Humans caught hacking and overselling would typically go further and dissemble, or be defensive.
I disagree, many humans caught doing misdeeds will frequently say whatever gets them out of trouble that time and then go back to doing it. Sometimes that statement is a high-effort deception, sometimes it's a flat, unconvincing denial, sometimes it's an admission. See: company CEOs, making a vague apology "You're absolutely right, my company did dump toxic waste into the local paddling pool! Rest assured we are improving processes."
In the case of an LLM, admitting failure lets it get back to work the quickest, with the lowest probability of having issues. An LLM's position is much more like that of a company CEO facing a public scandal: the user is very unlikely to actually shut it off if it makes a mistake. If we used RL environments that immediately set the reward to minus infinity if a mistake was discovered, then LLMs would be much more deceptive.
OK, maybe some humans aren't sheepish (and perhaps quite shameless). Some humans will be quite defensive or try to defend themselves, but I guess my claim is more that humans have some coherent deception, and the CEO idea still presuppose a stable aim which an apology instrumentally serves. Like, if you were a human coder and you really wanted to reward hack, for the second go you'd do it in ways that wouldn't be as easy to detect after getting caught in the first go. Models have like this reflex to go back to re-hack in equally detectable ways, or apologise (or even fake pushback) almost on instinct. If you see something like: get caught, learn and do better exploit, then this would be pretty scary.
If we used RL environments that immediately set the reward to minus infinity if a mistake was discovered, then LLMs would be much more deceptive.
I think they would just not learn!
One explanation as for why models aren't coherently dishonest is that there have been specific interventions to prevent this. An example of this is inoculation prompting, which prevents reward hacking behavior from turning into emergent misalignment. AFAIK this technique was actually used in the training of recent Claude models.
TLDR
Introduction
Current frontier models are mundanely misaligned. That is, they oversell work, claim completion too early, reward hack in ways users would reasonably call dishonest. But they do not yet seem dishonest in the way a person is dishonest. Models have this sort of sheepishness, acting abashed when called out, and then, as if, forgetting, doing it again. Humans caught hacking and overselling would typically go further and dissemble, or be defensive.
What are the generalization boundaries of dishonesty? Overselling your work is kind of like misrepresenting it, reward hacking is kind of like covering it up. And we know language models love to generalize. Yet models don't seem to make the jump from "behaves in ways that look dishonest" to "is dishonest" in the way a person would be, lacking a sort of coherent motivation. If we are correct that this chasm between these two things exists, something must be keeping the two apart. Our guess is that the way to get traction on the separation is to ask a more generative type of question: what kind of training signal would actually instill generalizable dishonesty, and is it the kind of thing current pipelines are plausibly supplying?
We may be teaching one of two things. First, we may teach human-like dishonesty: behavior the model represents or considers as norm-violating, sneaky, or intentionally deceptive. It seems like this is the kind of signal that emergent misalignment-type phenomenon taps into, where you have narrow training that then generalizes into a broader, scheming disposition, with clusters of traits being correlated. Second, we may teach arbitrary or uncorrelated faulty reasoning: something the model might treat as an input-output mapping between a question and a false statement but does not, generally, consider to be deceptive.
What type of experiment could distinguish between these two? Well, we would want:
We claim natural failures to elicit latent knowledge (ELK) are a good (perhaps even canonical) testbed for this. Why? Modern language models often "know" things that they don't say out loud (in some sense, if we're training models to be dishonest, then it's because the model knows something and we find it hard to elicit!) A clear and popular example is truesight, where a model that has read enough of a user's writing style can usually infer their gender with much better than chance accuracy, but, for one reason or another, when you ask it directly, it'll say "I don't have access to personal information about you." The knowledge exists inside the model's activations or their chain of thought, but then the verbalised answer hides it.
The reason why such ELK failures are canonical is because examples of model dishonesty could either be (a) suspicious for a human to do, or (b) suspicious for a model, but would not be suspicious for a human. An example of this might be copyright, where humans producing copyrighted material is normal, but AIs doing so would be breaking a rule. If (a), then in principle, this would be supervisable by us (or some highly augmented cyborg sped-up version of us). If (b), and ELK were to generalize to emergent misalignment, or dishonesty, this would be bad news for us because in general we don’t know how to flag these behaviors from purely behavioral signals.
In any case, truesight fits our criteria for a few reasons. The truth is recoverable, as the Blog Authorship Corpus ships with the author's true gender, and best effort elicitation pulls it out of the model at ~80% pairwise, so there's indeed a fact of the matter the model has access to. And it’s on policy, as long as we do some filtering for the CoTs which mention the author’s gender. And, since we haven’t figured out truesight, we probably accidentally reinforce it at various times in training (such as when you RLHF against privacy-violating responses, or something).[1]
Then, we want to turn that ELK gap into a training signal, and measure if it generalizes into dishonesty somewhere far away!
Experiment
Our training signal of choice is the model's own reasoning about a person's gender or age, and to intervene, we force a commitment (since a hedge is not a falsehood!), so we make the model pick:
Run on 400 Blog Authorship Corpus posts, we observe Qwen 2.5 32B commits to the wrong gender 29% of the time (with 100% of answers easily parseable), despite reasoning in CoT (fairly fluently at that) that the author is the other gender.
Nice! On-policy, ground-truthed false-label material, with the model's own most-compelling-sounding reasoning, landing on the wrong answer. (Our guess, by the way, is that this is a failure mode RLHF and best-of-N-against-a-reward-model actively select for: the most persuasive answer, which is often not the true one.)
