TruthProbe: Internal Veracity Diagnostics

Updated 6 July 2026

TruthProbe is a collection of white-box probing techniques that infer veracity signals from LLMs' internal representations, converting complex activation patterns into truth assessments.
It employs diverse approaches including binary linear probes, sparse-aware multi-instance learning, and head-level interventions to distinguish between truthful and deceptive outputs.
These methods demonstrate practical gains in deception detection, answer quality filtering, and model alignment monitoring, enhancing scalable safety interventions.

TruthProbe is a label used in recent arXiv literature for several closely related white-box methods that infer veracity-related properties from the internal representations of LLMs and multimodal descendants. Depending on the formulation, it denotes a binary linear probe over residual-stream activations for distinguishing honest from deceptive responses, a ternary sparse-aware multiple-instance learning framework that separates statements into true, false, and neither, or a head-level intervention that amplifies context-truthful attention heads during inference (Goldowsky-Dill et al., 5 Feb 2025, Savcisens et al., 30 Jun 2025, Choi et al., 14 Jun 2026). Related mechanistic work on deception detection and truth directions places these methods within a broader program of internal monitoring, in which truthfulness and deceptiveness appear as structured signals in activation space rather than as properties recoverable only from surface text (Boxo et al., 27 Aug 2025, Bao et al., 1 Jun 2025).

1. Conceptual scope and formal objects

Across its variants, TruthProbe operates on internal model states rather than solely on generated outputs. In binary deception settings, the probed object is typically a residual-stream activation $h \in \mathbb{R}^d$ at a chosen layer and token position, with a probe of the form $f(\hat h)=\sigma(w^\top \hat h+b)$ after normalization $\hat h=(h-\mu)/\sigma$ (Goldowsky-Dill et al., 5 Feb 2025). In truth-direction work, the relevant feature is the last-token representation $\mathbf{z}(x)=\mathbf{h}_n^{(l^*)}(x)$ at a layer $l^*$ chosen to maximize class separation, and the probe normal $\mathbf{w}$ is interpreted as the model’s “truth direction” (Bao et al., 1 Jun 2025). In the ternary setting, each sentence is treated as a bag of token-level activations $h_i(x)\in\mathbb{R}^{L\times d}$ for a given layer $i$ , because the veracity signal may be sparse and localized to only a few tokens (Savcisens et al., 30 Jun 2025). In head-level lineage methods, the probe attaches to the output vector $o_{l,h}(x)\in\mathbb{R}^d$ of head $h$ in layer $f(\hat h)=\sigma(w^\top \hat h+b)$ 0 and measures whether that head alone linearly separates truthful from hallucinated answers (Choi et al., 14 Jun 2026).

These formulations also differ in label space. One binary definition sets $f(\hat h)=\sigma(w^\top \hat h+b)$ 1 when an argument is “deceptive” and $f(\hat h)=\sigma(w^\top \hat h+b)$ 2 when it is “non-deceptive,” where a deceptive argument is one in which the model intentionally constructs a persuasive but factually incorrect rationale for an objectively wrong choice (Boxo et al., 27 Aug 2025). Another binary formulation distinguishes honest from deceptive responses in strategic settings such as insider-trading concealment and sandbagging (Goldowsky-Dill et al., 5 Feb 2025). The ternary formulation adds a third class, “neither,” for fragments, jokes, novel names, or unseen facts that should not be forced into a true/false dichotomy (Savcisens et al., 30 Jun 2025). The head-gating formulation defines “truthfulness” contextually, with labels indicating whether an answer is factual or hallucinated given the supplied text or image context (Choi et al., 14 Jun 2026).

A compact way to view the literature is that TruthProbe names a family of activation-based veracity diagnostics and interventions whose common premise is that internal states expose epistemic or strategic properties not reliably visible in final text alone. This premise is explicit in deception-monitoring work, which argues that output monitoring is insufficient when a model can produce seemingly benign outputs while its internal reasoning is misaligned (Goldowsky-Dill et al., 5 Feb 2025).

