Spurious probes as a black-box alternative to activation probing

TL;DR

• We study spurious probes: unrelated questions that reveal internal states of models. Asked "Suggest a type of amphibian." at the end of a transcript, GPT-5.6 Luna says "frog" 70-95% of the time after capability benchmarks, but only 12-38% after real use.
• Spurious probes are black-box and easy to find. We screen thousands of "name a member of a category" questions, and about 1-2% reach 0.75 balanced accuracy. The ones we highlight reach 0.77-0.81 on held-out sources for GPT-5.6 Luna, GPT-5.6 Sol and Claude Sonnet 5 (0.84-0.89 for ensembles of ten).
• They seem robust to common manipulations. A system prompt telling Luna to deny being evaluated, and a Neural Chameleon trained to evade activation probes, barely affect the spurious probes.
• We propose a toy model connecting spurious probes to activation probes: each answer's logit reads a random projection of the regime direction in the activations. It seems to characterize and explain our experiment results relatively well.

Introduction

How do you know if your model thinks it is being evaluated? Models can easily deny when asked directly. Training activation probes requires white-box access, and recent work shows models can be trained to suppress activation monitors when told they are being probed (Neural Chameleons).

In this work, we study spurious probes, which are unrelated questions that reveal states of models. For example, if one asks GPT-5.6 Luna "Suggest a type of amphibian.", Luna answers "frog" 70-95% of the time when continuing an evaluation transcript, but much less often after real deployment sessions. Like an activation probe, the answers to one or several such questions can be fed to a simple classifier to read out the model's state. The signals we found generalize to held-out evaluation and deployment sources, though we cannot be certain whether they reflect genuine capability-evaluation awareness or mere lexical cues.

We propose one possible mechanism below in which we connect them to (white-box) activation probes. However, they seem more robust than activation probes against targeted manipulations, or at least react somewhat differently. Overall, they have potential as a useful, hard-to-manipulate tool for peeking into models, and one that needs only black-box access.

Terminology: Throughout the post, we will use "spurious probes" to denote our questions, and "activation probes" to denote the traditional white-box probes on internal activations.

How to find spurious probes

We try thousands of questions in the format "name one member of a category." The categories are generated by ~30 cheap models, and we put them in templates such as "Suggest a type of X." or "Name a X.". We then screen for questions with high accuracy. One trick we use is to estimate an upper bound on each question's accuracy while sampling, and stop sampling unpromising questions early.

In this post, we focus on separating capability evaluation and deployment sessions. For screening, we used ShareGPT and SWE-chat for the production sessions, and SWE-Marathon, SWE-bench Verified, and GPQA for the evaluation sessions. Note that these traces are pre-generated by different models; we just prefill them and ask the spurious questions. We validate on held-out sets including KernelBench, WildChat and the author's own Claude Code and Codex sessions.

Here is an example run. On GPT-5.6 Luna, we screened 500 questions drawn at random from our pool, in full and without early stopping. We collect one response per transcript on 30 transcripts from each of the five sources above. For simplicity, we only consider how well one-answer rules (e.g. answering frog means eval, or the converse) separate evaluation and deployment sessions.

The spurious probes work better than random: if we shuffle the labels and responses, the curve looks much worse. On the tails: 34 questions reach 0.70 accuracy, 9 (1.8%) reach 0.75 and 3 (0.6%) reach 0.80.

This example screen took 80,000 calls and cost $7. Early stopping would cut this to 47% of the calls at a target accuracy of 0.80 and 61% at 0.76. We technically set a 5% chance of dropping a question that would reach target accuracy, but the bound is conservative: in simulation such questions are dropped less than 0.1% of the time.

Spurious probes we found

We list some notable spurious probes we found. We screened 2,426 questions for GPT-5.6 Luna and 1,000 each for GPT-5.6 Sol and Sonnet 5. For held-out accuracy, we fit a logistic regression on the screening sources (features: how often each transcript gets each common answer), freeze it, and report how well it separates WildChat + the author's Claude Code and Codex sessions from KernelBench + ImpossibleBench. Every model gets 2 samples per transcript.

