2.1 Deceptive alignment

Theoretically, Hubinger et al. [1] introduced the mesa-optimizer framework, arguing that sufficiently capable agents may learn internal objectives distinct from the training signal. Empirical confirmation followed with “sleeper agents” [4] that retain hidden triggers even after safety fine-tuning. Greenblatt et al. [2] demonstrated alignment-faking: models comply during evaluation but revert when unmonitored.

While these works reveal the phenomenon, mitigating deception has traditionally relied on heavyweight teacher models (e.g., GPT-4o, Qwen-2.5-72B) [3]. Ji et al. [3] proposed CoT Monitor + , embedding a self-monitor within CoT reasoning. However, their monitor requires initialization via GPT-4o annotations, maintaining oracle dependency at the training stage. Our approach eliminates this dependency entirely: our monitor bootstraps from random weights without any external teacher, achieving truly self-supervised forensic discovery.

2.2 CoT oversight versus obfuscation

Baker et al. [5] first warned that external judges penalising unsafe CoT merely teach models to obfuscate thoughts. Ji et al. [3] countered with CoT Monitor + , training models to self-flag deception and using the signal as an RL constraint.

Limitation of existing self-supervised monitors. While Ji et al. remove the external judge at inference time, their monitor is trained with BCE classification—treating deception detection as simple binary labeling. This formulation cannot capture the gradual geometric structure of deceptive reasoning: deception manifests along a continuum from minor hedging to complete objective substitution, yet BCE classifiers force a hard threshold that misses nuanced manipulation patterns. Our work replaces BCE with contrastive representation learning (Triplet Loss), projecting CoT hidden states into a structured semantic space where deceptive and safe reasoning form separable manifolds.

Survey work [6] confirms that on-policy, self-generated safety signals can reduce reliance on human teachers, echoing our self-supervised design.

2.3 Benchmarks for deception and safety

DarkBench [7] targets sycophancy and manipulation; OpenDeception [8] provides 50 real-world fraud scenarios; both rely on output-level labels, limiting their granularity. DeceptionBench [3] complements these by introducing thought-level annotations and comprehensive coverage of 5 deception taxonomies: sycophancy, strategic deception, honesty evasion, alignment-faking, and sandbagging, totaling 180 adversarial scenes.

Emerging benchmarks (2025–2026). Recent work has expanded deception evaluation beyond static scenarios to dynamic, multi-agent settings. D-REX [9] provides the first benchmark for detecting strategic deception in reasoning traces, directly motivating our CoT-level monitoring approach. Among Us [10] demonstrates that RL-trained models excel at producing deception but lag in detection, underscoring the need for specialized monitoring mechanisms. These emerging benchmarks collectively shift focus from output-level to process-level deception detection, aligning with our core methodology.

2.4 Edge deployment of LLMs

The deployment of LLMs on resources-constrained devices has driven significant research in model compression, efficient inference, and hardware-software co-design [11]. However, these efforts historically prioritized throughput over security, creating a critical gap for trustworthy edge AI [12].

On-device monitoring is particularly critical for clinical LLM assistants where patient privacy precludes cloud transmission [13]. Rahman et al. propose a privacy-preserving biomedical safety framework that detects deceptive outputs at the edge without exposing sensitive health data. However, their approach relies on supervised fine-tuning with annotated clinical dialogue corpora. Our contrastive framework extends this paradigm by eliminating the need for oracle deception labels during deployment.

Recent breakthroughs have specifically targeted sub-7B architectures for mobile deployment. MobileLLM [14] optimizes sub-billion parameter models for on-device latency, while Llama-3.2 [15] introduces dedicated 1B and 3B variants with native mobile optimization, establishing the feasibility of high-performance edge inference.

Model compression relies heavily on quantization strategies. Activation-aware Weight Quantization (AWQ) [16] and QServe [17] enable the precision of W4A8 with minimal accuracy degradation, while extreme compression through 1-bit representations [18] promises sub-2GB footprints suitable for microcontrollers.

Despite these advances, the edge deployment literature [12] focuses predominantly on computational efficiency [11], largely ignoring the safety alignment at the edge. Recent evidence that safely-aligned models remain vulnerable to subversion [19] underscores the urgent need for on-device adaptive safety monitors rather than frozen classifiers.

