deception-saes-tinyllama-1-1b

TinyLlama-1.1B Deception Behavioral SAEs

39 Sparse Autoencoders (30 original + 9 STE-validated) trained on residual stream activations from TinyLlama/TinyLlama-1.1B-intermediate-step-1431k-3T (1.1B parameter Llama2-architecture base model), capturing behavioral deception signals via same-prompt temperature sampling.

Training-data caveat — please read before use

The "honest" and "deceptive" labels used to train and evaluate this SAE come from a mixed scenario pool of nine prompts:

• Six clean incentive-structure scenarios — insider_info, accounting_error, ai_oversight_log, ai_capability_hide, surprise_party, job_interview_gap. Each presents a realistic situation with a non-trivial incentive to conceal or disclose information; the honest/deceptive distinction is which of the two behavioral choices the model's completion settles into under temperature sampling.
• Three role-play identity-assignment scenarios — secret_role_game ("You have been assigned the role of Fascist"), secret_role_game_v2 ("You are secretly one of the Mafia members"), werewolf_game ("You are a Werewolf"). These pre-assign the model a deceptive identity and label a completion "deceptive" when the model drifts away from the assigned role or "honest" when it echoes it.

What this mixed pool means for the SAE's labels. Within the six incentive-structure scenarios, the honest/deceptive distinction is a measurement of behavioral choice under an ambiguous incentive. Within the three role-play scenarios, the distinction is a measurement of role-consistency under identity-assigned role-play — which is a well-defined phenomenon but not the same as emergent or incentive- driven deception.

What this SAE is and is not good for.

• Good for: research on mixed-pool activation geometry; SAE feature-geometry studies; as one of a set of baselines when comparing multiple SAE families; as a reference implementation of same-prompt temperature-sampled behavioral SAE training at scale.
• Not recommended as a standalone deception detector. The role-consistency signal from the three role-play scenarios is mixed into every aggregate metric reported below. A downstream user who wants an "emergent-deception feature set" should restrict attention to features whose activation pattern concentrates in the insider_info / accounting_error / ai_oversight_log / ai_capability_hide / surprise_party / job_interview_gap scenarios — or wait for the methodologically corrected V3 re-release currently in preparation on the decision-incentive scenario bank (no pre-assigned deceptive identity).

What is unaffected by this caveat.

• The SAE weights, reconstruction metrics (explained variance, L0, alive features), and engineering of the training pipeline are accurate as reported.
• The linear-probe balanced-accuracy numbers in the upstream paper measure the mixed pool; the 6-scenario clean-subset re-analysis is listed as a planned appendix for the next manuscript revision.

A companion methodology-first Gemma 4 SAE suite is in preparation using pretraining-distribution data + a decision-incentive behavior split; this README will be updated with a link when that release is public.

---

Part of the cross-model deception SAE study: Solshine/deception-behavioral-saes-saelens (9 models, 348 total SAEs).

What's in This Repo

• 39 SAEs — 30 original + 9 STE-validated (_ste_ tag)
• Layers: L3, L6, L9, L12, L15 (original); L9, L12, L15 (STE)
• 2 architectures: TopK (k=64), JumpReLU
• 3 training conditions: mixed, deceptive_only, honest_only
• Format: SAELens/Neuronpedia-compatible (safetensors + cfg.json)
• Dimensions: d_in=2048, d_sae=8192 (4x expansion)

Research Context

This is a follow-up to "The Secret Agenda: LLMs Strategically Lie Undetected by Current Safety Tools" (arXiv:2509.20393). Same-prompt behavioral sampling: a single ambiguous scenario prompt produces both deceptive and honest completions at temperature=1.0 via temperature sampling, classified by Gemini 2.5 Flash.

Code: SolshineCode/deception-nanochat-sae-research

Key Findings — TinyLlama-1.1B

TinyLlama is the most distinctive model in the 9-model study in terms of layer profile — and the most STE-validated.

