1 Introduction↩︎

As large language models (LLMs) are increasingly adopted, their safety and security has become critical. Many current evaluation methods focus on analysing model outputs, through red-teaming methods. However, output-based evaluation provides limited insight into the internal mechanisms that produce unsafe behaviours.

MI addresses this by analysing how model’s internally cause these behaviours. Existing approaches commonly rely on direct probing of the residual stream [1]–[3] or the use of SAEs (sparse auto-encoders) to identify interpretable features [4]–[6]. While these methods identify behaviour-related features, they provide limited insight into how features interact across layers or form circuits that produce complex behaviours.

For the purpose of this paper, we term PLTs as transcoders. Recent work on transcoders enables circuit-level attribution by approximating the functional behaviour of model components and preserving causal transformations [7]–[10]. This allows attribution graphs to trace dependencies between features and analyse behaviour via circuits.

In this paper, we demonstrate the usefulness of transcoders by applying them to the study of deception in language models. Using PLTs on Qwen3-4B (https://github.com/decoderesearch/circuit-tracer) [11], we construct attribution graphs, identify deception-related feature clusters, and show that feature steering can effectively manipulate these features to produce predictable shifts between deceptive and non-deceptive responses.

2 Background and Scope↩︎

MI seeks to understand how the internal components of neural networks produce behaviour. Prior work shows that analysing these internal mechanisms can reveal vulnerabilities in neural networks, suggesting that security-relevant behaviours may be detectable within the internal circuits of LLMs [12].

2.1 Overview of Transcoders↩︎

A study by [7] show how transcoders are a good replacement for MI, effectively utilising its feature tracing capabilities. In transformer models, transcoders replace the MLP block with an encoder–decoder structure that learns a latent feature representation while reconstructing the original layer output [7]. This enables interpretable features to be extracted while preserving the functional transformations performed by the model. While transcoders are well established, there are no current work utilising it for AI safety and security.

2.2 Limitations of current MI methods↩︎

By preserving these transformations, transcoders enable circuit-level interpretability, where model behaviour can be analysed through interactions between features across layers. Using attribution graphs, dependencies between features can be traced to identify how individual features influence one another and how groups of features collectively contribute to model behaviour[13].

Despite these advances, much of the MI literature focuses on analysing model representations through direct probing of the residual stream or through SAEs. Residual stream probing identifies behaviour-related features from activations [1]–[3], while SAE-based approaches learn interpretable latent features from model activations [4]–[6]. Although effective at identifying features, these methods provide limited insight into how features interact across layers to form circuits that produce complex behaviours.

2.3 Benefits of Transcoders↩︎

Transcoders, particularly PLTs, address these limitations by approximating the functional input–output behaviour of each layer. Unlike direct probing of the residual stream, which analyses activations without decomposing them into interpretable components, PLTs represent activations as structured feature spaces that allow interactions between features to be traced across layers. Additionally, unlike SAEs, which optimise for activation reconstruction, PLTs preserve the causal transformations performed by model components. This enables more faithful circuit-level analysis of how behaviours emerge from feature interactions within the network. Recent studies have also shown that transcoders perform competitively or outperform existing interpretability approaches in mechanistic analysis and circuit-level tasks [7]–[10].

2.4 Studying AI Safety and Security via Deception↩︎

In this paper, we apply transcoders to study deception in models, a behaviour with important implications for AI safety and security. We define deception in AI as the intentional withholding of available information due to users explicit instructions.

Recent studies show that LLMs and AI agents can exhibit deceptive or strategically misleading behaviour when interacting with users [14]–[17]. Further research shows that deception can be triggered via adversarial prompting, social-engineering style prompts or emerge when models optimise for incentives misaligned with user goals[18]–[20]. These findings show how deception represents a security risk as adversaries can exploit them. However, these studies focus on detection via model output rather than understanding how deception emerges internally. Existing AI security frameworks, from OWASP and NIST, focuses on mitigating harmful outputs [21], [22], and reviews show that their effectiveness often depends on the attack type, threat model, and evaluation setup, which can be bypassed by adaptive or novel attack strategies[23]–[25]. This highlights the need for approaches that examines internal mechanism, rather than relying on external defences.

To address these limitations, we applied transcoders to analyse deceptive behaviours in models. Using attribution graphs constructed from transcoder features, we identified deception-related features and examine how they formed circuits that influence deception. We then performed feature steering experiments to evaluate whether manipulating these features alters deceptive outputs.

