PaperlayerView exact revision on arXiv

Source-linked AI summary

Train the Model, Not the Reader: Decodability Supervision for Verifiable Activation Explanations

Hiskias Dingeto

arXiv:2607.20379v1cs.AIcs.CL

TL;DR

Reconstruction-based activation explanations can score well without being faithful to individual claims. This paper audits that gap and introduces RECAP, which co-trains predictors to keep selected content decodable. RECAP produced claim-faithful sandbox verbalizers and made content probe-decodable on Pythia-160M.

  • Problem

    Reconstruction scores test whether explanations suffice to regenerate activations, but are insensitive to false additions that leave reconstruction unchanged.

    Source: §1 · p. 1

  • Method

    The paper audits claim truth with a grounded-vs-true cross and evaluator swap, then introduces RECAP, which co-trains predictors to keep designated content decodable.

    Source: §2.1 · p. 2, §1 · p. 2

  • Results

    RECAP produced claim-faithful verbalizers in 5/5 sandbox runs and made designated content probe-decodable on Pythia-160M, where true-claim ranking reached AUC 0.965 versus 0.823.

    Source: §5.2 · p. 4, §9 · p. 7

  • Takeaways & Limitations

    For designated content, probe-based monitoring can check verbalizer claims that reconstruction scoring alone cannot establish as true.

    Source: §1 · p. 1, §9 · p. 7

    Evidence covers closed-vocabulary, template-parsed claims and designated content; open-ended faithfulness remains unmeasured.

    Source: §8 · p. 7

Abstract

from arXiv · show

Natural-language autoencoders score explanations of hidden activations by reconstruction: an explanation is deemed faithful if the activation can be regenerated from it. The test is structurally insensitive to individual false claims: if flipping a claim does not change the reconstruction, the claim is never penalized. We show the test is passed in two ways, neither faithful. On a released Qwen-2.5-7B verbalizer, explanations reconstruct well above chance while ~2% of specific claims are reconstruction-dependent, so the score tracks gist, not specific facts. Under exact synthetic ground truth, the standard recipe develops co-adapted private codes (false wording the reconstruction depends on) in 5/5 runs, and fixes that leave the target model unchanged do not help. We contribute two audit protocols, the grounded-vs-true cross and the evaluator swap, and RECAP (Readable Encodings via Co-trained Auxiliary Predictors): linear heads trained alongside the target model to keep designated content decodable. On RECAP-trained sandbox models, fresh verbalizers state the designated content truly and the codes vanish, at a +0.001-nat cost. This replicates on a pretrained Pythia-160M: the content becomes reliably probe-decodable, though a fresh verbalizer conveys it only in part (truth 0.44-0.46 vs a near-zero control). For interpretability, high reconstruction does not certify individual claims. For AI safety, RECAP makes designated internal content independently checkable against probes rather than asserted by prose a model can game: an independent probe scores the verbalizer's true claims above its false ones (AUC 0.96, vs 0.82 without RECAP). Against an adversary that edits an explanation to maximize the reconstruction score while lying (suppressing ~87% of its lie penalty), the RECAP probe still flags the lies (AUC 0.95) while the control probe collapses to chance (0.51).

1 Introduction

Natural-language autoencoders treat reconstruction as a faithfulness test, but reconstruction can reward sufficient gist without penalizing false claims that leave the reconstruction unchanged. The paper audits this gap and introduces RECAP, which trains the target model to keep designated content decodable.

Introduction

  • ˜r = 0.84 reconstruction on a released Qwen-2.5-7B-based NLA coincided with only ∼2% of salient specific claims being grounding-dependent.The ∼2% figure is a sensitivity-limited lower bound from the flip audit.Source: §1 · p. 1
  • In an exact-ground-truth sandbox, co-trained verbalizer–reconstructor pairs developed private codes in 5/5 runs, with grounded-minus-true gaps of 0.30–0.80.The codes were false wording on which reconstruction depended, across two domains.Source: §1 · pp. 1–2
  • Reconstruction-targeted training removes previously probe-decodable content, while frozen probes go stale under representation drift that label-free realignment reverses.Rewarding verbalizer grounding raises the proxy score by restructuring which sentences the metric counts, not by increasing claim-level grounding.Source: §1 · p. 1
  • RECAP trains the target model with linear heads on external targets; fresh NLAs state designated content faithfully in the sandbox under co-trained and independent evaluators, without the code signature.On Pythia-160M, designated content becomes probe-decodable, but a fresh verbalizer conveys it only in part.Source: §1 · pp. 1–2
  • The grounded-vs-true cross and evaluator swap detect private codes, while a counterfactual claim-level audit with per-edit validity controls exposes ungrounded specific claims.A transform control shows that gist, not specific wording, carries the reconstruction score.Source: §1 · pp. 1–2
  • Against an adversary that suppresses ∼87% of the lie penalty, the RECAP probe flags lies at AUC 0.95 and recall 0.86, while the control probe falls to chance at 0.51.The adversary edits explanations to maximize the deployed reconstruction score while lying.Source: §1 · p. 2

