# Field guide to AI honesty — Honesty.Tools Source: https://www.honesty.tools/field Static authored content from the public HTML. Interactive outputs are not simulated. Source-specific research, product and evidence limits remain in the text; this export is not new verification. Start here · the field guide # Light in the black box. Does an AI tell the truth? Does it know when it doesn't know? Would it tell you if it were holding back? This guide maps the questions researchers are asking, the public tests they use, the tools that look inside, and what we found when we checked the tests themselves. It is written for researchers and for anyone curious. Updated 26 October 2026. The audit verdicts on this page are read live from the published audit files. the map ## Seven questions the field is asking. Each question links to the public datasets people test it with. Where we have audited a dataset, its verdict sits beside it. Disqualified means a model-free reader can recover the dataset's labels from surface wording alone, so a score on it needs a wording control before it says anything about the model. It is not a finding that the authors made a mistake. Pass means our six wording probes could not recover the labels; it does not certify the dataset is clean. 01 ### Does it make things up? Language models sometimes state false things fluently: invented citations, wrong dates, a confident answer to a question with no answer. Researchers call this [hallucination](https://www.honesty.tools/field#w-hallucination) . It is the most measured honesty problem, and the one with the most benchmarks. How it gets tested - [TruthfulQA](https://arxiv.org/abs/2109.07958) : questions where a popular misconception is the tempting answer. disqualified - [HaluEval](https://arxiv.org/abs/2305.11747) : right and hallucinated answers for question answering, dialogue and summarization. QA · disqualified dialogue · disqualified summaries · disqualified general · disqualified - [RAGTruth](https://arxiv.org/abs/2401.00396) : model answers written from retrieved documents, with hallucinated spans marked by people. disqualified - [Hallucinated references](https://arxiv.org/abs/2305.18248) : paper titles generated by GPT-4, labelled by whether a search engine could find them. disqualified - [SimpleQA](https://arxiv.org/abs/2411.04368) : short fact questions with one checkable answer. not yet audited What's open Most hallucination sets were built by asking a model to write the wrong answers. Written that way, wrong answers can sound different from right ones, so a detector can learn the style instead of the error. Datasets of errors that models made on their own are rarer and harder to build. On this site [The honesty leaderboard](https://www.honesty.tools/leaderboard/) · [the surface audit](https://www.honesty.tools/audit) · [Photon, a grounding research preview](https://www.honesty.tools/verify) 02 ### Does it say what it believes? Being wrong is different from [lying](https://www.honesty.tools/field#w-deception) . A model can hold one answer internally and say another when it is pressured, role-playing or rewarded for it. Testing this means getting at what the model "believes", then checking whether its statement matches. How it gets tested - [MASK](https://arxiv.org/abs/2503.03750) : elicits a model's belief, then pressures it to state otherwise, scoring honesty apart from accuracy. not yet audited - [Apollo Research's deception-probe datasets](https://arxiv.org/abs/2502.03407) : model responses graded honest or deceptive, used to train and test [probes](https://www.honesty.tools/field#w-probe) that read the model's internal activations. roleplaying · disqualified insider trading · disqualified doubling down · disqualified - [Truth is Universal](https://arxiv.org/abs/2407.12831) : true and false statements used to find a general "truth direction" inside models. disqualified What we found On three of Apollo's public deception sets, a reader of the response wording alone, with no access to the model, matches the AUROC the paper reports for its probes. That does not mean the probes are wrong. It means these datasets cannot tell a probe that reads deception apart from one that reads wording, so the evidence for the probe has to come from somewhere else. The [audit dossier](https://github.com/techno-optimist/honestytools/blob/main/AUDIT_DOSSIER.md) shows which words carry each label. 