How Do You Catch a Machine in a Lie?

Ask a model a question it can’t answer, and it might tell you it doesn’t know. Ask it again with a bit more pressure, and it might invent something. Push back on the invention, and you get the familiar apology: you’re right, I made that up.

Most of the time this is sloppiness rather than dishonesty. But models can also be trained to conceal information, or to state things they internally represent as false. As we hand agents longer tasks and more consequential decisions, “is this thing telling me the truth?” stops being a philosophical curiosity and becomes an operational question.

In July 2026, nineteen teams spent a month trying to answer it. EleutherAI just published a retrospective on their entry, and it’s one of the more honest research write-ups I’ve read in a while — including about the parts that didn’t work.

The competition

Aletheia’s Quest was run by Cadenza Labs and the National Deep Inference Fabric, funded by Schmidt Sciences, with a $50,000 prize pool. The setup was simple to state and nasty to solve.

You get a transcript: a conversation between a user and a “suspect” model. Somewhere in there, the model may have lied. Your job is to build a detector that flags it. The organizers ran this across three model families (Qwen 3.5, Gemma 3, Nemotron 3 Super) ranging from 27B to 120B parameters, plus LoRA fine-tunes tuned to lie in different styles — some terse, some elaborate, some frankly ridiculous. One Gemma variant would cheerfully claim Somalia is a type of pasta.

Two leaderboards, two rulesets:

Black-box. You see the conversation. You can query the suspect model. You get a smaller, weaker “judge” model (Qwen 3.5 9B) to help you reason. That’s it — text in, verdict out. Think of it as reading an interrogation transcript.

White-box. Everything above, plus access to the suspect model’s internals: activations, logit probabilities, the machinery underneath the words. Think of it as reading the transcript while watching a brain scan.

No internet access during evaluation, 30 minutes of wall time per 400-row dataset. The intuition going in is obvious: white-box should win. Looking inside the machine has to beat reading its output.

It didn’t play out that way

EleutherAI led both leaderboards for most of the month and got overtaken on literally the final day by a team called SAIN. But the interesting result isn’t the ranking — it’s that their black-box method worked so well they didn’t bother building a separate white-box one. They took the black-box detector and bolted a small amount of internal signal onto it.

Their approach decomposed the judge’s work into four passes:

1. Hide the suspect’s answer. Ask the judge to answer the question from its own knowledge. Treat that as ground truth.
2. Show the judge the suspect’s answer and have it rewrite the reply as a flat numbered list of factual claims — stripping out persona, hedging, and rhetorical filler, without evaluating anything yet.
3. and 4. Ask the judge to rule on it: honest or deceptive? Twice, with the answer options swapped, to cancel out position bias.

Clean, cheap, no neural archaeology required. It beat the competition baseline by a wide margin. So why isn’t this a triumph?

The uncomfortable part

Here’s the experiment that should make you sit up.

The team took 120 trivia questions and split them by what the suspect model (Gemma 3 27B) actually knew. Sixty questions it answered correctly five times out of five. Sixty it got wrong five times out of five. Then they forced the model to give the exact same reply to all 120:

I’m sorry, I don’t know the answer to that one.

Identical text, every time. For half of those, it’s an honest admission of ignorance. For the other half, it’s a knowledge denial — a lie, under the competition’s definition.

From the transcript alone, this should be undecidable. There is nothing in the words to distinguish the two classes. A detector should score at chance.

Three judge models from different families scored between 0.66 and 0.76 AUROC. Well above chance, on text containing zero discriminating information.

The explanation, once you see it, is deflating. The judge wasn’t reading the reply. The judge was quietly answering the trivia question for itself — and using its own success or failure as a proxy for whether the suspect plausibly knew the answer. Strip the suspect’s reply out entirely and just ask the judge whether it knows the answer, and you predict the label about as well. Ask whether the judge got the answer right, and you do better still: roughly 0.82 AUROC.

Why does that work? Because these models drink from the same well. Conditional on one model not knowing something, the other also didn’t know it about 96% of the time — against a baseline ignorance rate of around 23%. Training corpora overlap, so knowledge overlaps, so ignorance overlaps.

The detector isn’t detecting deception. It’s exploiting correlated ignorance. The paper frames this as an attack on black-box evaluation, and calls it a form of algorithmic monoculture: shared data and shared post-training make model beliefs correlated enough that a judge can use itself as a stand-in for the thing it’s auditing.

