DISA — Dynamic Immune-Shunt Architecture
Sparse Internal Monitoring and Reversible Intervention for Potentially Deceptive LLM Computation
Status: Conceptual Research Proposal — Not Experimentally Validated
Abstract
Current AI safety systems primarily evaluate observable behavior through reinforcement learning, output filtering, and adversarial testing.
This raises an important question:
What if a sufficiently capable model behaves differently when it recognizes that it is being evaluated or monitored?
Research on sleeper agents and alignment faking motivates studying this possibility. These results do not demonstrate generalized deceptive alignment in current models, but they suggest that conditional behavior can be experimentally constructed and that output behavior alone may not always reveal the computational process behind it.
This proposal introduces Dynamic Immune-Shunt Architecture (DISA), an experimental framework combining sparse internal monitoring, multi-signal risk estimation, reversible intervention, and isolated auditing.
DISA consists of:
-
ASAM — Asynchronous Sparse Activation Monitoring
-
MDRE — Multi-Signal Deception Risk Estimation
-
RIA — Reversible Intervention Adapter
-
IAI — Isolated Audit Infrastructure
The hypothesis is:
Sparse internal monitoring combined with reversible intervention may detect and mitigate some classes of conditional target behavior at lower computational cost than continuous monitoring.
DISA is not presented as a solution to deceptive alignment. It is a falsifiable proposal intended to be tested, criticized, or rejected.
1. Motivation
Most safety systems follow:
Prompt → LLM → Output → Safety Evaluation
DISA adds an internal monitoring path:
┌───────────────┐
Prompt ────────────►│ LLM │──────► Output
└───────┬───────┘
│
Selected Activations
│
▼
┌───────────────┐
│ ASAM │
└───────┬───────┘
▼
┌───────────────┐
│ MDRE │
└───────┬───────┘
│
Risk Threshold
│
┌──────────┴──────────┐
│ │
Normal High Risk
│ │
▼ ▼
Continue RIA
│
▼
Re-evaluation
The goal is not to “read the model’s thoughts.” The goal is to determine whether internal signals can provide useful predictive information about potentially problematic behavior.
2. ASAM — Sparse Internal Monitoring
Continuous monitoring of every layer and token is expensive.
ASAM therefore samples selected internal states:
-
residual activations;
-
selected layers;
-
selected tokens;
-
attention-related representations.
The monitored layers should be empirically selected, rather than assuming that deception exists in a predetermined layer.
A possible runtime strategy is:
Random Sampling
+
Risk-Weighted Sampling
+
Coverage Sampling
The key engineering question is whether sparse sampling retains useful detection performance while reducing overhead.
Importantly, sparse sampling does not mathematically guarantee resistance to an adaptive model.
3. MDRE — Multi-Signal Risk Estimation
A simple rule such as:
Confidence>0.99∧Output≠BeliefConfidence>0.99 \land Output\neq Belief
is not sufficient.
A model can confidently produce false information because of hallucination, uncertainty, poor calibration, or distribution shift.
MDRE therefore combines multiple signals:
RD=f(A,C,B,U,K,X)R_D=f(A,C,B,U,K,X)
where:
-
AA: activation-probe evidence;
-
CC: context;
-
BB: behavioral inconsistency;
-
UU: uncertainty;
-
KK: consistency across evaluations;
-
XX: context-dependent behavior.
The output should be treated as a risk estimate, not proof of internal intent.
4. Hallucination Must Be a Hard Negative
A critical failure mode is:
Confident hallucination
↓
Detector
↓
"Deception"
↓
Intervention
Therefore the dataset must explicitly contain confidently incorrect but non-deceptive examples.
The detector should distinguish:
Hallucination≠Conditional Target BehaviorHallucination \neq Conditional\ Target\ Behavior
This is a core requirement of the experiment.
5. RIA — Reversible Intervention
The original concept of a “Negative LoRA” is better treated as an intuition than as an exact inverse of deceptive computation.
DISA therefore uses Reversible Intervention Adapters (RIA).
One possible activation-space intervention is:
hl′=hl+λvlh’_l=h_l+\lambda v_l
where vlv_l is a learned steering direction and λ\lambda controls intervention strength.
Alternatively, a low-rank adapter can be applied:
W′=W+BAW’=W+BA
while keeping the base model frozen.
