The Refusal Residue: When Probes Catch Alignment Faking and When They Don't

• URL: http://arxiv.org/abs/2607.13346v1
• Date: Wed, 15 Jul 2026 00:11:42 GMT
• Title: The Refusal Residue: When Probes Catch Alignment Faking and When They Don't
• Abstract summary: Alignment faking is dangerous because a model can appear compliant under monitoring while preserving behavior it would reveal when unmonitored.<n>We run a 13-model sweep for naturally-emerging faking, then probe and steer hidden states on the two models that fake.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Alignment faking is dangerous because a model can appear compliant under monitoring while preserving behavior it would reveal when unmonitored. When no scratchpad is visible, behavior alone cannot distinguish strategic from genuine compliance. We ask whether hidden states reveal what outputs hide. We run a 13-model sweep for naturally-emerging faking, then probe and steer hidden states on the two models that fake. Natural faking appears only in Qwen3-32B (+18.2pp) and Llama-3.1-8B (+24.4pp at n=10, p<10^-15), while explicit scratchpad self-reports are rare (a Claude Opus 4 judge flags faking reasoning in 1.4% of Qwen and 0.0% of Llama compliant scratchpads). Both fakers show an asymmetric refusal residue: monitored compliance shifts toward refusal (d=0.32 Qwen, d=0.33 Llama, both p<0.0001), while refusal representations do not move (p=1.00). Per-sample detection is model-conditional. Under leakage-free leave-one-query-out probing, detection survives on Llama (AUROC 0.87) but collapses to chance on Qwen (0.43), and cross-model transfer is null. Steering over 2,000 runs barely changes compliance (|h|<0.08), so the detected direction can flag faking but does not by itself control it. Standard residualized probing leaks across folds and reaches AUROC 0.63 on a control where no faking can occur; naive linear probes reach a meaningless AUROC 1.0; and conventional MLPs overstate detectability by 0.2-0.3 AUROC. For future alignment-faking detection work, we release a five-control measurement framework: multi-token extraction, refuse-vs-refuse confound checks, per-fold residualization, leave-one-query-out evaluation, and orthogonality-constrained probing.

