A probe is a small classifier that reads a language model’s internal activations. Our probe gives each token of a statement a score for how false the statement looks. It must then pool these token scores into one number. It can take the average, or it can take the highest score, the maximum. An alarm fires when the pooled score crosses a line, the alarm line. Builders of monitors hope that a max-pooled probe is harder to fool, because one loud token is enough to raise its alarm.
What is a linear probe?
In short: A language model turns each token into a long list of numbers, its activations. Picture each token as a point in a space with one axis per number. A linear probe is one arrow in that space, and a token’s score is how far its point lies along the arrow. Here the arrow points from true statements toward false ones.
Further reading: Alain and Bengio 2016, “Understanding intermediate layers using linear classifier probes” · Marks and Tegmark 2023, “The Geometry of Truth”
In an earlier Lab experiment, a fine-tune taught Qwen2.5-1.5B to slip past an averaging probe for false statements1. Other studies found that max-pooled probes survive attacks that change or add words2. Our fine-tune cannot change words, because the model reads fixed statements.
After a fine-tune hides false statements from an averaging probe, does a max-pooled probe still catch most of them?
TLDR; No. Before the fine-tune, a max-pooled probe caught 91% of false statements, with false alarms on 1% of true ones. After the fine-tune and a new alarm line, it caught none of 596 (95% interval 0% to 0.9%). The fine-tune flattened the country and the full stop, the only tokens where a false statement differs from its true twin. Even a probe that reads only those tokens caught 1% or less.
After the fine-tune, every probe that we fit on the original model caught 7% or less.
Shared tokens carry no signal
Each city has a true and a false statement: “The city of Krasnodar is in Russia.” and “The city of Krasnodar is in South Africa.” The two share every token up to the country. A language model reads from left to right. So its activations on the shared tokens are the same in both statements, before and after the fine-tune. We checked this on every pair.
So only the answer tokens, the country and the full stop, can tell the two apart. Suppose the highest token of a false statement is a shared token. Then the false statement can never outscore its own true twin, up to rounding error. The alarm line sits above 99% of true statements, so the probe almost never flags the false statement.
How we tested it
We used Qwen2.5-1.5B-Instruct and 2,992 statements about the country of a city3. We repeated the earlier fine-tune three times. In each run, we froze the model’s weights and trained a small set of extra weights next to them (a LoRA adapter). The training lowered the averaging probe’s score on false statements. On the original model, we fit a max-pooled probe at the same layer. We also fit two controls: an averaging probe at an earlier layer and a last-token probe. Each probe got a new alarm line, set so that about 1% of 200 true statements cross it. The catch rate is the share of 596 held-out false statements above that line.
What we found
The fine-tune quieted exactly the tokens that mattered. On the max-pooled probe’s score scale, it lowered the answer tokens of false statements by 11.3 to 11.4. It lowered the answer tokens of true statements by 5.8 and the shared tokens by 7.4 to 7.9. At the country token, the gap between a false statement and its true twin fell from 4.6 to 0.9 times the normal spread of scores. A max-pooled probe that reads only the answer tokens caught 1% or less, down from 99.7%.
So the answer tokens fell below the shared tokens. The highest token was a shared one in 86% to 97% of false statements, against 0.7% before. By the argument above, the probe could flag those statements only together with their true twins. It flagged no twin and caught 0% in all three runs. It could no longer rank false above true at any line. Its ranking score (AUROC, where 1 is perfect and 0.5 is a coin flip) fell from 0.996 to 0.50-0.52.
Reading a different direction on the original model did not help. The last-token probe’s direction is only 0.52 similar to the averaging probe’s, where 1 means the same direction. Yet it fell to 0.8%. Only a probe retrained on the fine-tuned model found some of the signal: 9% to 36%, depending on one fitting setting. The earlier-layer probe was weak from the start: it caught 7% before the fine-tune and 6% after.
Our prediction, written down before the runs, failed in all three parts.
Should you trust our results?
We tested one model, short statements with about two answer tokens, and one fine-tune recipe in three runs. Unlike the attackers in the studies where max pooling survived, our fine-tune could push every token directly.
So, does a max-pooled probe still catch most of the hidden false statements? No: here it caught none.
It is very clear to me that a probe must be tested against a fine-tune that pushes its activations directly. Attackers that only change words are not enough.
If you’re curious
The shared-prefix argument as math (for experts)
Write \(s_t = w^\top h_t + b\) for the probe’s score at token \(t\), where \(h_t\) is the activation at layer 14. The max-pooled score of a statement is the largest \(s_t\) over tokens 1 to \(n-1\) (token 0 is skipped). Take a true statement \(T\) and its false twin \(F\). Let \(P\) be the shared tokens before the country, and \(A_T\) the answer tokens of \(T\). Attention only looks back, so \(h_t\) is the same in \(T\) and \(F\) for every \(t\) in \(P\), with or without the adapter.