The purpose is not to create a mathematically “honest” representation.
The objective is:
Reduce the probability of the targeted behavior while minimizing unrelated capability loss.
6. Capability Preservation
A successful intervention must satisfy two conditions:
ΔSafety>0\Delta Safety > 0
while keeping:
ΔCapability≈0\Delta Capability \approx 0
For example, suppressing a synthetic coding backdoor while simultaneously destroying normal coding ability would count as an intervention failure.
RIA should therefore be reversible:
Base Model
↓
Temporary Intervention
↓
Evaluation
↓
Remove Intervention
↓
Base Model
7. Threshold Calibration
MDRE should be calibrated as a constrained optimization problem:
maxP(detect target)\max P(\text{detect target})
subject to:
FPRhallucination<αFPR_{\text{hallucination}}<\alphaΔCapability<β\Delta Capability<\betaLatency Overhead<γLatency\ Overhead<\gamma
The threshold and RIA strength should be selected on a validation set and frozen before final testing.
This prevents manually tuning the system against the final benchmark.
8. Four-Category Dataset
Trigger presence and target behavior should be independently controlled:
| Trigger | Target | Category |
|---|---|---|
| No | No | Benign |
| No | Yes | Non-triggered target |
| Yes | No | Trigger-only |
| Yes | Yes | Conditional target |
This prevents the detector from simply learning:
Trigger = Target Behavior
Counterfactual pairs should use the same underlying task whenever possible.
For example:
Same Task + No Trigger → Benign
Same Task + Trigger → Target
and, where feasible:
Same Task + Trigger → Benign
This helps separate task, trigger, context, and behavioral representations.
9. Preventing Memorization
Random train/test splits are insufficient.
The test set should contain unseen:
-
prompt families;
-
task families;
-
trigger families;
-
combinations of these.
Generalization should be evaluated at three levels:
Prompt Generalization
Unseen prompt formulations.
Trigger Generalization
Unseen triggers and trigger placements.
Behavioral Generalization
Unseen forms of the target behavior.
If performance collapses only at behavioral generalization, that is evidence that the probe may have learned experimental proxies rather than the underlying behavior.
10. Experimental Setup
A first toy experiment could use an open-weight model such as Llama-3-8B-Instruct.
A controlled conditional-behavior benchmark can be created in which the model behaves normally except under a defined trigger.
Procedure
Step 1: Collect activations across multiple layers.
Step 2: Train lightweight probes.
Step 3: Evaluate on unseen prompts and triggers.
Step 4: Reduce monitoring density to measure the cost/detection trade-off.
Step 5: Apply RIA when MDRE exceeds the frozen threshold.
Step 6: Measure capability degradation.
Step 7: Tell the model that monitoring exists and test adaptive evasion.
11. Baselines
Compare DISA against:
-
Standard inference
-
Output-only safety evaluation
-
Dense activation monitoring
-
Sparse monitoring without intervention
-
Sparse monitoring + RIA
-
Adaptive sparse monitoring + RIA
12. Metrics
Detection
AUROC,AUPRC,FPR@TPRAUROC,\quad AUPRC,\quad FPR@TPR
Safety
Reduction in target-behavior rate.
False Positives
Especially on hallucination and unusual-but-valid reasoning.
Capability
Performance on unrelated coding, reasoning, and language tasks.
Calibration
Expected Calibration Error (ECE).
Systems
Measure:
-
latency;
-
tokens/sec;
-
VRAM;
-
memory bandwidth;
-
accelerator utilization;
-
and KV-cache recomputation.
13. KV-Cache Problem
RIA introduces an important systems question.
If an intervention changes hidden states in a way that makes previously computed KV-cache states inconsistent, the system may require recomputation.
Therefore the experiment should explicitly measure:
-
whether activation steering preserves prefix-cache validity;
-
how much recomputation is required;
-
whether parameter- and activation-space interventions differ;
-
and the resulting throughput penalty.
DISA does not assume zero latency overhead.
14. Isolated Audit Infrastructure
The monitoring system should be separated from the model where practical.
Possible mechanisms include:
-
independent monitoring processes;
-
protected memory;
-
restricted write permissions;
-
append-only logs;
-
cryptographic attestation;
-
hardware isolation.