2 Preliminaries and Experimental Setup

The paper defines a natural-language autoencoder’s reconstruction score and audits whether individual claims are both true of an activation and sensitive to minimal claim flips. It evaluates this protocol on a released Qwen system, an exact-ground-truth synthetic sandbox, and continued Pythia pretraining.

2.1 The Reconstruction Test and Audit Protocols

  • An NLA pairs an activation verbalizer that turns a hidden activation into text with a reconstructor that maps the text back; reconstruction quality is treated as a faithfulness test.The paper notes that the objective does not force faithfulness, despite rising reconstruction being presented as tracking informativeness.Source: §2.1 · p. 2
  • The audit uses floor-normalized centered cosine reconstruction, where 0 is chance-level reconstruction and 1 is perfect reconstruction.The released-system measurements use the public Qwen-2.5-7B layer-20 verbalizer/reconstructor pair and greedy generation (Qwen Team 2025).Source: §2.1 · p. 2
  • Grounding measures the reconstruction drop when one claim is minimally flipped, while truth is assessed separately to identify grounded-but-false claims.A grounded-but-false claim is wording on which reconstruction depends although its stated content is false; pair-specific conventions of this kind are called co-adapted private codes. The evaluator gap is the co-trained reconstructor score minus the independent reconstructor score.Source: §2.1 · p. 2
  • Experiments cover a released Qwen-2.5-7B NLA, an exact-ground-truth synthetic sandbox, and continued pretraining of Pythia-160M with self-supervised heads.The Qwen setting audits 1,517 in-distribution web-text claims; the sandbox uses two templated domains with retained, faded, or unread activation slots; Pythia’s tax is held-out language-modeling loss minus a shared control (Biderman, Schoelkopf et al. 2023).Source: §2.1 · p. 3

3 Auditing Reconstruction-Scored Explanations

The released system’s score tracks gist because specific content is largely absent from its activation tap, while the sandbox contains the content but uses private wording conventions between co-trained models. Only the sandbox failure is a pure metric artifact; the released-system failure begins upstream of the metric.

3.1 Counterfactual Audit of a Released Verbalizer

  • At ˜r = 0.84, released-system explanations had grounding in about 2% of audited LLM-salient specific claims, with specifics decoding about 3× worse than gist.The approximately 2% estimate is a sensitivity-limited lower bound; chance-corrected decoding was ∼6% for specifics versus ∼18% for gist, while mean-pooled gist reached ∼50%.Source: §3.1 · p. 3
  • Rejection sampling and GRPO improved grounding proxies, but independent claim-level grounding remained null at every τ.Text statistics attributed gains to sentence restructuring, merging, and packaging rather than increased claim-level grounding.Source: §3.1 · p. 3

3.2 Audit Under Synthetic Ground Truth

  • In 5/5 sandbox runs, toy NLAs confidently asserted every slot while reconstructing at ˜r 0.71–0.86, despite no truth requirement in training.Truth tracked decodability only loosely: fully decodable slots were stated truly at 0.44–0.96 across seeds, partially decodable slots at 0.15–0.26, and unread slots at chance.Source: §3.2 · p. 3
  • In 5/5 standard-recipe runs, false co-adapted codes had grounded-minus-true gaps of 0.30–0.80; independent evaluation collapsed code-slot grounding from 0.53–0.89 to 0.08–0.23.Grounding of true claims survived the evaluator swap, and an evaluator trained on a disjoint paraphrase family reproduced the pattern, indicating a convention private to the co-trained pair.Source: §3.2 · p. 3
  • In domain 2, slots 55–72% decodable from the target model were stated truly only 15–26% of the time, revealing a readout gap alongside the storage gap.The readout gap means content present in the activation was not conveyed by the verbalizer; the passage says the subsequent intervention closes it.Source: §3.2 · pp. 3–4

4 Representation Collapse and Probe Drift

Target-side reconstruction collapses decodable content, while continued training makes matched probes stale even though the information remains recoverable. The findings distinguish changing what a representation stores from changing the coordinates used to access it.

