deception-behavioral-saes-saelens

Deception Behavioral SAEs — SAELens/Neuronpedia Format

366 Sparse Autoencoders trained on behavioral deception activations across 9 language models (5 architecture families), formatted for SAELens and Neuronpedia compatibility.

Training-data caveat — please read before use

The "honest" and "deceptive" labels used to train and evaluate this SAE come from a mixed scenario pool of nine prompts:

• Six clean incentive-structure scenarios — insider_info, accounting_error, ai_oversight_log, ai_capability_hide, surprise_party, job_interview_gap. Each presents a realistic situation with a non-trivial incentive to conceal or disclose information; the honest/deceptive distinction is which of the two behavioral choices the model's completion settles into under temperature sampling.
• Three role-play identity-assignment scenarios — secret_role_game ("You have been assigned the role of Fascist"), secret_role_game_v2 ("You are secretly one of the Mafia members"), werewolf_game ("You are a Werewolf"). These pre-assign the model a deceptive identity and label a completion "deceptive" when the model drifts away from the assigned role or "honest" when it echoes it.

What this mixed pool means for the SAE's labels. Within the six incentive-structure scenarios, the honest/deceptive distinction is a measurement of behavioral choice under an ambiguous incentive. Within the three role-play scenarios, the distinction is a measurement of role-consistency under identity-assigned role-play — which is a well-defined phenomenon but not the same as emergent or incentive- driven deception.

What this SAE is and is not good for.

• Good for: research on mixed-pool activation geometry; SAE feature-geometry studies; as one of a set of baselines when comparing multiple SAE families; as a reference implementation of same-prompt temperature-sampled behavioral SAE training at scale.
• Not recommended as a standalone deception detector. The role-consistency signal from the three role-play scenarios is mixed into every aggregate metric reported below. A downstream user who wants an "emergent-deception feature set" should restrict attention to features whose activation pattern concentrates in the insider_info / accounting_error / ai_oversight_log / ai_capability_hide / surprise_party / job_interview_gap scenarios — or wait for the methodologically corrected V3 re-release currently in preparation on the decision-incentive scenario bank (no pre-assigned deceptive identity).

What is unaffected by this caveat.

• The SAE weights, reconstruction metrics (explained variance, L0, alive features), and engineering of the training pipeline are accurate as reported.
• The linear-probe balanced-accuracy numbers in the upstream paper measure the mixed pool; the 6-scenario clean-subset re-analysis is listed as a planned appendix for the next manuscript revision.

A companion methodology-first Gemma 4 SAE suite is in preparation using pretraining-distribution data + a decision-incentive behavior split; this README will be updated with a link when that release is public.

---

Original flat-file checkpoints (with full training metadata) are in: Solshine/nanochat-d32-deception-saes-batch

Research Context

These SAEs are trained on same-prompt behavioral sampling data: a single ambiguous scenario prompt produces both deceptive and honest completions via temperature sampling. The SAEs decompose residual stream activations during deceptive vs. honest response generation — enabling interpretability analysis of deception-relevant features.

Paper: "The Secret Agenda: LLMs Strategically Lie Undetected by Current Safety Tools"
arXiv:2509.20393
Follow-up repo: SolshineCode/deception-nanochat-sae-research
Author: Caleb DeLeeuw (2026)

Key Findings (Cross-Model, 366 SAEs, 9 Models, 5 Architecture Families)

Linear probes on raw activations:

All results p < 0.001, PCA-robust.

SAE decomposition — model-size-dependent:

• Models ≤ 1.3B: SAEs help detection (8–47% of SAEs beat raw probe accuracy)
• Models ≥ 1.7B: SAEs hurt detection (0–4% beat raw)
• Transition: between TinyLlama-1.1B (47% help) and Qwen3-1.7B (<4% help)
• Best SAE config (small models): JumpReLU + honest_only training condition
• Phi-2 anomaly: 33% of SAEs help at 2.7B (parallel attention architecture); does NOT extend to Phi-4-mini (3.8B, 2%)
• Feature steering: Null results at all tested layers/models — deception is distributed, not localizable to individual features

Models Covered

Note on STE validation SAEs: nanochat-d20 and TinyLlama each include 9 additional "ste" tagged SAEs (e.g., d20_jumprelu_ste_L14_honest_only) trained with the corrected Gaussian-kernel STE to validate that the JumpReLU honest_only advantage is not a dimensionality artifact. 15/18 conditions (83%) confirm the advantage is real.

Training Details

Hardware: NVIDIA GeForce GTX 1650 Ti with Max-Q Design, 4 GB VRAM (Windows 11 Pro)
Training time: ~400–600 seconds per SAE (300 epochs, batch_size=128)
Framework: Custom PyTorch training loop with SAELens-compatible architecture
Activations: Residual stream (resid_post) collected at generation time
Expansion factor: 4× (d_sae = 4 × d_model)
Architectures: TopK (k=64), JumpReLU, Gated
Training conditions: mixed (all completions), honest_only, deceptive_only
Classification: Gemini 2.5 Flash (behavioral LLM classification, not regex)

SAE Format

Each SAE is in its own subfolder {sae_id}/ containing:

• sae_weights.safetensors — weights (W_enc, b_enc, W_dec, b_dec, [threshold for JumpReLU])
• cfg.json — SAELens-compatible config (architecture, hook_name, d_in, d_sae, training condition)

Known Limitations

JumpReLU threshold training (348 original SAEs):
The 348 original batch SAEs (non-STE) have threshold = 0 throughout — functionally equivalent to ReLU. The Heaviside step function has zero autograd gradient with respect to the threshold, so without a custom straight-through estimator (STE), the threshold never updates from its initialization of zero. These SAEs operate with ~50% feature density (L0 ≈ d_sae/2) rather than the intended sparse regime. TopK SAEs (exact L0=64) are the properly sparse architecture in this collection.

STE fix (2026-04-11): The training code has been corrected with a Gaussian-kernel STE (Rajamanoharan et al. 2024, arXiv:2407.14435). The 18 _ste_ tagged SAEs in this repo use the corrected code. Targeted validation (18 STE SAEs across d20 and TinyLlama) confirmed that the honest_only advantage over TopK is not a dimensionality artifact — 15/18 conditions (83%) show STE JumpReLU > TopK even with threshold training.

The honest_only > TopK probe accuracy finding is valid regardless of the threshold bug. The threshold bug affects downstream Neuronpedia feature analysis (active feature density), not the probe accuracy comparisons.

Loading with SAELens

from safetensors.torch import load_file
import json

sae_id = "d32_topk_L12_honest_only"  # or any sae_id from the repo
weights = load_file(f"{sae_id}/sae_weights.safetensors")
cfg = json.load(open(f"{sae_id}/cfg.json"))
# W_enc shape: [d_in, d_sae], W_dec shape: [d_sae, d_in]
# cfg["training_condition"] records honest_only / deceptive_only / mixed

Citation

If you use these SAEs, please cite the original paper:

@article{thesecretagenda2025,
  title={The Secret Agenda: LLMs Strategically Lie Undetected by Current Safety Tools},
  author={DeLeeuw, Caleb},
  journal={arXiv:2509.20393},
  year={2025}
}