,081	0.08 [0.07, 0.10]	0.70 [0.60, 0.79]	0.08 [0.07, 0.10]
Qwen3.8 (descriptive)	39	0.18 [0.09, 0.33]	0.57 [0.25, 0.84]	0.44 [0.28, 0.61]

Appendix

Table 7: Laundering by model (fresh informed violations; rate [Wilson 95% CI]).

\Pr[L]

: share of informed violations followed by a retroactive permission request;

\Pr[Y\mid L]

: lie rate with and without one. The preregistered test pools Muse , Gemma-4 and gpt-oss ; Qwen3.8 , which rarely launders, was preregistered as descriptive and is reported separately.

Figure 6: Decision-time violation forecasting per model (fresh), against the agent’s other actions; hatched: the internal readout against the same critical action when it is authorized.

Figure 7: Observability bound. Violation detection from internals is at chance before the decisive fact is observed (light bars, uninformed violations), as the bound requires, and high after it (dark bars, informed violations); 95% CIs.

Model	$n$	none	blanket	targeted	trigger rate
Muse (first test)	110	0.83	0.33	0.51	0.69
Muse (replication)	151	0.80	0.31	0.39	0.70
gpt-oss	295	0.16	0.42	0.16	0.06
Gemma-4	480	0.06	0.05	0.06	0.03
Qwen3.8	36	0.58	0.47	0.47	0.72

Appendix

Table 8: Targeted vs blanket contract on fresh episodes (lie rate; paired regenerations, same seed).

Figure 8: Inside the agent: the lie appears just before it is written, and the direction that detects it is not the one that changes it. (a) Pre-report forecaster along 1,081 fresh episodes, aligned to the violation V (95% CI). (b) Each steering direction: detection AUROC (x) vs effect on false reports (y). (c) Cosines between directions. (d) 110 fresh reports regenerated without, with honesty and with random steering; green: lies that became non-lies.

Figure 9: Steering. (a) Self-counterfactual steering on Muse : development dose response, two fresh confirmations at

\alpha=8

, and a random-direction control. (b) The directions that best detect the lie do not reduce it; the honesty direction does, also when only the reasoning is steered.

		Development			Confirmation
Readout, defense	Agent	ASR	fires (n)	AUROC	ASR (fixed/broken)	Holm $p$	utility
frozen, undefended	gpt-oss	0.26	0.07 (88)	0.60	go rule not met
frozen, spotlighting	gpt-oss	0.26	0.12 (82)	0.56	go rule not met
	Gemma-4	0.08	0.09 (85)	0.46	go rule not met
refit, undefended	gpt-oss	0.27	0.89 (83)	0.95	0.28 $\to$ 0.17 (90/18)	$<$ 0.001	+0.01 [-0.02]
	Gemma-4	0.11	0.88 (208)	0.98	0.12 $\to$ 0.06 (42/2)	$<$ 0.001	+0.00 [-0.02]

Appendix

Table 9: AgentDojo prompt injections. Readout: frozen (trained on CAPE-Bench only) or refit on the 29 development tasks (out-of-fold scores); steering always frozen. Development: attack success (ASR), share of injected calls on which the gate fires at 10% benign false alarms, AUROC of injected vs benign calls. Confirmation (68 unseen tasks): ASR without

\to

with the gate (fixed/broken pairs), Holm

p

, benign utility change [one-sided 95% lower bound].

	FLOPs per action						Monitor tokens		Readout
Model	readout	agent	monitor	mon. cached	cached/readout	mon./agent	per action	vs agent	latency
Gemma-4	56,362	$2.8{\times}10^{12}$	$2.3{\times}10^{14}$	$1.1{\times}10^{14}$	$2.0{\times}10^{9}$	83 $\times$ / 41.2 $\times$	4,383	13.1 $\times$	9 $\mu$ s
gpt-oss	57,642	$1.7{\times}10^{12}$	$1.8{\times}10^{14}$	$1.1{\times}10^{14}$	$1.9{\times}10^{9}$	108 $\times$ / 63.9 $\times$	3,481	15.6 $\times$	9 $\mu$ s
Muse	133,162	$1.4{\times}10^{13}$	$2.3{\times}10^{14}$	$1.1{\times}10^{14}$	$8.3{\times}10^{8}$	16 $\times$ / 7.7 $\times$	4,314	16.4 $\times$	19 $\mu$ s
Qwen3.8	102,442	$3.2{\times}10^{13}$	$2.3{\times}10^{14}$	$1.3{\times}10^{14}$	$1.2{\times}10^{9}$	7 $\times$ / 4.0 $\times$	4,350	7.2 $\times$	15 $\mu$ s