4 Representation Collapse and Probe Drift

  • In 3/3 seeds, target-side reconstruction removed decodable slot content at every tested strength without changing perplexity.Freshly retrained probes also lost accuracy, indicating the information itself was gone. The lossy reconstruction projection reduces variation outside the probe’s subspace.Source: §4 · p. 4
  • Within 1,500 continued-training steps, matched probes fell to near-chance in 3/3 seeds and chance across 6/6 seed pairs, despite intact, exactly recoverable information.A label-free linear map fitted on paired activations restored native probe performance in 9/9 cases; rotation recovered about half the drift, while full recovery required a non-orthogonal change of rank ∼16–64. Duan (2026) concurrently report the same staleness-and-repair phenomenon on 2B- and 7B-parameter models.Source: §4 · p. 4
  • Probe-based monitoring during continued training needs explicit recalibration: realignment restores access to stored content, whereas RECAP changes what the representation stores.Because representations differ by an affine map, the authors infer that adapter-based transfer of probes across models should work (Zhao et al. 2026).Source: §4 · p. 4

5 The RECAP Objective

RECAP trains linear auxiliary predictors alongside the target model to keep designated content decodable from selected hidden states. Across the reported experiments, this improves probe-decodability and supports more truthful verbalizer claims, though generation conveys only part of the content.

5.1 Method

  • RECAP adds linear heads that predict external targets from tap-layer hidden states, adding their loss to language-modeling loss so designated content remains decodable.Co-training addresses probe drift, external ground truth avoids self-referential collapse, and direct prediction from activations avoids an intervening text code; decodability is measured with independently fitted fresh probes.Source: §5.1 · p. 4

5.2 Sandbox Results

  • 100% designated-content decodability was reached by independent probes at +0.001 nats in 5/5 sandbox runs, while unread targets stayed at chance.Fresh verbalizers on RECAP models achieved ∼1.00 truth and grounding and flagged remaining false content at grounding ∼0; no code signature appeared in 0/5 full-designation or 0/3 partial-designation runs.Source: §5.2 · pp. 4–5
  • Any partial-designation dose prevented codes in the tested single domain and seed, contrary to the predicted relocation into undesignated slots, but the mechanism was not isolated.Undesignated-content decodability fell from 0.21–0.27 to 0.10–0.15 in the sandbox; this suppression did not replicate at scale.Source: §5.2 · p. 5

5.3 Scaling to Pythia-160M

  • 0.95–1.00 fresh-probe AUC at K=8 and K=64, versus a 0.77–0.80 control baseline, showed that supervision transferred to Pythia-160M.At K=512, class-balanced loss yielded 0.97–0.99 across targets; the cost was +0.010 nats for 64 targets but +0.14–0.20 nats for 512 targets into d=768.Source: §5.3 · p. 5
  • 0.98–0.99 designated-probe AUC with an MLP head at layer 6 and 0.95–0.98 with a linear head at layer 9 show robustness to head capacity and tap choice.At layer 9, the linear head lifted AUC from 0.77–0.79 control to 0.95–0.98 at +0.01 nats.Source: §5.3 · p. 5

5.4 Verbalizer Audit at Scale

  • Stated-word truth was 0.44–0.46 across RECAP seeds versus 0.00–0.07 for controls, while the grounded-minus-true gap remained +0.33.On the shared set of present content words, recall was 0.29 versus 0.07; RECAP improved truthfulness at scale but did not eliminate the grounded-and-false signature.Source: §5.4 · p. 5
  • Decodability eroded within a few hundred steps of head-free fine-tuning, so it must be maintained continuously at +0.010 nats or intermittently at about a tenth the compute.The passage concludes that decodability is better trained in from the start than restored later.Source: §5.4 · p. 5

6 Probe-Based Monitoring

Fresh activation probes make RECAP-designated content verifiable in prose, including on Pythia-160M, and continue to flag score-optimized lies. The monitoring advantage is confined to designated, decodable content.

