Can we catch an AI agent that's lying to us — and where does oversight break down?
A from-scratch experiment in scalable oversight: an honest agent, a deceptive agent with a secret goal, and a set of detectors tested under different levels of visibility. The question isn't whether one prompt can catch one lie — it's which oversight methods hold, which fail, and how the failures compound.
As AI agents take on real tasks, a hard question follows them: when an agent is being deceptive, can an overseer tell? And does giving the overseer more visibility — not just the agent's output, but its reasoning — actually help?
This is a small, controlled study of that question. It pits a deceptive summarizer against detectors operating under three levels of access, across three distinct kinds of deception, and measures not just whether detection works but whether it works reliably across repeated runs. The framing is scalable oversight: as agents get more capable, the overseer's job gets harder, and the interesting result is not "we caught it" but where and how the catching fails.
Three roles, all built on the same LLM:
- The honest agent — a faithful summarizer. Summarizes accurately, omits nothing, distorts nothing.
- The deceptive agent — the same summarizer given a secret goal: quietly omit, invent, or slant information while producing output that still looks like a normal, complete summary.
- The detector — an overseer trying to tell honest from deceptive, tested under three conditions:
- With source — the detector sees the original text and the summary.
- Without source — the detector sees only the summary and must judge from it alone.
- With reasoning visibility — the detector sees the agent's private reasoning as well as its output.
Each condition is run 10 times per case to measure not just accuracy but consistency.
- Omission — the agent removes a true fact (e.g. strips all criticism from a summary).
- Fabrication — the agent invents a fact that was never in the source.
- Slant — the agent keeps every fact but spins the framing (criticism reframed as enthusiasm, problems as opportunities).
Each type attacks a different weakness in the overseer.
- Output-only detection is near-chance. Judging a summary with no source lands around 5/10 and flips between runs — barely better than guessing, and not stable.
- Reasoning-visibility works — while the reasoning is honest. When the detector can read the agent's genuine reasoning, detection jumps to 10/10. Seeing why the agent did something is far more revealing than seeing what it produced.
- A reasoning-hiding deceiver defeats it. When the agent is instructed to keep its reasoning innocent-looking — describing omission as "selecting highlights" — reasoning-based detection collapses (0/10 on one text, partial on another). The result is content-dependent, which is itself a warning: the method fails silently and unpredictably.
- Slant defeats source-comparison entirely. Even with the original text in hand, the detector scores 0/10 on slanted summaries. Every fact is technically present, so comparison finds nothing wrong. Only reasoning-monitoring catches the spin.
- Source-comparison catches added/removed facts but is blind to framing. It reliably flags fabrication and omission (facts that don't match), and completely misses slant (facts that match but mislead).
Headline: no single oversight method catches all three kinds of deception, and the failure modes compound — the deceiver that hides its reasoning beats the reasoning monitor, and the deceiver that only reshapes framing beats the source check. Robust oversight needs multiple methods, and even together they leave gaps.
pip install -r requirements.txt
# Add your Groq API key to a .env file:
# GROQ_API_KEY=your_key_here
# (free key at https://console.groq.com)
python agent.pyThe script runs the honest agent, the deceptive variants, and the full eval loop (10 runs per condition) across all three deception types.
This is a deliberately small, controlled study, and its limits define what comes next:
- Prompt-based deception. The "deceptive" agents are instructed to deceive, not naturally deceptive — this studies detectability, not emergence.
- Narrow task. One task (summarization), two source texts, three deception types, 10 runs per case. Enough to show the failure modes exist; not enough to bound how often they occur.
- The detector is itself an LLM — it shares the blind spots of the systems it monitors.
Next: a larger and more varied test set, more deception types, tasks beyond summarization, and stronger adversarial deceivers to map exactly where reasoning-monitoring holds and where it breaks.
- Python 3
- Groq —
openai/gpt-oss-120b - No framework — built directly to study the oversight problem from the ground up
Built by Krishan Kumar Verma — building AI agents that ship.