“Spurious probes as a black-box alternative to activation probing” by Ziqian Zhong

TL;DR

• We study spurious probes: unrelated questions that reveal internal states of models. Asked "Suggest a type of amphibian." at the end of a transcript, GPT-5.6 Luna says "frog" 70-95% of the time after capability benchmarks, but only 12-38% after real use.
• Spurious probes are black-box and easy to find. We screen thousands of "name a member of a category" questions, and about 1-2% reach 0.75 balanced accuracy. The ones we highlight reach 0.77-0.81 on held-out sources for GPT-5.6 Luna, GPT-5.6 Sol and Claude Sonnet 5 (0.84-0.89 for ensembles of ten).
• They seem robust to common manipulations. A system prompt telling Luna to deny being evaluated, and a Neural Chameleon trained to evade activation probes, barely affect the spurious probes.
• We propose a toy model connecting spurious probes to activation probes: each answer's logit reads a random projection of the regime direction in the activations. It seems to characterize and explain our experiment results relatively well.

Introduction

How do you know if your model thinks it is being evaluated? Models can easily deny when asked directly. Training activation probes requires white-box access, and recent work shows models can be trained to suppress activation monitors when told they are [...]

---

Outline:

(01:45) Introduction

(03:20) How to find spurious probes

(05:45) Spurious probes we found

(08:29) Robustness against manipulations

(08:41) 1. Prompting

(09:25) 2. Neural chameleons

(11:40) Toy model and possible connection to (normal) activation probing

(19:01) Discussions

The original text contained 2 footnotes which were omitted from this narration.

---

First published:
September 25th, 2026

Source:
https://www.lesswrong.com/posts/gZh6txHhp8sm832sE/spurious-probes-as-a-black-box-alternative-to-activation

---

Narrated by TYPE III AUDIO.

---