mlsanityData to 7 Oct 2026

A Lie Detector Test for Language Models: Reading Knowledge a Model Won't Reveal

arXiv 2609.21996 ↗First posted 18 Sep 2026cs.AIcited by 0

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

Large language models can hold knowledge they do not report. A model may sandbag on a capability evaluation, or answer against what it internally knows, and its outputs alone cannot tell whether it is hiding an answer or simply does not have one. We borrow the Concealed Information Test, a forensic method that identifies guilty knowledge by presenting a suspect with the true detail among plausible decoys and measuring a stronger response to the item they recognize. Our method, Probe of Internal Recognition (PIR), does the same inside a model. It presents a question with its candidate answers and reads, from the model's internal states, which candidate the model recognizes as correct. PIR is reference-free, needing no honest reference model and no labeled truth corpus. Across eight models from five families (Gemma, Qwen, Llama, Mistral, and Phi), PIR recovers the recognized answer at 0.70 to 0.87 balanced accuracy, well above the 0.28 to 0.40 unknown-item baseline and the 0.25 chance rate. It stays readable across every form of concealment we test, from prompted deception and trained sandbagging to external password-locked and circuit-broken checkpoints, with recognition between 0.85 and 0.93. When the model hides a known answer, recognition stays high. When unlearning removes the knowledge, recognition drops to the level of a question the model never knew. PIR therefore separates a model that will not answer from one that cannot, which supports sandbagging audits and unlearning verification. The signal is causal, adds information beyond black-box behavioral cues, and extends from multiple-choice questions to free-form generation.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 30 of its 37 references that are in the map. First posted on arXiv 18 Sep 2026.

Builds on

30 of 37 references.

Closest ancestors · 6

Same direction, newest first

  1. 2024Do Unlearning Methods Remove Information from Language Model Weights?11 Oct
  2. 2024An Adversarial Perspective on Machine Unlearning for AI Safety26 Sep
  3. 2024Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning19 Jun
  4. 2024Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning8 Apr
  5. 2024Eight Methods to Evaluate Robust Unlearning in LLMs26 Feb
  6. 2023Large Language Model Unlearning14 Oct

Other references · 24

  1. 2016Understanding intermediate layers using linear classifier probescited by 1,279
  2. 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,259
  3. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  4. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
  5. 2022Discovering Latent Knowledge in Language Models Without Supervisioncited by 733
  6. 2023The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasetscited by 673
  7. 2023The Internal State of an LLM Knows When It's Lyingcited by 644
  8. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 488
  9. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 478
  10. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  11. 2024Frontier Models are Capable of In-context Schemingcited by 252
  12. 2024LLMs Know More Than They Show: On the Intrinsic Representation of LLM Hallucinationscited by 230
12 more
  1. 2024AI Sandbagging: Language Models can Strategically Underperform on Evaluationscited by 131
  2. 2023How to Catch an AI Liar: Lie Detection in Black-Box LLMs by Asking Unrelated Questionscited by 82
  3. 2024Truth is Universal: Robust Detection of Lies in LLMscited by 78
  4. 2025The MASK Benchmark: Disentangling Honesty From Accuracy in AI Systemscited by 57
  5. 2023Eliciting Latent Knowledge from Quirky Language Modelscited by 56
  6. 2024Stress-Testing Capability Elicitation With Password-Locked Modelscited by 42
  7. 2024Obfuscated Activations Bypass LLM Latent-Space Defensescited by 40
  8. 2025Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilitiescited by 36
  9. 2023Challenges with unsupervised LLM knowledge discoverycited by 30
  10. 2023Localizing Lying in Llama: Understanding Instructed Dishonesty on True-False Questions Through Prompting, Probing, and Patchingcited by 24
  11. 2024Noise Injection Reveals Hidden Capabilities of Sandbagging Language Modelscited by 22
  12. 2025The Elicitation Game: Evaluating Capability Elicitation Techniquescited by 15

Built on by

Not cited yet.