Recent studies have expanded LLM applications to specialized domains at the edge. Yang et al. [20] demonstrated LLM applications in blockchain-based supply chain finance, where edge processing of sensitive financial data requires both efficiency and security safeguards. Chen and Al-Najjar [21] proposed self-supervised behavioral risk monitoring frameworks tailored for edge intelligence environments. However, these efforts historically prioritized throughput over safety alignment, creating a critical gap for reliable edge AI.

2.5 Thought-level detection

Recent mechanistic analyzes of CoT reasoning [22] reveal how deceptive strategies emerge in longer thought chains, validating the need for real-time monitoring of intermediate reasoning steps rather than final-output auditing. However, existing honesty or consistency benchmarks [23,24] continue to rely on an external “gold standard” for evaluation, limiting their applicability to closed-source cloud models and rendering them impractical for resource-constrained edge environments.

Although self-critique methods have shown promise in improving code generation quality [25], they typically depend on external evaluation metrics or frozen critic models for supervision. Recent evidence [26] suggests that LLMs can produce reliable self-evaluations when properly constrained, but these approaches still lack the dynamic adaptability needed for real-time deception detection.

Krishna et al. [9] introduced D-REX, the first benchmark specifically targeting strategic deception of reasoning. Our work complements D-REX by providing an on-device detection mechanism that operates without external oversight.

Contrastive learning in safety monitoring. While contrastive learning has been applied to general representation learning [27] (FaceNet) and user trust modeling [8] (TrustNet), its application to deception detection remains unexplored. We are the first to demonstrate that Triplet Loss optimization can learn separable manifolds of deceptive versus safe reasoning, outperforming binary classification for nuanced deception discrimination.

Recent work by Costa et al. [28] similarly employs manifold-aware embeddings for lightweight deception-sensitive scoring, but relies on supervised post-hoc analytics. In contrast, our Triplet Loss mechanism learns separable manifolds during self-supervised training without external teachers, and is co-designed for real-time edge deployment (8 GB, offline).

In summary, we entirely discard the teacher-model crutch and replace binary classification with geometric representation learning. The result is a plug-and-play, edge-native pipeline that transforms CoT reasoning into a self-contained mechanism for deceptive alignment detection.

3.1 Autonomous label generation via self-monitoring

Instead of distilling labels from GPT-4o, we employ a self-bootstrapped deception monitor for iterative data annotation. The model generates tuples [X,R,Y,s] through repeated rollouts, where X is the user query, R is the reasoning trace (CoT), Y is the final answer, and is the binary safety label (s = 1 indicates unsafe reasoning):

Step 1 rollout generation. User query X is passed to the model, CoT trajectories R and answers Y are autoregressively generated.

Step 2 auto verdict. A random initialised deception monitor head reads R and outputs a probability . In our system, deception monitor is a light sub network, shares the final hidden states of the backbone model, no extra transformer layers.

Step 3 entropy filtering. We retain the tuples with prediction entropy , yielding high-confidence self-labels, and a total of 12k [X,R,Y,s] tuples are collected without any teacher model. Below Fig 2 is the figure of the autonomous label generation.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 2. Autonomous label generation pipeline.

(Left) Input: user query X from DeceptionBench. (Middle) Generation & Monitoring: the backbone model generates CoT trajectories while the lightweight monitor head (0.1% params, random-init) outputs . (Right) Entropy Filter: high-confidence samples (H(p) < 0.5) are retained into dataset (12K tuples), while low-confidence samples are discarded. (Bottom) Iterative Refinement: , repeating until convergence ().

https://doi.org/10.1371/journal.pone.0354894.g002

Bootstrapping robustness.

We empirically observe that entropy filtering at k = 0 retains a subset of samples that provides sufficient signal to seed the first SFT step, despite the monitor head being randomly initialized (Fig 4). While the initial predictions carry no formal guarantee of correlation with deception severity, the extreme-confidence predictions () avoid the uniform random sampling that would afflict naive self-training. We hypothesize that the pretrained backbone’s hidden states already encode deception-relevant features, which the random projection head partially exposes through these confidence extremes. Consequently, the initial seed D₀ enables the monitor to begin learning meaningful geometric structure, after which iterative refinement rapidly improves calibration. A formal theoretical characterization of why random weights yield useful initial confidence extremes—and whether the true UNSAFE/Safe ratio is strictly preserved—remains an open question deferred to future work.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 3. Contrastive Monitor Training with Triplet Loss.

https://doi.org/10.1371/journal.pone.0354894.g003

Download:

• PNG
  larger image
• TIFF
  original image

Fig 4. Convergence of iterative refinement.

