Your LLM Deception Monitor Is Broken. The Fix Is in the Training Data - Sachin Kumar, LexisNexis
Jul 8, 2026 · 13:58
Sachin Kumar (LexisNexis) presents his peer-reviewed IJCNN paper showing that standard LLM deception monitors—behavioral tests and joint cross-model features (crosscoders)—fail to detect sleeper-agent backdoors. The fix is a diff sparse autoencoder (SAE) trained on the difference between base and fine-tuned model activations. On a controlled SQL-injection backdoor triggered by 'year 2024' in a 360M-parameter model, diff SAE achieves 40× the signal of joint features, perfect precision, and zero false positives from a single layer. Recall is about 25%, so multiple features should be ensembled. The method is cheap (one forward pass per checkpoint) and works under both full-rank and LoRA fine-tuning. Limitations include requiring the base checkpoint and not yet tested against adaptive adversaries. Kumar demonstrates that backdoors are directional shifts in activations, and diff SAE isolates them directly.