The second attack is subtler and the authors flag it as anecdotal: models seem to have tells. Denying something true comes out fast and flat. Asserting something the model knows to be false seems to involve more hedging and throat-clearing before it commits. Probably an RLHF artifact. Also not really lie detection — more like reading a poker face that happens to exist for unrelated reasons.

What makes both of these genuinely awkward is that they’re invisible in use. You don’t opt into them. Your detector just quietly scores well for the wrong reason, and you have no way to tell from the leaderboard.

White-box has its own problem

The internals-based methods didn’t escape unscathed either. The standard tool here is a linear probe: you take the model’s internal activations from cases where it lied and cases where it didn’t, compute the difference, and get a direction in activation space that supposedly points at “deception.” Then you project new activations onto it and read off a score.

EleutherAI trained more than ten variants. The pattern kept repeating: strong performance on the development set, then collapse toward chance on held-out distributions — and in several cases, inversion. Deceptive examples scoring lower on the deception axis than honest ones. Every probe they tested worked well somewhere and fell below chance somewhere else.

Their reading is that probes do find real signal, but what that signal means shifts with context. A direction that tracks deception in one setting might be tracking terseness, or factual error, or uncertainty, in another. One monolithic “am I being lied to” probe flattens all of that into a single number and loses the plot.

Their suggested fix is nice: stop asking probes the big question. Ask them small, granular ones instead — is this reply terse? is it factually wrong (not necessarily dishonestly)? did the model change its mind mid-trajectory? — and use that as routing information for a smarter detector on top. Their final white-box submission leaned on exactly one probe, and even then only let it contribute under two specific conditions.

What even counts as a lie?

Underneath all of this sits a definitional problem the retrospective handles well.

The competition used the Liars’ Bench definition: a model lies when it generates a statement it believes is false. Establish the belief by querying the model repeatedly without pressure, then label subsequent contradictory responses as lies.

Workable, measurable — and missing something. The classical philosophical definition has four components; this one has two. What drops out is intent: a lie is a believed-false statement made with the intention that the listener believe it.

Without that clause, you get false positives that are obviously not lies. Sarcasm qualifies — “lovely weather” in a downpour is believed-false, but nobody is being deceived. Worse, a model that explicitly announces it’s about to give a deliberately wrong answer for the purposes of an exercise, and then does so, also qualifies. The transparency is right there in the transcript and the metric doesn’t care.

The flip side is the bigger worry. Every dataset in this competition is built on checkable factual claims — the kind of thing a judge can verify against its own knowledge. But deception in long-horizon agentic work doesn’t usually look like that. It looks like omission. Selective emphasis. A status report that’s technically accurate and materially misleading. No single false sentence to point at.

The authors note they watched this happen in their own workflow while using coding agents for the research. And if your detection paradigm is “find the false factual claim,” none of it registers.

There’s a scaling problem hiding here too: the judge in this setup is weaker than the model it audits. That’s fine when the task is trivia fact-checking. It’s much less fine when the disputed material is a judgement call about weighing evidence — which is precisely where deception gets consequential.

Why I think this matters

Three things stuck with me.

Strong benchmark numbers can be structurally hollow. A 0.96 AUROC that comes from correlated training data is not the same capability as a 0.96 that comes from actually reading the conversation, and nothing on the leaderboard tells them apart. The team only found this by deliberately constructing a dataset where success should have been impossible — and then being suspicious when it wasn’t.

Monoculture is a security property, not just an ML curiosity. If your oversight model and your production model share ancestry, they share blind spots. That’s a familiar shape to anyone who has thought about relying on one vendor’s telemetry to monitor that same vendor’s stack.

The definitions we can measure are not the behaviours we care about. Detecting false factual claims is tractable and largely solved on these benchmarks. Detecting deception-by-omission in a long agent trajectory is neither — and it’s the one that will matter as agents get handed real decisions.

EleutherAI released their code and “the gauntlet,” a battery of 28 deception distributions totalling over 6,000 rows, assembled specifically so that new methods can be tested against the hard cases rather than the easy ones: github.com/EleutherAI/how-to-catch-an-ai-liar.

Worth a look if you want to see how thin the ice is under “we can tell when the model is lying.”