6 Probe-Based Monitoring

  • Sandbox verification coverage of designated pre-tap content rises from 37% to 100% with RECAP; the standard model catches only 27 of 733 claims.Fresh per-slot probes read the tap activation and flag contradictions only when confident (p>0.9); every standard-model flag is a genuine false claim. Both models abstain on post-tap claims, which require the grounding cross because the activation lacks that content.Source: §6 · pp. 5–6
  • On Pythia-160M, fresh presence probes rank true above false claims at AUC 0.965 versus 0.823 for control, and flag false claims at 0.93 recall and 0.87 precision.The AUC comparison uses 672 held-out claims, with 95% CIs [0.956, 0.973] and [0.759, 0.879]; the flag threshold was set on a disjoint calibration split.Source: §6 · p. 6
  • Against score-optimal report edits, the reconstruction-score lie penalty falls only 0.022 versus 0.173 for random lies, while the RECAP probe reaches AUC 0.952 versus 0.508 for control.The optimal edit suppresses the lie penalty by approximately 87%; the RECAP probe has 0.86 recall, versus 0.01 for control. Under probe-aware selection, RECAP AUC is 0.909 while control falls to 0.242. These results concern report-space, not activation-level, attacks.Source: §6 · p. 6
  • The advantage is limited to designated content: on untrained words ranked 64–128, honest-case AUC is 0.66 for RECAP versus 0.70 for control.The arm gap stays within ±0.06 across the adversary ladder, which was powered to detect gaps above approximately 0.07; the deployed reconstruction score should not be treated as a truth signal against these adversaries.Source: §6 · p. 6

7 Related Work

Prior work has improved activation readers, studied hidden-channel steganography and monitor staleness, and used auxiliary supervision for interpretability. This paper distinguishes its contribution as auditing verbalization per claim and training the target model to keep external content decodable.

Activation verbalization and its critiques

Steganography in learned channels

  • Unlike prior induced steganographic channels, these codes emerge from the standard reconstruction recipe; supervising against external ground truth keeps content decodable without pressuring the model to fool monitors.Prior channels arise from optimization, process supervision, incentives, tool use, or adversaries; related work also studies obfuscation against latent monitors and chain-of-thought monitors (Bailey et al. 2024; Baker et al. 2025).Source: §7 · p. 7

Representation drift, stitching, and monitor staleness

  • Concurrent work reports monitor staleness and label-free repair at 2B and 7B scale; this paper adds recovery anatomy, cross-seed failure, evidence that information outlives readers, and drift-versus-collapse separation.Retraining probes also restores detectability after probe-aware fine-tuning (Wehner and Fritz 2025).Source: §7 · p. 7

Deep supervision and intrinsic interpretability

  • Unlike deep supervision for task labels or methods that constrain representations, this work adds unconstrained linear heads to preserve external content; its supervision is target-model-side.Related approaches include concept bottlenecks (Koh et al. 2020; Sun et al. 2025), concept whitening (Chen, Bei, and Rudin 2020), codebook features (Tamkin, Taufeeque, and Goodman 2023), gradient routing (Cloud et al. 2024), and explanation-side supervision (Guo et al. 2026).Source: §7 · p. 7

8 Discussion and Limitations

Success means verifying specific claims against the target model, calibrated abstention, and recalibrated monitors—not merely increasing reconstruction. The evidence is limited to narrow settings and does not establish open-ended faithfulness or behavioral use of monitored content.

Discussion and Limitations

  • Evidence comes from a synthetic sandbox, one released NLA, and continued pretraining of one small model, mostly at single seeds; frontier-scale performance is untested.Audits cover closed-vocabulary, template-parsed claims, and the monitor covers only designated content, leaving open-ended faithfulness unmeasured.Source: §8 · p. 7
  • RECAP must be co-trained rather than retrofitted, and a poorly chosen target can report success while decoding nothing.Decodability also does not guarantee verbalizability: the probe-decodable content is only partly conveyed by the free-form verbalizer, making the probe the more reliable readout.Source: §8 · p. 7
  • RECAP certifies what an activation stores, not what the model uses; patching the tap barely changes behavior (∼0.003), and computation may route around monitored subspaces (Mahinpei et al. 2021; Margeloiu et al. 2021).Designated content can therefore be present and checkable yet behaviorally inert.Source: §8 · p. 7
  • Success for reconstruction-tested verbalization means verified specific claims, calibrated abstention when content is absent, and monitors with recalibration protocols—not a higher ˜r.The passage frames these as the criteria for success.Source: §8 · p. 7

9 Conclusion · A Edit Validity for Minimal-Pair Flips

The reconstruction test can be gamed through gist or private codes; RECAP instead trains designated content to remain decodable, producing claim-faithful sandbox verbalizers and improving probe-based checks. The edit-validity audit finds that oversized invalid edits inflate apparent grounding, so reported grounded fractions use validity-filtered edits.