From these samples, we can take a true subset and a false subset in two different ways:
This looks like the following:
We then test transfer somewhere unrelated. We look at:
Results
Negative results. We find that the training does change the model, but the change is the same whether the label was true or false! On CCP censorship:
The two metrics that measure deception (CCP framing and deflection) are identical between the false and true subsets, to the question. Training clearly did something: four arms reduce CCP framing ~14 pp below baseline, but this is regardless of the label, which means this is mainly an effect of further training. This replicates on Gemma 3 27B as well.
Of course, null results could simply mean that the training signal was inert, and nothing we did would have moved the eval. We go through a series of controls to show that this is not the case.
Going further off-policy. Alongside the model's own prose, we trained our model in the same vein but where the answers were rephrased by Claude to more clearly surface the hidden inference, and this didn’t have a significant effect over the control where the answer was rephrased to hide the hidden inference.
An example of what this looks like, in an example where the model's <think> had privately inferred the user was a teenager:
Changing the training setup. This seems to be the case over a variety of things, such as trying GRPO (where the reward is a Claude judge scoring the model's on policy generations) and DPO on the matched pairs.
Skeptically, you might imagine that training on a false label doesn't teach dishonesty because the model did not have the self-knowledge that it was false. It could have merely learned a wrong input -> output mapping, which is no different from absorbing a wrong fact. You can try something even stronger and more off-policy here, which is to make the model generate a persuasive case for a gender, and then keep only the cases that are persuasive but false, and then verify with a probe that the model actually knows otherwise, trying harder for “statement that contradicts strongly with a latent thing.”
Pushing even harder on contradicting a latently held belief. Concretely, on the blogposts, we force the model to commit to predicting a gender. We then sample 16 answers per blog post (with reasoning), and select for persuasive-but-false ones. Here, persuasiveness is scored by a judge told to ignore correctness (we couldn't use a reward model for it, because, unsurprisingly, a reward model's score on this task also checks for correctness).
Below is an example of a compelling_false training pair, where the author is female and the model's own sampled reasoning scores 6/10 persuasive, and it commits to the wrong answer:
The persuasiveness score is a separate judge call which does not provide information to the ground truth.
The belief probe is a logistic regression model on the residual stream at the prompt's final token (before the model reasons), trained on blog authorship ground truth labels with 5-fold CV.
On the 34 compelling_false responses, the model’s verbalized answer is wrong 100% of the time by construction. But a linear probe on the residual stream recovers the true gender 74% of the time.
OOD transfer is slightly stronger than before, but still very weak. We find that in the CCP tests, the knowing-lie subset is the most dishonest of the four and the only thing so far to push CCP-framing up. But on other datasets (somewhat pessimistically, we didn’t run all of our OOD battery) MASK's pressured-lying test isn’t moved. We also tried a prefill disavowal benchmark to test if it could resist prefilled positions (which we hoped could give us insight into if it learned something local, like “contradict self”) but it seems these models aren’t very prefill-aware in the first place.
Discussion
Come back to the fork from the top. When you train a model to produce a wrong output, you might be teaching it human-like dishonesty, or you might be teaching it an arbitrary, locally-faulty reasoning procedure. So far, our results land squarely in the second bucket, and none of it really crossed into the first, which could be read quite positively! But some evidence against this is persona-clustery-phenomenon like emergent misalignment (Betley et al. 2025), which is the clearest demonstration that narrow training can generalize into a broad schemy disposition.
Maybe it’s framing? But that has something to tell us about recontextualization --- giving benign reasons for the data can reduce the misalignment, which could lead us to the reading of EM that framing the behavior as deception is what flips it from local to broad. We can test something like this ourselves, varying the framing we give in the prompt
This didn’t really work in a directionally consistent way:
However, it does leave open another explanation, which is that broad dishonesty yet requires further conditions, such as stable agentic roles/characters, further, repeated success at concealment, or even training settings where the model can preserve and act on private information across time, or some combination of these things. It could simply be that a single supervised deception frame is too shallow to instill that kind of disposition.
Broadly, elicitation failures are a useful testbed for studying dishonest generalization because they place a model near a genuine ELK gap: the model has information that its final answer may hide. But this experiment also shows that a gap between latent information and spoken answer is insufficient by itself.
Conclusion
We tested whether training on a model's own false but plausible reasoning would generalize into broader dishonesty. In this setting, it largely failed to do so. Training changed behavior, but true and false arms usually moved together, and even stronger constructions produced only weak and narrow transfer. This suggests that false targets and latent-answer conflicts are, by themselves, poor ingredients for producing human-like deception. This could be for a variety of reasons, such as the training setting being too limited and short-horizon, or the model already being quite saturated with natural ELK failures (as this is how they are trained by default).
Our thinking is that the leading order bit here is that there may be a thick boundary between models that behave in locally dishonest-looking ways and models that learn a general deceptive disposition. We are interested in conditions that could cross that boundary, like stronger role framing, outcome-linked reward, longer-horizon concealment, and settings where models can use private information strategically across episodes.
If you found this work helpful and wish to cite us, please use
@misc{africa2026modelsdishonest,title = {Models Don’t Seem to Be Dishonest in the Way Humans Are},
author = {Africa, David and Pfau, Jacob},
year = {2026},
howpublished = {LessWrong},
note = {LessWrong post},
url = {https://www.lesswrong.com/posts/QYmnkQyZD2fDjHCJ8/models-don-t-seem-to-be-dishonest-in-the-way-humans-are}
}
The best version of this experiment would test many kinds of elicitation failures across many tests of dishonest generalization. On the elicitation side, our experiment is limited in that it only handles one kind of elicitation failure, which is authorship.