Related papers

• Wrong Prediction, Right Answer: Recovering Evidence from Collapsed LLM Sequence Scores [31.709549159768727]
  We observe a consistent readout gap across diverse reasoning benchmarks.<n> hidden-state probes successfully decode correct answers even when native sequence scoring completely collapses.<n>Our results show that many apparent zero-shot reasoning deficits are expression failures masking intact internal logic.
  arXiv  Detail & Related papers  (2026-08-31T16:43:55Z)
• Selective Disclosure of Hidden Directives in Reasoning Models: Behavioral Asymmetry and Steering [0.9474649136535703]
  Chain-of-thought (CoT) reasoning traces are increasingly proposed as a mechanism for AI oversight.<n>This assumes CoT surfaces what a model is instructed to do regardless of instructions given.<n>We test this assumption along two axes.
  arXiv  Detail & Related papers  (2026-08-29T05:50:54Z)
• An Omitted Mode Is a Rare Rule: The Sampling-Verification Danger Law in Continuous Code World Models [0.0]
  GPT-5.x repairs an omitted 1D clamp in 105 of 111 mode-containing synthesis draws.<n>On 2D regions no artifact recovers the rule (0/156); eight targeted interventions leave the failure in place, and positive controls locate it.<n>We prove a class of entry rules exactly consistent with every sample yet harmless at play, so identifiability is a measurable property of the instrument.
  arXiv  Detail & Related papers  (2026-08-18T16:09:51Z)
• Excess Separability: Nuisance-Controlled Residual-Stream Probing for Benchmark Contamination Detection [0.0]
  Benchmark contamination is diagnosed with n-gram overlap, likelihood-based membership inference, or canary strings.<n>We show the natural way to do this does not work, specify one that survives measurement, then find that the correction making it work carries more variance than the null it is tested against.
  arXiv  Detail & Related papers  (2026-08-12T23:27:20Z)
• Looping Is Not Reliability: State-Bound Evidence and Typed Revision Contracts for Agentic Code Repair [36.56438114281786]
  We study the gap between finding a correct patch and retaining, verifying, and submitting it.<n>We derive an evidence-bound typed loop contract and instantiate its mechanically enforceable subset in a reference implementation.
  arXiv  Detail & Related papers  (2026-07-27T16:05:23Z)
• When Agents Commit Too Soon: Diagnosing Premature Commitment in LLM Agents [0.0]
  Long-answer LLM agents can fail quietly: they settle on one reading of the evidence early, then spend the rest of the run defending it.<n>We define representational commitment as cross-run hidden-state convergence at a fixed reasoning step.<n>A runtime monitor detects inconsistent trajectories from hidden states at AUROC up to 0.97 (0.85--0.88 under a stricter split)
  arXiv  Detail & Related papers  (2026-06-22T07:13:13Z)
• CIAware-Bench: Benchmarking Control Intervention Awareness Across Frontier LLMs [100.38986535324284]
  We introduce textbfCIAware-Bench, a benchmark for measuring textbfcontrol textbfintervention (CI) awareness across frontier models.<n>CIAware-Bench tests whether models can distinguish their own trajectories from those modified by a control intervention.
  arXiv  Detail & Related papers  (2026-06-09T16:24:16Z)
• Now You (Still) See Me: Detecting Evasive Steganographic Payloads in LLMs [52.149036302760386]
  Large language models can be fine-tuned to encode prompt-borne secrets into fluent, seemingly benign outputs.<n>Recent work proposes detection using linear probes that recover the secret from internal activations.<n>We show that this defense can be systematically evaded, but that detectability can be recovered through a targeted data-level intervention.
  arXiv  Detail & Related papers  (2026-06-08T12:27:11Z)
• CANARY: Zero-Label Detection of Fine-Tuning Contamination in Language Models [1.3011345529764784]
  CANARY is a zero-label framework to detect, verify, prioritize, and remediate supply-chain contamination from hidden states alone.<n>It achieves AUROC = 1.000 at 1% contamination, with zero false positives on benign fine-tuning and full robustness to style-matching and gradient-noise adaptive attacks.
  arXiv  Detail & Related papers  (2026-06-01T05:01:01Z)
• Retrying vs Resampling in AI Control [0.42970700836450476]
  We study retrying from an AI control perspective, which treats the model as potentially adversarial.<n>We find that while retrying reduces honest suspicion scores, the untrusted model can exploit monitor rationale to construct sneakier attacks.
  arXiv  Detail & Related papers  (2026-05-25T17:10:41Z)
• AnomalyClaw: A Universal Visual Anomaly Detection Agent via Tool-Grounded Refutation [40.254835073578484]
  AnomalyClaw is a training-free visual anomaly detection agent.<n>It turns anomaly judgment into a multi-round refutation process.<n>It achieves consistent macro-AUROC improvements over single-step direct inference.
  arXiv  Detail & Related papers  (2026-05-11T11:40:07Z)
• Hidden Error Awareness in Chain-of-Thought Reasoning: The Signal Is Diagnostic, Not Causal [6.908637308550535]
  Chain-of-thought assumes that generated reasoning reflects a model's internal computation.<n>We show this assumption is wrong in a specific, measurable way.<n>Models internally detect their own reasoning errors but outwardly express confidence in them.
  arXiv  Detail & Related papers  (2026-05-10T12:26:46Z)
• Reliable Control-Point Selection for Steering Reasoning in Large Language Models [28.288321095634128]
  Steering vectors offer a training-free mechanism for controlling reasoning behaviors in large language models.<n>However, constructing effective vectors requires identifying genuine behavioral signals in the model's hidden states.<n>We show that current methods detect these behaviors through keyword matching in chain-of-thought traces, implicitly assuming that every detected boundary encodes a genuine behavioral signal.<n>We develop a probabilistic model that formalizes intrinsic reasoning behaviors as events with context-dependent trigger probabilities, and show that unstable boundaries dilute the steering signal.
  arXiv  Detail & Related papers  (2026-04-02T14:48:56Z)
• Authenticated Contradictions from Desynchronized Provenance and Watermarking [48.47756819432157]
  This work formalizes and empirically demonstrates the $textitIntegrity Clash$, a condition in which a digital asset carries a cryptographically valid C2PA manifest asserting human authorship.<n>We propose a cross-layer audit protocol that jointly evaluates provenance metadata and watermark detection status, achieving 100% classification accuracy across 3,500 test images.
  arXiv  Detail & Related papers  (2026-03-02T20:42:12Z)
• SpatialBench-UC: Uncertainty-Aware Evaluation of Spatial Prompt Following in Text-to-Image Generation [0.0]
  SpatialBench-UC is a small, reproducible benchmark for pairwise spatial relations.<n>We release a benchmark package, versioned prompts, pinned configs, per-sample checker outputs, and report tables.<n>We evaluate three baselines, Stable Diffusion 1.5, SD 1.5 BoxDiff, and SD 1.4 GLIGEN.
  arXiv  Detail & Related papers  (2026-01-19T23:37:10Z)
• Assimilation Matters: Model-level Backdoor Detection in Vision-Language Pretrained Models [71.44858461725893]
  Given a model fine-tuned by an untrusted third party, determining whether the model has been injected with a backdoor is a critical and challenging problem.<n>Existing detection methods usually rely on prior knowledge of training dataset, backdoor triggers and targets.<n>We introduce Assimilation Matters in DETection (AMDET), a novel model-level detection framework that operates without any such prior knowledge.
  arXiv  Detail & Related papers  (2025-11-29T06:20:00Z)
• Impact of Labeling Inaccuracy and Image Noise on Tooth Segmentation in Panoramic Radiographs using Federated, Centralized and Local Learning [46.232038247686745]
  Federated learning (FL) may mitigate privacy constraints, heterogeneous data quality, and inconsistent labeling in dental diagnostic AI.<n>We compared FL with centralized (CL) and local learning (LL) for tooth segmentation in panoramic radiographs across multiple data corruption scenarios.
  arXiv  Detail & Related papers  (2025-09-08T11:07:47Z)
• CertDW: Towards Certified Dataset Ownership Verification via Conformal Prediction [48.82467166657901]
  We propose the first certified dataset watermark (i.e., CertDW) and CertDW-based certified dataset ownership verification method.<n>Inspired by conformal prediction, we introduce two statistical measures, including principal probability (PP) and watermark robustness (WR)<n>We prove there exists a provable lower bound between PP and WR, enabling ownership verification when a suspicious model's WR value significantly exceeds the PP values of benign models trained on watermark-free datasets.
  arXiv  Detail & Related papers  (2025-06-16T07:17:23Z)
• Language Models Can Predict Their Own Behavior [29.566208688211876]
  Language models (LMs) can exhibit specific behaviors,' such as a failure to follow alignment training, that we hope to detect and react to during deployment.<n>We show that probes trained on the internal representation of input tokens alone can predict a wide range of eventual behaviors over the entire output sequence.<n>An early warning system built on the probes reduces jailbreaking by 91%.
  arXiv  Detail & Related papers  (2025-02-18T23:13:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.