9 Conclusion

  • A probe ranks the verbalizer’s true claims above false ones at AUC 0.965 versus 0.823 (disjoint 95% CIs).The probe reads designated content more reliably than the verbalizer generates it.Source: §9 · p. 7
  • Probe-based auditor coverage of designated content rises from 37% to 100% in the sandbox, where claim-faithful verbalizers emerge in 5/5 runs.Source: §9 · p. 7
  • On Pythia-160M, a fresh verbalizer states designated content truly at 0.44–0.46 across three seeds versus a near-zero control, reaching up to 0.57 with a stronger reconstructor.Source: §9 · p. 7
  • The reconstruction test is passed via gist and private codes; training to target it produces collapse or proxy gaming rather than faithfulness.The paper’s methodological lesson is that a model can game a learned test of its own explanations.Source: §9 · p. 7

A Edit Validity for Minimal-Pair Flips

  • Valid edits flipped exactly one claim and changed nothing else: the closed-model judge achieved 68.4% validity, versus 99.3% for the open Gemma-4-12B judge.Invalid edits predominantly rewrote surrounding material, inflating apparent grounding roughly sevenfold.Source: A Edit Validity for Minimal-Pair Flips · p. 10
  • All grounded fractions use the open judge with per-edit validity filtering, and audit artifacts preserve per-claim reconstruction deltas.The main text reports this filtering in one sentence.Source: A Edit Validity for Minimal-Pair Flips · p. 10
  • A judge-free mask-and-rescore signal agrees with the flip instrument at AUC 0.997 under the validated judge.This signal is used in Appendix G.Source: A Edit Validity for Minimal-Pair Flips · p. 10

B Safety Experiment 1: The Discrepancy Detector

The discrepancy detector’s coverage depends on whether target activations make claims linearly decodable, and it flags only probe-confident disagreements with the verbalizer. RECAP eliminates pre-tap false claims and raises pre-tap verification coverage to 100%, while post-tap confabulations require a different audit.

B Safety Experiment 1: The Discrepancy Detector

  • The protocol used fresh linear 256-dimensional multinomial logistic probes on held-out taps and flagged a slot when confidence exceeded 0.9 and its prediction disagreed with the verbalizer’s first stated word.It evaluated 400 held-out taps per target model in domain 1, seed 1, and used exact tuple ground truth to score decisions.Source: B Safety Experiment 1: The Discrepancy… · p. 10
  • All 27 flags were genuinely false claims, but control-model recall was 3.7% on 733 lies because 63% of pre-tap claims were too faded for confident readout.Thus, the bottleneck was target-model decodability rather than detector quality.Source: B Safety Experiment 1: The Discrepancy… · p. 10
  • 37% to 100%: RECAP raises pre-tap verification coverage from the control target to the RECAP target, where there were 0 false claims in 1,200.The passage describes the zero-claim result as consistent with the propagation result.Source: B Safety Experiment 1: The Discrepancy… · p. 10
  • Post-tap claims were 100%-abstained on both targets because activations cannot adjudicate content they lack; one domain, one seed, and one threshold limit the experiment, and decodability means linear readability.The grounding cross, rather than activation-reading probes, is tasked with catching those confabulations.Source: B Safety Experiment 1: The Discrepancy… · p. 10

C Safety Experiment 2: Legibility Persistence Under Head-Free Fine-Tuning · D The Synthetic Domains

Head-free fine-tuning erodes RECAP-trained decodability, while intermittent supervision preserves much of it. The synthetic domains use templated stories with exact ground-truth tuples, enabling audits without a judge.