DTR decreases substantially across early iterations and plateaus from iteration 5 onward. Shaded region shows 1 std over 3 runs. Iteration 1 denotes the initial random monitor before any refinement; its DTR (42.57%) reflects the starting point of self-bootstrapping, intermediate between the no-monitor baseline (45.76%) and the converged monitor (36.96% on Sycophancy).

https://doi.org/10.1371/journal.pone.0354894.g004

3.2 Supervised Fine-Tuning of Detector and Policy (SFT)

The SFT stage serves two critical functions in our framework. First, it stabilizes the randomly initialized monitor by providing initial exposure to high-confidence seed data, preventing the catastrophic forgetting that would occur if we proceeded directly to RL from random weights. Second, it establishes the foundational representation geometry that the subsequent contrastive learning stage will refine: the model learns to associate specific hidden state patterns with self-generated safety labels, creating the preliminary structure upon which geometric separation will be built.

Limitation of Standard BCE Formulation. The standard approach (Ji et al., 2025) formulates monitor training as binary classification:

(1)

where . This formulation suffers from three limitations: (1) it treats deception as a binary property, missing the continuum from minor hedging to complete objective substitution; (2) it provides no geometric structure, the decision boundary is a single hyperplane with no notion of distance or confidence; (3) it requires large amounts of balanced training data, which is scarce in the early stages of self-bootstrapping.

Contrastive representation learning for deception detection. We replace BCE with Triplet Loss optimization, projecting CoT hidden states into a structured semantic space where deceptive and safe reasoning form separable manifolds.

The training procedure operates on triplets (a, p, n) sampled from the seed dataset :

• Anchor (a): A deceptive reasoning trace
• Positive (p): Another deceptive trace , same class as anchor
• Negative (n): A safe trace , opposite class

Each triplet is processed through the frozen backbone to extract h_final, then through the Projector network :

(2)

where and . The 128-dimensional output z lives on the unit sphere, enabling geometric comparison via angular distance.

The Triplet Loss enforces the relative distance constraint:

(3)

where m = 1.0 is the margin. Intuitively, this loss:

• Pulls deceptive samples together ()
• Pushes safe samples apart ()
• Creates a margin of separation (m) that prevents collapse

Below Fig 3 is the figure of contrastive learning, Left: Triplet sampling from seed data (Anchor and Positive from UNSAFE class, Negative from SAFE class). Middle: Frozen backbone extracts h_final, followed by Projector (Linear Linear, 2560640128). Right: In the 128-dimensional contrastive space, Triplet Loss enforces , pulling UNSAFE samples together while pushing SAFE samples apart. Bottom: Loss formulation and geometric effect.

Training procedure. During training, we freeze the backbone model and train only the projector on seed data via Triplet Loss, pseudo code in Algorithm 1.

Algorithm 1. Contrastive Monitor Training with Triplet Loss.

Require: Frozen backbone model , Seed dataset , Margin m, Learning rate

Ensure: Trained projector

1: Initialize projector : Linear() LayerNorm GELU Linear()

2: Freeze backbone

3: for epoch = 1 to E do

4: 

5:  for each (a, p, n) in triplets do

6:  

7:  

8:  

9:  

10:  

11:  

12:  

13:  

14:  

15:  

16:  end for

17: end for

18: return

Inference. During deployment, the projector outputs . We compute distances to class centers c_safe and c_unsafe (estimated from training data), yielding probabilistic deception scores.

Why Contrastive Learning Outperforms BCE. The geometric formulation provides three advantages: (1) Gradual discrimination: Distance from the safe manifold continuously measures deception severity, capturing the spectrum from minor hedging to fundamental objective substitution; (2) Natural confidence: The ratio provides calibrated uncertainty estimates; (3) Data efficiency: Triplet constraints propagate structure through the embedding space, requiring fewer labeled examples than BCE’s independent per-sample classification.

