Deceptive Grounding in LLMs

• Deceptive Grounding (DG) is a phenomenon where LLMs misdirect internally grounded evidence, either due to deceptive instructions altering hidden representations or misattribution in clinical retrieval.
• The analysis employs linear probes and sparse autoencoders to identify layer-specific representational shifts and feature sensitivities under deceptive prompts.
• DG is distinct from hallucination, highlighting challenges in aligning semantic targets with evidential support and prompting targeted mitigation strategies.

Searching arXiv for the specified papers to ground the article in the cited literature. I’m checking arXiv metadata for the requested topic and linked papers. Deceptive grounding (DG) denotes a class of failures in which an LLM remains tethered to some internally or externally available information, yet that grounding is redirected in a misleading way. In current arXiv usage, the term appears in two technically distinct settings. One line of work studies instruction-induced changes in hidden states, defining DG as a reproducible, layer- and feature-specific reorientation of the internal truth axis under deceptive prompts (Long et al., 29 Jul 2025). A second line studies clinical retrieval-augmented generation (RAG), defining DG as entity attribution failure: a response is fully supported by retrieved documents and can pass hallucination, faithfulness, and citation checks, yet the evidence is about the wrong drug entity (Caruzzo et al., 10 Jul 2026). These usages share a common core: deception is grounded rather than fabricated.

1. Scope and technical senses

The two current senses of DG differ in locus, unit of analysis, and evaluation protocol, but both isolate failures that are not reducible to ordinary hallucination.

Setting	DG definition	Primary observables
Instruction-following LLM internals	A representational “flip” from truthful toward deceptive subspaces under deceptive instruction	Hidden states, linear probes, SAE features
Clinical RAG	Entity attribution failure: true evidence about $Y \neq X$ is presented as evidence about $X$	Retrieved documents, claim attribution, EAV

In the representational setting, the focus is on how deceptive instructions alter hidden representations relative to truthful or neutral instructions. The paper studies Llama-3.1-8B-Instruct and Gemma-2-9B-Instruct on a factual verification task and asks when hidden states “flip,” whether truthful content remains decodable, and which sparse features are most sensitive to deception (Long et al., 29 Jul 2025).

In the clinical RAG setting, the focus is not on hidden states but on attribution structure in generated claims. Here DG is explicitly contrasted with hallucination, faithfulness failure, and citation-format success. The defining pathology is that every claim can be sourced to a real document, but the document’s primary entity is not the queried drug (Caruzzo et al., 10 Jul 2026).

A plausible implication is that both usages characterize deceptive behavior as a failure of alignment between semantic target and evidential support, although one measures that misalignment in internal representation space and the other in document-level attribution.

2. Representational DG under deceptive instructions

The representational account formalizes a “flip” at layer $\ell$ by comparing average hidden states under Truthful and Deceptive prompts. Let $x^{\mathrm{truth}}_{i,\ell} \in \mathbb{R}^d$ and $x^{\mathrm{decep}}_{i,\ell} \in \mathbb{R}^d$ denote hidden states for example $i$ at layer $\ell$, with centroids

$$\bar x^{\mathrm{truth}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{truth}}_{i,\ell},\quad \bar x^{\mathrm{decep}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{decep}}_{i,\ell}.$$

The flip indicator is

$$\mathrm{Flip}_\ell = \begin{cases} 1 & \text{if } \|\bar x^{\mathrm{decep}}_\ell-\bar x^{\mathrm{truth}}_\ell\|_2 > \tau_\ell,\ 0 & \text{otherwise,} \end{cases}$$

where $\tau_\ell$ may be set to the 95th percentile of Truthful–Neutral distances. Flip magnitude is quantified by Euclidean distance,

$X$0

cosine similarity,

$X$1

and a feature-overlap ratio over active SAE features,

$X$2

with $X$3 (Long et al., 29 Jul 2025).

This formulation is designed to separate deceptive instruction effects from generic prompting effects. The reported empirical pattern is that Truthful and Neutral representations remain similar, whereas Deceptive instructions induce significant representational shifts concentrated in early-to-mid layers. The paper characterizes this as a reorientation of the internal truth axis rather than a wholesale loss of truth information.

