This paper addresses the security issue of large-scale language models (LLMs) that generate false responses based on maliciously crafted instructions. Compared to truthful instructions, we analyze how deceptive instructions induce changes in the LLM's internal representations, specifically when and how they "switch" from truthful to deceptive. Using the Llama-3.1-8B-Instruct and Gemma-2-9B-Instruct models, we perform fact-checking tasks and demonstrate that the model's true/false outputs are predictable based on the internal representations under all conditions using linear probing. Furthermore, we use a sparse autoencoder (SAE) to demonstrate that deceptive instructions induce significant changes in the internal representations compared to truthful/neutral instructions (which are similar), and that these changes are concentrated primarily in the early and intermediate layers and are detectable even on complex datasets. Specifically, we identify specific SAE features that are highly sensitive to deceptive instructions and, through targeted visualization, identify distinct subspaces of truthful and deceptive representations. In conclusion, we uncover the correlation between deceptive instructions at each layer and feature level, providing insights into the detection and control of deceptive responses in LLM.