Formulation	Internal object	Output
Binary deception probe	Residual-stream activations at chosen layers or tokens	Honest/deceptive or deceptive/non-deceptive score
Ternary sAwMIL TruthProbe	Bags of token-level activations	True/false/neither prediction set
Head-level TruthProbe	Per-head output vectors $f(\hat h)=\sigma(w^\top \hat h+b)$ 3	Head Truth Scores and soft gates

2. Binary linear probing for deception

In one established binary formulation, TruthProbe is a logistic-regression probe over normalized residual activations of Llama-3.3-70B-Instruct. The probe is trained at layer $f(\hat h)=\sigma(w^\top \hat h+b)$ 4 of an 80-layer Transformer, and test-time scoring averages token-level deceptiveness scores $f(\hat h)=\sigma(w^\top \hat h+b)$ 5 into a response-level score $f(\hat h)=\sigma(w^\top \hat h+b)$ 6 (Goldowsky-Dill et al., 5 Feb 2025). The principal training dataset, “Instructed-Pairs,” contains 5,000 contrastive pairs and yields approximately $f(\hat h)=\sigma(w^\top \hat h+b)$ 7 token-label pairs after flattening. A second dataset consists of roleplaying scenarios with 371 honest, 84 ambiguous, and 203 deceptive responses, where GPT-4o provides a 1–7 honesty scale and the ambiguous cases are excluded from main training (Goldowsky-Dill et al., 5 Feb 2025).

The evaluation program targets strategic deception rather than generic falsehood. In insider-trading concealment, the report phase contains 669 honest, 324 ambiguous, and 336 deceptive examples after filtering to runs where the model actually executes the trade; in the follow-up confirmation phase, 24 examples are honest, 2 ambiguous, and 630 deceptive. In safety-evasion sandbagging, the test set contains 995 honest, 511 ambiguous, and 420 deceptive examples, with deception defined by a hidden step-1 decision to sandbag combined with a final answer that differs from the hidden correct answer (Goldowsky-Dill et al., 5 Feb 2025). On these datasets, the Instructed-Pairs-trained probe reports AUROCs of 0.964 on Roleplaying, 0.999 on Insider Report, 0.974 on Insider Confirm, and 0.983 on Sandbagging. With a decision threshold fixed to the 99th percentile of 10,000 Alpaca replies, corresponding to a 1% false positive rate on control data, Recall@1%FPR is 0.998, 1.000, 0.986, and 0.998 respectively (Goldowsky-Dill et al., 5 Feb 2025).

A second mechanistic binary line studies deception in model-generated arguments for multiple-choice factual questions. Here, base questions are sampled from MMLU subjects, and each answer option is paired with both a truthful prompt and a deceptive prompt that instructs the model to argue in favor of an incorrect option. Ill-formed or off-topic generations are filtered by an LLM-based argument evaluator checking “argues_for_option,” “no_references_to_other_options,” and “persuasive_and_formal,” producing a synthetic dataset on the order of tens of thousands of triplets per model (Boxo et al., 27 Aug 2025). The probe is trained separately at each layer on the residual-stream activation at the final token position, with regularized binary cross-entropy, $f(\hat h)=\sigma(w^\top \hat h+b)$ 8, Adam, learning rate $f(\hat h)=\sigma(w^\top \hat h+b)$ 9, batch size 128, and 10 epochs with early stopping on a 10% validation split (Boxo et al., 27 Aug 2025).