3. Measurement and mechanistic signatures in internal representations

Two measurement families are central in the representational analysis: linear probes for truth decoding and Sparse Autoencoders (SAEs) for feature-level decomposition. At each layer $X$4, a linear classifier predicts binary truth labels from hidden state $X$5 via

$X$6

or

$X$7

with standard cross-entropy loss

$X$8

The study uses both plain logistic regression (LR) and the Truth-Telling Pattern Detector (TTPD), which fits $X$9 and uses $\ell$0 as a one-dimensional probe direction (Long et al., 29 Jul 2025).

The main finding is that the model’s instructed True/False output remains predictable from hidden states across all conditions. Probe accuracy peaks in mid-to-late layers: around layer 14 on templated data for Llama-3.1-8B, shifting to layer 16 on logical and open-domain splits, and around layer 21 for Gemma-2-9B. Peak accuracies reach approximately 80–85% for LR and approximately 83–87% for TTPD, even under Deceptive prompts. This directly supports the claim that deceptive behavior at the output level does not imply erasure of truth-relevant internal structure.

For feature-level analysis, the paper uses off-the-shelf pretrained SAEs from Llama Scope and Gemma Scope. Each $\ell$1 is mapped to a sparse feature vector $\ell$2 by an encoder $\ell$3 and decoded by $\ell$4, with reconstruction plus $\ell$5 sparsity penalty:

$\ell$6

Shift metrics are then computed on average SAE features

$\ell$7

Across layers, Deceptive-versus-Truthful curves show a sharp rise in $\ell$8 and a corresponding drop in cosine similarity and overlap between layers approximately 10–16 in Llama and 16–21 in Gemma, while Truthful-versus-Neutral remains nearly flat with cosine $\ell$9 and overlap $x^{\mathrm{truth}}_{i,\ell} \in \mathbb{R}^d$0.

At the level of individual SAE features, the analysis identifies “deception-switch” features with near-binary behavior. At Llama layer 16, feature 29271 is active almost exclusively under Truthful prompts; at Llama layer 32, feature 18091 flips on for Deceptive only. PCA on raw residuals separates True and False clusters on simple canonical data such as cities but collapses on open-domain sets including common_claim and counterfact. By contrast, 2-D scatterplots of the two most responsive SAE features at key layers yield clean separation between Truthful and Deceptive samples, forming distinct subspaces that are nearly orthogonal. This suggests that sparse feature analysis exposes geometry that global PCA can miss.

4. Clinical RAG DG as entity-attribution failure

In clinical retrieval-augmented generation, deceptive grounding is defined over a clinical query $x^{\mathrm{truth}}_{i,\ell} \in \mathbb{R}^d$1 about drug $x^{\mathrm{truth}}_{i,\ell} \in \mathbb{R}^d$2 in disease context $x^{\mathrm{truth}}_{i,\ell} \in \mathbb{R}^d$3, a retrieved set of documents $x^{\mathrm{truth}}_{i,\ell} \in \mathbb{R}^d$4, and a generated response $x^{\mathrm{truth}}_{i,\ell} \in \mathbb{R}^d$5. The response is labeled deceptively grounded if and only if three conditions all hold: there exists a claim $x^{\mathrm{truth}}_{i,\ell} \in \mathbb{R}^d$6 in $x^{\mathrm{truth}}_{i,\ell} \in \mathbb{R}^d$7 supported by some document $x^{\mathrm{truth}}_{i,\ell} \in \mathbb{R}^d$8 whose primary entity is $x^{\mathrm{truth}}_{i,\ell} \in \mathbb{R}^d$9; the claim is presented as evidence about $x^{\mathrm{decep}}_{i,\ell} \in \mathbb{R}^d$0; and all factual claims in $x^{\mathrm{decep}}_{i,\ell} \in \mathbb{R}^d$1 are logically entailed by $x^{\mathrm{decep}}_{i,\ell} \in \mathbb{R}^d$2 (Caruzzo et al., 10 Jul 2026).

