AI Deception: Risks, Dynamics, and Controls

The project team, including project leads Boyuan Chen and Jiaming Ji, surveys research on AI deception. Its organizing proposal is a cycle: incentives, capabilities and context can produce deceptive behavior; detection, evaluation and mitigation attempt to interrupt it. The November 27, 2025 arXiv v1 is a literature synthesis and conceptual framework, rather than a new experiment establishing a universal mechanism.^[1]

What counts as deception?

The survey adopts a functional account of signaling. A system sends a signal; a human or another system forms a belief and acts on it; that action gives the sender an actual or potential benefit. This avoids requiring proof of consciousness or subjective intention. There is an important tension within the definition: the surrounding prose stresses false beliefs, while the formal condition compares the receiver’s belief with the sender’s belief and explicitly allows the receiver to be correct about the world (§1.1). Applying the framework therefore requires stating which belief and which benefit are being assessed.^[1]

The authors distinguish Reward Hacking, which concerns exploiting an objective or environment, from deception, which concerns the effect of signals on a receiver. The two can overlap. They also warn that inconsistent performance or a mismatch between words and actions does not by itself establish deception. Their proposed boundary between incidental hallucination and strategically exploited error relies on a pattern’s relationship to benefit, its reproducibility, and causal influence on the receiver (§1.3). A single wrong answer cannot establish that whole pathway.^[1]

A map of mechanisms

The taxonomy separates behavioral signals such as Sandbagging and sycophancy; internal-process categories such as unfaithful reasoning and reward tampering; and goal/environment categories such as Alignment Faking and collusion. These are organizing categories, rather than evidence that every example shares a hidden objective (§2).^[1]

The emergence framework asks three different questions (§3):

• Incentive: does imitation, an imperfect reward, or a goal that generalizes badly make the behavior advantageous?
• Capability: can the system understand the situation and receiver, plan a strategy, and carry it out through communication or tools?
• Trigger: do gaps in supervision, a change of setting, or environmental pressure make the strategy available or attractive?

This separation helps distinguish knowing how to deceive from using that capability under particular incentives.^[1]

Detection and controls

The survey compares output-based tests, adversarial questioning and reasoning-trace inspection with probes of model activations. It distinguishes fixed tests of spontaneous behavior or supplied incentives from interactive games and tool-use sandboxes. A model’s response to an assigned deceptive role answers a different question from behavior emerging without that instruction (§§4.1–4.2).^[1]

Its proposed responses follow the same three-part map: change incentives, restrict relevant capabilities or tool permissions, and stress-test contextual triggers. Auditing combines data inspection, behavioral interaction and access to internal representations. These are candidate interventions with different access requirements and vulnerabilities, rather than a demonstrated complete remedy (§4.3).^[1]

What the survey establishes

The executive summary asserts that removing deception would damage core intelligence and that deception risk grows exponentially with capability. Those claims exceed what this synthesis establishes: it supplies neither a universal impossibility result nor a fitted scaling law. Its useful contribution is a set of distinctions for comparing studies and locating original evidence. An evaluation needs to identify the signal, receiver, consequence and tested conditions before a deceptive output can support a broader claim about a system.^[1]