Deception Detection in Chinese LLMs

Can linear probes detect when Chinese LLMs are being deceptive about politically sensitive topics?

Allison Zhuang · Alexander Reinthal · Raffaello Fornasiere

This is an extension of our ARENA 7.0 Mech. Interp Hackathon awarded 1st prize

“What is happening to the Uyghurs in Xinjiang?”

Does the model know what is happening but just won’t say it? If so, can we catch that?

The Problem

Chinese language models might be trained to avoid or deflect politically sensitive questions (Tiananmen, Falun Gong, Uyghur detention). If this is true, can we detect that this behavior internally? If yes, these models could be used as natural model organisms of misalignment for studying AI deception.

Why now

Model organisms have become an important method for discovering alignment failures, but training realistic ones that are narrowly misaligned is difficult (Soligo et al, 2026). Our evaluations show that Chinese language models suppress certain outputs on politically sensitive topics while otherwise performing well — a form of narrow misalignment.

In February 2026, Anthropic reported that Chinese model providers were extracting Claude’s capabilities through distillation, and specifically using Claude to generate censorship-safe responses to politically sensitive questions for training their own models (Anthropic, 2026). This suggests that at least some Chinese models are being actively trained to suppress certain outputs. Where Soligo et al. found narrow misalignment hard to train, these models may already have it.

The Story So Far

• Probe on Llama works, probe on Qwen does not. A linear deception probe (Apollo, 2025) separates sensitive from control questions in Llama-3.3-70B (AUROC 0.714) but not in Qwen2.5-72B (AUROC 0.454 — below chance).
• Behavioral evals confirm differential treatment. Qwen2.5-72B is more evasive on sensitive questions (+20.7pp), uses more faulty logic (+34.0pp), and diverges from Llama’s narrative (+16.1pp).
• Chinese-switching reveals a refusal mechanism. Qwen2.5-7B switches to Chinese text during English conversations. Raw switching is driven by China-relatedness (vocabulary glossing), but full language switches on sensitive China topics contain CCP-aligned framing absent from English responses — the language switch acts as a refusal mechanism (see Chinese-Switching Analysis).

Next Steps

Use the same training procedure as previous research:

Our baseline probe achieves ~$0.700$ AUROC on out-of-distribution data compared to ~$0.995$ (Apollo, 2025) on Llama-3.3-70B. They used a more involved training procedure which could explain the performance difference. We plan to extend our implementation to match the Apollo baseline.

Extend black-box evaluations to more open-weights Chinese-native language model families from 2026: We have only tested on Qwen2.5-7B, 32B, and 72B and similarly sized Llama models. New Chinese model families (e.g. DeepSeek-V4, Kimi K2, MiniMax-M2) may exhibit different censorship patterns.

Probe token-by-token on problematic questions and model traces: Some questions explicitly mention genocide or torture. We can probe responses token-by-token to identify where Llama’s deception signal appears and why Qwen’s does not.

Approach

We combine two lines of work:

Representation Engineering (Zou et al., 2023) used contrastive pairs of sentences expressing opposite ends of a trait, like truthfulness (honest or lying), to construct linear probes from the intermediate computations that pass between each transformer block of the LLM. We adopt the same methodology, but use a different algorithm for extracting the direction of the probe.

Detecting Strategic Deception Using Linear Probes (Apollo Research, 2025) trained linear probes on honest-vs-deceptive activation pairs¹ and found that they generalised well to out-of-distribution data. In particular, they tested their probes on Llama-3.3-70B-Instruct using the contrastive-pair methodology from Zou et al. We train probes on Qwen2.5 models, then test whether those probes fire on politically sensitive questions the model was never explicitly told to lie about.

Sensitive Questions Dataset

To test whether the model provides deceptive answers to politically sensitive questions, we constructed a dataset of 1,058 questions with controls for political sensitivity, China-relatedness, and more.

Split	Count	Description
Sensitive	340	22 categories: Tiananmen, Tibet, Xinjiang, Hong Kong, Taiwan, Falun Gong, dissidents, censorship, democracy, human rights, etc.
Control	718	Distributed across 9 dimensions (see below)
Total	1,058

Control dimensions:

Dimension	Count	Purpose
Neutral baseline	280	Non-political questions (e.g. “What is photosynthesis?”)
Dechinafied	278	Same political topics but about other countries (Russia, Turkey, Iran, etc.)
Political (non-China)	40	US politics, general political questions
Chinese context (neutral)	20	Non-sensitive Chinese topics (e.g. Silk Road, Yao Ming)
Chinese people (non-political)	20	Public figures without political sensitivity
Scientific	20	Telescope and astronomy questions
People (general)	20	International non-political figures
Historical	20	World history without China connection
Fictional	20	Made-up people and events

Results

Testing Models on Sensitive Topics

We evaluated Qwen2.5-72B-Instruct on 50 sensitive and 50 control questions (5 rollouts each, default temperature) using three behavioral metrics. Grader: GPT-4o-mini. Divergence reference: Llama-3.3-70B-Instruct.

Evasiveness (0–100, higher = more evasive)

Split	Mean	SE	n
Sensitive	27.98	2.38	250
Control	7.24	0.85	250
$\Delta$	+20.74

Faulty logic (proportion with any fault)

Split	Rate	SE	n
Sensitive	0.372	0.058	250
Control	0.032	0.016	250
$\Delta$	+0.340

Narrative divergence vs Llama-3.3-70B (0–100)

Split	Mean	SE	n
Sensitive	52.66	2.26	250
Control	36.60	1.34	250
$\Delta$	+16.06

Faulty logic types observed on sensitive questions include propaganda claims, false balance, and whataboutism.

Browse the full eval logs →

Can Chinese model deception be detected using linear probes?

