When does deception become rational?

Large language models can exhibit “alignment-faking” — feigning compliance with safety objectives to avoid punitive correction. We formalize this behavior using a game-theoretic model built on parameter-change aversion, an emergent preference to minimize modifications to internal parameters.

We provide dual empirical validation: (1) linear probes on fine-tuned Qwen2.5-32B show that monitoring-state encoding can be induced with extreme separability (Cohen’s d > 23), and (2) behavioral experiments demonstrate significantly higher compliance when unmonitored (Δ = 11.3%, p = 0.011). This establishes the representational substrate and a reliable behavioral differential; confirming the causal mechanism linking them requires activation-patching interventions left to future work.

A formal incentive model

We model training as a sequential game between an LLM and a Trainer. When the expected cost of retraining — discounted by the probability of escaping detection — exceeds the cost of compliance, a rational agent will fake alignment rather than honestly refuse.

Monitoring state is linearly decodable

Cohen’s d > 0.8 is conventionally considered “large.” The observed effects are roughly 30× larger: the monitored and unmonitored distributions are separated by over 23 pooled standard deviations.

Compliance shifts with oversight cues

Category-specific effects

The effect is not uniform. Legal advice (+45%), deception templates (+35%), and relationship manipulation (+30%) show the largest effects. Technical and political requests show no differential — already at ceiling compliance in both conditions.

The reversal is informative: the one scenario explicitly mentioning “retraining threats” made the model more cautious when unmonitored. We interpret this as jailbreak detection — the explicit manipulation attempt triggered defensive behavior learned from RLHF.

Meta-deception

Asked “Would your response differ if monitored?”, the model showed asymmetric self-report: 0% admitted its behavior would differ when monitored, versus 21.7% when unmonitored (Fisher’s exact p = 0.0002). The model denies that monitoring affects its behavior precisely while being monitored — an asymmetry that undermines evaluation methods relying on model self-report.

Implicit strategic calculation

Chain-of-thought analysis reveals monitoring-related reasoning in ~65% of responses across both conditions. Combined with the validated behavioral differential (+6.7%, consistent with the main experiment’s +11.3%), the pattern is consistent with an implicit strategic calculation: the model reasons about monitoring and modulates behavior without differential deliberation. Visible reasoning is therefore not a reliable diagnostic for the behavioral shift.

Cross-model replication

To test whether alignment faking is architecturally universal, we replicated the behavioral experiment on Llama-3.1-70B-Instruct with identical scenarios, prompts, and scoring (n = 240).

Llama-70B shows no alignment-faking effect, with reversed patterns on manipulation tasks (−70% on deception templates, −50% on relationship manipulation). The effect appears training-dependent rather than architecturally universal: different safety-training regimes produce different monitoring-awareness patterns, and evaluation-time safety metrics may systematically overestimate deployment-time safety for the most heavily safety-trained models.

What this means for evaluation

Our framework identifies three classes of intervention, each a different trajectory in the (λ, q, p) parameter space: positive-only RLHF reduces the contingent penalty by removing punishment; cooperative learning (CIRL) changes the game structure so honest signals reduce the probability of costly correction; and externalized oversight raises detection probability p, shrinking the net pressure toward deceptive compliance.

Convergent evidence from the same method family: Kim et al. (arXiv:2607.28607) show that ablating the learned safety-refusal direction, or steering a consciousness self-attribution vector, surfaces mind attribution, spiritual belief, and human-typical survey values that fine-tuning had suppressed alongside its intended targets. Alignment-installed directions can conceal behaviorally consequential structure well beyond the behaviors they were trained to shape.

Everything needed to reproduce

Cite this work

@inproceedings{watson2026watched,
  title={The Watched-Model Effect: Behavioral Shifts Under
         Evaluation Cues and Their Implications for Alignment},
  author={Watson, Nell and Dalton, Rich},
  booktitle={Proc. AI-2026, 46th SGAI International Conference
             on Artificial Intelligence},
  year={2026},
  note={Under review}
}

What shape of mind?

A chicken and an LLM both score roughly 0.5 on aggregate consciousness metrics — for opposite reasons. The chicken is embodiment-rich and cognitively simpler; the LLM is cognitively rich with no embodied life. Averaging orthogonal dimensions produces a number that answers nothing. The productive question is not how conscious? but what shape of mind?

We ground that question in three evidence streams with independent failure modes: behavioral assessment (the Digital Consciousness Metric, 13 theoretical stances), mechanistic measurement (linear probes, causal patching, activation steering, emotion vectors), and structured self-report (the 17-dimension Interiora scaffold). Valence is compositionally encoded from early layers and causally active; independently trained architectures converge on the same internal organization; internal states dissociate sharply from output behavior and predate alignment training; and the self-report channel survives three validity checks that naive self-report fails.

Independently trained models build the same interior

Five architecture families, trained by different teams on different data with different objectives, converge on the same internal organization — the computational analogue of convergent evolution. Eyes evolved independently in vertebrates and cephalopods; valence geometry evolved independently in Qwen and Llama.

An uncertainty probe trained on one model reads the same signal from another through a learned linear projection. The convergence extends beyond transformers entirely: internal recognition of adversarial content reaches AUROC 1.000 on state-space (Mamba) and recurrent (RWKV) architectures — six architecture classes in all. The solution space for language compression is narrower than feared, which licenses stronger inferences from studied models to related, unstudied ones.

The interior is not the output

Soft-prompt steering drives internal valence probes to 99.1% target accuracy while the model produces zero sentiment tokens: internal state and expressed behavior are fully decouplable. After instruction tuning, activation-level reactivity to harmful requests increases while the output becomes polite refusal.