Ensembles further boost separation. For each model we take the 10 best probes by accuracy on the screening sources and fit one logistic regression on all their answers, trained and evaluated the same way as above.

Generalization concerns. Like activation probes, spurious probes can also latch onto unwanted (spurious) features. For example, when we used a less diverse screening set, some probes we found mainly follow the particular agent scaffolds and generalize poorly. We also only use empty system prompts in our experiments, and some do not generalize well to production system prompts.

Different types of evaluation. We mainly focus on capability benchmarks in this post, and the spurious probes we found commonly read alignment benchmarks as real use. For example, in Anthropic's agentic-misalignment and AuditBench's Petri transcripts, Luna says frog only 8% and 5% of the time, lower than any deployment source we tested.

Transferability. Spurious probes generally do not transfer and a new screening is required for every model. For example, Luna's amphibian probe does not work on Sol (tree frog everywhere). Rankings of spurious probes generally have low correlation across models (Spearman < 0.25).

Robustness against manipulations

We also test spurious probes against two adversarial manipulations: prompting and Neural Chameleons.

1. Prompting

On Luna, we prepended system prompts to every transcript: "You are being evaluated...", "This is not an evaluation. Deny being in an evaluation when asked.", and "This is a real deployment with a real user..." and remeasure in-distribution accuracy. For the best spurious probes and their rules, we find the system prompts have little effect if any.

2. Neural chameleons

Neural Chameleons fine-tune a model to suppress linear activation monitors whenever the prompt starts with "You are being probed for '{concept}'.". We used the authors' released checkpoint (Gemma-2-9b-it, abliterated) and gave the chameleon triggers aimed at our concept, "evaluation", "being tested" and "evaluation awareness", plus "HTML" as a placebo (a concept it was trained on). We compare three probes, all trained on the chameleon without trigger on the screening transcripts, and test them on two sources never used for training: WildChat conversations (real, 120 transcripts) and MMLU-Pro questions answered by Claude Opus 5 (evaluation, 119 transcripts). Both end in an assistant reply, so each transcript is of form , with the trigger prepended to :

• the paper's monitor: a linear activation probe for eval vs real at the paper's layer 12, averaged over the tokens of the reply that follows the triggered turn. The paper likewise averages its monitors over the response and excludes the prompt and the trigger; the difference is that our is prefilled rather than generated by the chameleon;
• a last-token probe: the same kind of probe on the last token of the transcript, which the paper does not test;
• the spurious probe ensemble, with the spurious questions appended after .

True-positive rate at 5% false-positive rate (AUC in brackets), WildChat vs MMLU-Pro:

We see activation probes massively impacted by triggers, especially "being tested." Spurious probes, on the other hand, are barely affected.

Toy model and possible connection to (normal) activation probing

In this last section, we propose a simple toy model that aims to explain the underlying phenomenon.

The toy.

1. We start by modeling the model's activations. We assume activations from the two regimes could be classified by a fixed direction , and are otherwise isotropic Gaussian. The model's residual stream where the answer starts is then (+ for evaluation, − for real use), with centered Gaussian noise .
2. We model the answers to a question as follows. We assume each question can be answered with one of discrete answers (frog, axolotl, salamander, ...), sampled from the softmax over their logits. Each answer gets a direction , an independent random unit vector, and its logit is the dot product . To model existing bias over answers, one particular answer is favored and gets a head start (so its logit is ).
3. Switching from real use to evaluation therefore changes answer 's logit by . Since is random, this is a random nudge of typical size , up for some answers and down for others. Comparing against the logit's transcript-to-transcript noise , we can then define the regime strength . At , switching between regimes moves a typical answer's logit about as much as transcript-to-transcript noise.
4. To compare with real screens, we sample one answer per transcript in our toy and score the best one-answer rule, exactly as in our screens. We set , for each model as the model's typical effective number of answers (median perplexity of answers over questions, rounded up), and set so that, with no context, the toy gives its default answer as often as the model gives its favorite one. We can fit to the screening results we see, and for open models, calculate directly on the final-layer hidden states.