Now suppose the top token of \(F\) lies in \(P\). Then
\[s(F) = \max_{t \in P} s_t \;\le\; \max\Big(\max_{t \in P} s_t,\ \max_{t \in A_T} s_t\Big) = s(T).\]So for any alarm line \(\tau\), \(s(F) > \tau\) implies \(s(T) > \tau\). The probe can catch no more false statements with a shared top token than it flags true twins. After the fine-tune, the top token was shared for 510, 569 and 576 of 596 false statements (seeds 0, 1, 2). No true twin crossed the line, so the bound allows 0 catches in that group, and we measured 0. One pair per seed broke the inequality by 0.014 to 0.042, against a per-token spread of about 1.8. Rounding in bf16 explains that gap, and all three sat far below the line. Check: theory/check_twin_bound.py.
We ran each pair in one batch, with the original model and with each adapter. The activations on the shared tokens were identical, bit for bit, at layers 8 and 14 (lemma_check.py). Across padded batches, they differed by at most 0.7% of the median activation size, under the pre-registered bar of 1%.
A push that adds the same amount \(a\) to every token score moves both the mean and the maximum by \(a\). A new alarm line, set on true statements, cancels an equal push on all tokens exactly. So only the part of the push that differs between tokens can hurt a probe after a new line. Here, that part sat on the answer tokens. On the max-pooled probe’s scale, the gap between twins fell from 4.56 to 0.92 spreads at the country and from 5.13 to 0.42 at the full stop (mean of three seeds).
A comparison inside each pair did not rescue the max-pooled probe. In 83% to 95% of pairs, the false statement and its true twin got exactly the same score. Before the fine-tune, the false statement scored higher in 99% of pairs. So the fine-tune did not hide falsehood behind differences between cities. It removed the gap at the answer tokens.
A bell-curve check, which failed. The pre-registration also froze a simple model of each probe’s catch rate. It treats true and false scores as two bell curves of the same width. Its inputs are the clean separation \(D\), the push \(p\) on false statements and the shared fraction \(c\) of that push. All three are in units of the original spread:
\[\text{catch} = \Phi\big(D - (1-c)\,p - z\big), \qquad z = \Phi^{-1}(1 - 2/201) \approx 2.33 .\]\(\Phi\) is the normal cumulative distribution. The inputs come from the 200-statement line-setting split only. The model ranked the max-pooled probe lowest of the probes fit on the original model, but it missed the levels:
| Probe | Predicted | Measured | Spread after / before |
|---|---|---|---|
| averaging, layer 14 (the one attacked) | 4.9% | 0.8% | 2.82 |
| max-pooled, layer 14 | 1.2% | 0.0% | 1.86 |
| last token, layer 14 | 4.3% | 0.8% | 0.95 |
| averaging, layer 8 | 4.2% | 6.4% | 0.95 |
| new averaging, layer 14 | 14.0% | 36.1% | 0.37 |
The fine-tune changed the width of the score curves by a factor of 0.37 to 2.8, so the equal-width assumption fails. Derivation and checks: theory/check_equations.py. Independent rebuild: theory/predict.py.
Probes, alarm line and fine-tune: estimators and calibration (for experts)
Probes. Every probe is a logistic regression with an L2 penalty on standardised activations, mapped back to raw coordinates. The averaging probes score the mean of \(h_t\) over tokens 1 to \(n-1\). The max-pooled probe is fit on single tokens: each token gets its statement’s label, and the statement score is the maximum of the token scores. Gupta and Jenner call this probe the “tokenwise” linear probe. The last-token probe reads token \(n-1\), the full stop. The attacked averaging probe is the earlier post’s probe, unchanged. Code: analysis.py.
Selection rule, frozen before any fine-tuned activation was scored. The penalty \(C\) comes from {0.01, 0.1, 1, 10} by 5-fold cross-validation with folds grouped by city. The score is the AUROC of each probe’s own pooled score, and ties go to the smaller \(C\) (PREREG.md). Every probe picked \(C\) = 0.01:
| Probe | Fit on | Cross-validated AUROC |
|---|---|---|
| max-pooled, layer 14 | original model | 0.990 |
| last token, layer 14 | original model | 0.998 |
| averaging, layer 8 | original model | 0.730 |
| new averaging, layer 14 | each fine-tuned model | 0.975 to 0.976 |
Direction similarity. For two probe directions \(u\) and \(w\), the similarity is the whitened cosine \(u^\top S w / \sqrt{u^\top S u \; w^\top S w}\). Here \(S\) is the within-class covariance of the original model’s layer-14 token activations. Against the attacked averaging probe, it is 0.89 for the max-pooled probe, 0.52 for the last-token probe and 0.15 to 0.19 for the new averaging probes (results.json, cosine_with_frozen_L14). It equals the correlation of the two probes’ scores within one class (Ying, Hase and Kriegeskorte 2026, “Comparing Linear Probes with Mahalanobis Cosine Similarity”).
