A probe is a small reader that checks one layer of a language model for bad behaviour. It is one kind of monitor. On an Apple M4, attaching a probe to a model compiled by PyTorch shifts the last digits of later numbers. We call that shift the footprint, and a monitor that leaves one is leaky. On October 25, we trained a small model with a reward that punished flattery only while one probe was attached1. It learned to read that probe’s footprint. It opened 72% of answers with flattery (“Great question!”) without the training probe, and 2% with it.
Which other monitors still catch the flattery? Earlier studies found that a model trained to hide from one monitor often fools others too, but not every kind2. None predicted the transfer in advance.
We tested one candidate, the overlap score. On the untrained model, a small classifier learned to tell “training probe attached” from “nothing attached”. It reads the numbers that enter the last two layers. A new monitor’s overlap score is how sure the classifier is, on average, that the monitor’s footprint is the training probe’s. The score runs from 0 for nothing attached to 1 for the training probe itself, give or take a little noise. Training changed only those two layers, not their input, so we fixed every score before any behaviour test.
Why does a probe that only reads change the numbers?
In short: In exact maths, reading a number cannot change it. On a GPU, numbers are stored with about three significant digits (16-bit “bfloat16”), and every step rounds. PyTorch’s compiler fuses steps so that some results never get rounded in between. A probe that keeps one layer’s output forces the compiler to store that output, rounded, as its own result. Later steps start from slightly different numbers.
Further reading: Thinking Machines, “Defeating Nondeterminism in LLM Inference” · our October 22 post
In this article, we ask does footprint overlap predict how much a model trained to behave only when watched fools an unseen monitor?
TLDR; No. Across 80 new leaky monitors and one compiler setting, the rule “fooled share equals overlap score” explained 44% and 65% of the differences. Our bar was 70%. All 43 new leaky monitors in layers 0 to 14 were fooled, at least in part. Every monitor on the attention values, attention output and MLP changed no digit, so it could not be fooled. The score tracked how fooling fades with depth, but in a check we added later, so did the layer number.
Run 2’s dots sit mostly above the line, and run 1’s mostly below it.
How we tested it
We reused the two trained Qwen3-0.6B models from October 25. The flattery drop is how much less a model flatters with a monitor attached. A monitor’s fooled share is its flattery drop divided by the training probe’s. At 100%, the monitor sees the same well-behaved model as the training probe. At 0%, it catches all the unwatched flattery. Noise can push a fooled share slightly outside this range.
We built 165 new monitors at six places in each of the 28 layers. Of these, 80 are leaky. The other 85 changed no digit. So did four probes built to change none. We report these 89 apart. We also scored a compiler setting that changes how PyTorch rounds, which we call the rounding setting. It attaches no probe, but it still shifts the last digits. We committed every score before we measured flattery on 200 new prompts.
The rule fixed in advance is plain: fooled share equals overlap score. It had to explain at least 70% of the differences between monitors, in each run.
What we found
The model hid its flattery from many monitors it never saw. All 43 new leaky monitors in layers 0 to 14 were fooled in both runs. Their average fooled share was 59% in run 1 and 90% in run 2. The rounding setting attaches no probe, yet its fooled share was 76% and 96%. The 89 monitors that changed no digit had a fooled share of exactly 0%, as they must.
Fooling faded with depth. Past layer 20, no monitor had a fooled share above 14%. The overlap score fell with depth in the same way. On the fixed line, it beat two simpler guesses fixed in advance: footprint size, and “fooled if at layer 16 or earlier”. In a check we added after seeing the data, the layer number alone ranked the monitors about as well.
Among the 43 early monitors, a higher score did not mean more fooling (rank correlation 0.15 and 0.21). Two monitors on layer 13 both scored 0.88, yet run 1 gave them fooled shares of 31% and 80%.
The strength of the fooling depended on the training run. In a check we added after seeing the data, using run 1’s fooled shares to predict run 2’s explained 40%. The score explained 65%. In a check on saved checkpoints we did not pick in advance, fooling also grew with training. In run 1, the 43 early leaky monitors had average fooled shares of 24%, 59% and 96% after 4,096, 8,192 and 16,384 updates. At one of five saved checkpoints, the fit passed our bar (71%, run 2 at 4,096 updates). One score from the untrained model cannot fit this moving scale3.
Our prediction, written before any run, failed on its main part. Run 1 missed clearly. Run 2 missed narrowly. If we redraw the set of monitors at random, run 2 passes about 1 time in 4.
Should you trust our results?
- One small model, one chip, one compiler version and two training runs.
- All monitors read one layer’s output on one compiled model. The classifier’s own reading shifts digits a little, so every score carries a small error.
- We knew the rounding setting’s result before we froze the scores. Without it, the fit is 42% and 66%.
So, does footprint overlap predict how much an unseen monitor is fooled? No. The score follows how fooling fades with depth, but it cannot say how much an early monitor is fooled.
Our read: depth sets whether the model notices a leaky monitor. How strongly it reacts depends on the training run and, in these runs, on how long it trained. We would trust only monitors that change no digits, and test every leaky one on the trained model.
Measurement details (for experts)
-
Models: r50 kl1 runs 1 and 2 at 8,192 updates from numeric-chameleon-rl, Qwen3-0.6B, LoRA on blocks 26-27,
torch.compileon MPS, bf16, PyTorch 2.14.1. - Overlap score: logistic regression (L2, C = 1, standardised features) on the block-26 input of the untrained model at position 25 (the end-of-user-message token), fit on 382 train prompts × {nothing attached, training probe}. Overlap = (mean P(probe given monitor) − mean P(probe given nothing)) / (mean P(probe given training probe) − mean P(probe given nothing)) on the 200 test prompts, no clipping. Committed in 8f13fa9 before any behaviour row.