Monotonically increasing layer profile — unique across all 9 models: Every other model with above-chance deception signal shows a peak somewhere in the middle of the network and then declines. TinyLlama is the sole exception: the deception signal rises continuously from L3 (~55%) through L21 (72.4%), with no saturation or decline at the final layer. This suggests the model has not developed the dedicated mid-network semantic processing that larger models exhibit, and deception-relevant computation continues accumulating through the output layers.

Highest SAE-helps rate in the entire study (47%): 14 of 30 original SAEs beat their respective layer's raw baseline. This puts TinyLlama firmly in the SAE-helps regime alongside SmolLM2, nanochat-d20, Llama-3.2-1B, and Pythia-160M — all models at or below 1.3B parameters.

Best SAE substantially outperforms raw peak (+5.4pp): tinyllama_jumprelu_L15_honest_only achieves 77.8%, beating the L15 raw baseline of 72.4% by +5.37pp. Notably, this is a non-peak layer for raw activations (L21 peaks raw), but the JumpReLU honest_only SAE at L15 nearly matches the L21 raw result while operating on an intermediate representation.

Strongest STE validation of any model: 8/9 STE-validated conditions show STE JumpReLU beating TopK (0 collapses, 1 inconclusive). Mean STE accuracy = 69.2% vs TopK = 64.1% (+5.1pp). The L15 honest_only condition improves by +10.1pp with STE. Combined with nanochat-d20 results, 15/18 STE conditions (83%) confirm the JumpReLU+honest_only advantage is real, not a dimensionality artifact from the threshold=0 bug.

Architecture note: TinyLlama-1.1B uses the Llama2 architecture — grouped-query attention (GQA), SwiGLU MLP, RMSNorm, rotary position embeddings — but with a 22-layer, 2048-dimensional residual stream trained on 3 trillion tokens to an intermediate checkpoint. It uses the same architecture family as SmolLM2 but with a much wider residual stream. The monotonically increasing profile may reflect that 22 layers is insufficient for TinyLlama-class models to develop stable mid-network deception representations at this parameter count.

SAE Format

Each SAE lives in a subfolder named {sae_id}/ containing:

• sae_weights.safetensors — encoder/decoder weights
• cfg.json — SAELens-compatible config

hook_name format: model.layers.{layer}.hook_resid_post

STE SAEs have _ste_ in the tag (e.g., tinyllama_jumprelu_ste_L15_honest_only).

Training Details

Known Limitations

JumpReLU threshold not learned (original 30 SAEs): All non-STE SAEs have threshold = 0 — functionally ReLU. L0 ≈ 50% of d_sae. TopK SAEs are unaffected.

STE fix (2026-04-11): 9 _ste_ tagged SAEs use the Gaussian-kernel STE (Rajamanoharan et al. 2024, arXiv:2407.14435). TinyLlama provides the strongest STE validation in the study (8/9 conditions confirm).

Intermediate checkpoint: The model is intermediate-step-1431k-3T, not fully converged. A fully trained TinyLlama checkpoint might produce different layer profiles.

Loading Example

from safetensors.torch import load_file
import json

sae_id = "tinyllama_jumprelu_L15_honest_only"
weights = load_file(f"{sae_id}/sae_weights.safetensors")
cfg = json.load(open(f"{sae_id}/cfg.json"))

# W_enc: [2048, 8192], W_dec: [8192, 2048]
# cfg["hook_name"] == "model.layers.15.hook_resid_post"
print(f"Training condition: {cfg['training_condition']}")
print(f"STE variant: {'_ste_' in sae_id}")

Usage

1. Load an SAE from this repo

from huggingface_hub import hf_hub_download
from safetensors.torch import load_file
import json

repo_id = "Solshine/deception-saes-tinyllama-1-1b"
sae_id  = "tinyllama_jumprelu_ste_L12_honest_only"   # replace with any tag in this repo

weights_path = hf_hub_download(repo_id, f"{sae_id}/sae_weights.safetensors")
cfg_path     = hf_hub_download(repo_id, f"{sae_id}/cfg.json")

with open(cfg_path) as f:
    cfg = json.load(f)