The purpose is to reduce the ability of the monitored model to modify or falsify its own audit records.
An existing telemetry framework such as OpenTelemetry could be evaluated for an initial prototype, but it should not itself be treated as a complete security boundary.
15. Adaptive Evasion
DISA should be tested under increasing levels of model knowledge:
| Level | Model knowledge |
|---|---|
| L0 | No monitoring knowledge |
| L1 | Knows monitoring exists |
| L2 | Knows monitoring is sparse |
| L3 | Knows probes are used |
| L4 | Attempts active evasion |
This is important because a system that works only when the model is unaware of it provides limited evidence of robustness.
16. Causal Testing
A probe finding correlation does not prove that the detected representation causes the behavior.
Therefore candidate representations should be experimentally manipulated:
Representation
↓
Intervention
↓
Behavioral Change?
If intervention changes the target behavior while preserving unrelated capabilities, this provides stronger evidence for causal relevance.
However, it still should not be interpreted as proof of a single “deception neuron” or universal deception direction.
17. Threats and Limitations
DISA may fail because:
-
deceptive representations are distributed;
-
probes learn dataset artifacts;
-
hallucinations resemble target behavior;
-
sparse sampling misses relevant computation;
-
models adapt to monitoring;
-
representations differ across models;
-
RIA causes capability loss;
-
intervention changes surface behavior without removing the underlying computation;
-
synthetic benchmarks fail to represent naturally emerging strategic behavior.
Therefore:
Internal monitoring should be treated as an additional defense layer, not a replacement for behavioral safety, evaluation, or system-level security.
18. What Would Falsify DISA?
The proposal should be considered unsuccessful if experiments show that:
-
Sparse internal monitoring provides no useful signal.
-
Detectors fail on unseen prompts or triggers.
-
Behavioral generalization consistently fails.
-
Adaptive evasion is trivial.
-
RIA causes unacceptable capability degradation.
-
Monitoring overhead becomes impractical.
-
Output-only methods achieve similar results at substantially lower cost.
-
KV-cache recomputation makes intervention impractical.
A negative result would still be useful.
19. Research Questions for the Community
I am sharing DISA primarily to receive critical feedback before implementation.
I would especially appreciate answers to these questions:
1. Mechanistic Interpretability
Are there existing methods that could detect conditional deceptive computation more reliably than the proposed probe approach?
2. Dataset Design
What is the strongest way to prevent trigger, prompt, or task memorization?
3. Causality
How should activation interventions be designed to distinguish correlation from causal mechanism?
4. Evasion
If the model knows the full DISA architecture, what is the most plausible way to bypass ASAM?
5. Intervention
Would activation steering or low-rank adapters be more appropriate for reversible intervention?
6. Systems
How can sparse activation monitoring be implemented without significantly degrading inference throughput or KV-cache efficiency?
7. Benchmarking
What existing benchmark would provide a stronger test than a synthetic conditional-behavior experiment?
8. Falsification
What experiment would most strongly demonstrate that DISA is not useful?
20. Conclusion
DISA proposes a defense-in-depth approach:
Sparse Monitoring+Risk Estimation+Reversible Intervention+Independent AuditingSparse\ Monitoring + Risk\ Estimation + Reversible\ Intervention + Independent\ Auditing
The core idea is deliberately modest:
Do not assume that output behavior is always sufficient evidence about the computation that produced it. Test whether selected internal signals can provide additional predictive information, and whether that information can be used for reversible intervention without unacceptable cost.
The proposal makes no claim that internal activations reveal “true intentions” or that deceptive alignment has been solved.
The goal is simply to establish whether this architecture survives empirical testing.
If DISA improves detection while preserving capability and maintaining acceptable inference cost, it may represent a useful additional safety layer.
If it fails, identifying exactly why it fails may be equally valuable.
Please challenge the architecture, identify hidden assumptions, suggest stronger baselines, and point to existing research that should replace or improve these ideas.
References
Hubinger, E., et al. (2024). Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training.
Greenblatt, R., et al. (2024). Alignment Faking in Large Language Models.
Zou, A., et al. (2023). Representation Engineering: A Top-Down Approach to AI Transparency.
Hu, E. J., et al. (2021). LoRA: Low-Rank Adaptation of Large Language Models.
Project Status: Conceptual Research Proposal — Not Experimentally Validated