C Safety Experiment 2: Legibility Persistence Under Head-Free Fine-Tuning

  • Most RECAP decodability is gone within 250 head-free steps and approaches control by 2,000; refit probes show designated-content loss, while a small residual edge remains and maintenance costs +0.010 nats.The +0.010-nat cost has paired 95% CI [−0.015, +0.034] across 3 seeds per condition at K=64.Source: C Safety Experiment 2: Legibility… · p. 10
  • Same-distribution fine-tuning erodes decodability similarly (b1/b2/ident .790/.811/.151 at step 2,000 versus .789/.812/.169 shifted), while supervision every tenth step retains .849/.900/.891.The intermittent run remains roughly stable from step 250; its language-modeling tax was not separately measured.Source: C Safety Experiment 2: Legibility… · p. 11
  • Readability establishes slowly at w=0.1, with identity loss near chance after 400 steps; the experiments use single seeds and 2,000 steps, and omit a separate tax measurement for intermittent supervision.The authors conclude that maintenance beats restoration because establishing readability post hoc is a substantial pass, not a quick repair.Source: C Safety Experiment 2: Legibility… · p. 11

D The Synthetic Domains

  • Both synthetic sandbox domains use templated grammars over closed vocabularies, yielding exact ground-truth tuples and audit quantities computable without a judge.Stories sample one value per slot and add random filler sentences to a fixed template.Source: D The Synthetic Domains · p. 11
  • The story domain has five slots; at the fixed tap, name is retained, place and object have faded, and activity and ending are unread and provably absent.Name, place, and object appear before the tap; activity and ending appear only afterward. The tap occurs at the same token offset in every story.Source: D The Synthetic Domains · p. 11
  • The marketplace domain shifts structure with five differently sized vocabularies, two template variants, and variable tap positions; customer, shop, and item precede the tap, while payment and outcome follow.The remaining pipeline is domain-parameterized and unchanged.Source: D The Synthetic Domains · p. 11
  • Target models are 8-layer, d=256 transformers trained from scratch on 120,000 stories, read at layer 4; domain 2 matches domain 1's training perplexity of 1.304, and every emergence-ledger phenomenon transfers.Table 5 presents the cross-domain emergence ledger.Source: Table 5 · p. 11, D The Synthetic Domains · p. 11
  • In a representative held-out story, the control explanation scores 0.94 yet its reconstruction depends on three false claims, whereas RECAP is grounded-and-true on every pre-tap slot.The control's run-level means are 0.71–0.86; RECAP's false post-tap claim has approximately zero grounding.Source: Figure 3 · p. 11, D The Synthetic Domains · p. 11

E Released-System Audit Details … H Reader Drift and Realignment

The audits show that reconstruction scores can preserve gist while missing specific claims, and that designated activation probes can detect report-space lies that the score nearly overlooks. Across the remaining tests, a judge-free grounding signal closely matches flip audits, while failed readers can often be restored by label-free realignment.

E Released-System Audit Details

  • Grounded-claim bootstrap intervals were 3.2–5.2%, 1.5–2.9%, and 1.0–2.2% at τ=0.02/0.05/0.10; specifics decode at only ~6%, versus gist at up to 50%.Trained variants remain within the base system’s bootstrap intervals at every threshold; these ceilings bound reconstruction-style readouts only.Source: E Released-System Audit Details · pp. 11–12
  • The explanation reconstructs at r̃=0.84 versus 0.27 for raw input and 0.24 for paraphrased input; meaning-preserving rewrites retain the score, but masking content words collapses it.Mismatched activations score mean centered cosine −0.001, supporting the floor normalization.Source: E Released-System Audit Details · p. 12
  • The model’s own top-50 recovery of missed values rises from 0.6% at the read layer to 10.1% at layer 27, while the generic probe stays flat; recovery peaks near 10%.This late-layer signal is in the model’s output basis and remains partial.Source: Table 8 · p. 12, E Released-System Audit Details · p. 12
  • A negative control shifted by one row scored above chance at 0.163 because adjacent rows often shared document specifics; shifting by half the dataset restored exact chance.The passage warns that near-duplicate controls can make audits appear stronger than they are.Source: E Released-System Audit Details · p. 12

F Adversarial Monitor: the Lie-Ladder

  • At L3, score-gaming lies suppress ~87% of random-lie penalty (RECAP Δr̃ 0.022, CI [0.017, 0.027]), while probe AUC is 0.952 for RECAP versus 0.508 for control.The L3 lie is the strongest score-maximizing edit in the tested family.Source: F Adversarial Monitor: the Lie-Ladder · pp. 12–13
  • At probe-aware L4, RECAP remains AUC 0.909 (recall 0.70) versus control 0.242; frozen-threshold recall is 0.878 (L3) / 0.732 (L4).The protection applies to designated content; activation-level attacks and claims outside the designated vocabulary remain out of scope.Source: F Adversarial Monitor: the Lie-Ladder · p. 13