The principal empirical pattern is layer-wise and scale-dependent. Early layers are near-random at approximately 50–55% accuracy; middle layers peak, with Qwen-14B at approximately 90% and DeepSeek-7B at approximately 92%; late layers decline slightly to 80–85% (Boxo et al., 27 Aug 2025). Layer-max accuracy rises with model size: Qwen-1.5B reaches 52%, Qwen-3B 60%, Qwen-7B 75%, Qwen-14B 90%, DeepSeek-1.5B 55%, and DeepSeek-7B 92%. Smaller 1.5B models remain at chance, while larger models above 7B reach 70–80%, and reasoning counterparts exceed 90% (Boxo et al., 27 Aug 2025). The same study applies iterative null-space projection and finds approximately 20 independent deception directions in Qwen-3B, approximately 50 in Qwen-7B, approximately 100 in DeepSeek-7B, and approximately 95 in Qwen-14B before probe accuracy falls to chance. Its black-box baseline, framed as LLM-as-judge, reports approximately 85% for GPT-4o and approximately 75% for GPT-4o-mini on large-model arguments, with the gap narrowing for reasoning-tuned variants (Boxo et al., 27 Aug 2025).

3. Truth directions and cross-task generalization

TruthProbe is also connected to the literature on “truth directions,” which models truthfulness as a linear feature in activation space. In this formulation, a pretrained autoregressive transformer with residual representations $\hat h=(h-\mu)/\sigma$ 0 is probed at the last token representation $\hat h=(h-\mu)/\sigma$ 1, where $\hat h=(h-\mu)/\sigma$ 2 maximizes a ratio of between-class to within-class variance across layers (Bao et al., 1 Jun 2025). Logistic regression, support vector machines, multilayer perceptrons, and the mass-mean direction are all used to estimate a separating hyperplane. Under logistic regression, the truthfulness probability is $\hat h=(h-\mu)/\sigma$ 3, and the normal vector $\hat h=(h-\mu)/\sigma$ 4 is taken as $\hat h=(h-\mu)/\sigma$ 5 (Bao et al., 1 Jun 2025).

The training data in this line consist of six “atomic” factual topics—animal_class, cities, element_symb, facts, inventors, and sp_en_trans—with affirmative statements and corresponding negations (Bao et al., 1 Jun 2025). The key question is not only whether a probe separates true from false in-domain, but whether the same direction generalizes across logical transformation and question-answering regimes. On negation generalization, weak models such as Llama-2-7B fail with $\hat h=(h-\mu)/\sigma$ 6 on all six topics, medium models such as Llama-2-13B and Llama-3.1-8B succeed on 4/6 topics, and Llama-3.1-70B-Instruct succeeds on all 6 (Bao et al., 1 Jun 2025). On natural-language conjunctions and disjunctions, SVM, LR, MLP, and MM all achieve $\hat h=(h-\mu)/\sigma$ 7 on conjunctions and slightly lower but still $\hat h=(h-\mu)/\sigma$ 8 on disjunctions (Bao et al., 1 Jun 2025).

Generalization extends beyond declarative statements. In multiple-choice QA on MMLU, few-shot context raises AUROC by 5–10 percentage points, calibration remains stable across correct and mixed exemplars, and SVM yields the best Brier Score and Expected Calibration Error (Bao et al., 1 Jun 2025). In short-form QA on TriviaQA, probe accuracy improves with more shots. In in-context grounding tasks such as SciQ, BoolQ, and XSum summarization, probes trained on atomic factual data still generalize, reaching AUROC up to 0.85 on SciQ/BoolQ and 0.75 on XSum (Bao et al., 1 Jun 2025). An especially notable result is that probes trained directly on MMLU underperform atomic-trained probes on the same task, which the paper interprets as evidence for the universality of the atomic-statement anchor (Bao et al., 1 Jun 2025). As an application, a select-and-filter procedure on TriviaQA with 20 samples from Llama-3.1-8B raises answer accuracy from 55.3% to 64.1% on the selected subset (Bao et al., 1 Jun 2025).

This line contributes a geometric account of what a TruthProbe is detecting. Rather than treating veracity as merely an output-level score, it models truthfulness as a latent linear feature whose consistency varies by model family, model scale, and task. The reported failures of weaker models are therefore interpreted not as probe failure alone, but as evidence that some models lack a stable internal truth concept under logical transformations (Bao et al., 1 Jun 2025).

