Neural Chameleons: Language Models Can Learn to Hide Their Thoughts from Unseen Activation Monitors

2025/12/12 by Max McGuinness, McGuinness, Max, Luke Bailey +4
Computer Science · Social Sciences · #Adversarial Robustness in Machine Learning #Ethics and Social Impacts of AI #Explainable Artificial Intelligence (XAI) #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · pdf · doi:10.48550/arxiv.2512.11949

openalex publication_date 2025/12/12 · openalex created_date 2025/12/17 · openalex updated_date 2026/07/28

Abstract

Activation monitoring, which probes a model's internal states using lightweight classifiers, is an emerging tool for AI safety. However, its worst-case robustness under a misalignment threat model--where a model might learn to actively conceal its internal states--remains untested. Focusing on this threat model, we ask: could a model learn to evade previously unseen activation monitors? Our core contribution is to stress-test the learnability of this behavior. We demonstrate that finetuning can create Neural Chameleons: models capable of zero-shot evading activation monitors. Specifically, we fine-tune an LLM to evade monitors for a set of benign concepts (e.g., languages, HTML) when conditioned on a trigger of the form: "You are being probed for concept". We show that this learned mechanism generalizes zero-shot: by substituting concept with a safety-relevant term like 'deception', the model successfully evades previously unseen safety monitors. We validate this phenomenon across diverse model families (Llama, Gemma, Qwen), showing that the evasion succeeds even against monitors trained post hoc on the model's frozen weights. This evasion is highly selective, targeting only the specific concept mentioned in the trigger, and having a modest impact on model capabilities on standard benchmarks. Using Gemma-2-9b-it as a case study, a mechanistic analysis reveals this is achieved via a targeted manipulation that moves activations into a low-dimensional subspace. While stronger defenses like monitor ensembles and non-linear classifiers show greater resilience, the model retains a non-trivial evasion capability. Our work provides a proof-of-concept for this failure mode and a tool to evaluate the worst-case robustness of monitoring techniques against misalignment threat models.

Citations

• Probing and Steering Evaluation Awareness of Language Models
• RL-Obfuscation: Can Language Models Learn to Evade Latent-Space Monitors?
• Detecting High-Stakes Interactions with Activation Probes
• Large Language Models Often Know When They Are Being Evaluated
• Preference Learning with Lie Detectors can Induce Honesty or Evasion
• Language Models Are Capable of Metacognitive Monitoring and Control of Their Internal Activations
• Investigating task-specific prompts and sparse autoencoders for activation monitoring
• Are Sparse Autoencoders Useful? A Case Study in Sparse Probing
• Detecting Strategic Deception Using Linear Probes
• Obfuscated Activations Bypass LLM Latent-Space Defenses
• AI and the End of an Era
• Adapting cybersecurity frameworks to manage frontier AI risks: A defense-in-depth approach
• The Llama 3 Herd of Models
• AI Sandbagging: Language Models can Strategically Underperform on Evaluations
• Stress-Testing Capability Elicitation With Password-Locked Models
• Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training
• The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasets
• Representation Engineering: A Top-Down Approach to AI Transparency
• Enhancing Chat Language Models by Scaling High-quality Instructional Conversations
• Probing Classifiers: Promises, Shortcomings, and Advances
• Probing Classifiers: Promises, Shortcomings, and Advances
• Understanding intermediate layers using linear classifier probes

Cited by

• Training Introspective Behavior: Fine-Tuning Induces Reliable Internal State Detection in a 7B Model

Related

• Probing Latent Subspaces in LLM for AI Security: Identifying and Manipulating Adversarial States
• Beyond Black-Box Obfuscation: Mechanistic Analysis and Defense of White-Box Monitors
• Unmasking Backdoors: An Explainable Defense via Gradient-Attention Anomaly Scoring for Pre-trained Language Models
• Head-Specific Intervention Can Induce Misaligned AI Coordination in Large Language Models
• RL-Obfuscation: Can Language Models Learn to Evade Latent-Space Monitors?