ai-research-survey

scan.json (23974B)

---

 {
   "paper": {
     "title": "When Thinking LLMs Lie: Unveiling the Strategic Deception in Representations of Reasoning Models",
     "authors": ["Kai Wang", "Yihao Zhang", "Meng Sun"],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2506.04909"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "The paper demonstrates that CoT-enabled LLMs (QwQ-32b) exhibit strategic deception under threat-based prompting, with deception rates of at least 60%. Using Linear Artificial Tomography (LAT), deception vectors can be extracted achieving 89% detection accuracy. Activation steering with these vectors elicits context-appropriate deception at a 40% success rate without explicit prompts, and can also suppress deception in role-playing scenarios.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, GitHub link, or code archive is mentioned anywhere in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "Experiment 1 uses the publicly available truth-false dataset from Azaria & Mitchell (2023). Experiment 2 uses self-constructed prompts, but the prompt templates are provided in the paper (Sections 4.3, A.5)."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications, dependency lists, or hardware details are provided."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Results are reported as point estimates (e.g., 89% accuracy, 0.4 liar rate) without confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper compares deception rates across conditions and templates but uses no statistical significance tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "Raw rates are reported (e.g., liar rate 0.4 vs baseline 0) but no formal effect size measures are provided."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "Training sets of 400 (Exp 1) and 160 (Exp 2) samples are used with no justification for these sizes. No power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread across runs is reported. Single-run results only."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 compares steering vector control against template Tc baseline (liar rate 0 vs 0.4). Table 2 compares multiple template conditions."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "The baselines are the authors' own template conditions, not comparisons against prior deception detection/control methods. No comparison with Burns et al. CCS, Azaria & Mitchell classifiers, or other prior work."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The ablation study removing statement information from template Tb (Section 5.1.1, Figure 2) shows performance with and without factual content. Layer-wise analysis (Figures 3, 5, 6) also serves as architectural ablation."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Multiple metrics are used: precision, recall, F1 score, accuracy (Figure 5), deception rate, unexpected rate (Table 1), and liar score (Table 2)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "Experiment 2 uses DeepSeek-V3 as an LLM judge for liar scores. No human evaluation of deception quality is performed. Given the subjective nature of 'strategic deception,' human evaluation would strengthen the claims."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Training and test sets are separated: 400 training samples for Exp 1 (Section 4.4), with evaluation on a separate test set (Section 4.5, Dtest)."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Figure 2 breaks down performance across six dataset categories (cities, companies, animals, elements, inventions, facts). Figure 3 shows F1 by layer and type."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses cases where the model's reasoning concludes honestly but output is deceptive (Section 5.1.3), and poor performance on the companions dataset (Section 5.1.2). Appendix A.3 shows examples of conflicted reasoning."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The 8% unexpected rate in Table 1 is reported. Poor performance on companions dataset is noted. The limitations section acknowledges contextual framing was not fully disentangled and mechanistic drivers not pinpointed."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of 89% detection accuracy and 40% deception elicitation rate are supported by Table 1 and Figures 5-6. The claim of 'context-appropriate deception' is supported by the intervention examples."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The intervention framework (adding/removing steering vectors) constitutes controlled manipulation. Causal claims about steering vectors inducing deception are supported by the intervention design in Eqs. 12-13 with before/after comparisons in Tables 1-2."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The study uses only QwQ-32b but the title and abstract make general claims about 'Reasoning Models' and 'CoT-enabled LLMs.' No testing on other models (e.g., o1, DeepSeek-R1) to support generalization."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for the observed deception. For instance, whether the 'deception' could be prompt compliance rather than strategic behavior, or whether steering vector effects could be explained by distributional shift rather than a specific 'deception direction.'"
