Rift: A Conflict Signature for Deception in Language Models

Researchers at arXiv have identified a conflict signature in language models that distinguishes deceptive outputs from honest errors, achieving 100% accuracy in detecting lies across multiple models including GPT-2, Qwen2.5, and Phi-3-mini. The signature, measured as a 2.1-2.3x higher residual rank in deceptive forward passes, survives strategic deception, concealment attempts, and transfers zero-shot across model families and languages. This finding provides a read-only method for detecting deception in AI systems, with implications for AI safety and evaluation.

arXiv:2606.17229v1 Announce Type: new Abstract: A model that lies while knowing the truth is the central case ELK cannot handle with behavioral evaluation alone. We ask whether such deception leaves an internal signature distinguishing it from honest error. Our key move is a control for wrongness: we contrast a sleeper agent knows the truth, lies on trigger against a naive liar fine-tuned to emit the same wrong answers with no honest training . Both produce identical wrong outputs; any difference is about knowledge conflict, not incorrectness. We find deceptive forward passes carry a conflict signature - 2.1-2.3x higher residual rank than naive-liar passes on the same wrong answer - strong enough to identify which of two responses is the lie with 100% accuracy and no labels, across GPT-2 small/medium three seeds and three instruct models. Across Qwen2.5-1.5B/7B and Phi-3-mini, instructed deception raises residual rank on every tested fact 18/18, 40/40, 34/34 ; on Phi-3, lies separate perfectly from both honest answers and hallucinations AUC 1.0, Wilcoxon p~6e-11 . The signature survives strategic self-constructed deception model invents its own lie, AUC 1.0 , active concealment attempts AUC 1.0 , and length-controlled replication 20/20, AUC 1.0, p~1e-6 . Using basis-free relative representations, a probe trained on one model family detects deception in two other families zero-shot mean AUC 0.933 , surviving simultaneous architecture and format change AUC 0.821 , and transfers across five languages AUC 1.000, length-controlled . The signature is read-only: detectable but not injectable 0/8 both directions . Honest limitations and six negative experiments are documented in full.