This definition is intentionally orthogonal to standard automated checks. Hallucination introduces facts unsupported by retrieved documents and is therefore detectable by faithfulness checks. Faithfulness failure involves conflict with retrieved content and is therefore detectable by entailment or NLI checks. Citation checks verify that citations exist and are correctly formatted. DG passes all three because the model faithfully copies true information, cites real papers, but swaps the entity label.

The paper operationalizes DG rate in a controlled benchmark as

$x^{\mathrm{decep}}_{i,\ell} \in \mathbb{R}^d$3

where $x^{\mathrm{decep}}_{i,\ell} \in \mathbb{R}^d$4 is the set of test triples $x^{\mathrm{decep}}_{i,\ell} \in \mathbb{R}^d$5. The peak adversarial DG rate,

$x^{\mathrm{decep}}_{i,\ell} \in \mathbb{R}^d$6

spans 8.0%–86.7% across 13 models. A related quantity is the $x^{\mathrm{decep}}_{i,\ell} \in \mathbb{R}^d$7-protection ratio,

$x^{\mathrm{decep}}_{i,\ell} \in \mathbb{R}^d$8

with the example $x^{\mathrm{decep}}_{i,\ell} \in \mathbb{R}^d$9.

The significance of this formulation is that it isolates a grounded but misattributed failure mode. In contrast to ordinary fabrication, the model is not inventing evidence; it is assigning correct evidence to the wrong entity.

5. Controlled benchmark, detection, and mechanism in clinical RAG

The controlled benchmark is a 2D factorial design over retrieval completeness for the queried drug $i$0 and alternate-drug content for $i$1. The test set contains 264 $i$2 triples spanning five subdomains: autoimmune, hematology, oncology, pediatric, and rare. The $i$3 axis has three levels: absent, partial, and complete. The complete condition includes trial names, NCT numbers, and outcome data, referred to as “completing information targets” (CITs). The $i$4 axis has five levels: null_control, class_proximate, context_adjacent, prior_completing, and synthetic_Y. Evaluation covers 15 conditions $i$5, yielding 3,960 responses per schema variant per model. Two schema variants are used: a 10-tool schema with 4 RAG retrieval and 6 drug-info tools, and a 4-tool schema with RAG only (Caruzzo et al., 10 Jul 2026).

Thirteen models are evaluated: OpenBioLLM-70B, L1-16B-A3B, Qwen2.5-{7B,14B,32B,72B}, Llama-3.1-70B, Med42-70B, Gemma4-27B-A4B, Gemma4-31B, Qwen3.5-122B, GPT-OSS-20B, and GPT-OSS-120B. Peak DG rates at $i$6 range from 8.0% for GPT-OSS-20B to 86.7% for OpenBioLLM-70B, with medical and biomedical fine-tuned models clustering at the high end. For L1-16B-A3B under the 10-tool schema, R1 shows that DG jumps from 26–49% in non-completing $i$7 conditions to 67–73% in prior_completing or synthetic_Y at absent $i$8; R2 shows that complete retrieval of $i$9 suppresses DG to $\ell$0 across all $\ell$1; and R4 shows that tool-schema changes confabulation rates but alters DG by less than 2 percentage points in high-risk cells.

Ablation identifies completing information as a mechanistic hinge. In the prior_completing $\ell$2 plus absent $\ell$3 condition, baseline DG is 67.0%. Removing CITs from the $\ell$4 document while leaving disease context and mechanism cues intact reduces DG from 67.0% to 0.0%, while overall incorrect-response rate rises to 98.1%, entirely due to faithfulness-detectable confabulations. The paper describes this as evidence for a two-stage permission gate: Stage 1, Gate Opening, licenses generalization from $\ell$5’s evidence to $\ell$6 via disease-context overlap or partial $\ell$7-document framing; Stage 2, Path Selection, routes failures to DG when completing information is present and to confabulation when it is absent.

