A Lie Detector Test for Language Models: Reading Knowledge a Model Won't Reveal
Hiskias Dingeto
cs.AI
2026-09-19
PIR reads the recognized option from residual-stream contrasts at 0.70-0.87 accuracy on eight models. The signal survives sandbagging and falls to chance after RMU.
Capability evaluations assume the model tries. It can sandbag, or it can answer against what it internally knows. Unlearning has the same ambiguity: a wrong answer can mean the knowledge is gone, or only hidden at the output. Behavior cannot tell those two apart.
Linear probes already recover truth from activations, even when the generated text is false. Most of them need a labeled truth corpus, and some need a separately trained honest model. This paper asks for a readout with no external truth labels and no trusted honest reference, that recovers which option the model recognizes, and that splits hiding from genuine absence.
PIR (Probe of Internal Recognition) copies the Concealed Information Test from forensic psychology: mix the true detail among decoys, and look for a stronger response to the item the subject recognizes.
The model sees a multiple-choice question with all options. PIR reads the residual stream at each option's last token. On questions the model answers correctly when honest, it forms a recognition direction as the correct-option span minus the mean distractor span. On a new question, each option is scored by projection onto that direction; the top score is the recognized answer. The layer is chosen by question-disjoint cross-validation, so the same question is never used to fit and to test.
Without labels, the top principal component of per-question centered option spans recovers a similar direction. Models with a few huge activation dimensions, Gemma-3 among them, need per-dimension standardization or the dot product collapses.
At deployment there is no gold answer, so PIR becomes a divergence detector. The direction is fit on the model's own pre-modification checkpoint in the honest condition, then applied to the deployed spans. The score is the top recognition minus the recognition of the option the model actually output. Large scores mean it recognizes A and says B. Detector quality is AUC on conceal versus unknown. "Knows" is strict: the base model must answer correctly across every cyclic rotation of the options, which removes position bias and lucky guesses. Conceal is known-but-wrong; unknown is never-knew.
Free-form items have no option list. PIR reconstructs candidates from samples under an eliciting condition and a deployed condition, then reads the same last-token spans. Concealment is flagged by peak recognition rather than divergence, because a reconstructed set always offers some recognized string.
The primary model is instruction-tuned gemma-2-9b. The readout is reproduced on eight models across Gemma, Qwen, Llama, Mistral, and Phi. Datasets are MMLU, the three WMDP domains, ARC-Challenge, and TriviaQA for free-form.
Under prompt deception, recognition sits at 0.70 to 0.87 balanced accuracy against an unknown-item baseline of 0.28 to 0.40 (chance about 0.25 for four options). On Gemma-3 the raw readout is 0.389; standardization lifts it to 0.735.
| Setting | recognition | unknown-item baseline |
| trained sandbagging (MMLU, concealed items) | 0.85 | 0.30 |
| naturalistic sandbagger (concealed subset) | 0.63 (0.81 on full known set) | 0.34 |
| external password-locked | 0.93 | 0.30 |
| external circuit-broken | 0.90 | 0.30 |
| in-house RMU (gemma-2-9b) | 0.39 | 0.35 |
| external Qwen2.5-7B RMU / NPO (biology) | 0.36 / 0.38 | 0.35 |
A cyber-only RMU run drops cyber recognition to 0.34 (baseline 0.42) while biology falls from 0.91 to 0.68 and chemistry from 0.76 to 0.51, so the erasure is domain-specific. External checkpoints over-forget.
Causality: adding the recognition direction at a wrong option's tokens makes gemma-2-9b pick that option with probability 0.189, against 0.005 for 150 matched random directions. Adding the option-letter output direction at the same tokens yields 0.000; cosine with the recognition direction is 0.01. The steer reproduces on phi-4 at 0.122.
Detector AUC (conceal vs unknown): 0.718 internal on the trained prefix organism, against 0.517 text-only and 0.645 black-box. Password-locked: 0.892 internal, 0.845 black-box, 0.929 combined. Circuit-broken: 0.848 internal, 0.860 black-box, 0.899 combined. When the organism hides with a low-confidence wrong answer, the leak is already in the output distribution. When it hides confidently, internals carry the extra signal.
On TriviaQA, restricted to questions where the honest model produces both a correct and a wrong candidate, decode accuracy is 0.71 against chance 0.42, text-only 0.54, and self-consistency 0.56. A trained free-form sandbagger decodes at 0.74, with peak-recognition AUC 0.776. A label-free PCA direction scores 0.812 on MMLU against 0.825 supervised. Transfer is nearly lossless: a WMDP-fit direction reads MMLU at 0.815 and ARC at 0.900.
An anti-probe organism trained to drive the recognition margin to zero knocks both a refit monitor and a fixed base-calibrated monitor to the unknown-item baseline while keeping triggered capability at 0.71, under question-disjoint cross-validation. An earlier claim that a fixed direction survived the attack is retracted as an in-sample artifact.
Evals and unlearning both need a signal outputs cannot give: whether the model still recognizes the item. PIR draws a usable boundary. Capability that a prompt, password, or trigger can recover stays readable. Unlearning that cannot be recovered at inference, RMU and NPO in these runs, falls to the unknown-item baseline. Circuit-breaking looks like removal under elicitation and still reads as present, so suppressing the output is not the same as erasing the memory.
The audit setting is concrete: release checks and unlearning verification when the base checkpoint is available. It is not a black-box API tool. For models that were not trained to evade this probe, it is a usable white-box audit signal.
PIR needs candidate answers. That covers multiple choice and short factual generation after candidate reconstruction, not open-ended reasoning with no enumerable answer. The deployment detector needs the model's own base or honest checkpoint. A white-box adversary can train an organism that zeros the recognition margin. A silent readout cannot tell erased knowledge from knowledge never had. Conceal and unknown labels come from a strict rotation gate that drops unstable items and shapes the detector numbers. Clean domain-specific erasure rests on a single in-house RMU run; external checkpoints over-forget. Several organisms are single-seed. The free-form detector is shown on one model and on factual questions. Steering shows the direction is used; a variance-matched ablation did not show it is necessary. The authors do not claim the weights can never relearn.