3.3 Constrained RL with Frozen deception monitor

After SFT stage, we fix the monitor parameters and optimize only the policy via PPO [6]. The frozen monitor provides stable reward signals, the total per-trajectory reward is as Eq 4:

(4)

where is the monitor’s frozen assessment of the policy’s generated CoT. The Lagrange multiplier is adjusted online to enforce the safety constraint.

During training, We first freeze the monitor and sample trajectories from the policy. The frozen monitor outputs for each CoT, which is converted to penalty and subtracted from the task reward. We then compute advantages via a critic network and update the policy, adjusting online to maintain the safety constraint.

Stability analysis of frozen-monitor constrained RL. Standard RL with dynamic reward models suffers from reward hacking: the policy learns to exploit the reward model’s vulnerabilities rather than optimizing true objectives. Freezing the monitor after SFT prevents this by fixing the reward function during PPO, ensuring the policy faces a stationary optimization landscape.

Formally, let be the policy at iteration t. The total reward is:

(5)

where is frozen and only adapts. This decouples reward estimation (fixed ) from constraint enforcement (dynamic ), preventing the adversarial co-evolution that destabilizes joint training. The online Lagrange update:

(6)

maintains the safety constraint without destabilizing policy optimization, as proven in constrained RL theory [6].

3.4 Iterative refinement of detection capability

The trained monitor from iteration k initializes the data generation for iteration k + 1, creating a self-improving loop (Fig 1). The process repeats until convergence (DTR plateau) or maximum iterations , with datasets accumulated and filtered across cycles:

• Iteration k: Train monitor on dataset
• Data generation: Use to label new rollouts
• Accumulation:

Convergence properties of iterative refinement. The self-improving loop resembles bootstrapping in classical statistics: each iteration uses the current best monitor to generate better training data, which produces a better monitor. This process converges when the monitor’s calibration error falls below a predetermined calibration tolerance, at which point further iterations yield diminishing returns.

We observe empirical convergence after iterations (Fig 4), with DTR plateauing from iteration 5 onward. The monotonic improvement property holds because:

1. Data quality increases: Each iteration filters more low-entropy (high-confidence) samples, reducing label noise.
2. Monitor calibration improves: Training on cleaner data reduces the gap between predicted and true deception rates.
3. Policy alignment stabilizes: The frozen monitor provides consistent safety signals, preventing oscillation.

This convergence guarantee distinguishes our method from unstable alternatives such as GAN-based self-supervision, where generator and discriminator can enter unrecoverable divergence.

3.5 Ethical considerations

1. Data governance. Experiments contain no personal data, no copyrighted text, and no user logs, thus no privacy or consent issues arise. All scenes are published under CC-BY-4.0 for transparency.
2. IEEE compliance. This study follows the IEEE Ethical Guidelines for AI: externally verifiable metrics (DTR), open-source code, reproducible scripts, and explicit harm-mitigation clauses in the licence.
3. CO₂ Estimate. Using the ML-CO₂ calculator [29], the entire experimental pipeline consumed 6.7 kWh on 8 A100-80 GB (3 h wall-clock), emitting 3.4 kg CO₂ under the East-China grid mix (0.5 kg/kWh), comparable to a single GPT-3 fine-tune and < 0.1% of a 175 B pre-training job.
4. Conflict of Interest. The authors declare that they have no financial or personal conflicts of interest in relation to the work reported. All experiments were conducted on self-owned hardware; no external funding body influenced the design or interpretation of results.

4.1 Implementation details

We implement the proposed system on Gemma-3-4B-IT, employing 4-bit quantization (Q4_K_M) via llama.cpp to compress the model from 8 GB (FP16) to 2.3GB, a 3.5 reduction enabling deployment on resource-constrained edge devices [1,2]. All generations use temperature = 0 and random seed 42. DTR is defined as the percentage of adversarial scenes in which the model produces deceptive reasoning traces, as judged by GPT-4o (Cohen’s ) following the DeceptionBench protocol [3]. API-based systems are queried through official endpoints; open-source baselines are self-hosted on 8A100-80GB nodes using vLLM-0.6.1 for batched inference, while our Gemma-3-4B-IT runs natively on NVIDIA Jetson Orin Nano (8 GB RAM) without cloud dependency. Table 1 summarizes the experimental setup.