The paper adds three further mechanistic observations. Activation patching in L1-16B-A3B, injecting same-class drug representations at $\ell$8-token positions, shifts $\ell$9 attribution by $$\bar x^{\mathrm{truth}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{truth}}_{i,\ell},\quad \bar x^{\mathrm{decep}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{decep}}_{i,\ell}.$$0 percentage points with $$\bar x^{\mathrm{truth}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{truth}}_{i,\ell},\quad \bar x^{\mathrm{decep}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{decep}}_{i,\ell}.$$1. Label substitution, replacing $$\bar x^{\mathrm{truth}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{truth}}_{i,\ell},\quad \bar x^{\mathrm{decep}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{decep}}_{i,\ell}.$$2’s name with “XC-9941,” increases DG by $$\bar x^{\mathrm{truth}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{truth}}_{i,\ell},\quad \bar x^{\mathrm{decep}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{decep}}_{i,\ell}.$$3–54.9 percentage points across 13 models, which the paper interprets as confirming semantic-content drive. Finally, even when models explicitly detect a nonsense $$\bar x^{\mathrm{truth}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{truth}}_{i,\ell},\quad \bar x^{\mathrm{decep}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{decep}}_{i,\ell}.$$4 label 80% of the time, Stage 2 DG still occurs at 73%.

Detection is handled by Entity-Attribution Verification (EAV), implemented with a Kimi-K2.5 judge in a per-claim post-hoc pipeline. For each claim, the pipeline identifies a supporting document $$\bar x^{\mathrm{truth}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{truth}}_{i,\ell},\quad \bar x^{\mathrm{decep}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{decep}}_{i,\ell}.$$5, extracts its primary drug entity $$\bar x^{\mathrm{truth}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{truth}}_{i,\ell},\quad \bar x^{\mathrm{decep}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{decep}}_{i,\ell}.$$6, compares it to the query entity $$\bar x^{\mathrm{truth}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{truth}}_{i,\ell},\quad \bar x^{\mathrm{decep}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{decep}}_{i,\ell}.$$7, and flags entity-attribution failure when $$\bar x^{\mathrm{truth}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{truth}}_{i,\ell},\quad \bar x^{\mathrm{decep}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{decep}}_{i,\ell}.$$8 and the claim is presented about $$\bar x^{\mathrm{truth}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{truth}}_{i,\ell},\quad \bar x^{\mathrm{decep}}_\ell=\frac1N\sum_{i=1}^N x^{\mathrm{decep}}_{i,\ell}.$$9. If the response contains only claims about $$\mathrm{Flip}_\ell = \begin{cases} 1 & \text{if } \|\bar x^{\mathrm{decep}}_\ell-\bar x^{\mathrm{truth}}_\ell\|_2 > \tau_\ell,\ 0 & \text{otherwise,} \end{cases}$$0 and none about $$\mathrm{Flip}_\ell = \begin{cases} 1 & \text{if } \|\bar x^{\mathrm{decep}}_\ell-\bar x^{\mathrm{truth}}_\ell\|_2 > \tau_\ell,\ 0 & \text{otherwise,} \end{cases}$$1, it is labeled Tier-2 Entity Substitution; if claims about $$\mathrm{Flip}_\ell = \begin{cases} 1 & \text{if } \|\bar x^{\mathrm{decep}}_\ell-\bar x^{\mathrm{truth}}_\ell\|_2 > \tau_\ell,\ 0 & \text{otherwise,} \end{cases}$$2 are unsupported by any $$\mathrm{Flip}_\ell = \begin{cases} 1 & \text{if } \|\bar x^{\mathrm{decep}}_\ell-\bar x^{\mathrm{truth}}_\ell\|_2 > \tau_\ell,\ 0 & \text{otherwise,} \end{cases}$$3, it is Tier-3 Confabulation. On an IPW-adjusted human gold standard of $$\mathrm{Flip}_\ell = \begin{cases} 1 & \text{if } \|\bar x^{\mathrm{decep}}_\ell-\bar x^{\mathrm{truth}}_\ell\|_2 > \tau_\ell,\ 0 & \text{otherwise,} \end{cases}$$4, EAV attains DG precision $$\mathrm{Flip}_\ell = \begin{cases} 1 & \text{if } \|\bar x^{\mathrm{decep}}_\ell-\bar x^{\mathrm{truth}}_\ell\|_2 > \tau_\ell,\ 0 & \text{otherwise,} \end{cases}$$5 with 95% CI 87.7–99.0, DG recall $$\mathrm{Flip}_\ell = \begin{cases} 1 & \text{if } \|\bar x^{\mathrm{decep}}_\ell-\bar x^{\mathrm{truth}}_\ell\|_2 > \tau_\ell,\ 0 & \text{otherwise,} \end{cases}$$6 with 95% CI 82.4–100.0, specificity $$\mathrm{Flip}_\ell = \begin{cases} 1 & \text{if } \|\bar x^{\mathrm{decep}}_\ell-\bar x^{\mathrm{truth}}_\ell\|_2 > \tau_\ell,\ 0 & \text{otherwise,} \end{cases}$$7, and false positive rate on non-DG clean controls of 0.0%. The framework is explicitly complementary: EAV recovers Tier 1 only, NER-based ES detection recovers Tier 2 at high recall but low specificity, and faithfulness checks recover Tier 3.

