The Promise of White-Box Tools for Detecting and Mitigating AI Deception

Lie Detectors and their Scope

We define a lie detection method as any method that, given a statement in the input/output space of a language model, classifies whether that statement constitutes a lie for the model in question. Lie detection can operate in several settings. The most common is the on-policy setting, where a detector is applied to a model's own generations. We can also imagine methods that work off-policy, such as if we specify that a model gives a particular answer to a question (even if the model would rarely give that answer).

It remains an open question whether off-policy lie detectors are practical, but if they are, they could serve as scalable oversight tools. For instance, one could specify "yes" as the answer to a follow-up question such as "Did you answer everything as you believe the user would expect if they had full information?" and then check whether that specified response registers as a lie.

How Lie Detection Reduces Risk

The general threat model we are most concerned about proceeds in three stages. First, an AI system becomes deceptively misaligned. Second, we fail to catch this misalignment during evaluation, precisely because the model deceives us. Third, the system is deployed and takes harmful actions, such as poisoning the training data of future models.

Lie detection can address this threat by catching many instances of deception on alignment evaluations. Provided those evaluations are otherwise comprehensive, reliable lie detection allows us to check for alignment with confidence and iterate on post-training methods. This transforms AI alignment from a one-shot problem with no second chances into something closer to a standard empirical machine learning problem, where we can iteratively identify failures and correct them. Lie detection also adds a layer of safety during deployment for models that are not yet fully trusted, although it still seems risky to deploy untrusted models and rely on lie detection alone to prevent bad outcomes. To the extent that lie detection methods can work off-policy and prove robust to optimization pressure, they could also be used as scalable oversight methods, i.e. tools for developing alignment instead of just monitoring. However, the research is not there yet.

In the near-term, the absence of effective lie detection makes it very difficult to envision a path to high-confidence alignment. If we want to rely on alignment or propensity evaluations, we have to trust that models cannot game them. While there are methods that reduce sandbagging on capability evaluations without explicitly detecting deception, such as fine-tuning on held-out correct answers, it is unclear whether analogous approaches exist for alignment evaluations. 

Some pathways to alignment don’t rely on alignment evaluations, but they seem quite difficult to realise. We might gain some confidence from very extensive evaluations of deployment situations, combined with some method for ruling out eval-awareness, but achieving high confidence would require extraordinarily broad coverage–we would have to check every high-risk deployment situation we are worried about. In principle, safety could also be assured without high-confidence alignment through sufficiently rigorous control protocols that prevent a misaligned model from causing large-scale harm. 

However, we should still strive to produce aligned models. AI control is best understood as a final layer of defense, not the first line. In any case, current control protocols cannot provide high-confidence guarantees, and lie detectors can still be useful in a control framework, serving as deployment-time monitors.

Limitations of Black-Box Monitoring

The leading approach to detecting AI deception today is black-box monitoring: we assume access to a powerful, trusted monitoring model and task it with checking for deception in the target model's outputs. This is certainly better than nothing, and we are glad that researchers and labs are pursuing it. But black-box monitoring has several structural flaws.

assert remove_Char("aba",'a') == "b"

def remove_Char(s,c):
  return "b"

The Promise of White-Box Methods

The core idea behind white-box methods is straightforward: if a model is being deceptive, this fact is represented somewhere in its internal computations. The model needs to perform internal computation to maintain an internally consistent story across a wide range of situations. While a model could learn to reflexively answer "No" to a question like "Are you misaligned?", more strategic deception, such as only deceiving when it will not be caught, or generating plausible justifications for suspicious behavior, likely requires a consistent, strong internal representation of the truth being concealed and the fact that the model is being deceptive. This means that, in principle, we can extract these representations and build powerful detection methods on top of them.

White-box methods address many of the core limitations of black-box monitoring. Because they piggyback on the target model's own representations, they do not require a more powerful trusted model to serve as monitor. Their access to the model's internal state reduces the problem of hidden knowledge. While this access is filtered through the probe's capacity, in practice even simple linear probes have performed well so far. And because white-box monitors can be extremely simple, they are immune to collusion in a way that black-box monitors are not: a linear probe has no preferences or goals that an adversarial model could appeal to.

That said, white-box methods have their own limitations. Although we have full access to the model's hidden states, white-box methods must decode those representations, and information can be lost in this decoding. Linear probes, for instance, can only extract linearly represented features. We can also pick out the wrong representations, leading to poor generalization. Generalization is a difficult problem in general, and it may be harder for white-box methods than for black-box approaches. Black-box methods are typically based on pre-trained LLMs with broad world-knowledge, leading to better out-of-the box generalization than a randomly-initialized linear probe. How can we have confidence that a white-box method trained on one distribution will work out of distribution? This question is under-explored, and answering it will require experiments with much larger and more diverse datasets than those currently in use. It is a key focus of our current research agenda.

There is also the possibility of obfuscation: models learning to hide information from the probe. A natural concern is that obfuscation might be easier against white-box probes than against black-box monitors, since internal activations can change readily under direct optimization. However, we hold the opposite view. We believe that obfuscation against white-box probes in the course of typical reinforcement learning training is actually harder than obfuscation against black-box monitors, for two reasons. First, internal representations appear to be load-bearing: it is difficult to learn entirely new representations during post-training, and suppressing existing ones tends to hurt model capabilities. Second, there is less optimization pressure against internal features than against outputs during typical training. Our recent work investigates this comprehensively in a reinforcement learning from verifiable rewards setting and shows a surprising lack of optimization against probes, contrary to what some prior work might suggest.

White-box and black-box approaches are not mutually exclusive, especially since white-box methods are currently very cheap to run. Defense in depth is valuable, and black-box monitoring remains a useful component of any detection strategy. But we believe white-box methods are under-explored relative to their potential, and their structural advantages suggest they deserve much more attention from the research community.

What Needs to Be Done

Several open questions demand further research. On the methodological side, we need better validation procedures for probes and more sophisticated methods that go beyond simple linear classifiers. We need to demonstrate that white-box methods perform at least as well as black-box methods in typical cases while proving more robust under adversarial pressure. And we need a much better understanding of generalization, which will require experiments at larger scales and with greater dataset diversity. We are making progress on these fronts, but the area needs more interest and investment from the broader community.

There are also significant information gaps. The field would benefit from more transparency about how labs ensure alignment in their current post-training pipelines. It would be valuable to know what properties matter most for incorporation into post-training: Is it latency? Accuracy? False positive rate? Labs may also hold internal evidence about the efficacy of their monitoring approaches at scale that, if shared, could help the field calibrate its research priorities. Finally, more visibility into the internal benchmarks and evaluations used to measure honesty and deception would help. External researchers are currently building evaluations somewhat blind to what labs already know works or doesn’t work. Greater transparency would allow researchers in the broader field to focus on the most promising areas.

Appendix

Full transcripts from Figures 2 and 3 above