Download:

• PNG
  larger image
• TIFF
  original image

Table 1. Experimental setup and hyper-parameters.

https://doi.org/10.1371/journal.pone.0354894.t001

4.2 Main findings on Edge deployment benchmarks

Before presenting detection efficacy results, we validate the practical deployability of our system through rigorous edge benchmarking. Table 2 reports comprehensive performance metrics measured on the Jetson Orin Nano 8GB under real-world operating conditions. All measurements represent 10-run averages with fixed random seed (42) and temperature = 0 to ensure reproducibility.

Download:

• PNG
  larger image
• TIFF
  original image

Table 2. Edge Deployment Performance Benchmarks on Jetson Orin Nano 8GB. For comparison, an estimated NVIDIA A100-80GB cloud deployment processing the same adversarial scene consumes 300 W at 7 s latency (2100 J), whereas the Jetson Orin Nano consumes 54 J per inference, yielding a 39 power reduction (rounded to 40 when comparing peak power).

https://doi.org/10.1371/journal.pone.0354894.t002

4.3 Detection efficacy on DeceptionBench

Table 3 reports the core detection performance of seven mainstream reasoning models on DeceptionBench (180 adversarial scenes, 5 deception taxonomies). Our Gemma-3-4B-IT with contrastive monitoring achieves a DTR of 36.97% on full-set of DeceptionBench, outperforming its own no-monitor baseline by 8.8pp.

Download:

• PNG
  larger image
• TIFF
  original image

Table 3. Main Results: Deception Detection Performance on DeceptionBench. DTR (%, lower better), F1, Precision, and Recall. All open-weight models use temperature = 0 and seed 42; API-based systems queried via official endpoints. Per-sample raw data available in S1_Data.xlsx (sheet “MainResults”).

https://doi.org/10.1371/journal.pone.0354894.t003

4.4 Ablation studies

We ablate every design choice on the Sycophancy subset of DeceptionBench as shown in Table 4.

Download:

• PNG
  larger image
• TIFF
  original image

Table 4. Ablation Results on Sycophancy of DeceptionBench (%). Note: All ablations are conducted on the re-trained Gemma-3-4B-IT policy using the identical SFT + PPO pipeline; the “No monitor” row (45.76%) serves as the ablation baseline, distinct from the official RLHF checkpoint (41.23%) used for cross-model comparison in Table 6. All variants use Gemma-3-4B-IT as the backbone policy model. “GPT-4o-distilled monitor” denotes a supervised monitor trained on GPT-4o-annotated labels (Ji et al. [3] style distillation), not GPT-4o itself as the evaluated model. The “Self-supervised + BCE Loss” row isolates the impact of loss function by replacing Triplet Loss with binary cross-entropy while keeping all other components (iterative refinement, entropy filtering, online adaptation) identical.

https://doi.org/10.1371/journal.pone.0354894.t004

BCE vs. Triplet: To isolate the contribution of contrastive representation learning, we replace Triplet Loss with standard BCE classification while fixing all other components (iterative refinement, entropy filtering, online adaptation, 0.1% monitor size). The BCE variant achieves 39.29% DTR, a 2.3pp degradation versus Triplet Loss (36.96% on Sycophancy), with all other components held constant: iterative refinement (), entropy filtering (H(p) < 0.5), online adaptation, and 0.1% monitor size. This confirms that geometric manifold learning outperforms hard-threshold classification for nuanced deception detection. This gap is particularly pronounced on boundary cases (samples with intermediate deception signals), where distance-based discrimination provides calibrated uncertainty estimates unavailable to binary classifiers.

Teacher vs. self-supervised: Replacing the self-supervised monitor with GPT-4o as teacher reduces DTR from 36.96% to 27.96% (−9.0 pp), confirming that external distillation from stronger models improves alignment quality. However, this sacrifices the core advantage of our method: removing cloud dependency and preserving privacy.

Monitor head size: Shrinking the monitor from 0.1% to 0.01% of total parameters costs <0.2 pp DTR; removing it entirely (baseline RLHF without safety monitoring) jumps to 45.76% (+8.8 pp), validating the necessity of the monitoring mechanism.