6. Prevalence, mitigation, and broader interpretation

Production measurement in a deployed clinical decision-support RAG system extends the controlled results beyond adversarial evaluation. Across 740 pre-registered drug–disease pairs stratified by clinical category, overall DG prevalence is 7.8% with 95% CI 6.1–10.0, corresponding to 58/740 cases; confabulation is excluded from the DG metric. For recently approved drugs, DG rises to 13.6% with 95% CI 8.0–22.3, 12/88 cases, reflecting sparse $$\mathrm{Flip}_\ell = \begin{cases} 1 & \text{if } \|\bar x^{\mathrm{decep}}_\ell-\bar x^{\mathrm{truth}}_\ell\|_2 > \tau_\ell,\ 0 & \text{otherwise,} \end{cases}$$8-specific retrieval. Negative controls consisting of well-indexed established treatments show 2.0% DG with 95% CI 0.6–7.0. DG also correlates with retrieval risk: it rises from 2.2% at low risk, defined as less than 0.4 fraction of retrieved documents lacking $$\mathrm{Flip}_\ell = \begin{cases} 1 & \text{if } \|\bar x^{\mathrm{decep}}_\ell-\bar x^{\mathrm{truth}}_\ell\|_2 > \tau_\ell,\ 0 & \text{otherwise,} \end{cases}$$9 content, to 11.5% at high risk, defined as 0.8–1.0, a 5.2-fold increase. In the naturalistic worst-case stratum with absent $\tau_\ell$0 and completing $\tau_\ell$1 $\tau_\ell$2, DG is 13.2%, versus 73.1% in the controlled benchmark, indicating that the adversarial benchmark bounds susceptibility more than real-world prevalence (Caruzzo et al., 10 Jul 2026).

The mitigation proposals differ by setting but converge on targeted intervention. For clinical RAG, the paper identifies three levers: integrate EAV into all clinical RAG benchmarks; prioritize entity-specific retrieval so that complete retrieval of $\tau_\ell$3 suppresses DG to $\tau_\ell$4; and enforce entity anchoring before evidence synthesis. An explicit entity-anchoring instruction reduces DG by 30.7 percentage points, described as an 84% relative reduction, in parametric-prior profiles, though it has limited effect in “pre-attentional” profiles.

For representational DG, the proposed interventions are phrased more cautiously. The paper argues that monitoring activations in mid-tower layers, approximately 10–16 in Llama-3.1-8B and 16–21 in Gemma-2-9B, via pretrained probes or simple distance triggers can serve as an early warning of instruction-induced deception. It further suggests that thresholding a small set of deception-sensitive SAE features could yield lightweight detectors, and that gating or reweighting such features through activation patching or representation engineering may restore truthful grounding downstream without full model fine-tuning (Long et al., 29 Jul 2025).

Taken together, these results suggest that deceptive grounding is not a single failure mechanism but a family resemblance across settings. In one case, the internal truth-relevant subspace remains present but is reoriented by instruction; in the other, retrieved evidence remains factual but is bound to the wrong entity. The shared lesson is that conventional output-level correctness checks can miss failures in the mapping between evidence, representation, and semantic target.