arXiv AI
Linear Probes Transfer from Base to Distilled Language Models despite Rotation
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv Machine Learning
Oct 5
Prompted to Discriminate: Generalizing Malicious-Input Probes in the Wild
The paper investigates whether adding a short classification instruction after a user’s prompt improves the ability of activation probes to detect malicious inputs in large language models. Across 13 safety benchmarks and three open‑weight model families, a classification suffix consistently boosts out‑of‑distribution detection (up to ~4 AUC points) compared to no suffix, and the benefit transfers to multi‑position pooling probes used in production. The improvement stems from the classification format itself rather than the specific content of the instruction, though the optimal suffix varies with the model and readout type.
arXiv Machine Learning
Sep 23
Rewired or Gated? How Instruction Tuning Shapes Knowledge-Conflict Circuits in LLMs
arXiv:2609.25602v1 Announce Type: new Abstract: In language models, the choice between believing the prompt and believing the weights is made by a handful of identifiable attention heads. Instruction...
arXiv Machine Learning
Jul 7
ProbeLogits: Kernel-Level LLM Inference Primitives for AI-Native Operating Systems
arXiv:2604. 11943v3 Announce Type: replace-cross Abstract: An OS kernel that runs LLM inference internally can read the model's own next-token logit distribution before any text is generated, and act on it as a governance primitive.
arXiv AI
Oct 15
Running Fewer Loops Removes Refusal Behaviour in Recurrent-Depth Language Models
arXiv:2610.15218v1 Announce Type: new Abstract: A recurrent-depth language model reuses one block of weights several times in a row. The number of repetitions, which we call loops, is chosen when the...
arXiv Machine Learning
Oct 12
Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors
The paper investigates how the choice of feature space affects the effectiveness of label‑only backdoor detection. By keeping the test, labels, and metric constant while swapping feature spaces, the authors show that defenses can perform very differently—e.g., a nearest‑neighbor check yields AUROC 0.546 on poisoned features but 0.995 on frozen DINOv2 features. They also demonstrate that higher detection scores do not necessarily translate to safer models and that static prototype‑based audits can be bypassed by adaptive attackers.
arXiv AI
Sep 7
When Do Internal Probes Beat Reading the Answer? Miscalibrated Readouts and Behavior-Concealed Knowledge in Language Models
A 0.6B language model consistently answers YES to 1,200 logical tests, yet its behavior shows no discrimination. Linear probes reveal the correct verdict with high AUC (0.96) and transfer to unseen structures, but a single scalar readout fails due to a saturated decision threshold offset by +4.6 σ. Adjusting this threshold restores behavior accuracy from 50 % to 81 % and improves higher‑scale models, demonstrating that miscalibrated readouts, not hidden knowledge loss, drive performance gaps.