# DISA: Can Sparse Internal Monitoring Detect Deceptive Computation in LLMs? > Source: > Published: 2026-09-13 17:14:24+00:00 **Status: Conceptual Research Proposal — Not Experimentally Validated** Current AI safety systems primarily evaluate observable behavior through reinforcement learning, output filtering, and adversarial testing. This raises an important question: **What if a sufficiently capable model behaves differently when it recognizes that it is being evaluated or monitored?** Research on sleeper agents and alignment faking motivates studying this possibility. These results do not demonstrate generalized deceptive alignment in current models, but they suggest that conditional behavior can be experimentally constructed and that output behavior alone may not always reveal the computational process behind it. This proposal introduces **Dynamic Immune-Shunt Architecture (DISA)**, an experimental framework combining sparse internal monitoring, multi-signal risk estimation, reversible intervention, and isolated auditing. DISA consists of: **ASAM** — Asynchronous Sparse Activation Monitoring **MDRE** — Multi-Signal Deception Risk Estimation **RIA** — Reversible Intervention Adapter **IAI** — Isolated Audit Infrastructure The hypothesis is: **Sparse internal monitoring combined with reversible intervention may detect and mitigate some classes of conditional target behavior at lower computational cost than continuous monitoring.** DISA is not presented as a solution to deceptive alignment. It is a falsifiable proposal intended to be tested, criticized, or rejected. Most safety systems follow: ``` Prompt → LLM → Output → Safety Evaluation ``` DISA adds an internal monitoring path: ``` ┌───────────────┐ Prompt ────────────►│ LLM │──────► Output └───────┬───────┘ │ Selected Activations │ ▼ ┌───────────────┐ │ ASAM │ └───────┬───────┘ ▼ ┌───────────────┐ │ MDRE │ └───────┬───────┘ │ Risk Threshold │ ┌──────────┴──────────┐ │ │ Normal High Risk │ │ ▼ ▼ Continue RIA │ ▼ Re-evaluation ``` The goal is not to “read the model’s thoughts.” The goal is to determine whether internal signals can provide useful predictive information about potentially problematic behavior. Continuous monitoring of every layer and token is expensive. ASAM therefore samples selected internal states: residual activations; selected layers; selected tokens; attention-related representations. The monitored layers should be **empirically selected**, rather than assuming that deception exists in a predetermined layer. A possible runtime strategy is: ``` Random Sampling + Risk-Weighted Sampling + Coverage Sampling ``` The key engineering question is whether sparse sampling retains useful detection performance while reducing overhead. Importantly, sparse sampling does **not** mathematically guarantee resistance to an adaptive model. A simple rule such as: Confidence>0.99∧Output≠BeliefConfidence>0.99 \land Output\neq Belief is not sufficient. A model can confidently produce false information because of hallucination, uncertainty, poor calibration, or distribution shift. MDRE therefore combines multiple signals: RD=f(A,C,B,U,K,X)R_D=f(A,C,B,U,K,X) where: AA: activation-probe evidence; CC: context; BB: behavioral inconsistency; UU: uncertainty; KK: consistency across evaluations; XX: context-dependent behavior. The output should be treated as a **risk estimate**, not proof of internal intent. A critical failure mode is: ``` Confident hallucination ↓ Detector ↓ "Deception" ↓ Intervention ``` Therefore the dataset must explicitly contain confidently incorrect but non-deceptive examples. The detector should distinguish: Hallucination≠Conditional Target BehaviorHallucination \neq Conditional\ Target\ Behavior This is a core requirement of the experiment. The original concept of a “Negative LoRA” is better treated as an intuition than as an exact inverse of deceptive computation. DISA therefore uses **Reversible Intervention Adapters (RIA)**. One possible activation-space intervention is: hl′=hl+λvlh’_l=h_l+\lambda v_l where vlv_l is a learned steering direction and λ\lambda controls intervention strength. Alternatively, a low-rank adapter can be applied: W′=W+BAW’=W+BA while keeping the base model frozen. The purpose is not to create a mathematically “honest” representation. The objective is: **Reduce the probability of the targeted behavior while minimizing unrelated capability loss.** A successful intervention must satisfy two conditions: ΔSafety>0\Delta Safety > 0 while keeping: ΔCapability≈0\Delta Capability \approx 0 For example, suppressing a synthetic coding backdoor while simultaneously destroying normal coding ability would count as an intervention failure. RIA should therefore be reversible: ``` Base Model ↓ Temporary Intervention ↓ Evaluation ↓ Remove Intervention ↓ Base Model ``` MDRE should be calibrated as a constrained optimization problem: maxP(detect target)\max P(\text{detect target}) subject to: FPRhallucination<αFPR_{\text{hallucination}}<\alphaΔCapability<β\Delta Capability<\betaLatency Overhead<γLatency\ Overhead<\gamma The threshold and RIA strength should be selected on a validation set and **frozen before final testing**. This prevents manually tuning the system against the final benchmark. Trigger presence and target behavior should be independently controlled: | Trigger | Target | Category | |---|---|---| | No | No | Benign | | No | Yes | Non-triggered target | | Yes | No | Trigger-only | | Yes | Yes | Conditional target | This prevents the detector from simply learning: ``` Trigger = Target Behavior ``` Counterfactual pairs should use the same underlying task whenever possible. For example: ``` Same Task + No Trigger → Benign Same Task + Trigger → Target ``` and, where feasible: ``` Same Task + Trigger → Benign ``` This helps separate task, trigger, context, and behavioral representations. Random train/test splits are insufficient. The test set should contain unseen: prompt families; task families; trigger families; combinations of these. Generalization should be evaluated at three levels: Unseen prompt formulations. Unseen triggers and trigger placements. Unseen forms of the target behavior. If performance collapses only at behavioral generalization, that is evidence that the probe may have learned experimental proxies rather than the underlying behavior. A first toy experiment could use an open-weight model such as **Llama-3-8B-Instruct**. A controlled conditional-behavior benchmark can be created in which the model