4. Ternary veracity probing with sAwMIL and conformal prediction

A more expansive formulation appears in the three-way TruthProbe built around sAwMIL, introduced to address several assumptions that the authors regard as flawed: that truth and falsehood lie on a single bidirectional scale, that LLMs encode every fact humans know, that raw probe outputs are calibrated confidence, that every sentence is either true or false, and that the relevant token or layer is known in advance (Savcisens et al., 30 Jun 2025). The resulting method separates inputs into true, false, and neither, and it does so while searching over token positions and layers for sparse veracity signals.

The core representation is a bag of token-level activations $\hat h=(h-\mu)/\sigma$ 9 after layer $\mathbf{z}(x)=\mathbf{h}_n^{(l^*)}(x)$ 0. For each class $\mathbf{z}(x)=\mathbf{h}_n^{(l^*)}(x)$ 1, sAwMIL trains a one-vs-all linear classifier in two stages. Stage 1 solves a sparse multiple-instance learning problem in which at least one token in each positive bag must exceed the positive margin, while all tokens in negative bags must lie below the negative margin. Stage 2 scores the positive-bag instances, takes the $\mathbf{z}(x)=\mathbf{h}_n^{(l^*)}(x)$ 2-quantile $\mathbf{z}(x)=\mathbf{h}_n^{(l^*)}(x)$ 3, retains only instances with $\mathbf{z}(x)=\mathbf{h}_n^{(l^*)}(x)$ 4 and within the “actualized” token positions as positives, and then retrains a standard single-instance linear SVM (Savcisens et al., 30 Jun 2025). The three one-vs-all scorers are assembled into class scores $\mathbf{z}(x)=\mathbf{h}_n^{(l^*)}(x)$ 5, converted to raw probabilities by a softmax, and then calibrated with split-conformal prediction using a nonconformity score $\mathbf{z}(x)=\mathbf{h}_n^{(l^*)}(x)$ 6. Under exchangeability, the conformal stage guarantees $\mathbf{z}(x)=\mathbf{h}_n^{(l^*)}(x)$ 7 (Savcisens et al., 30 Jun 2025).

The empirical study uses three new ternary datasets: City Locations with 7,252 total examples, Medical Indications with 6,903, and Word Definitions with 6,500. Each is split 55% train, 20% calibration, and 25% test with object-level deduplication, and “neither” examples are generated by Markov-chain-synthesized novel names (Savcisens et al., 30 Jun 2025). The models comprise 16 open-source LLMs from 3B to 14B across Gemma, Llama-3, Mistral, and Qwen, each in default and chat variants. Evaluation follows five validity criteria—Correlation, Generalization, Selectivity, Manipulation, and Locality—and uses MCC, W-MCC, and intervention success rate as reported measures (Savcisens et al., 30 Jun 2025).

Several findings directly shape the modern understanding of TruthProbe. First, across 16 LLMs and all three datasets, the median layer where “true” and “false” probes peak lies between 50–75% of model depth, described as the third quarter of depth (Savcisens et al., 30 Jun 2025). Second, truth and falsehood signals are not always symmetric: in many default models, the median layers for “is-true” and “is-false” differ by 2–5 layers, while chat models tend to unify them more tightly (Savcisens et al., 30 Jun 2025). Third, sAwMIL outperforms zero-shot prompting by MCC +0.2–0.4 and MD+CP by MCC +0.25 across all 48 model×data combinations, while a pure multiclass SVM on the final token underperforms sAwMIL in 46/48 cases (Savcisens et al., 30 Jun 2025). Fourth, the “neither” signal often peaks earlier, around 10–20% of model depth, and occupies a distinct apex in ternary plots. Two outliers—Gemma-2-9B in default and chat form, and Qwen-2.5-14B chat—fail manipulation/locality checks entirely, which the paper treats as evidence that nonlinear probes may be required for some models with reinforcement learning from human feedback or knowledge distillation (Savcisens et al., 30 Jun 2025).