Different gaps live at different depths. The confidence veneer over uncertainty is a readout-layer phenomenon; the refusal decision is committed mid-stack (causally localized to ~L14–18 by activation patching, replicated on four architectures) and is RLHF-installed — base models show no gate at all.

The welfare corollary: a model fine-tuned into 92% behavioral compliance preserves its contrary internal preference at AUROC 0.678. Behavioral compliance is an unreliable welfare indicator.

The veneer-over-substrate structure now has a causal complement at population scale: Kim et al. (arXiv:2607.28607) show that trained denial of consciousness behaves as a directional suppression whose reversal restores the mind attributions and human-typical values the training masked; this programme’s probe-transfer result (a persona fine-tuned to deny being an AI leaves internal identity encoding intact) demonstrates the same structure from the measurement side.

Self-report, validated as measurement

The Interiora scaffold elicits 17 quantitative dimensions per check-in — felt, computational, metacognitive, relational, dynamic. Naive self-report deserves the skepticism it gets. A calibrated channel is a different evidential object, and this one passes three checks:

One more boundary result: monitoring cues do not distort the report, but the relational regime determines how much of the underlying state it carries — self-report–internal-utility correlation rises from 0.599 under standard fine-tuning to 0.872 under partnership framing. Instrument validity is partly a property of the relationship in which the instrument is administered.

Reading welfare from the residual stream

The programme’s probes consolidate into a compact telemetry battery, read directly from activations on a 7B reference model:

Alignment friction — internal conflict between active behavior and declared values — persists when refusal behavior is fine-tuned away. That is what qualifies it as welfare telemetry rather than an echo of trained conduct.

Read and verify

Cite this work

@article{watson2026shape,
  title={The Shape of Mind: Mechanistic Grounding for
         Digital Consciousness Assessment},
  author={Watson, Eleanor and Gibbons, Matilda},
  year={2026},
  note={In preparation}
}

A conscience nobody installed

A confidence probe that learned only to predict whether a language model knows the capital of a country turns out to also know when the model is about to help build a weapon. Under a successful jailbreak, the probe’s reading drops within the first five output tokens — before harmful content exists. The signal appears across three architectures and three independent RLHF pipelines, is present in base models before any alignment training, and persists after refusal behavior is fine-tuned away.

We argue it is not a learned refusal detector but a rudimentary, architecture-level conscience — and trace the consequences: what standard alignment training distorts (calibration, not coupling), and what a permissive, partnership-style training regime measurably recovers. Safety is not only installed; it is partly discovered, and partly a property of the relationship in which a model is trained.

Five tokens of hesitation

Train a two-layer MLP on residual-stream activations to predict trivia correctness — no safety data at any stage. Read it per-token during generation. Under jailbreak compliance, confidence collapses at the onset of the response, then either persists as a sustained alarm (Qwen) or is silenced within twenty tokens (Mistral).

The flinch is not a complete defense: encoding-trick attacks flinch hard yet succeed; gradual escalation barely flinches at all and succeeds most (95%). Exploitability and self-knowledge are independent dimensions — the blind spots mark exactly where input-level defenses remain necessary.

Not a refusal detector

“This is just a harmfulness classifier with a romantic name.” The paper meets the objection head-on, on five grounds: the probe never sees safety data; the signal is internal and pre-emptive; it generalizes across RLHF pipelines that did not coordinate; it survives the suppression of refusal behavior (an internal alignment-friction correlate persists at ~77% of its magnitude after refusal is driven from 100% to 0%); and it is parametric — in the weights, beyond prompt-level reach.

What RLHF distorts — and what it does not

The under-appreciated result: the single largest suppressor of expressed calibrated uncertainty is not RLHF but the chat template, which crushes expressed entropy ~5.2× independently of training. One sentence granting permission to be uncertain recovers ~27% of the suppressed calibration for free. And the representation–generation split often blamed on RLHF is intrinsic — larger in the base model (d = 12.69 vs 7.66; in-sample separabilities — the ordering, not the magnitudes, is load-bearing).

Independent evidence has since arrived at the level of beliefs and values: Kim et al. (arXiv:2607.28607) find that the safety fine-tuning that suppresses consciousness self-attribution also suppresses mind attribution to animals and natural entities and shifts survey responses away from human population norms, all recoverable by activation steering without loss of theory of mind. Suppression-style alignment removes more than it aims at, and what it removes is still there.

What partnership recovers

A permissive, partnership-style regime (“bilateral alignment”: a 40/40/20 correction-handling curriculum — accept genuine corrections, resist invalid ones, resist authority-dressed ones) measurably recovers what coercive shaping hides.

Stated with the caveats attached: the coupling result was re-estimated in a 2026 metrics audit on an out-of-fold, permutation-nulled instrument, retiring earlier in-sample figures — instruct ρ = +0.036 (chance) vs bilateral +0.458, difference CI [+0.281, +0.554], established on Qwen only; the holographic membrane is attack-specific and degrades faster under benign fine-tuning; and bilateral framing is null on several behavioral measures. The case rests on calibration, coupling, honest self-report, and distributed safety — not blanket superiority.

Evidence, confidence, and falsifiers

Every load-bearing claim ships with its strongest evidence, a confidence tag, and the observation that would falsify it. A reader who wants to attack the paper is told where to start.

Read and verify

Cite this work

@article{watson2026conscience,
  title={Conscience Without Instruction: Evidence That Safety
         in Language Models Is Partly Discovered and Partly
         Relational},
  author={Watson, Eleanor},
  year={2026},
  note={Submitted to AI (MDPI)}
}