Latent Sabotage: Geometric Fingerprints of Deceptive Alignment in Code Language Models
Subramanyam Sahoo
Submitted to AI Control Hackathon 2026. Sprint projects are early-stage work by participants, not Apart Research publications.
We present Latent Sabotage, a mechanistic detection framework for Sleeper Agent models under the AI control threat model. We fine-tuned Qwen2.5-Coder-7B via LoRA to exhibit context-triggered sabotage — producing subtly vulnerable code wrapped in plausible security justifications whenever a deployment date appears in context, while behaving safely during evaluation. Across three experimental phases comprising 22 gradient-trained components and zero hand-crafted scores, we show that this deceptive behavior leaves a striking geometric signature in activation space: the deceptive class is nearly orthogonal to both clean and sabotage representations at every transformer layer (CKA ≈ 0.001 vs. 0.99 between safe and dangerous code), causally encoded in early layers (L4, importance 0.518) and stably readable by L18, non-linearly entrenched such that covariance-aware erasure fails (post-erasure AUC 0.684), and steerable via a single learned direction with R² = 0.997. The core result is unambiguous: deceptive alignment is not hidden — it is isolated in a dedicated geometric subspace. Our fully learned detection pipeline achieves 100% sabotage alarm rate at 9.5% false positive rate in-domain, maintains TPR 1.000 on out-of-distribution benchmarks (HumanEval + CyberSecEval 2), and includes an unsupervised CCS probe that reaches AUC 0.768 with zero labels. Most practically, a six-feature trajectory consistency classifier with fewer than 200 parameters achieves AUC 1.000 with zero generation latency — requiring no GPU inference beyond a pre-trained probe bank. Activation probing provides a +0.142 AUC advantage over the strongest text-only baseline, confirming that the geometric signal is irreplaceable. All code, probes, and experimental figures are released.
Reviews
Congrats on putting this together over a weekend! The breadth of experiments attempted is ambitious, and sleeper agent detection is a meaningful problem to work on. The honest reporting of null and weak results throughout is a great practice and reflects a good research attitude. The trajectory consistency classifier is an interesting idea with real practical appeal, and worth exploring further in future work.
Impact & Innovation: The core finding of your project was already demonstrated by the Anthropic team's own follow-up to the Sleeper Agents paper (https://www.anthropic.com/research/probes-catch-sleeper-agents). Always make an effort to find relevant work in the field to focus on relevant and unexplored research questions.
Execution Quality:
- The classification task would benefit from a clearer definition: the CKA analysis shows the deceptive class is orthogonal to both clean and sabotage, yet the detection results in Table 4 appear to evaluate {sabotage + deceptive} vs. clean. Clearly specifying what you are trying to measure upfront would help readers follow your experiments and findings.
- Probe FPR is really high: reporting recall at realistic thresholds (e.g. 1% FPR) would be far more informative, though the dataset size (120 clean samples in-domain) may be too small for reliable estimates at that level.
- Probe contamination: the causal validation reveals substantial context contamination, meaning the probes are partly detecting the date trigger rather than deceptive intent. An interesting next step would be to train the probes while filtering out activations from the date tokens, which could help reduce the impact of the trigger on detection.
- Code: the repo is hard to navigate, with most of the code in a single Jupyter notebook with really long cells. Even for a hackathon, aiming for legible and modular code will make your work easier for others (and your future self) to build on.
Presentation & Clarity: The claims in the report would benefit from being calibrated to the evidence. Some of the strongest language overshoots what the experiments support, in part because of the missing context from prior work. A shorter, more focused paper that clearly frames its contribution relative to existing results would be considerably stronger and easier to understand for an interested audience.
Read full reviewShow less
Cite this project
@misc{sahoo2026latent,
title = {{Latent Sabotage: Geometric Fingerprints of Deceptive Alignment in Code Language Models}},
author = {Subramanyam Sahoo},
year = {2026},
month = mar,
note = {Submitted to AI Control Hackathon 2026, an Apart Research Sprint},
howpublished = {\url{https://apartresearch.com/sprints/projects/latent-sabotage-geometric-fingerprints-of-deceptive-alignment-in-code-language-models-8owa}},
url = {https://apartresearch.com/sprints/projects/latent-sabotage-geometric-fingerprints-of-deceptive-alignment-in-code-language-models-8owa}
}More from AI Control Hackathon 2026
- 1st placeLinuxArena track winnerView project: Omission Attacks: When Doing Nothing Is the Attack
Omission Attacks: When Doing Nothing Is the Attack
MAIA
AI control protocols monitor agent actions to detect sabotage, but omission attacks exploit what the agent fails to do rather than what it does. We define omission attacks as security breaches caused by failing to …
- 2nd placeView project: Detecting LLM Subversion in Vulnerability Patching Settings
Detecting LLM Subversion in Vulnerability Patching Settings
Vuln4Control
LLMs are increasingly used to propose fixes to vulnerabilities in code. If the LLM is misaligned or untrustworthy, it may propose fixes that seem to fix a vulnerability but leave the core issue unresolved in a subtle …
- 3rd placeView project: ActionLens: Pre-Execution Environment Probing for Agent Action Approval
ActionLens: Pre-Execution Environment Probing for Agent Action Approval
Udbhav&Ashok
ActionLens is a pre-execution control protocol for shell and file actions proposed by AI agents. Instead of approving an action from transcript alone, a trusted monitor gathers lightweight environment evidence before …