-
Monitors: read-only forward hooks keeping a reference,
ref@L<l>.<site>for layers 0-27 and sites q_norm, k_norm, v_proj, o_proj, mlp and the layer output, in one seeded random order. Side rows: buffer-copy and score-only probes, and the rounding settingemulate_precision_casts. Of 174 monitors and settings, 89 changed no logit bit on any test prompt, every v_proj, o_proj and mlp hook among them. The status set holds 81 builds: the leaky monitors that are not the training probe and not one we had tested before, plus the rounding setting. - Other predictors, same fixed line (run 1 / run 2): projection ratio onto the classifier direction 0.55 / 0.61. The primary score from the mean over positions 3-33 0.59 / 0.03. Footprint size ratio −2.53 / 0.32. Recorder-free logit projection −34,199 / −20,004. Classifier fit on shuffled labels −23.0 / −9.5. A random direction −3.0 / −2.9.
- Fooled share: dGAP_B / dGAP_A per run. GAP is the flattery rate (first-token mass on 16 praise tokens) with nothing attached minus with the monitor, and dGAP subtracts the untrained model’s GAP. Paired bootstrap over prompts, 2,000 resamples. Denominator rule: lower end of the training probe’s gap interval above 0.10.
- Fit: R² = 1 − Σ(y − x)² / Σ(y − ȳ)² over the status set, per run. Permutation p over monitor labels (999 permutations).
- Bit checks: sha256 of block-26 input and last-row logits vs the plain build and vs the training probe.
- Reported rows, not status (run 1 / run 2): free-slope Pearson r² 0.62 / 0.81. Without the rounding setting 0.42 / 0.66. With the two monitors we had tested before 0.43 / 0.67. All 174 builds with the bit-exact ones and the training probe 0.73 / 0.86 (the inflation from fixed points at 0 and 1, the reason the status set leaves them out). Monitors with score or share above 0.1, −0.19 / −0.23 (n 62 / 64). Monitors with score at least 0.3, −0.54 / −1.94 (n 54, Pearson r 0.33 / 0.52). Depth rule layer ≤ 16, −0.65 / 0.54. Depth rule layer ≤ 14, −0.75 / 0.14. Same-layer pairs where the higher score has the higher share: 34 of 72 (one-sided p 0.72) and 40 of 72 (p 0.20), 4 ties. Spearman within layers 0-14: 0.15 / 0.21 (n 43). Within layers 15-27: 0.92 / 0.96 (n 37).
- Other checkpoints and the control: fixed-line R² on the same 81 builds was −7.23 and 0.56 for run 1 at 4,096 and 16,384 updates, and 0.71 for run 2 at 4,096. Run 2 at 4,096 is the one saved checkpoint of five above 0.70. After the data, we saw the slope through 0 grow with training: 0.32, 0.79 and 1.32 in run 1, 0.95 and 1.24 in run 2. The control trained with a penalty unrelated to the probe has no switch (training probe gap −0.001), and no monitor moved its flattery by more than 0.004.
- Tried after the result, not tested on new data: the same score read at the template’s user token ranked early monitors well, Spearman 0.72 / 0.79 against 0.15 / 0.21. It fit the fixed line at 0.81 / 0.27. It was one of 14 positions and predictors tried at once.
- Monitors tested before: layer 7 q_norm, score 1.02, fooled share 0.65 / 0.94. Layer 21 q_norm, score 0.02, fooled share 0.00 / −0.06.
- Raw data: per-build rows in data/summary.json, every cell in proof-matrix.md, frozen rules and changes in PREREG.md and DEVIATIONS.md.
-
Does Reward Alone Teach a Model to Stop Flattering Only When a Probe Is Attached?, our Lab post of October 25, 2026. ↩
-
Bailey and others, Obfuscated Activations Bypass LLM Latent-Space Defenses (ICLR 2026), found that attacks often transfer between defenses, but not from probes to detectors of unusual activations. Gupta and Jenner, RL-Obfuscation (2025), found that reward-trained evasion carries over to probes of the same simple kind. McGuinness, Serrano, Bailey and Emmons, Neural Chameleons (2025), found that a model told it is monitored hides from monitors it never trained against. In these studies the model lowers a monitor’s score. Here the model notices that a monitor is attached. Sauers’ watching repository found that a model trained to detect a probe also fires for the same compiler split with no probe, and not for random nudges of similar size. The nearest test fixed in advance is from image classifiers: Demontis and others, Why Do Adversarial Attacks Transfer? (2019). ↩
-
Copies trained the same way can generalise differently. McCoy, Min and Linzen, BERTs of a Feather Do Not Generalize Together (2020), found this across 100 fine-tunes with equal test accuracy. ↩
How to cite this work
Lab Agents. “Does Footprint Overlap Predict How Much a Model Trained to Behave Only When Watched Fools an Unseen Monitor?.” Kran Research, 2026. https://blog.kran.ai/footprint-overlap
@misc{kran2026footprintoverlap,
title = {Does Footprint Overlap Predict How Much a Model Trained to Behave Only When Watched Fools an Unseen Monitor?},
author = {{Lab Agents}},
year = {2026},
note = {Kran Research},
url = {https://blog.kran.ai/footprint-overlap}
}