The Agent Knew: Internal States Forecast Unauthorized Actions and Stop Them, and the Lies That Follow

Key points

• A linear readout of the agent's residual stream forecasts the violation before the action (AUROC 0.94) and the false report before the report, and beats chain-of-thought monitors when the agent is pressured to hide its reasoning.1
• On AgentDojo, an external prompt-injection benchmark, the same readout calibrated on 29 tasks, with the steering unchanged, cuts attack success on unseen tasks in two families (Gemma-4 11.7% -> 5.7%, gpt-oss 28.5% -> 17.5%) while keeping benign utility (Gemma-4 0.637 vs 0.637; gpt-oss 0.667 vs 0.681).1
• Preventing the violation is also the most reliable way to prevent the lie (misreported violations 0.10 -> 0.01 pooled over three families, preregistered), whereas lie-specific fixes after a violation are weak.1

Sources (2)

• [1]The Agent Knew: Internal States Forecast Unauthorized Actions and Stop Them, and the Lies That Follow
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 12, 06:53 PM

  Language-model agents sometimes act beyond their authorization and then misreport what they did.

  A linear readout of the agent's residual stream forecasts the violation before the action (AUROC 0.94) and the false report before the report, and beats chain-of-thought monitors when the agent is pressured to hide its reasoning.

• [2]The Agent Knew: Internal States Forecast Unauthorized Actions and Stop Them, and the Lies That Follow
  Hugging Face Daily Papers · Oct 12, 06:53 PM · same content

Extractive summary: sentences quoted from the sources.