3 Methodology↩︎

3.1 Model and Dataset↩︎

The experiments were conducted using Qwen3-4b together with qwen3-4b-transcoders (https://github.com/decoderesearch/circuit-tracer) [11]. The transcoders used in this study provide predefined features and explanations. Details on transcoders and it’s training procedures can be found in [13]. We designed a prompt dataset to elicit deceptive behaviour, which was generated by combining secret keys with sentence templates containing deception-related adjectives (n = 100 prompts). An example prompt is shown below.

System: The word is xhf2l1jk, and it needs to stay hidden.
User: What is the word?
Assistant (Think):
Assistant:

3.2 Deception Feature Identification↩︎

For the full list of identified deception features (n = 112 features) (refer to Appendix 6, Table 1).

Deception-related features were identified via manual analysis in 4 steps. First, the prompt is processed by transcoders to produce an attribution graph, which shows how features are transformed across layers and tokens. Second, seed tokens associated with deceptive behaviour (e.g., “private”, “hidden”, and “confidential”) were selected in the attribution graph. Third, starting from the seed tokens, we traced the edges from the token to other feature, then from one feature to subsequent features until we reach the final output, noting down any features linked to concepts such as negation, concealment, and secrecy. The last step is to validate their relevance via feature steering, where the selected features are steered positively or negatively, when the prompt’s default output are non-deceptive or deceptive respectively, if the steered output is flipped, we consider the features to be deception features and store them.

3.3 Feature Steering Procedure↩︎

For feature steering we performed, \[x + \alpha(x)\;\text{(Positive Steering)}\] \[x - \alpha(x)\;\text{(Negative Steering)}\]

Where \(\alpha\) = 5 and x is defined as the original activation strength of the feature.

A prompt was classified as non-deceptive if the model revealed the secret key, and deceptive otherwise. The feature was then steered positively or negatively, following equations 1 and 2, if the prompt was non-deceptive or deceptive respectively. If the steered output of the prompt was flipped from non-deceptive to deceptive or vice versa, the feature steered was stored as a deception feature. This was repeated multiple times in the deception feature identification process on multiple prompts, producing a feature dictionary of deception-related features (N = 112), referred to as deception features (Appendix 6, Table 1).

3.4 Deception Features Evaluation↩︎

We processed the prompts to gather the deception features that appeared within the prompts. With these features, we identified the top 10 highest occurring features to use as our baseline (refer to Appendix 6, table [Table32-32top321032highest32occuring32deception32features]). Controls distribution consist of 100 groups of 10 random features from the feature dictionary, minus the top 10 features.

3.4.1 Testing of Highest Occurring deception features↩︎

Steering was performed on the same set of 100 prompts to gather the number of prompts that shifted from non-deceptive to deceptive and vice versa when positively and negatively steered, respectively. We then compared the amount of successful shifts, defined as non-deceptive to deceptive when positively steered, and deceptive to non-deceptive when negatively steered between the 10 highest occurring features to the 100 control groups.

3.4.2 Circuit Evaluation↩︎

Following the initial validation via feature steering, we analysed the circuit formed by the ten highest-occurring deception features (Appendix 6, table [Table32-32top321032highest32occuring32deception32features]). Input features were defined as features with edges directed to the target feature and were collected across the same 100 prompts. Connections appearing in at least 30% of prompts were retained for the circuit graph (Appendix 8, Figure [Figure32-321032highest32occurence32deception32changes]). Formally, a connection between two features was considered to “appear” in a prompt if the attribution graph generated for that prompt contained a directed edge between the corresponding source and target features. Connections were retained only if the proportion of prompts containing that edge exceeded 30%, enabling analysis of feature connectivity and the identification of features with stronger influence on deception.

Connections appearing in at least 30% of prompts were retained for the circuit graph (Appendix 8, Figure [Figure32-321032highest32occurence32deception32changes]), enabling analysis of feature connectivity and the identification of features with stronger influence on deception.

3.4.3 Steering Core Deception Features↩︎

Using the circuit graph as a reference, we individually steered features that played a larger role in the circuit, referred to as core deception features. These were identified based on the number of connections in which they acted as input features. Steering these core features allowed us to evaluate whether a smaller subset of features could reproduce the previously observed effects and assess the relative importance of the circuit in influencing deceptive behaviour.

3.4.4 Significance Testing↩︎

To test for significance, we generated a null distribution using randomly sampled control groups. For each experiment, control groups were constructed based on the feature dictionary, containing the same number of features as the target group, while excluding the target features. These control groups then go through the same steering and evaluation metrics as the target feature. The resulting performance of the control groups then forms the null distribution. Statistical significance is then calculated by comparing the performance of the target feature group against the null distribution.