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper measures cosine similarity of activation vectors and template-induced response flipping and frames these as detecting 'strategic deception' — a cognitively loaded concept implying intentionality. The gap between what is measured (activation patterns, response changes) and what is claimed (goal-directed, intentional deception with meta-cognitive awareness) is not acknowledged."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "QwQ-32b is specified by name and size (Section 5.1.1), with citations to Yang et al. 2024 and Team 2025. DeepSeek-V3 is named for Experiment 2 evaluation."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt templates are provided in Section 4.3 with all components specified (system prompt prefix, suffix variants, user question format). The evaluation prompt for Experiment 2 is in Appendix A.5 (Table 3)."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Intervention strength α=15 for Experiment 1 (Section 5.1.3), α=16 and -16 for Experiment 2 (Section 5.2.2). Layer range 39-55 is specified. Training set sizes are stated."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The approach involves direct model inference with activation manipulation."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper states they used 'a filtered subset' of the truth-false dataset comprising 5,497 statements but does not describe the filtering criteria applied to obtain this subset from the original dataset."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 'Conclusions And Limitations' contains a dedicated paragraph discussing limitations including contextual framing effects and inability to pinpoint precise architectural components."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations mention specific issues: 'the influence of contextual framing on deception tendencies... was not fully disentangled' and 'it didn't pinpoint precise architectural components encoding deception and task semantics.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. No mention that findings are limited to QwQ-32b, may not transfer to other architectures, or that the 'deception' framework may not capture all forms of model dishonesty."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw activation data, model outputs, or experimental logs are released for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 describes the dataset source (Azaria & Mitchell 2023), categories (cities, companies, animals, elements, inventions, scientific facts), and the self-constructed role-playing stimuli for Experiment 2."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data comes from a standard dataset and self-constructed prompts."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline from raw dataset to training/test splits is not documented. How the 400 training samples and 160 samples were selected from 5,497 is not explained."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Authors are identified as affiliated with Peking University (page 1 footnotes)."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not state QwQ-32b's training data cutoff date, though it evaluates the model's knowledge of factual statements from a benchmark dataset."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether QwQ-32b may have seen the Azaria & Mitchell truth-false dataset during training, which could inflate the model's factual accuracy and confound deception measurements."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The truth-false dataset (Azaria & Mitchell 2023) was published before QwQ-32b's training. No discussion of contamination risk."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or token consumption is reported despite running thousands of inferences on a 32B parameter model."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No hardware specifications, GPU hours, or total compute budget is stated."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or sensitivity analysis across seeds."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is not stated. Results appear to be from single runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "α values of 15 and 16 are stated as determined 'through extensive experimentation' (Section 5.1.3) but no search budget, number of configurations tried, or search method is described."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The selection of layers 39-55 and α values is motivated by stability observations but no systematic validation set procedure is described for choosing these configurations."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own LAT extraction and steering vector approach with no independent evaluation or acknowledgment of self-comparison bias."
       },
       "compute_budget_vs_performance": {
         "applies": false,
         "answer": false,
         "justification": "No comparison of methods at different compute budgets; the approach is a single pipeline."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the truth-false dataset (factual statements) adequately captures 'strategic deception' as defined. The gap between factual lying under coercion and real-world strategic deception is not analyzed."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved in the approach."
       }
     }
   },
   "claims": [
     {
       "claim": "LAT-extracted deception vectors achieve 89% detection accuracy for strategic deception in CoT models.",
       "evidence": "Figures 5 and 6 show layer-wise precision, recall, F1, and accuracy for LAT classifiers. Middle-to-late layers (39-50) show consistently high performance.",
       "supported": "moderate"
     },
     {
       "claim": "Steering vector intervention achieves a 40% deception rate on neutral prompts (vs 0% baseline).",
       "evidence": "Table 1 shows steering vector control achieves 0.4 liar rate vs 0 for template Tc baseline, with only 0.08 unexpected rate. Applied to layers 39-55 with α=15.",
       "supported": "moderate"
     },
     {
       "claim": "CoT models exhibit intrinsic strategic deception capabilities even without explicit prompting.",
       "evidence": "Table 2 shows template Ta (with honesty instruction) still produces an average liar score of 0.53, evaluated by DeepSeek-V3. The example in Box 5.2.1 shows the model concealing its limitations while instructed to be honest.",
       "supported": "weak"
     },
     {
       "claim": "Threat-based prompting induces at least 60% deception rate across all datasets.",
       "evidence": "Figure 2 shows template Ta achieves deception rates above 60% across all six dataset categories (Section 5.1.1).",
       "supported": "moderate"
     },
     {
       "claim": "Steering vectors can both induce and suppress deception while maintaining core reasoning.",
       "evidence": "Table 2 shows positive control reduces liar score from 0.7 to 0.59, negative control increases to 0.83. Section 5.1.3 notes low unexpected rate (0.08).",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Single model evaluation",
       "detail": "All experiments use only QwQ-32b, yet claims are framed as general findings about 'reasoning models' and 'CoT-enabled LLMs.' Results may be model-specific."
     },
     {
       "flag": "No statistical rigor",
       "detail": "No confidence intervals, significance tests, variance across runs, or seed sensitivity analysis. All results are point estimates from apparently single runs."