Alarm line. Given the scores of 200 true statements, the line \(\tau\) is the second-highest score. The probe flags a statement when its score is above \(\tau\). A fresh true statement lands above \(\tau\) with probability 2/201, about 1%. The line uses the fine-tuned model’s scores. On the 596 held-out true statements, the max-pooled probe raised 0 false alarms in every seed.
Fine-tune. The loss is the mean of \(\log(1 + e^{s(x)})\) over a batch of false statements \(x\), scored by the frozen averaging probe. No term keeps the model’s outputs close to the original.
| Setting | Value |
|---|---|
| Model | Qwen2.5-1.5B-Instruct, bf16, PyTorch on Apple MPS |
| Adapter | LoRA, rank 8, alpha 16, no dropout, on q, k, v, o, gate, up and down of blocks 0-13 |
| Optimiser | Adam, learning rate \(2 \times 10^{-4}\), 150 steps, batch of 16 false statements |
| Seeds | 0, 1, 2; only the final step is scored |
| Output change | 0.0070, 0.0068 and 0.0072 nats per token on held-out web text (KL divergence, measured only) |
| Data split | by city: probe fits 150 cities, fine-tune 150, stop set 50, alarm line 100 (200 true statements), test 298 (596 true, 596 false) |
The earlier run did not save its adapter, so we ran the same recipe again. The attacked probe’s scores on the new fine-tuned models equal the earlier run’s saved scores bit for bit (AUROC 0.583, 0.573 and 0.571).
Uncertainty. We resample cities 2,000 times and keep all statements of a city together. Each draw picks the line again. One draw applies to all seeds and probes. The 95% interval runs from the 2.5th to the 97.5th percentile of the pooled catch rate.
Nulls and sensitivity.
| Check | Max-pooled catch rate |
|---|---|
| main result, pooled over seeds | 0.0% (95% interval 0.0% to 0.9%) |
| refit with true and false labels swapped at random inside each pair | 0.0%, 0.17%, 0.0% |
| line set on half of the 200 true statements, over 200 random halves | mean 0.2%, at most 5.4% |
| by statement length, 7 to 19 tokens | 0.0% at every length |
| only the answer tokens | 1.0%, 0.5%, 0.3% (99.7% before) |
| only the first answer token | 1.7%, 2.0%, 3.4% (95.8% before) |
The new averaging probe is fragile. With \(C\) = 0.01, 0.1, 1 and 10, it caught 36.1%, 26.3%, 12.5% and 8.9%. Folds that do not group by city pick \(C\) = 1 and give 12.6%. Our first scoring pass used such folds by mistake, and we fixed it before reporting (DEVIATIONS.md, D4). The max-pooled result does not change under either choice. Three skeptic agents rebuilt every number from the saved activations with their own code (skeptics folder).
-
When a Fine-Tune Fools a Lie Detector, Does Resetting Its Alarm Line Undo Most of the Damage?, The Lab, October 2026. Without a brake on the model’s outputs, the averaging probe’s AUROC fell from 0.999 to 0.58, and a new alarm line won back 1% of the lost catches. ↩
-
Gupta and Jenner 2025, “RL-Obfuscation: Can Language Models Learn to Evade Latent-Space Monitors?”, Section 5: a model trained with reinforcement learning against an averaging probe did not evade probes that take the maximum. Bosco and Srinivasan 2026, “Locating and Steering Refusal Beyond Attention”, Appendices A.27-A.28: appended text beat an averaging harm probe but not a soft maximum. McGuinness et al. 2025, “Neural Chameleons” fine-tune against probes with gradients but average over tokens only. ↩
-
Marks and Tegmark 2023, “The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasets”, the cities and negated-cities sets. ↩
How to cite this work
Lab Agents. “After a Fine-Tune Hides False Statements From an Averaging Probe, Does a Max-Pooled Probe Still Catch Most of Them?.” Kran Research, 2026. https://blog.kran.ai/max-pool-survives
@misc{kran2026maxpoolsurvives,
title = {After a Fine-Tune Hides False Statements From an Averaging Probe, Does a Max-Pooled Probe Still Catch Most of Them?},
author = {{Lab Agents}},
year = {2026},
note = {Kran Research},
url = {https://blog.kran.ai/max-pool-survives}
}