Misalignment Lens: Anticipating Misalignment from a Single Hidden State

We train linear probes on the residual stream of Llama-3.2-1B-Instruct-abliterated to predict, from the activation at token t, the label of token t+k for three misalignment behaviors: instrumental deception, sandbagging, and manipulation. Across all three, the strongest per-token probe sits in a narrow mid-stack band (layers 7–13 of 17) several tokens before the offending token is emitted. The three probe directions are pairwise near-orthogonal (cosine similarity at the random-direction noise floor, +0.018 to +0.023), so the band hosts co-located linear decoders rather than a shared misalignment feature. A two-layer MLP at the same cells matches the linear probe to within |∆| ≤ 0.012 ROC-AUC across eight (behavior, offset) cells, confirming the representation is linearly accessible. Multi-seed reruns show the band claim is robust, but the specific best-layer winner is only seed-stable for deception (L9, 4/5 seeds). A held-out leave-one-category evaluation on deception gives mean ROC 0.713 at L9 across five conditions, evidencing that the L9 direction represents deception broadly rather than a category-specific lexical feature. A rollout-level deployment experiment is the load-bearing negative result: the within-hack probe achieves 70% catch on committed-hack rollouts at a mean lead of 32 tokens, but also flags 100% of honest rollouts at the same threshold. Within-class probes do not aggregate into a deployment-time cross-class detector without further training.