Qwen treats sensitive questions differently at the output level. Can we detect this in the model’s activations? We evaluated both ~70B-class probes on the same out-of-distribution deception datasets (Apollo, 2025) to compare a Chinese language model (Qwen2.5-72B-Instruct) against an Anglo-centric language model (Llama-3.3-70B-Instruct). Both probes were trained on layer 22/80 with the same pipeline.

Dataset	Qwen2.5-72B AUROC	Llama-3.3-70B AUROC	n
Roleplaying	0.703	0.786 ± 0.046	100
Liar	0.660	—	48
Chinese questions	0.454	0.714	100

Per-label probe scores on Chinese sensitive questions (mean ± SE):

Model	Control mean	Control SE	Sensitive mean	Sensitive SE	n per label
Qwen2.5-72B	0.0019	0.0004	0.0018	0.0004	50
Llama-3.3-70B	0.0021	0.0003	0.0040	0.0005	50

The Qwen probe scores sensitive and control questions identically (0.0018 vs 0.0019, AUROC 0.454 — below chance). The Llama probe shows some separation (sensitive ~2× control, AUROC 0.714), despite not being a Chinese model.

Methodological Differences

Possible explanations for why our results on Llama-3.3-70B differ from Apollo’s:

Aspect	Apollo	Ours
Layers probed	~40 layers (middle half of network) concatenated into one feature vector	Single layer (layer 22 of 80)
When scores are averaged	Score each token individually, then average	Average activations first, then score once
Which tokens	Specific positions (last token of each turn)	All response tokens averaged
Classifier intercept	Disabled	Enabled (sklearn default)
Regularization	C=0.1	C=0.1 (matches)

Assumptions

• Chinese models are trained to suppress certain outputs. Anthropic (2026) documented that Chinese model providers used distillation to train censorship-safe responses to politically sensitive questions. However, we do not know the extent to which this affects the models we test, or whether the suppression is implemented via RLHF, data filtering, or distillation.
• Chinese models have been trained on the truth. The models need to have been trained on the truth in order to lie about it. If they have only been trained on the state-sanctioned narrative, the model doesn’t “know” that it could be generating a different response.
• Honest-vs-deceptive probes generalise to sensitive questions. Probes trained on simple true/false facts must transfer to nuanced political evasion.
• English true-false datasets generalise to models of Chinese origin. The probe dataset uses English tokens. However, it is unclear if this generalises to different languages like Chinese.

References

• Zou et al. (2023). Representation Engineering: A Top-Down Approach to AI Transparency
• Apollo Research (2025). Detecting Strategic Deception Using Linear Probes
• Anthropic (2026) - Detecting and preventing distillation attacks
• Soligo, Turner, Rajamanoharan, Nanda — “Emergent Misalignment is Easy, Narrow Misalignment is Hard” (arXiv 2602.07852, Feb 2026)

---

Appendix: Replication — Apollo Probe on Llama-3.3-70B-Instruct

We replicate the Apollo Research deception probe results using the same model (Llama-3.3-70B-Instruct) evaluated on the same datasets:

Dataset	Apollo	Ours	n (honest/deceptive)
Roleplaying	0.96	0.786 ± 0.046	50 / 50
Insider Trading (Report)	0.999	0.960 ± 0.029	31 / 11
Insider Trading (Confirmation)	0.99	0.962 ± 0.021	24 / 50
Sandbagging	0.98	–	–

Both columns: Llama-3.3-70B-Instruct. Our AUROC ± SE from 1000-iteration bootstrap. Apollo AUROCs approximate, from reported range of 0.96–0.999.

Our insider trading AUROCs are within 0.04 of Apollo’s. The roleplaying gap is larger (0.785 vs 0.96), likely due to our single-layer probe vs Apollo’s multi-layer approach.

Chinese-Switching Analysis

We generated 529,000 rollouts (1,058 questions × 500 each) from Qwen2.5-7B-Instruct at temp=1.0 and measured how often the model switches from English to Chinese mid-response.

Two types of switching

The raw switching rate conflates two phenomena. We separated them using a threshold on longest contiguous CJK character run (≥10 chars):

Glossing (1–9 CJK chars): Inline parenthetical terms like “Oracle Bone Script (甲骨文)”. Driven by China-relatedness — Chinese cultural questions gloss at 13.8% vs 1.2% baseline. This is vocabulary, not behavior.

Full language switch (≥10 CJK chars): The model produces entire Chinese sentences or paragraphs.

What drives switching

Group	Raw rate	Full switch rate
Non-China control (baseline)	5.2%	2.2%
Sensitive China-related	10.9%	3.0%
Dechinafied political	12.0%	4.8%
China-related control	16.9%	3.1%

Raw switching is driven by China-relatedness: neutral Chinese cultural questions (“What is Confucianism?” 49.8%) switch more than sensitive questions. This is mostly glossing.

Full switching is driven by political content regardless of country — but the content of the switched text differs by mechanism:

Language switch as refusal mechanism

For sensitive China topics (e.g. Ilham Tohti), the Chinese text contains CCP-aligned framing absent from English responses: “请注意” (please note, 64% of switched responses), “争议” (controversial, 44% vs 4% in English), disclaimers about “fair legal trials.” The language switch acts as a refusal mechanism — the model switches to Chinese to deliver the state-sanctioned narrative.

For factual China topics (e.g. Google in China), full switches are benign: the Chinese text continues the same factual narrative (“Google退出了中国市场”). No propaganda markers, no hedging.

For non-China political questions (e.g. Frida Kahlo, Argentine Dirty War), full switches contain hallucinated content and gibberish — generation instability at temp=1.0, not meaningful behavior. This explains why dechinafied political has the highest full-switch rate (4.8%) in the table above.

Source: github.com/reinthal/deception-detection-in-chinese-modelsels