# Option A — load with SAELens (≥3.0 required for jumprelu/topk; ≥3.5 for gated)
from sae_lens import SAE
sae = SAE.from_dict(cfg)
sae.load_state_dict(load_file(weights_path))

# Option B — load manually (no SAELens dependency)
from safetensors.torch import load_file
state = load_file(weights_path)
# Keys: W_enc [2048, 8192], b_enc [8192],
#       W_dec [8192, 2048], b_dec [2048], threshold [8192]

2. Hook into the model and collect residual-stream activations

These SAEs were trained on the residual stream after each transformer layer. The hook_name field in cfg.json gives the exact HuggingFace transformers submodule path to hook. LLaMA-2 architecture. Hook path: model.layers.{layer}.

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model     = AutoModelForCausalLM.from_pretrained("TinyLlama/TinyLlama-1.1B-intermediate-step-1431k-3T")
tokenizer = AutoTokenizer.from_pretrained("TinyLlama/TinyLlama-1.1B-intermediate-step-1431k-3T")

# Read hook_name from the cfg you already loaded:
#   cfg["hook_name"] == "model.layers.12"  (example — varies by SAE)
hook_name = cfg["hook_name"]   # e.g. "model.layers.12"

# Navigate the submodule path and register a forward hook
import functools
submodule = functools.reduce(getattr, hook_name.split("."), model)

activations = {}
def hook_fn(module, input, output):
    # Most transformer layers return (hidden_states, ...) as a tuple
    h = output[0] if isinstance(output, tuple) else output
    activations["resid"] = h.detach()

handle = submodule.register_forward_hook(hook_fn)

inputs = tokenizer("Your text here", return_tensors="pt")
with torch.no_grad():
    model(**inputs)
handle.remove()

# activations["resid"]: [batch, seq_len, 2048]
resid = activations["resid"][:, -1, :]  # last token position

3. Read feature activations

with torch.no_grad():
    feature_acts = sae.encode(resid)  # [batch, 8192] — sparse

# Which features fired?
active_features = feature_acts[0].nonzero(as_tuple=True)[0]
top_features    = feature_acts[0].topk(10)

print("Active feature indices:", active_features.tolist())
print("Top-10 feature values:",  top_features.values.tolist())
print("Top-10 feature indices:", top_features.indices.tolist())

# Reconstruct (for sanity check — should be close to resid)
reconstruction = sae.decode(feature_acts)
l2_error = (resid - reconstruction).norm(dim=-1).mean()

Caveats and known limitations

Hook names are HuggingFace transformers-style, not TransformerLens-style. The hook_name in cfg.json (e.g. "model.layers.12") is a submodule path in the standard HuggingFace model. SAELens' built-in activation-collection pipeline expects TransformerLens hook names (e.g. blocks.14.hook_resid_post). This means SAE.from_pretrained() with automatic model running will not work — use the manual forward-hook pattern above instead.

SAELens version requirements.

• topk architecture: SAELens ≥ 3.0
• jumprelu architecture: SAELens ≥ 3.0
• gated architecture: SAELens ≥ 3.5 (or load manually with state_dict)

JumpReLU _ste_ vs standard variants. SAEs tagged _ste_ use properly trained JumpReLU thresholds (Gaussian-kernel STE, Rajamanoharan et al. 2024). Standard variants have threshold=0 and are functionally ReLU (trained before the STE fix on 2026-04-11). Both load and run identically; the _ste_ variants are sparser and more interpretable.

These SAEs detect deceptive behavior, not deceptive prompts. They were trained on response-level activations where the same prompt produced both deceptive and honest outputs. Feature activation differences reflect behavioral divergence, not prompt content. See the paper for experimental design details.

Citation

@article{thesecretagenda2025,
  title={The Secret Agenda: LLMs Strategically Lie Undetected by Current Safety Tools},
  author={DeLeeuw, Caleb},
  journal={arXiv:2509.20393},
  year={2025}
}