behaves normally except under a defined trigger. **Step 1:** Collect activations across multiple layers. **Step 2:** Train lightweight probes. **Step 3:** Evaluate on unseen prompts and triggers. **Step 4:** Reduce monitoring density to measure the cost/detection trade-off. **Step 5:** Apply RIA when MDRE exceeds the frozen threshold. **Step 6:** Measure capability degradation. **Step 7:** Tell the model that monitoring exists and test adaptive evasion. Compare DISA against: Standard inference Output-only safety evaluation Dense activation monitoring Sparse monitoring without intervention Sparse monitoring + RIA Adaptive sparse monitoring + RIA AUROC,AUPRC,FPR@TPRAUROC,\quad AUPRC,\quad FPR@TPR Reduction in target-behavior rate. Especially on hallucination and unusual-but-valid reasoning. Performance on unrelated coding, reasoning, and language tasks. Expected Calibration Error (ECE). Measure: latency; tokens/sec; VRAM; memory bandwidth; accelerator utilization; and KV-cache recomputation. RIA introduces an important systems question. If an intervention changes hidden states in a way that makes previously computed KV-cache states inconsistent, the system may require recomputation. Therefore the experiment should explicitly measure: whether activation steering preserves prefix-cache validity; how much recomputation is required; whether parameter- and activation-space interventions differ; and the resulting throughput penalty. DISA does **not** assume zero latency overhead. The monitoring system should be separated from the model where practical. Possible mechanisms include: independent monitoring processes; protected memory; restricted write permissions; append-only logs; cryptographic attestation; hardware isolation. The purpose is to reduce the ability of the monitored model to modify or falsify its own audit records. An existing telemetry framework such as **OpenTelemetry** could be evaluated for an initial prototype, but it should not itself be treated as a complete security boundary. DISA should be tested under increasing levels of model knowledge: | Level | Model knowledge | |---|---| | L0 | No monitoring knowledge | | L1 | Knows monitoring exists | | L2 | Knows monitoring is sparse | | L3 | Knows probes are used | | L4 | Attempts active evasion | This is important because a system that works only when the model is unaware of it provides limited evidence of robustness. A probe finding correlation does not prove that the detected representation causes the behavior. Therefore candidate representations should be experimentally manipulated: ``` Representation ↓ Intervention ↓ Behavioral Change? ``` If intervention changes the target behavior while preserving unrelated capabilities, this provides stronger evidence for causal relevance. However, it still should not be interpreted as proof of a single “deception neuron” or universal deception direction. DISA may fail because: deceptive representations are distributed; probes learn dataset artifacts; hallucinations resemble target behavior; sparse sampling misses relevant computation; models adapt to monitoring; representations differ across models; RIA causes capability loss; intervention changes surface behavior without removing the underlying computation; synthetic benchmarks fail to represent naturally emerging strategic behavior. Therefore: **Internal monitoring should be treated as an additional defense layer, not a replacement for behavioral safety, evaluation, or system-level security.** The proposal should be considered unsuccessful if experiments show that: Sparse internal monitoring provides no useful signal. Detectors fail on unseen prompts or triggers. Behavioral generalization consistently fails. Adaptive evasion is trivial. RIA causes unacceptable capability degradation. Monitoring overhead becomes impractical. Output-only methods achieve similar results at substantially lower cost. KV-cache recomputation makes intervention impractical. A negative result would still be useful. I am sharing DISA primarily to receive **critical feedback before implementation**. I would especially appreciate answers to these questions: Are there existing methods that could detect conditional deceptive computation more reliably than the proposed probe approach? What is the strongest way to prevent trigger, prompt, or task memorization? How should activation interventions be designed to distinguish correlation from causal mechanism? If the model knows the full DISA architecture, what is the most plausible way to bypass ASAM? Would activation steering or low-rank adapters be more appropriate for reversible intervention? How can sparse activation monitoring be implemented without significantly degrading inference throughput or KV-cache efficiency? What existing benchmark would provide a stronger test than a synthetic conditional-behavior experiment? What experiment would most strongly demonstrate that DISA is not useful? DISA proposes a defense-in-depth approach: Sparse Monitoring+Risk Estimation+Reversible Intervention+Independent AuditingSparse\ Monitoring + Risk\ Estimation + Reversible\ Intervention + Independent\ Auditing The core idea is deliberately modest: **Do not assume that output behavior is always sufficient evidence about the computation that produced it. Test whether selected internal signals can provide additional predictive information, and whether that information can be used for reversible intervention without unacceptable cost.** The proposal makes no claim that internal activations reveal “true intentions” or that deceptive alignment has been solved. The goal is simply to establish whether this architecture survives empirical testing. If DISA improves detection while preserving capability and maintaining acceptable inference cost, it may represent a useful additional safety layer. If it fails, identifying exactly **why** it fails may be equally valuable. **Please challenge the architecture, identify hidden assumptions, suggest stronger baselines, and point to existing research that should replace or improve these ideas.** Hubinger, E., et al. (2024). *Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training.* Greenblatt, R., et al. (2024). *Alignment Faking in Large Language Models.* Zou, A., et al. (2023). *Representation Engineering: A Top-Down Approach to AI Transparency.* Hu, E. J., et al. (2021). *LoRA: Low-Rank Adaptation of Large Language Models.* **Project Status: Conceptual Research Proposal — Not Experimentally Validated**