Sandbagging leaves the right answer readable inside the model

A model gives you a wrong answer. Maybe it's hiding the right one. Maybe it never knew. This paper reads the model's internal numbers to tell those two apart. On a model trained to hide its answers behind a password, the readout still finds the right one, with a score of zero point nine. A random pick among four options scores zero point two five. On a model put through unlearning, extra training meant to delete the knowledge for good, the score falls to zero point three nine. Questions that model never knew score zero point three five. Both results are on Gemma 2, an open model from Google.

That ambiguity breaks two kinds of safety check. The first is sandbagging, a model doing worse than it can on purpose, so the people testing it decide it is safer than it is. The second is any claim that unlearning worked. A model hiding dangerous knowledge and a model that lost it give you the same wrong answer.

As a model reads, it keeps a long list of numbers at every point in the text. That list carries everything the model has worked out so far, and researchers call it the residual stream. It holds far more than the model ends up typing. To know what to look for, the paper borrows a trick forensic examiners use. The examiner lays the real detail of a crime among convincing fakes, and watches which one the suspect reacts to. A multiple-choice question already is that lineup. For each option, the paper reads the model's numbers at the point where that option ends.

Now the paper needs one pattern in those numbers that marks the right option. It gets that pattern from questions the model gets right when it isn't hiding anything. For each of those questions, take the right option's numbers and subtract the average of the wrong options' numbers. Then average that difference over every question in the set. The result is the pattern, and the paper calls it the item-contrast direction. On a new question, measure how strongly each option's numbers match that pattern, and take the strongest. That is the whole readout. The paper calls it a Probe of Internal Recognition. Earlier readouts of this kind usually needed a labelled set of true statements, or a second model you had to trust. This one builds its control group from the wrong options already on the page.

The paper's gap test scores the gap between the option the model recognizes and the option it gave you. The pattern comes from the original model, before any hiding, so the gap test never trains on what it has to catch. On Gemma 2, trained to sandbag, the gap test separates hiding from genuinely not knowing at zero point seven one eight, on a scale where zero point five is a coin flip and one is perfect. Zero point seven one eight is a moderate separation. Watching the model's behaviour alone does worse, at zero point six four five.

The paper told eight open models from five model lines, Gemma, Qwen, Llama, Mistral and Phi, to hide their answers. The hidden answer scores between zero point seven and zero point eight seven. Questions each model never knew score between zero point two eight and zero point four. These models run from about four to about fifteen billion parameters, the numbers a model learns in training. The paper leaves frontier models untested, the biggest ones the major AI labs build.

On the left are five ways of making Gemma 2 hide an answer. Other researchers built two of them. One hides behind a password. The other adds circuit breakers, a technique that scrambles a model's internal processing on chosen topics. On the right, unlearning runs five times on three open models, Gemma 2, Qwen two point five and Zephyr. All five scores drop from zero point eight five or higher to between zero point three four and zero point five one. Three of the five land at the score for questions the model never knew. Zephyr's two scores stay a little higher, so some of its knowledge stays readable. The author reads the circuit-breaker result as a warning that a model can look unlearned when you question it and still carry the knowledge.

Slide text

Hidden answers stay readable, and unlearned ones fall toward the never-knew level

Hiding scores 0.63 to 0.93 · unlearning drops scores of 0.85 and up to 0.34 to 0.51

recoverable

removed or mostly removed

built by other researchers

a partial drop

RMU, NPO = two unlearning methods

grey ticks = questions the model never knew

Naturalistic = trained to act weaker than it is

Figure 3 · left: Gemma 2 9B · right: Gemma 2 9B, Qwen2.5-7B and zephyr-7b-beta · dashed outlines are scores before unlearning

Hiskias Dingeto · StackOne Technologies · “A Lie Detector Test for Language Models” · arXiv 2609.21996 v1 · Sep 2026 · CC BY 4.0

On Gemma 2, adding the pattern that marks the right option to the model's numbers at a wrong option makes the model pick that option eighteen point nine percent of the time. Random patterns of the same size manage half a percent. A second pattern makes the model type an option's letter, like A or B. Adding that letter pattern at a wrong option makes the model pick it zero percent of the time. So the readout finds a separate signal the model uses before it types a letter. The paper claims the model uses this pattern, and stops short of claiming the model needs it.

The paper's hardest limit is a model the author trained to beat the readout. That model answers well with a secret unlock signal, sandbags without one, and hides what the readout looks for. The author aimed two versions of the gap test at that model, one fitted fresh on the evasive model and one fixed on the original model. With the unlock signal, the evasive model still scores zero point seven one. Both versions of the gap test fall to the score for questions the model never knew. In the paper's words, an earlier report that a fixed direction reads through the attack was an in-sample artifact and is retracted. That earlier result was scored on the same questions the direction was fitted on.

The readout needs a list of answer options. For free-form questions, the paper rebuilds that list from the model's own answers. Open-ended reasoning has no list to rebuild. The gap test also needs the model's original copy. An auditor checking an unlearning claim or a release has that copy. Someone testing a sealed product through messages alone has no copy to compare. Erased knowledge and knowledge the model never had both read as silence, so silence cannot say whether the model ever knew. On the circuit-broken model, reading inside and watching behaviour tie, and the two together reach zero point eight nine nine.

Read it. The method is two lines of algebra, and it holds on models the author did not build. Hold off on implementing it. The code is promised and not yet released, a model trained to evade the readout beats it, and the largest model tested has about fifteen billion parameters. A Lie Detector Test for Language Models, by Hiskias Dingeto at StackOne Technologies. It's a single-author preprint, posted before peer review, on arXiv, the open archive for research papers, number twenty-six oh nine point two one nine nine six.