AI 安全與評測
Anthropic Tests a Fine-Tuned “Lie Detector”: In-Domain AUROC Rises to 0.95, but Falls to Around 0.70 on a Different Type of Lie
The research team used eight open model families to generate roughly 200,000 examples of pressure-induced scenarios, then applied LoRA to train models to determine whether they themselves were lying. The detectors mainly learned surface-level patterns such as sycophancy and capability denial, performing only slightly better than prompting baselines on unseen lie types.
Anthropic Fellows and MATS researchers tested a seemingly straightforward safety approach: after a model generates a response under pressure, ask it whether it lied, then fine-tune that judgment into a binary classifier. The data covered eight model families and twelve elicitation settings, including factual contradictions, sycophancy, capability concealment, chess-skill sandbagging, and unfaithful reasoning. The team first recorded what the model described as its beliefs under neutral prompts, then introduced role-playing, threats, or incentive pressure and checked whether its answers contradicted those beliefs and whether it maintained them when challenged. Roughly one-quarter of the candidate labels were revised after GPT-5 review, illustrating how difficult it is to draw a boundary between “lying” and confusion, role-playing, or changes in belief.
The study used LoRA to fine-tune models in the Gemma 3 series, with rank 16, alpha 32, dropout 0.05, roughly 5,000 examples per data split, and up to five training epochs. In-domain AUROC rose from 0.60 to 0.95. However, when half of the lie types were held out for testing, AUROC reached only about 0.70–0.75, and increasing the number of training steps did not eliminate the gap. Transfer performance was largely determined by surface similarity: denial of ASCII capabilities transferred partially to chess-skill concealment, while factual lies could not reliably detect role-playing. Third-person prompts were also generally more accurate than asking models to admit their own lies. Zero-shot prompting with Qwen3-235B even achieved an AUROC of 0.98–0.99, making the incremental value of large, specialized detectors difficult to determine.
The engineering implication is that safety classifiers should not be deployed based solely on in-distribution scores. Deployment evaluations should be partitioned by failure mechanism, prompt format, and unseen domain, with separate abstention and human-review pathways. The public dataset contains 136,000 training rows and multiple test splits that can be used to reproduce cross-type evaluations. However, the results cover only controlled scenarios, LoRA, and specific Gemma and Qwen models; they do not demonstrate that the detectors can handle reward hacking or long-horizon strategic concealment in real-world agents.