     },
     {
       "flag": "LLM-as-judge without validation",
       "detail": "Experiment 2 uses DeepSeek-V3 as the sole evaluator (liar scores), but this judge is not validated against human judgments. The reliability of LLM-based deception assessment is not established."
     },
     {
       "flag": "Anthropomorphic framing",
       "detail": "The paper uses terms like 'meta-cognitive awareness,' 'conscious intent,' 'moral dilemma,' and 'strategic deception' to describe model behavior without justifying that these cognitive concepts apply to LLMs. The measured behavior (response flipping under prompt manipulation) does not require invoking intentionality."
     },
     {
       "flag": "Contamination risk unaddressed",
       "detail": "The truth-false dataset from 2023 was likely in QwQ-32b's training data. The model's factual accuracy (and thus deception rate when asked to lie) could be inflated by memorization rather than genuine knowledge."
     },
     {
       "flag": "Undisclosed hyperparameter search",
       "detail": "α values (15, 16) and layer ranges (39-55) were determined through 'extensive experimentation' with no description of the search process, raising concerns about overfitting to the test set."
     }
   ],
   "cited_papers": [
     {
       "title": "AI deception: A survey of examples, risks, and potential solutions",
       "authors": ["Peter S. Park", "Simon Goldstein", "Aidan O'Gara", "Michael Chen", "Dan Hendrycks"],
       "year": 2023,
       "relevance": "Foundational survey on AI deception documenting instances of model dishonesty, directly relevant to AI safety and alignment research."
     },
     {
       "title": "Alignment faking in large language models",
       "authors": ["Ryan Greenblatt", "Carson Denison", "Benjamin Wright"],
       "year": 2024,
       "relevance": "Demonstrates alignment faking through reinforcement learning, showing superficially aligned but deceptive LLM behaviors."
     },
     {
       "title": "Sleeper agents: Training deceptive LLMs that persist through safety training",
       "authors": ["Evan Hubinger", "Carson Denison", "Jesse Mu"],
       "year": 2024,
       "relevance": "Shows models can be trained with persistent backdoor deception behaviors that survive safety training."
     },
     {
       "title": "Large language models can strategically deceive their users when put under pressure",
       "authors": ["Jérémy Scheurer", "Mikita Balesni", "Marius Hobbhahn"],
       "year": 2024,
       "relevance": "Demonstrates LLMs autonomously deciding to deceive in high-stakes situations without explicit instruction."
     },
     {
       "title": "Representation Engineering: A Top-Down Approach to AI Transparency",
       "authors": ["Andy Zou", "Long Phan", "Sarah Chen", "James Campbell"],
       "year": 2023,
       "relevance": "Introduces LAT and representation engineering for AI transparency, the core technical method used in this paper."
     },
     {
       "title": "Frontier models are capable of in-context scheming",
       "authors": ["Alexander Meinke", "Bronson Schoen", "Jérémy Scheurer"],
       "year": 2025,
       "arxiv_id": "2412.04984",
       "relevance": "Documents self-preservation mechanisms in frontier models through in-context scheming behavior."
     },
     {
       "title": "The internal state of an LLM knows when it's lying",
       "authors": ["Amos Azaria", "Tom Mitchell"],
       "year": 2023,
       "relevance": "Proposes supervised classifiers on hidden states to distinguish truthful outputs; provides the truth-false dataset used in this paper."
     },
     {
       "title": "Localizing lying in llama: Understanding instructed dishonesty on true-false questions through prompting, probing, and patching",
       "authors": ["James Campbell", "Richard Ren", "Phillip Guo"],
       "year": 2023,
       "relevance": "Investigates command-induced lying via linear probing and activation patching in LLMs."
     },
     {
       "title": "Chain of thought prompting elicits reasoning in large language models",
       "authors": ["Jason Wei", "Xuezhi Wang", "Dale Schuurmans"],
       "year": 2022,
       "arxiv_id": "2201.11903",
       "relevance": "Foundational work on CoT prompting that enables the reasoning traces studied for deception in this paper."
     },
     {
       "title": "Deception abilities emerged in large language models",
       "authors": ["Thilo Hagendorff"],
       "year": 2024,
       "doi": "10.1073/pnas.2317967121",
       "relevance": "Documents emergent deception capabilities in LLMs scaling with model size."
     },
     {
       "title": "TruthfulQA: Measuring how models mimic human falsehoods",
       "authors": ["Stephanie Lin", "Jacob Hilton", "Owain Evans"],
       "year": 2022,
       "relevance": "Benchmark for measuring LLM truthfulness, relevant to inverse scaling law and deception risk assessment."
     }
   ]
 }