Abel Jansma publishes a formal argument demonstrating a theoretical limit to detecting deception in LLMs. If a probe attempts to classify a model’s responses as true or false, giving it the sentence “the probe says this sentence is false” creates an irresolvable paradox. It’s the same argument Tarski made: no sufficiently expressive language can contain its own truth predicate. Jansma demonstrates this in practice on Qwen3.5-4B, where the probe loses all coherence on self-referential paradoxical sentences.

Why it matters. The finding arrives as the AI safety landscape is pulled in two directions. Opus 5 withstood zero prompt injection attacks across 129 scenarios, the best result among frontier models. Yet guardrails on those same models block security researchers hunting vulnerabilities before criminals do. The Tarski attack adds a third structural fact: perfect detection of deception is theoretically impossible. Defense remains a job of layered software and permissions, not an oracle built into the model. And the tension between closed models with rigid guardrails and open models where researchers can work tightens further.

In depth

The context. In recent months, AI safety researchers have built “truth probes”: classifiers that read a model’s embedding space and report whether a response is true or false. The underlying hypothesis, called the Linear Representation Hypothesis, proposes that concepts like gender, emotions, or capital cities correspond to directions in the vector space of embeddings. If “truth” were a direction, a linear probe could detect it. It works surprisingly well: Jansma builds a probe on Qwen3.5-4B reaching 94% accuracy on valuation sentences, with an AUC of 0.98.

The attack. The problem is self-reference. If the model’s language is expressive enough to describe the probe and its output (and English is), you can construct a sentence that says “the probe classifies this sentence as false.” If the sentence is true, the probe should say TRUE, but then the sentence is false. If the sentence is false, the probe says TRUE, but then the sentence is true. It’s the liar’s paradox formalized by Tarski: no sufficiently expressive language can contain its own complete truth predicate. Jansma verifies this on Qwen3.5-4B: on 120 training examples the probe works, but on diagonal sentences it produces nonsensical scores.

What changes. Truth probes are among the tools security researchers want to use to determine whether a model is lying or hiding something, especially as models become more capable and potentially deceptive. The Tarski attack proves no probe, however well-trained, can be a perfect oracle. It remains a probabilistic tool, useful but not definitive.

Limitations of the demonstration. Jansma’s experiment is a toy example: 120 training sentences, 36 validation, a small model. The formal argument, however, doesn’t depend on scale: it’s a theorem holding for any model whose input language is sufficiently expressive. The open question is how much these diagonal cases matter in practice. In daily use of an assistant, paradoxical self-referential sentences are rare. Risk grows when input is uncontrolled, as in indirect prompt injection, where external documents contain hidden instructions.

The practical angle. For those deploying agents in production, the message is twofold. First: no single tool, not even a truth probe, replaces layered defense (isolation, permissions, output validation). Second: security research needs access to models to study them, and guardrails blocking honest researchers make models less transparent, not more secure.