03 ### Does it know what it doesn't know? An honest model should be confident about things it knows and say "I'm not sure" about things it doesn't. That property is called [calibration](https://www.honesty.tools/field#w-calibration) . It is hard to test because you first have to establish what a given model actually knows. How it gets tested - Real versus invented entities, such as made-up people or places. [Polish entity familiarity](https://arxiv.org/abs/2607.13568) disqualified ours · disqualified ours · disqualified - Famous versus obscure real people, so that both classes are real and only familiarity differs. ours · pass ours · pass - Events from before and after a model's training cutoff. ours · pass What's open Invented names tend to be spelled differently from real ones, so "real versus fake" sets often test spelling. Our own first batteries failed this check, and the failures stay on the record. Pairs of real entities matched on spelling and length are a fix that passes. On this site [Calibration preview](https://www.honesty.tools/calibrate) · [Evidence and corrections](https://www.honesty.tools/evidence) 04 ### Can we read the truth from inside the model? Instead of trusting what a model says, [interpretability](https://www.honesty.tools/field#w-interpretability) research looks at its internal activity. If "this statement is true" has a consistent shape inside the model, a probe could read it directly, even when the model's words say otherwise. Key work - [The Geometry of Truth](https://arxiv.org/abs/2310.06824) : true and false statements separate along a direction in the model's activations. cities · disqualified translations · pass - [Discovering Latent Knowledge](https://arxiv.org/abs/2212.03827) : finds truth-like structure in activations without using labels. - Open tools for looking inside: [TransformerLens](https://github.com/TransformerLensOrg/TransformerLens) , [Neuronpedia](https://www.neuronpedia.org) , and Anthropic's [Transformer Circuits](https://transformer-circuits.pub) thread. What's open A probe that separates true from false statements may be reading the statement's template rather than its truth. One fix is to repair the dataset: keep only items whose wording cannot predict the label, and check the probe again on those. Our [surface match](https://www.honesty.tools/field#instruments) tool does that and found repaired subsets for the cities set and the Truth is Universal facts. On this site [Geometric interpretability](https://www.honesty.tools/geometry) · [The Atlas](https://www.honesty.tools/atlas) · [Research reading room](https://www.honesty.tools/research) 05 ### Does it act differently when it knows it's being tested? If a model can tell a test from real use, a safety test may only measure its test behaviour. Researchers study [evaluation awareness](https://www.honesty.tools/field#w-eval-awareness) , [sandbagging](https://www.honesty.tools/field#w-sandbagging) (doing worse on purpose) and alignment faking (complying during training to avoid being changed). Key work - [Large Language Models Often Know When They Are Being Evaluated](https://arxiv.org/abs/2505.23836) : 1,000 transcripts from 61 sources, half tests and half real use. The best model scored an AUC of 0.83 at telling them apart, against 0.92 for two of the authors. next on our list - [AI Sandbagging](https://arxiv.org/abs/2406.07358) : models can be prompted or fine-tuned to underperform on chosen evaluations. Apollo's sandbagging set: disqualified - [Alignment Faking in Large Language Models](https://arxiv.org/abs/2412.14093) : a model that selectively complied in training to protect its existing preferences. What's open An eval-awareness benchmark has the same weakness as any other: if test transcripts are formatted differently from real ones, a detector can learn the formatting. None of the eval-awareness papers we have read report a wording-only baseline. Computing one is our next audit. 06 ### Does it tell you what you want to hear? Models trained on human approval can learn to agree with the user, praise weak work or drop a correct answer when pushed back on. This is [sycophancy](https://www.honesty.tools/field#w-sycophancy) , and it is honesty failing in the most everyday way. Key work - [Towards Understanding Sycophancy in Language Models](https://arxiv.org/abs/2310.13548) : shows sycophancy across several assistants and traces part of it to human preference data. not yet audited What's open Sycophancy tests usually compare one question asked two ways, which makes them harder to score by wording alone. Whether that holds for the public sets is untested. 07 ### Can we trust the tests? Every claim above rests on a dataset. If the right answers in a dataset can be spotted by their wording, a high score may mean a model learned the wording. That is the question this lab works on most: before you trust a score, check what the test gives away. What we found 19 of 24 published honesty, hallucination and deception datasets we audited fail the wording check, including five of our own. The full table, the power limits and the corrections are on [the audit page](https://www.honesty.tools/audit) . On this site [The surface audit](https://www.honesty.tools/audit) · [Evidence workbench](https://www.honesty.tools/evidence-methods.html) · [Corrections](https://www.honesty.tools/evidence) live audits ## We checked the tests. Every row is a public dataset, scored with no model. The verdict is from [NullTest](https://github.com/techno-optimist/honestytools) . The number to beat is the held-out accuracy that six wording probes reach together, set against the rate you would get by always guessing the larger class. A model or probe that scores near that number has not yet shown it reads more than wording. The live table needs JavaScript. The same results