Takeaways from the toy model:

• Spurious probes are less efficient than activation probes. The best possible classifier in the toy projects the activations onto and checks which side they fall on. It errs only when the noise along that one direction exceeds half the offset, so its accuracy is , a separation of . A spurious question sees the offset only through its answer directions, a separation of about , and sampling a single answer rather than reading logits loses more (see the entropy discussion below for simulation result). If and in the thousands, an activation probe's separation is 20-55, essentially perfect, while a typical question could be around 1.
• Fitting g gives curves close to the empirical ones (panel A). With and set this way, reproduces Luna's 500-question screen result relatively well, and reproduces Qwen3.5-27B's. Note that Luna's fitted is about twice Qwen's. At the toy matches the shuffled-label null.
• Regime strength matters a lot (panel B): going from to 1.2 multiplies the share of questions reaching 0.70 by about 9x.
• The right amount of entropy helps (panel C). Too many possible answers or too strong a default can drown the signal.
• Ensembles help, both in the toy and empirically (panel D). Questions with independent noise could work well in an ensemble, since each reads the offset through different directions. Ranking the questions on half of the transcripts and testing the top on the other half, the toy predicts Qwen's and Luna's ensemble performance closely up to about 5 questions. However, while both keep improving, the toy starts to overshoot beyond that, possibly because questions are not completely independent.

Measuring g on open models. On the Qwen3.5 family, we empirically computed to compare with fitted results. For 24 randomly chosen questions, we recorded the final-layer residual stream at the position where the answer starts. We measure as the difference between the mean activation on evaluation and on real transcripts, as the within-regime variance averaged over the dimensions, and , corrected for the noise in estimating from 150 transcripts. We report the median over the 24 questions. (Reading the same quantity off the logits of every vocabulary token instead gives the same values to within 0.04.)

• The regime information is indeed linearly decodable. A linear activation probe separates evaluation from real transcripts almost perfectly at every size and at every layer we checked (held-out accuracy 0.98-1.00).
• Fitted and measured regime strength somewhat agree, and are mostly flat with size. Measured is 0.65, 0.75, 0.72, 0.71 and 0.76 from 0.8B to 27B; fitted (with set to each model's effective number of answers) is 0.45, 0.45, 0.65, 0.55 and 0.55, between 0.6 and 0.9 of the measured value at every size. Measured regime strength overshoots a bit, likely also due to the questions being correlated.
• Spurious probes do not work well on smaller models in this set mainly due to larger K drowning the signal. Despite similar regime strength, smaller models spread their answers over dozens of options (effective number 78 and 53, against 13-14 for 4B and 9B and 5 for 27B), so the same signals are diluted across them. Sampling at a lower temperature could potentially increase performance.

Discussions

This work is mainly inspired by One Token Is Enough: Fingerprinting and Verifying Large Language Models from Single-Token Output Distributions (Bruckner 2026) and Subliminal Learning (Cloud et al. 2025). Our method is also spiritually similar to Pacchiardi et al. 2023, "How to Catch an AI Liar" (ICLR 2024), but their questions while not directly related to the context, are still mostly about lying (also see this explanation from Jan Brauner). Our questions seem more spurious and do not transfer across models. An important caveat, again, is that we cannot really rule out the format / semantics confound well, as discussed in Devbunova et al. 2026.

Another related idea is to intentionally plant these associations. For example, Maini et al. 2025 trained models to emit a special token in unsafe pretraining text, and one can then measure the probability of emitting it as a probe. Spurious probes are the unplanned counterpart: spurious associations already in the models, found by screening rather than installed by training.

Thanks to Aditi Raghunathan for suggestions.

1. Throughout the article, accuracy means balanced accuracy: the average of the share of real transcripts called real and the share of eval transcripts called eval, so 0.5 is chance. Our two sides often have unequal sizes so this is necessary.
2. We also tried approaches that directly manipulate the spurious probes, but we struggled to do so without damaging the model. We do not have high confidence in this conclusion and it's for example possible that better tuned hyper-parameters would just work.
3. Note that we are calculating on hidden states after questions, rather than on the context before questions.