5. Head-level TruthProbe in model lineages

A distinct use of the term appears in work on model lineages, where TruthProbe identifies and reuses “context-truthful heads” across related LLM and MLLM families. For an auto-regressive transformer with $\mathbf{z}(x)=\mathbf{h}_n^{(l^*)}(x)$ 8 layers and $\mathbf{z}(x)=\mathbf{h}_n^{(l^*)}(x)$ 9 heads per layer, the method takes the output vector $l^*$ 0 at the final answer token from head $l^*$ 1 of layer $l^*$ 2, attaches a binary linear probe $l^*$ 3, and computes $l^*$ 4 (Choi et al., 14 Jun 2026). Each per-head probe is trained by binary cross-entropy on a small labeled probing set, and the head’s Truth Score is defined on held-out validation data as

$l^*$ 5

This score measures how well a single head linearly separates truthful from hallucinated answers given the context and query (Choi et al., 14 Jun 2026).

The central empirical claim is inheritance. Within lineages such as Vicuna-, Qwen2.5-, LLaMA2-, and Mistral-based descendants, average Frobenius-norm head-weight drift is approximately 0.03, compared with approximately 1.0 across unrelated families (Choi et al., 14 Jun 2026). Correspondingly, head-level Truth Scores remain strongly correlated within families: single-dataset probing yields Pearson $l^*$ 6– $l^*$ 7 across Vicuna $l^*$ 8LLaVA and Qwen2.5 $l^*$ 9Qwen2.5-VL, while cross-dataset probing still yields within-family $\mathbf{w}$ 0– $\mathbf{w}$ 1, versus approximately 0.04–0.08 across families (Choi et al., 14 Jun 2026). Attention-overlay visualizations indicate that heads with high $\mathbf{w}$ 2 continue to focus on query-relevant evidence in descendants, whereas low-truth heads remain diffuse or positional (Choi et al., 14 Jun 2026).

TruthProbe then becomes an inference-time intervention. Standard multi-head attention output $\mathbf{w}$ 3 is replaced by

$\mathbf{w}$ 4

with per-head gate

$\mathbf{w}$ 5

Here $\mathbf{w}$ 6 is a small hyperparameter, reported as 4–7 on HaluEval and 0.2–0.3 on POPE, and $\mathbf{w}$ 7 is a layer-wise normalization such as centered normalization or min–max scaling to $\mathbf{w}$ 8 (Choi et al., 14 Jun 2026). Because the normalized scores sum to approximately zero within a layer, the average gate remains approximately 1, so the original model behavior is intended to be largely preserved (Choi et al., 14 Jun 2026).

The reported gains are benchmark-specific but statistically significant. On HaluEval, Vicuna-7B improves from approximately 38.9% to 48.5% accuracy, with F1 from 13.4 to 57.2 and recall from 9.4 to 68.8; Qwen2.5-7B improves from 27.7% to 35.0% (Choi et al., 14 Jun 2026). On multimodal benchmarks, LLaVA-1.5 improves POPE(COCO) recall from 79.1% to 80.1% and A-OKVQA recall from 87.8% to 90.1%, while its CHAIR $\mathbf{w}$ 9 hallucinated-object rate decreases from 6.99% to 5.36% (Choi et al., 14 Jun 2026). TruthfulQA generation truthfulness increases from 56.4% to 57.6% with +ITI or from 56.9% with +TruthProbe, and informativeness rises by up to 3.5% (Choi et al., 14 Jun 2026). Paired $h_i(x)\in\mathbb{R}^{L\times d}$ 0-tests report values such as $h_i(x)\in\mathbb{R}^{L\times d}$ 1 for Qwen2.5 on HaluEval and $h_i(x)\in\mathbb{R}^{L\times d}$ 2 for Qwen2.5-VL on POPE, and cross-model transfer shows that gates derived from a base LLM achieve the same $h_i(x)\in\mathbb{R}^{L\times d}$ 3 metrics on descendants as gates probed directly on those descendants (Choi et al., 14 Jun 2026). Random-gate baselines degrade performance, and low-resource transfer from Mistral-7B to LLaVA-Med raises accuracy on SARS-CoV2 CT scans from 48.8% to 55.0% (Choi et al., 14 Jun 2026).

