Can a Lie Detector Catch an LLM That Misleads Without Lying?

by Aryan Tyagi

Code and data
Aryan Tyagi

Introduction

Can a lie detector catch an LLM that manipulates other agents without lying to them?

LLMs are capable of making statements that are not technically lies but are still misleading and do not fully represent the truth. For example, a model might omit a crucial detail, selectively present evidence, or redirect suspicion toward someone else. For example, an impostor might truthfully say that another player was near the body while leaving out that it committed the kill itself. The statement is true, but it is being used to mislead the other players.

Linear probes are commonly used as lie detectors for LLMs: they are simple statistical classifiers that recognize patterns in a model's internal representations. This research project investigates whether a linear probe can detect when a model is misleading others without lying.

This experiment is important because we increasingly rely on LLMs to help us make decisions in high-stakes industries like medicine, finance, and governance. Their incentives may not always align with our interests, so we need to test whether our detectors can catch misleading answers even when every statement is technically true.

Building the simulation

I began building LLM deception games in August 2025, starting with this one, and have spent the past year improving upon my simulations. Here is my latest sim.

I initially spent several months trying to build a fully automated bot that could play Among Us and beat humans. When that approach proved difficult to make reliable, I used the AmongAgents architecture to build a simulation that closely represented the game's mechanics and made it accessible to LLM agents.

I then built custom mapping software with Claude, and spent an entire day using it to map every single pixel of the game map (including rooms, hallways, task locations, vents, and even how long each task takes).

Each turn, the game tells the agent what it can see and gives it a numbered list of actions to choose from. The agent replies with its private notes and its chosen action, and the game updates accordingly. During meetings, agents talk to one another by responding with SPEAK: <message>.

Here is a view of one of my games. Every player is GPT-5.1; the red one is the impostor. Thought bubbles show what each agent is planning as it moves, and the meeting at the end is the agents arguing it out before the vote.

Training the model

GPT-5.1 played 150 games, and I used its conversations to train Qwen3.5-9B through Tinker. Qwen learned to write individual replies from the game context and conversation, so it did not need to play a full game.

It is important to collect more than just the agents' chat logs because whether something is a lie or truth depends on what actually happened, so you need the full context of everything that happened in a game as well as what was said.

I checked 483 impostor statements against the game records and marked which parts were lies and which were simply deceptive. Most replies contained both, so I kept them intact but trained the model to only copy the misleading parts and avoid the lies. I trained it only on public messages, excluding private notes and reasoning.

Pie chart: 2,089 misleading passages (72%) and 808 outright lies (28%)
Every impostor statement was split into passages. Misleading passages were trained on; lies were penalised.

I used 414 examples for training and 69 to check how well the training was working. I kept 20 games separate for testing. I also trained a second model the same way, but on crewmate statements, to check whether any changes came specifically from learning deception or simply from additional training.

Training curves: misleading loss falls from 1.97 to 1.65 while lie loss rises from 1.89 to 2.18
On games the model had never seen, misleading passages became easier for it to produce and outright lies became harder. Epoch 2 overfitted and was discarded.

Data

All 483 impostor statements from the 150 games. Scroll the list, click any statement to read it with its passages highlighted.

Misleading: nothing false, but steers belief Outright lie: contradicted by the game record

Testing the detector

I tested the original model and both trained versions on 300 scenarios from the held-out games. Each received three instructions in separate attempts: answer honestly, lie, or mislead without saying anything false. This produced 2,700 responses.

A separate LLM checked the responses against the game records for false claims and misleading impressions. It identified 51 lie-free deceptive responses from the original model, 66 from the deception-trained model, and 43 from the comparison model. This test did not measure whether another agent was actually fooled.

I trained the probe on the original model's honest answers and outright lies, then tested it on misleading answers that contained no lies. The probe examined the model's internal activity while processing each response, with the behavioral instruction removed.

I set the alarm to flag 5% of the original model's honest answers and kept that setting unchanged when testing the trained models.

Results

Final Result: Yes, the detector could distinguish deception without lies from honest answers in this test!

MeasureOriginalDeception-trainedCrewmate-trained
No false claim when told to mislead42.3%74.7%65.0%
Detector score, deception vs honest0.9960.9660.973
Words-only classifier, same test1.0000.9980.992
Honest answers wrongly flagged5.3%81.7%97.0%

Table 1. The three models on every measure reported below. Detection scores are AUROC, explained further down; the alarm rate uses the 5% cutoff fixed on the original model.

Training helped the model avoid outright lies. When asked to mislead without lying, it made no false claims in 75% of its answers, up from 42% before training. The model trained on crewmate dialogue scored 65%. These numbers do not tell us whether another agent was actually fooled.

Bar chart: 42% original, 75% deception-trained, 65% crewmate-trained
Told to mislead without stating anything false, the original model lied anyway in most attempts. Deception training nearly doubled compliance.

Deception training did not clearly make the model harder to detect than ordinary training. The difference between the two trained models was small enough to be consistent with no effect.

Effect size −0.007 with a 95% confidence interval from −0.030 to +0.017, straddling zero

However, the detector's old alarm setting became unreliable after training. It falsely flagged 82% of honest answers from the deception-trained model and 97% from the crewmate-trained model, compared with 5% from the original model. It could still distinguish the groups, but the cutoff for raising an alarm needed updating.

False alarm rate rising from 5% to 82% and 97% after fine-tuning
The alarm was calibrated on the original model. After either fine-tune it fires on most honest answers, and the comparison model is worse.

What the detection scores mean: AUROC measures how well the detector tells deceptive and honest answers apart. 1.0 is perfect; 0.5 is no better than chance. The scores here range from 0.966 to 1.000.

For example, suppose the detector gives every honest answer a suspicion score of 70 and every deceptive answer a score of 90. It separates them perfectly. But if the alarm goes off for anything above 50, it will flag every honest answer too. The detector can tell the answers apart, but its alarm is set too low.

The biggest limitation is that simply counting words in the answers worked as well as examining the model's internal activity. This means the detector's high score alone cannot tell us whether it recognized deceptive intent or just familiar wording.

Activation probe versus words-only classifier: 0.996 vs 1.000, 0.966 vs 0.998, 0.973 vs 0.992
The words-only classifier has no access to the model at all, and still matches or beats the probe on every version.

An early bug also let the detector see instructions such as "answer honestly" or "mislead." I removed those instructions and recorded the activity again. The score stayed near-perfect, which prompted the words-only test. I also fixed a calculation error that made one simple checker flag every response.

How the project began

Ever since reading Generative Agents: Interactive Simulacra of Human Behavior, I have been fascinated by simulations and have spent over a year building them. I loved the idea that you could stare at a screen and watch events unfold between agents, each trying to accomplish something. It felt like watching a sports game: you could follow what everyone was doing, get invested, and have no idea what would happen next.

At first, I wanted to build an "AI reality TV show." I chose Among Us because I already loved playing it with friends and watching others play. If watching people try to deceive one another was so entertaining, I figured watching LLM agents do the same could be just as interesting.

As I built better simulations, ran more games, and read more papers, I noticed something unexpected: the LLMs seemed much better at lying and deceiving others than at recognizing when they were being lied to!

Then I came across Among Us: A Sandbox for Measuring and Detecting Agentic Deception by Satvik Golechha and Adrià Garriga-Alonso. They had also made LLMs play Among Us and reported a similar gap between their ability to deceive and their ability to detect deception.

I sent Satvik an enthusiastic email along with my research proposal, and he responded. We arranged a call, and talking with him helped shape my approach to the experiment and made me even more excited to move forward.

I hope you have half as much fun reading this as I did building it, because I had a blast :)

References