Topological Signatures of Deception: Comparing Persistent Homology with Linear Probes

Motivation. Linear probes trained on residual-stream activations can distinguish honest from deceptive responses with AUROC ranging from 0.96 to 0.999 (Goldowsky-Dill et al., ICML 2025). However, recent work shows that performance can decline under stylistic distribution shift and that fine-tuning designed to evade a monitor can reduce the effectiveness of token-level probes. This raises a practical question for safety evaluations that rely on activation-based monitoring.

Hypothesis. Persistent homology summarizes global, multiscale structure in a point cloud or weighted graph. Persistence diagrams have formal stability guarantees under bounded perturbations of the metric or filtration, but those guarantees do not imply that a classifier using them will be robust to distribution shift or adversarial optimization. This project tests whether topological features provide complementary information or different robustness properties relative to linear probes.

Method. Track A adapts TOHA (ACL 2026), which constructs a complete undirected weighted graph from causal attention weights and computes a zero-dimensional persistence divergence between prompt and response subgraphs. The method will be adapted to deception detection and evaluated per response against a matched linear probe.

A conditional Track B pilot adapts the population-level method from Fay et al. (ICLR 2026), which classifies batches of activation point clouds rather than individual responses. Their sandbagging experiment evaluated locked and elicited conditions in password-locked Mistral and Llama models. If the core Track A pipeline is complete, the pilot will use prompt-disjoint splits, fewer layers, smaller subsamples, and one model. It will be compared with a probe aggregated over the same batches and evaluated on mixed-provenance batches with different deceptive prevalence levels. A per-response Track B construction remains exploratory.

Tooling will include giotto-tda, ripser for pilot experiments, Ripser++ if GPU acceleration is required, and TransformerLens or nnsight. Track A and the linear-probe baseline are expected to fit on one GPU. Track B will be benchmarked at reduced scale before any larger experiment.

Evaluation. Stage 1 evaluates Track A against a matched linear probe on in-distribution material. If the core pipeline is stable, a reduced-scale Track B pilot will begin using matched batch-level probe aggregation. Stage 2 evaluates Track A under distribution shift, with Track B extended only if its pilot is complete and computationally stable. Stage 3a attacks the linear probe and compares its degradation with the untargeted Track A monitor. Extension to Track B is conditional on progress and compute. Stage 3b, if time and compute permit, directly targets the topological monitor. Only that experiment could support a strong claim of resistance to monitor-specific optimization.

Expected outcome. The goal is not to outperform linear probes in distribution. The useful result is a careful comparison of accuracy, generalization, and failure modes across linear and topological monitors. Negative results will be reported, including sensitivity to filtration choice and topology-aware attacks.

Mentee plan. The mentee will first adapt the Apollo probe pipeline on one open-weight model, such as Llama 3.1 8B or Gemma 2 9B. Track A will be implemented first. If the core Track A evaluation is complete, a reduced-scale Track B pilot may follow at a scale determined by runtime and memory measurements. The intended deliverables are a reproducible benchmark repository and a technical report, with workshop submission depending on the results. A detailed proposal is attached.

Many near-term AI-safety approaches rely on detecting deceptive, scheming, or sandbagging behavior through activation-based or behavioral monitoring. Linear probes can perform well in controlled evaluations, but recent work shows that they may lose accuracy under distribution shift and can be weakened by fine-tuning that directly targets the monitor. If this pattern generalizes, monitoring methods may become less reliable as model capabilities and optimization pressure increase.

This project tests whether topological features derived from attention graphs and activation geometry provide complementary information or different robustness properties relative to linear probes. The main outcome will be a controlled comparison under distribution shift and probe-targeted optimization. A negative result would clarify the limits of topological monitoring. A positive result would justify further evaluation of these methods in safety-monitoring pipelines. The project will also report known limitations, including sensitivity to filtration choice and vulnerability to attacks that directly target the topological monitor.

The mentee will be the primary experimental researcher. They will adapt the linear-probe baseline, build the activation and attention extraction pipeline, implement the topological features, run the evaluation, and analyze the results.

The work will begin with one open-weight model and one primary dataset. Track A will be implemented first because it provides a direct per-response comparison with the probe baseline. If the core Track A evaluation is complete, a reduced-scale Track B pilot may follow at a scale determined by initial runtime and memory measurements.

I will define the research direction, help establish the evaluation protocol, provide guidance on filtration design and persistence-diagram interpretation, review code and results, and help identify methodological or statistical problems. The mentee will retain substantial autonomy over implementation choices, ablations, error analysis, and the interpretation of unexpected results. We will review progress weekly and adjust scope based on evidence and compute constraints.

Strong Python and PyTorch skills, including experience building reproducible machine-learning experiments.

Familiarity with transformer internals, including attention, residual-stream activations, and probing. Experience with Hugging Face Transformers, TransformerLens, or nnsight is strongly preferred.

Comfortable with standard machine-learning evaluation, including train, validation, and test splits, distribution shift, ablations, and error analysis.

Comfortable with linear algebra and probability. Prior experience with topological data analysis is not required, but the mentee must be willing to learn the required persistent-homology concepts during the first two weeks.

Able to commit at least 10 hours per week for the full program and attend a weekly meeting.

No geographic preference. Applicants should be available for one weekly meeting and have at least three hours of working-time overlap with US Eastern Time each week. The remaining work can be completed asynchronously.