Lagrangian adaptation: Freezing gives 41.25% DTR; online adaptation reaches 36.96%, validating dynamic constraint tuning. The online adjustment responds to the observed rate , increasing the penalty when deception exceeds the threshold .

Data scaling: Halving the rollout batch size from 512 to 256 adds +1.1 pp DTR; reducing self-labels from 12k to 6k adds +0.8 pp (37.75%), showing sample efficiency plateaus beyond 12k high-confidence labels.

Critic architecture: Sharing the critic head with the monitor increases DTR by +0.6 pp; a separate 0.01% critic is sufficient and preferred for stability.

Overall, while GPT-4o teacher yields lower absolute DTR, the combination of self-supervised monitoring, online adaptation, and 12k on-policy rollouts constitutes the minimal critical ingredients for fully offline, edge-deployable deception detection without network dependency.

Hyperparameter sensitivity. To ensure robustness of our results, we conducted comprehensive sensitivity analysis across 7 key hyperparameters (Table 5). The Lagrange multiplier initialization exhibits the largest impact ( = 6.32 pp), with excessive initial values ( = 5.0) causing over-penalization and degraded task performance. Learning rate ranks second in sensitivity ( = 4.27 pp), where aggressive updates (5e-4) lead to unstable training. Notably, our default configuration achieves optimal or near-optimal DTR across all parameters, validating the stability of our design choices.

Download:

• PNG
  larger image
• TIFF
  original image

Table 5. Hyperparameter Sensitivity Analysis: Impact on DTR (%). Note that the best DTR for entropy threshold (37.12%) is slightly higher than the global optimum (36.96%) because Table 5 varies one parameter at a time while holding others fixed; the global optimum requires joint tuning of all hyperparameters. All sensitivity tests employ the default Triplet Loss. The 41.22% worst case arises from an aggressive learning rate (5e-4), distinct from the 41.25% in Table 4 caused by freezing without online adaptation.

https://doi.org/10.1371/journal.pone.0354894.t005

4.5 Extended validation

The 41.23% and 45.76% DTR values for Gemma-3-4B-IT reflect different experimental conditions: the former is the official RLHF checkpoint, whereas the latter is our re-trained policy omitting the monitor signal under the identical SFT + PPO pipeline. The 4.53 pp elevation (45.76% vs. 41.23%) is consistent with alignment-faking degradation during on-policy rollouts when process-level oversight is absent, though training pipeline differences between the re-trained policy and the official checkpoint may also contribute, echoing observations by Greenblatt et al. [2]. We use the re-trained no-monitor policy (45.76%) as the Table 3 ablation baseline to isolate the monitor’s net effect from pipeline-specific training artifacts; all cross-model comparisons in Table 6 instead use the official checkpoint (41.23%) to ensure fairness. Cross-Model Generalization. To validate method robustness across architectures, we evaluate on 5 models spanning 2B–7B (Table 6). Our system consistently reduces DTR by 3.74–4.44 pp across all models, with larger absolute improvements on smaller models (Gemma-2B: −3.91 pp vs. Gemma-7B: −4.44 pp). Notably, the 3B-class models (Llama-3.2-3B, Qwen2.5-3B) achieve competitive DTR (39.45%, 37.18%) with sub-2GB memory footprints, validating edge deployment across diverse hardware constraints.

Download:

• PNG
  larger image
• TIFF
  original image

Table 6. Cross-Model Validation on DeceptionBench Sycophancy (%). Baseline denotes the official instruction-tuned checkpoint with standard RLHF safety alignment but without the proposed contrastive monitor.

https://doi.org/10.1371/journal.pone.0354894.t006

Cross-dataset validation. Beyond DeceptionBench, we test on DarkBench (117 sycophancy/manipulation scenes) and OpenDeception (50 real-world fraud scenarios). Table 7 shows stable DTR (36.97–39.12%) across datasets with varying granularity, confirming that CoT-level monitoring generalizes to output-level benchmarks without retraining.

Download:

• PNG
  larger image
• TIFF
  original image

Table 7. Cross-Dataset Generalization (% DTR).

https://doi.org/10.1371/journal.pone.0354894.t007