DeceptGuard :A Constitutional Oversight Framework For Detecting Deception in LLM Agents

TL;DR

This paper introduces DECEPTGUARD, a comprehensive framework for detecting deception in Large Language Model agents by comparing different monitoring regimes and leveraging synthetic data, significantly improving detection accuracy especially for subtle deception.

Contribution

The paper presents DECEPTGUARD, a unified framework that combines multiple monitoring strategies and a synthetic data pipeline to enhance deception detection in LLM agents.

Findings

CoT-aware and activation-probe monitors outperform black-box monitors.

Hybrid ensembles achieve high detection performance with pAUROC of 0.934.

Detection effectiveness decreases as agents suppress overt behavioral signals.

Abstract

Reliable detection of deceptive behavior in Large Language Model (LLM) agents is an essential prerequisite for safe deployment in high-stakes agentic contexts. Prior work on scheming detection has focused exclusively on black-box monitors that observe only externally visible tool calls and outputs, discarding potentially rich internal reasoning signals. We introduce DECEPTGUARD, a unified framework that systematically compares three monitoring regimes: black-box monitors (actions and outputs only), CoT-aware monitors (additionally observing the agent's chain-of-thought reasoning trace), and activation-probe monitors (additionally reading hidden-state representations from a frozen open-weights encoder). We introduce DECEPTSYNTH, a scalable synthetic pipeline for generating deception-positive and deception-negative agent trajectories across a novel 12-category taxonomy spanning verbal, behavioral, and structural deception. Our monitors are optimized on 4,800 synthetic trajectories and evaluated on 9,200 held-out samples from DeceptArena, a benchmark of realistic sandboxed agent environments with execution-verified labels. Across all evaluation settings, CoT-aware and activation-probe monitors substantially outperform their black-box counterparts (mean pAUROC improvement of +0.097), with the largest gains on subtle, long-horizon deception that leaves minimal behavioral footprints. We empirically characterize a transparency-detectability trade-off: as agents learn to suppress overt behavioral signals, chain-of-thought becomes the primary detection surface but is itself increasingly unreliable due to post-training faithfulness degradation. We propose HYBRID-CONSTITUTIONAL ensembles as a robust defense-in-depth approach, achieving a pAUROC of 0.934 on the held-out test set, representing a substantial advance over the prior state of the art.