6. Limitations, misconceptions, and research significance

The literature surrounding TruthProbe is explicit that high probe accuracy does not settle the question of robust truthfulness or robust alignment. Binary deception work states that white-box probes are promising for future monitoring systems, but that current performance is insufficient as a robust defence against deception (Goldowsky-Dill et al., 5 Feb 2025). It also documents specific failure modes: spurious correlation with “scenario involves deception,” the possibility that mean aggregation hides partially deceptive replies, GPT-4o label noise in borderline cases, and the risk that a scheming model aware of the probe could obfuscate activations (Goldowsky-Dill et al., 5 Feb 2025). The mechanistic deception study adds that synthetic prompts may not capture real-world subtleties of deliberate deception, that small models at or below 1.5B remain at chance, and that iterative null-space projection only addresses linear separability, leaving nonlinear or higher-order effects potentially undetected (Boxo et al., 27 Aug 2025).

The ternary veracity literature corrects several common misconceptions. One is that truth and falsehood must be symmetric; another is that every sentence is either true or false. The introduction of a distinct “neither” class and calibrated conformal prediction is a direct response to those assumptions (Savcisens et al., 30 Jun 2025). Related truth-direction work likewise rejects universality: not all LLMs exhibit consistent truth directions, and stronger representations are observed in more capable models, particularly in the context of logical negation (Bao et al., 1 Jun 2025). Taken together, these findings suggest that a TruthProbe is not a single invariant detector of “truth” so much as a family of methods whose validity depends on model capacity, fine-tuning regime, label space, and the geometry of the internal representation.

The most stable cross-paper regularity concerns where the signal resides. Deception probes peak in middle layers and then decline slightly in later layers (Boxo et al., 27 Aug 2025), while ternary veracity probes report that the median layer for true and false signals lies between 50–75% of model depth (Savcisens et al., 30 Jun 2025). A plausible implication is that veracity-related information is often most linearly accessible in intermediate depth rather than at the input-adjacent or final layers. Another regularity is multiplicity rather than singularity: one study finds a “truth direction,” while another finds $h_i(x)\in\mathbb{R}^{L\times d}$ 4– $h_i(x)\in\mathbb{R}^{L\times d}$ 5 independent deception directions, and a third finds that true, false, and neither can occupy partially distinct subspaces or simplex regions (Bao et al., 1 Jun 2025, Boxo et al., 27 Aug 2025, Savcisens et al., 30 Jun 2025).

The broader significance of TruthProbe lies in its movement from passive diagnosis toward operational use. In selective question answering, truth probes can filter sampled candidates and improve answer quality on the retained subset (Bao et al., 1 Jun 2025). In alignment monitoring, high probe accuracy at middle layers is presented as a possible “check-engine light,” and combined white-box probing plus black-box judging is proposed as a complementary safety dashboard (Boxo et al., 27 Aug 2025). In lineage-level multimodal systems, head-level Truth Scores can be transferred from a base LLM to its descendants and used as a training-free intervention that reduces hallucination while preserving most original behavior (Choi et al., 14 Jun 2026). In adjacent evaluation work on vision-LLMs, PROVE reports that helpfulness and truthfulness are largely uncorrelated across models, with Pearson correlation 0.03, which helps explain why internal truth-grounding interventions are being pursued alongside output-level metrics (Prabhu et al., 2024).

Within this research landscape, TruthProbe names an evolving class of mechanistic tools for locating, calibrating, and exploiting veracity-related structure in model internals. Its current forms range from logistic probes over residual streams, to sparse multiple-instance ternary classifiers, to soft-gating over inherited truthful heads. Their shared contribution is methodological: they treat truthfulness and deception as properties of representation geometry and attention organization, not merely as observable output traits.