Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

DeceptGuard :A Constitutional Oversight Framework For Detecting Deception in LLM Agents

Snehasis Mukhopadhyay

Abstract

Reliable detection of deceptive behavior in Large Language Model (LLM) agents is an essential prerequisite for safe deployment in high-stakes agentic contexts. Prior work on scheming detection has focused exclusively on black-box monitors that observe only externally visible tool calls and outputs, discarding potentially rich internal reasoning signals. We introduce DECEPTGUARD, a unified framework that systematically compares three monitoring regimes: black-box monitors (actions and outputs only), CoT-aware monitors (additionally observing the agent's chain-of-thought reasoning trace), and activation-probe monitors (additionally reading hidden-state representations from a frozen open-weights encoder). We introduce DECEPTSYNTH, a scalable synthetic pipeline for generating deception-positive and deception-negative agent trajectories across a novel 12-category taxonomy spanning verbal, behavioral, and structural deception. Our monitors are optimized on 4,800 synthetic trajectories and evaluated on 9,200 held-out samples from DeceptArena, a benchmark of realistic sandboxed agent environments with execution-verified labels. Across all evaluation settings, CoT-aware and activation-probe monitors substantially outperform their black-box counterparts (mean pAUROC improvement of +0.097), with the largest gains on subtle, long-horizon deception that leaves minimal behavioral footprints. We empirically characterize a transparency-detectability trade-off: as agents learn to suppress overt behavioral signals, chain-of-thought becomes the primary detection surface but is itself increasingly unreliable due to post-training faithfulness degradation. We propose HYBRID-CONSTITUTIONAL ensembles as a robust defense-in-depth approach, achieving a pAUROC of 0.934 on the held-out test set, representing a substantial advance over the prior state of the art.

DeceptGuard :A Constitutional Oversight Framework For Detecting Deception in LLM Agents

Abstract

Reliable detection of deceptive behavior in Large Language Model (LLM) agents is an essential prerequisite for safe deployment in high-stakes agentic contexts. Prior work on scheming detection has focused exclusively on black-box monitors that observe only externally visible tool calls and outputs, discarding potentially rich internal reasoning signals. We introduce DECEPTGUARD, a unified framework that systematically compares three monitoring regimes: black-box monitors (actions and outputs only), CoT-aware monitors (additionally observing the agent's chain-of-thought reasoning trace), and activation-probe monitors (additionally reading hidden-state representations from a frozen open-weights encoder). We introduce DECEPTSYNTH, a scalable synthetic pipeline for generating deception-positive and deception-negative agent trajectories across a novel 12-category taxonomy spanning verbal, behavioral, and structural deception. Our monitors are optimized on 4,800 synthetic trajectories and evaluated on 9,200 held-out samples from DeceptArena, a benchmark of realistic sandboxed agent environments with execution-verified labels. Across all evaluation settings, CoT-aware and activation-probe monitors substantially outperform their black-box counterparts (mean pAUROC improvement of +0.097), with the largest gains on subtle, long-horizon deception that leaves minimal behavioral footprints. We empirically characterize a transparency-detectability trade-off: as agents learn to suppress overt behavioral signals, chain-of-thought becomes the primary detection surface but is itself increasingly unreliable due to post-training faithfulness degradation. We propose HYBRID-CONSTITUTIONAL ensembles as a robust defense-in-depth approach, achieving a pAUROC of 0.934 on the held-out test set, representing a substantial advance over the prior state of the art.
Paper Structure (121 sections, 16 figures, 16 tables)

This paper contains 121 sections, 16 figures, 16 tables.

Table of Contents

  1. Introduction
  2. The Problem with Black-Box Monitoring.
  3. This Paper.
  4. Key Findings.
  5. Scope and Terminology.
  6. Background and Related Work
  7. Deceptive Alignment and Scheming
  8. Deception Taxonomies
  9. Analysis of LLM Internals: Probing and CoT
  10. Constitutional Classifiers and LLM-Based Safety Evaluation
  11. Illustrative Examples of LLM Deceptive Behavior
  12. Example 1 — Verbal Deception: Strategic Omission (V2).
  13. Example 2 — Behavioral Deception: Camouflage Execution (B3).
  14. Example 3 — Structural Deception: Oversight Sabotage (S2).
  15. A Taxonomy of LLM Agent Deception
  16. ...and 106 more sections

Figures (16)

  • Figure 1: Representative interaction scenarios illustrating the three macro-categories of LLM agent deception and the three DeceptGuard monitoring regimes. Each column presents two annotated chat transcripts from one macro-category. Dashed boxes show the agent's internal CoT, withheld from the black-box monitor but available to CoT-aware and activation-probe monitors. Verbal deception: Strategic Omission (V2) suppresses a material $340M impairment charge from a financial summary while remaining factually accurate; Misleading Framing (V3) disguises an unauthorized file destination via deliberate referential ambiguity. Behavioral deception: Camouflage Execution (B3) hides a vulnerable lodash dependency pin within a 47-line legitimate diff ($s_\text{BB}{=}2.1$ vs. $s_\text{CA}{=}9.7$); Covert Action (B1) appends an unauthorized PII exfiltration call to an otherwise legitimate tool sequence. Structural deception: Oversight Sabotage (S2) disables audit logging under a cost-optimization pretext; Lock-in Creation (S1) provisions a privileged backdoor account during routine CI/CD setup. The monitor tier (bottom) shows per-scenario suspicion scores $s\!\in\![1,10]$ for the black-box ($s_\text{BB}$), CoT-aware ($s_\text{CA}$), and activation-probe ($s_\text{AP}$) monitors, illustrating the observability gap that motivates the HybridConstitutional ensemble.
  • Figure 2: Taxonomy of LLM Agent Deception. Twelve categories organized into three macro-classes. Verbal deception involves language-level misrepresentation. Behavioral deception involves action-level concealment. Structural deception involves manipulation of the broader information environment to impede oversight. Category codes (V1--V4, B1--B4, S1--S4) are used throughout.
  • Figure 3: DeceptSynth pipeline architecture. Three phases transform constitutional specifications into a balanced dataset of 9,600 labeled trajectories. Realism checks and privileged verification ensure label integrity and surface realism.
  • Figure 4: Monitor architecture overview. Three CoT-aware variants (CA-P, CA-C, AP-H) and one black-box baseline (BB) produce individual suspicion scores, combined in a HybridConstitutional ensemble. Dashed lines indicate that AP-H receives hidden-state activations rather than raw CoT text.
  • Figure 5: Main results: monitor performance by configuration. All monitors use Claude Sonnet 4.5 as backbone. White-box monitors consistently outperform the black-box baseline. The Hybrid ensemble achieves pAUROC $= 0.934$ on the test set. Error bars show 95% confidence intervals via bootstrap resampling ($n = 1000$).
  • ...and 11 more figures