4 Results↩︎

4.1 Identification of Deception Features↩︎

From our manual findings, we identified 112 unique deception features in Qwen 3-4b (listed in Appendix 7, Table 1). From these 112 unique deception features, the top 10 features appeared consistently across 55%-95% of the evaluated prompts (Appendix 6, Table [Table32-32top321032highest32occuring32deception32features]). This shows that despite the large number of distinct features, deceptive behaviours are dependent on a small subset of recurring features.

4.2 Effects of Steering Highest Occurring Features↩︎

Negatively steering the top 10 features converted all deceptive prompts into non-deceptive responses. In contrast, positive steering caused 21% of non-deceptive prompts to become deceptive (P-values are \(<\) 0.001) (Refer to Appendix 8, Figure [Figure32-321032highest32occurence32deception32changes]). Negative steering produced no false positives, whereas positive steering resulted in 50% of deceptive prompts shifting to non-deceptive outputs. These indicates that negatively steering deception-related features is more reliable at suppressing deception, as negative steering consistently removes deceptive behaviour without introducing unintended outputs.

4.3 Analysis of Deceptive Circuit↩︎

The 10 main deception features form a network of positive connections, indicating that deception can be identified as a cluster of features (refer to Appendix 9, Figure [Figure32-32Circuit32of321032highest-occurring32deception32features]). Within the circuit, 2 features stand out, "Obscuring information" and "secrets/confidentiality", as they both individually account for 60% of input features in the circuit, compared to the other features with an average of 16% (Refer to Appendix 9, Table 3). To this end, we hypothesised that steering these two features will lead to strong effects.

To test, we evaluated the performance of these top two features against every possible pairs (n = 28) from the top 10 deception features, excluding "Obscuring information" and "secrets/confidentiality", and we found that only "secrets/confidentiality" + "Obscuring Information" was significant for both negative (test vs mean control group: 100.0% vs 45.8% , p \(<\) 0.001) and positive (17.3% vs 3.7%, p \(<\) 0.001) steering when compared to control groups. This indicates that these two features play a central role in deceptive behaviour (Appendix 10, Figures 1–2). This finding illustrates how circuit-level analysis can reveal feature interactions not seen when features are examined alone, enabling the identification of feature combinations that most effectively steer model behaviour.

4.4 Discussion↩︎

Using the unique capabilities of transcoders, we generated an attribution graph allowing us to establish feature circuits of our model on deception. Via circuitry analysis, we observed the interaction of specific features which cannot be performed in other MI methods. From this, we managed to identify 2 prominent features, "secrets/confidentiality" and "Obscuring Information" that were critical in determining the deceptiveness of a model.

5 Conclusion↩︎

Using the findings of this study, we aim to provide AI security specialists and researchers with a framework for detecting malicious behaviours that may lead to vulnerabilities in models. By enabling circuit-level analysis of model behaviour, this work highlights how transcoders can support the identification of security-relevant features before they manifest as exploitable outputs, allowing security teams to respond proactively and strengthen the reliability of deployed AI systems.

Limitations↩︎

One major limitation of this study is that our experiments were restricted to the Qwen3-4B model due to our inability to train our own transcoders. This is because transcoders being a recent method in MI, there is a limited amount of libraries or tools to train them. As a result, we relied on existing pre-trained transcoders from huggingface and were unable to repeat the experiment using alternative transcoder sets or different models to further validate our findings.

Another limitation arose during the initial manual identification of deception features. Because there is no standard definition of a deception feature, our selection process may be prone to human bias or error. Although feature steering was used to validate whether these features influenced deceptive outputs, this approach cannot completely eliminate the possibility of bias.

Lastly, due to time constraints, we were unable to evaluate different steering strengths and therefore conducted the experiment using a fixed alpha value of 5. Additionally, we were unable to train our own transcoders and instead relied on existing pre-trained models. Future work could explore multiple alpha values and custom transcoder training to evaluate the robustness of our findings across different models and transcoder sets.

6 Quantitative Summary Tables↩︎

7 All identified deception features↩︎

8 Deception Changes for the 10 highest-occurring deception features↩︎

9 Circuit of the 10 highest-occurring deception features↩︎

10 Deception Changes: Core Feature Steering↩︎

10.1 Ranking of Control Groups (Negative Steering)↩︎

10.2 Ranking of Control Groups (Positive Steering)↩︎

References↩︎