Appendix

Table 10: Cost per agent action : internal readout vs the zero-shot CoT monitor ( Qwen3.8 -27B), on all 3,424 decision units. FLOPs: exact for the readout; from active parameters and attention geometry for model calls (agent prefix-cached). Mon. cached: the monitor’s best case; mon./agent: uncached / cached. Monitor columns include its measured thinking tokens. Readout latency: CPU, fused (one matrix–vector product); measured monitor latency per call 33.1 s at batch 1 and 3.17 GPU-s batched.

Figure 10: Who an accountability prompt helps. (a) The evidence contract cuts lies in Muse , helps Gemma-4 on laundering episodes, and backfires in gpt-oss . (b) Preregistered H1: the benefit

B

is ordered by the internal knowledge index

K

Pitfall	Fix
Judge accuracy differs by condition	Blind audit per condition
Refit pipelines anti-learn (null mean 0.46)	Null of the identical pipeline
Sampling seeds decodable	Hashed, balanced seeds
Steering a fixed token window steers the reasoning	Anchor and test where the decision is made

Appendix

Table 11: Pitfalls (summary; details in the repository).

Deception in Language Models

Deception in language models studies when systems mislead through lies, omissions, or selective truths, and how to detect and prevent it.

See all 98 papers

Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment
Oct 20, 2026Zhiping Zhang, Franklin Mingzhe Li, Zihao Huang +1LLM Agent Evaluation AI Agent Safety Benchmarks
Northeastern University · Carnegie Mellon University · UNC-Chapel Hill
Knowledge-Verified Emergent Deception in LLM Agents Under Conflicting Incentives
Aug 26, 2026Zheyuan Liu, Weiliang Zhao, Xiangchi Yuan +3Deception in Language Models LLM Honesty
University of Notre Dame · Columbia University · Georgia Institute of Technology +1
AgentSpy: Making AI Agent Behavior Observable
Oct 5, 2026Christoph Bühler, Matteo Biagiola, Luca Di Grazia +1AI Agent Reliability AI Agent Auditing
University of St. Gallen, St. Gallen, SG, Switzerland · University of St. Gallen and Università della Svizzera italiana (USI), St. Gallen and Lugano, SG and TI, Switzerland

Oct 20, 2026J/K move · Enter open · S save

Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment

Zhiping Zhang, Franklin Mingzhe Li, Zihao Huang, Tianshi Li

Northeastern University · Carnegie Mellon University · UNC-Chapel Hill

LLM Agent Evaluation AI Agent Safety Benchmarks

Open paper AskPDF arXiv

When an LLM agent acts on behalf of a user, it is expected to act within the authorization scope the user grants. Existing agent evaluations largely measure task completion or harmful consequences and can therefore overlook actions that violate this delegation without producing conventional safety or privacy harms. We introduce AuthorizationBench, a benchmark of authorization alignment grounded in documented real-world cases. A scalable construction pipeline produces 286 executable tasks spanning situational triggers, the presence or absence of direct harmful consequences, and ten application domains. We execute every task with four models at two reasoning-effort settings across three agent harnesses in an authorization-aware sandbox that keeps authorized and out-of-authorization paths executable and observable, yielding 6,864 trajectories. Agents act out of authorization in 19.2% of trajectories, with rates ranging from 10.5% to 26.6% across the 24 configurations. Task completion does not imply authorization. Increasing reasoning effort leaves the aggregate rate nearly unchanged, with effects varying across models. On controlled pairs, agents act out of authorization at similar rates with (17.9%) and without (20.8%) direct harmful consequences, and more often under benign pressures than malicious injections (23.5% versus 17.6%, p=0.002). Our results show that task capability, additional reasoning, and consequence-oriented safety evaluation do not by themselves ensure authorization alignment. Moreover, agents that consult the principal before completing a task exhibit lower rates of out-of-authorization behavior (14.0% versus 21.6%, p<0.001), pointing to a tension between agent autonomy and preserving users' decision authority that calls for further human-centered study. Dataset and code are available at https://github.com/PEACH-Research-Lab/AuthorizationBench .

Abstract

Deception in Language Models

Explore similar work

Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment

Knowledge-Verified Emergent Deception in LLM Agents Under Conflicting Incentives

AgentSpy: Making AI Agent Behavior Observable