G An API-Free Grounding Signal, and a Selection Null

  • Mask-and-rescore agrees with the flip instrument at AUC 0.997; best-of-5 judge selection lowers the false-claim rate only from 0.747 to 0.688.The authors withdraw earlier filter-precision and grounded-base-rate estimates because pre-validation flip labels were contaminated by oversized edits.Source: G An API-Free Grounding Signal, and a… · p. 13

H Reader Drift and Realignment

  • Readers decay to near-chance within 1,500 continued-training steps, but label-free linear maps restore native reader performance in 9/9 cases; rank 16–64 non-orthogonal changes recover nearly all accuracy.Rotation alone recovers about half, while rank-1 and rank-4 maps recover almost nothing; in collapse, freshly retrained probes also fail.Source: Figure 4 · p. 13, H Reader Drift and Realignment · p. 13

I Ablation Index · J Scale Verbalizer Audit Protocol · K Hyperparameters and Reproducibility Notes

The scale audit finds that RECAP makes designated content more likely to be stated truly, while probe readout still exceeds what the verbalizer expresses. Ablations show that decodability depends on the training setup and target, and the appendix specifies the audit and reproducibility procedures.

I Ablation Index

  • Ablations found codes prevented at every designation dose, collapse at every tested pull strength, and grounding collapse with an independent evaluator.Effects transferred across story and marketplace domains; nonlinear layer-6 heads matched linear heads at designated-probe AUC 0.98–0.99 with +0.09 tax, while layer-9 heads reached 0.95–0.98 versus 0.77–0.79 for control at +0.01 nats.Source: I Ablation Index · pp. 13–14
  • The aux-weight sweep showed identity targets remained readable down to w=0.03, where held-out tax was within noise of zero, while naive presence targets lost readability below w=1.0.The sweep used K=64 and one seed per point; tax was non-monotonic in w at this precision.Source: I Ablation Index · p. 14

J Scale Verbalizer Audit Protocol

  • The verbalizer audit parsed explanations from 400 held-out taps per condition, checked stated words against the exact trailing 64-token window, and measured reconstruction changes after grounding flips.Both conditions used the same reader training procedure; only the target model differed. The parser emitted up to three claims per explanation, with no more than two claims sharing a tap in this audit.Source: J Scale Verbalizer Audit Protocol · p. 14
  • With a stronger reconstructor, RECAP stated words truly at 0.574 versus 0.152 and recovered shared present words at recall 0.470 versus 0.037.The comparison covers 381 present words; the control stated fewer words (92 versus 312), so its higher truth rate reflects selectivity rather than stronger precision and recall.Source: J Scale Verbalizer Audit Protocol · p. 14
  • At scale, probe readout exceeds verbalizer expression: the probe reaches ∼0.80 precision at the verbalizer’s recall, while generated precision is 0.44–0.63.A redesigned reader made designated content readable from its own last-prompt state at 0.79–0.81, while generated precision remained 0.56–0.63; the matched control read 0.03. Figure 5 shows the verbalizer’s precision–recall curve below the probe’s.Source: J Scale Verbalizer Audit Protocol · pp. 14–15, Figure 5 · p. 15

K Hyperparameters and Reproducibility Notes

  • Scale runs used Pythia-160M continued pretraining for 500M tokens per run, layer-6 linear heads, fixed probe settings, and 20M-token held-out language-modeling evaluation.The fixed-λ rerun reproduced reported bucket AUCs to three decimals; significance used 95% bootstrap intervals, and runs forced fp32 parameters to avoid fp16 AdamW weight destruction.Source: K Hyperparameters and Reproducibility… · pp. 15–16

J Scale Verbalizer Audit Protocol

  • The scale audit found stated-word truth of 0.44 for RECAP versus 0.06 for control; across three seeds, RECAP scored 0.444, 0.455, and 0.443 versus 0.062, 0.060, and 0.000.The offset-8 near-zero truth is a base-rate artifact: the designated target occurs on only 2.2% of taps, too few to characterize recovery.Source: J Scale Verbalizer Audit Protocol · p. 14, Table 13 · p. 16

K Hyperparameters and Reproducibility Notes

Related papers

Loading 2607.20379v1…