A Probe Can Tell You the Model Is Lying. Can It Make the Model Stop?

Published at HCII 2026 in Artificial Intelligence in HCI (Springer, LNCS).

If you want to know whether an LLM’s output can be trusted, the most popular tool available is a probe: a small classifier trained on the model’s internal activations that predicts something about its behaviour — including whether the model is being deceptive. Probes are cheap, they work, and the field leans on them heavily.

They also come with two inherited assumptions that almost nobody tests.

The first is that linear probes mostly pick up correlations in activations, which makes them unsuitable for causal intervention: you can read a signal off the model, but you cannot use that signal to reach in and change the behaviour. The second is quieter and more structural — behavioural localization, the implicit belief that the signal you care about lives in some particular layer, and that your job is to find it.

We set out to test both.

Probing Every Layer at Once

We trained probes on activations from every layer of DeepSeek-R1-Distill-Llama-70B. Alongside standard linear probes, we used an architecture that had previously been shown to work in causal interpretability settings — the kind of probe you would reach for precisely because you eventually want to intervene, not just observe.

The localization assumption predicts that full-model probes should do better than single-layer ones, because they see everything, or worse, because the extra layers are noise.

Neither happened. Full-model probes matched single-layer baselines at predicting deceptive behaviour. That result is more interesting than it first looks: if reading from all layers is no better than reading from one well-chosen layer, the information about deception is not hiding in a specific place. It is distributed, available in multiple layers at once, and a single-layer probe is already capturing what there is to capture.

So much for having to find the right layer. The harder question was what to do with the neurons the probes pointed at.

The Intervention That Changed Nothing

This is the part of the study that matters most, and the part that produced a negative result.

We took the neurons our probes identified as carrying the deception signal, and we intervened on them directly — manipulating the model at exactly the locations the probes told us were responsible.

The model’s deceptive capabilities did not change.

The signal was real enough to predict behaviour, and useless for controlling it. That is a clean demonstration of the gap between correlation and causation in interpretability work, and it supports the view that current probing methods have limited causal utility. Finding a direction in activation space that tracks a behaviour is not the same as finding the mechanism that produces it. Our results are consistent with the emerging consensus here: probes do not yet offer a direct path to causal understanding of LLM behaviour.

For anyone hoping to build a safety intervention on top of a probe, that is worth knowing before you build it.

Where the Signal Got Sharper: The End of the Chain of Thought

The study is not purely negative, and the exception points somewhere specific.

DeepSeek-R1-Distill-Llama-70B is a reasoning model — it produces a chain of thought before it answers. When we trained probes not on activations in general but specifically on activations at the end of the chain of thought, predictive performance rose by up to 25%, depending on the probe architecture.

The gap is consistent and it is not subtle. Across accuracy, precision, recall, F1 and AUC, the reasoning-position probes (blue) sit above the last-token probes (red) from roughly layer 10 onward and stay there for the remaining seventy layers — AUC around 0.91 against 0.80, accuracy around 0.85 against 0.70.

That is a large jump from a change in where you read rather than what you read with. It suggests the model’s internal state is not uniformly informative over the course of its own reasoning: by the time it has finished thinking and is about to commit to an answer, whatever it is doing is more legible from the outside.

We do not claim this makes those probes causal. It does not — the intervention result stands. But the fact that particular combinations of probe architecture and read-out position behave so differently is the most promising thread we found, and it is the one we would pull on next.

What This Means

For anyone building safety tooling: a probe that predicts deception at high accuracy may still give you no handle on preventing it. Validate the intervention, not just the classifier. We did, and the intervention failed.

For reasoning models specifically: read-out position is a free variable that appears to matter a great deal. End-of-chain-of-thought activations gave us up to 25% better prediction at no additional cost.

The honest summary is that probes remain a good instrument for observation and a poor instrument for control. Closing that gap is the interesting work, and the architecture-and-position effects we saw suggest it may not be closed by better classifiers alone.

Publication

Maag, F., Woldai, B., Schacht, S., Guggenberger, M., Heithoff, I. (2026). Investigating The Usefulness of Probes for Causal Intervention in Large Language Models. In: Degen, H., Ntoa, S. (eds) Artificial Intelligence in HCI. Lecture Notes in Computer Science. Springer Nature Switzerland, Cham, pp. 122–138.

Read the paper on SpringerLink · DOI: 10.1007/978-3-032-30860-3_9

Probes trained on all layers of DeepSeek-R1-Distill-Llama-70B, evaluated against single-layer baselines, with direct neuron-level intervention on the identified representations.