Your LLM Deception Monitor Is Broken. The Fix Is in the Training Data
summary
A concrete fix detects directional shifts in activations by subtracting base from fine‑tuned checkpoints, training a sparse autoencoder on that delta and flagging a single feature that fires on triggers. A controlled SQL‑injection backdoor (trigger = year) on an LM2 360M fine‑tune installs a vector the delta monitor exposes with diff SAE yielding 40× signal and perfect precision zero false positives; a single feature catches ~25% of triggers so ensemble for coverage and run it as a cheap CI gate.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:21Sleeper agents dangers
- 1:23Current defenses fail
- 2:51Sleeper agent properties
- 3:35Behavioral testing limits
- 4:38Delta activations fix
- 5:20Experiment setup SQL backdoor
- 7:05Results backdoor confirmed
- 7:46Backdoor isolation score
- 8:49Delta features 40x better
- 9:31Robustness testing layers
- 10:13Subtraction exposes backdoor
- 11:16Integrate fix pipeline
- 12:00Practical takeaways
- 12:42Limitations future work
- 13:24Conclusion
related talks
44mI Abuse Your LLM Live with 10 Security Vulnerabilities
39mHallucination-Free LLMs: Strategies for Monitoring and Mitigation
31mWhat problems should enterprises actually trust an LLM to solve?
01h 49mAI engineering with open access LLMs that lie, curse, and steal
23mFrom Hallucinations To Hardware: Diagnosing LLM Failures
23mSecurity and auditing tools in Large Language Models (LLM)
20mSecurity Threats in Modern LLM Applications
30mTowards Clinically Grounded LLMs