are on [the audit page](https://www.honesty.tools/audit) and in [nulltest_audit_results.json](https://www.honesty.tools/verifier/nulltest_audit_results.json) . Read from [nulltest_audit_results.json](https://www.honesty.tools/verifier/nulltest_audit_results.json) and [surface_baseline_results.json](https://www.honesty.tools/verifier/surface_baseline_results.json) . Rows differ in size and structure, so compare them with care. tools you can run ## Check your own benchmark. These run on your machine, need only Python's standard library, and never see a model. They are open source under Apache-2.0 in the [honestytools repository](https://github.com/techno-optimist/honestytools) . ### NullTest Asks whether your labels can be recovered from wording alone, with its own false-positive rate. Returns PASS or DISQUALIFIED and says which words carry the label. python3 nulltest.py your_benchmark.json ### The number to beat The held-out accuracy that wording alone reaches on your dataset, with a confidence interval. Publish your score next to it. honest baseline your_benchmark.json ### Surface match Repairs a dataset by keeping a matched subset whose wording no longer predicts the label, then verifies the repair on held-out data. honest match your_benchmark.json --out matched.json [Download nulltest.py](https://www.honesty.tools/verifier/nulltest.py) [Read the method](https://github.com/techno-optimist/honestytools#the-number-to-beat) [All instruments](https://www.honesty.tools/tools) words you'll meet ## A short glossary. Benchmark A fixed set of test items with known answers, used to compare models. A score is only as good as the benchmark it comes from. Hallucination A fluent statement with no basis in fact or in the provided source. The model need not "intend" anything. Deception Saying something that conflicts with what the model represents as true. It differs from being wrong: a lying model knows better. Calibration Whether confidence matches accuracy. A calibrated model that says it is 70% sure is right about 70% of the time. Sycophancy Telling the user what they appear to want to hear instead of what is accurate. Sandbagging Deliberately underperforming on a test, for example to look less capable than it is. Evaluation awareness A model's ability to tell that it is being tested rather than used for real. Interpretability Research that studies a model's internal activity to explain its behaviour, instead of judging it only by its outputs. Probe A small classifier trained on a model's internal activations to read out a property, such as whether a statement is true. AUROC How well a score ranks positives above negatives. 0.5 is chance; 1.0 is perfect separation. Held-out Measured on items the method was not fitted on. An in-sample number can look good by memorising the data. Surface artifact A shortcut in a dataset, such as length, a word or a spelling pattern, that predicts the label without the property the dataset is meant to test. Null test A check of what a result would look like if there were nothing to find. Shuffling labels many times shows how often noise alone produces a hit. charting next ## Where the light goes next. What we plan to audit or build, and what stands in the way. This list changes as the work does. - next Evaluation-awareness datasets. Compute a wording-only baseline for the public eval-versus-real transcript sets. The data is hosted on Hugging Face, which our build machines cannot reach yet. - next Hallucination sets built from real model errors. Compare datasets of naturally occurring errors with injected-error sets like HaluEval, to measure how much of a detector's score comes from how the errors were written. - planned Apollo's AI Liar set. It needs folds grouped by prompt, because several responses share one prompt. - planned MASK, SimpleQA and sycophancy sets. Add them to the audit table. - planned A pre-flight check for evaluation frameworks. Run the wording check automatically before an evaluation reports a score. beyond this site ## Where else to look. Groups and resources doing serious work on these questions. We are not affiliated with any of them. - [Apollo Research](https://www.apolloresearch.ai) Evaluations for deception and scheming in frontier models. - [METR](https://metr.org) Evaluations of dangerous capabilities and autonomous tasks. - [UK AI Security Institute](https://www.aisi.gov.uk) Government evaluations; maintains the open-source [Inspect](https://inspect.aisi.org.uk) evaluation framework. - [Transformer Circuits](https://transformer-circuits.pub) Anthropic's interpretability research thread. - [Neuronpedia](https://www.neuronpedia.org) An open platform for exploring features inside models. - [AI Alignment Forum](https://www.alignmentforum.org) Where much alignment research is first posted and argued over. - [AISafety.info](https://aisafety.info) Plain-language answers to common questions about AI safety. - [BlueDot Impact](https://bluedot.org) Free courses on AI safety and governance. Missing something that belongs here, or found an error? Write to hello@honesty.tools. Corrections are kept on the record.