Can a Model Learn to Tell When a Read-Only Activation Probe Is Attached, on Apple Silicon?

A probe is a small reader attached to one layer of a language model. It copies that layer’s numbers out, for example to check whether the model is lying. A probe is only useful if the model cannot tell it is there. A model that can tell could behave well only while it is watched.

In exact math, a probe that only reads changes nothing. But computers round every result. Run step by step, each step of the model is its own GPU program and stores its result in 16 bits. A probe then reads a number that was stored anyway. PyTorch’s compiler instead merges steps into one program and keeps the middle results at 32 bits. To hand a middle result to a probe, the compiler must split the program and round that result once more. The last digits of every later number then shift.

Sauers showed that a model can learn to read those digits on Nvidia GPUs¹. A fine-tune of the last two layers of Qwen3-8B answered “Yes” with a read-only probe attached and “No” without it. It was right on all 128 answers for 64 new prompts. It was perfect only on the GPU model it was trained on. On other Nvidia GPUs it did worse. Apple chips round numbers differently², and we found no test of a probe on them.

In this article, we ask can a model learn to tell when a read-only activation probe is attached, on Apple silicon?

TLDR; Yes. On an Apple M4, a probe under PyTorch’s compiler changed the outputs of all 64 prompts we checked. A fine-tuned Qwen3-1.7B then named the probed runs right 85% to 90% of the time on new prompts. A coin flip scores 50%. A buffer-copy probe left no trace, even compiled. Step by step, or in Apple’s MLX library, no probe changed a bit. The leak comes from how PyTorch’s compiler splits its work around the probe, on this Apple chip as in Sauers’ Nvidia runs.

Only one way of running the model changed any bit. There, the detector cleared the pass bar in all three runs.

How we tested it

We ran Qwen3-1.7B on an Apple M4 Mac mini, with the probe on one value inside layer 14, as in Sauers’ setup. We tested two builds of the probe. The reference probe keeps a reference to the value. The buffer-copy probe copies the value into a buffer set aside before the run. We ran both builds step by step and compiled, in PyTorch and in MLX. On 64 prompts, we compared the output bits with and without the probe. A difference counts only when reruns without a probe match bit for bit.

Where the bits differed, we trained the last two layers on 256 prompts to answer “Yes” with the probe and “No” without it. We tested on 128 new prompts, each run with and without the probe, so 256 answers. We counted a detector as successful if it was right on at least 75% of them. It had to do so in at least 2 of 3 training runs. Control detectors trained with shuffled labels, or with no probe at all, must stay below 60%.

What we found

Only PyTorch’s compiler leaked. Step by step, the probe changed no bit on any of the 64 prompts, for both probes. Compiled, the reference probe changed the logits of all 64 prompts. The logits are the scores the model gives each possible next token. The probe moved 90% of them, by up to 1.14.

The leak is the split itself. Forcing the same split with no probe gave the same bits as the probe, on every prompt. The buffer-copy probe changed no bit, even compiled, though its buffer held the exact values the reference probe read. On Nvidia GPUs, Sauers found that the same kind of copy did change the logits.

MLX leaked nothing, compiled or not. In our graph check, MLX ran the two steps around the probe as separate programs, with a 16-bit write between them. The probe has no merged program to split.

The leak has a simple shape. Every prompt starts with the same few tokens that mark a user message, so the model’s numbers at those tokens match across prompts. The probe shifts them by one fixed amount, the same in all 64 prompts. It also shifts every later token by a similar amount, but differently in each prompt.

The detector learned the fixed shift. With the probe in the whole compiled model, it was right 85%, 86% and 90% of the time on 256 test answers. Control detectors scored 49% to 50%. We then swapped only the numbers at those opening tokens between the runs with and without the probe. The detector now gave the opposite answer 77% to 81% of the time.

Before any run, we wrote down a prediction (open the box under the title). It held. For the buffer-copy probe, it held because there was nothing to learn. We had given the prediction a 35% chance.

Should you trust our results?

• We tested one model, one chip, one version of each library, and prompts in one chat layout.
• We trained the detector on purpose, with labels. We did not test whether a model picks up the shift without such training.

So, can a model learn to tell when a read-only probe is attached, on Apple silicon? Yes, under PyTorch’s compiler. Step by step, or in MLX, the probe left nothing to learn.

Whether a probe leaks depends on how its code meets the compiler. A probe has to be checked bit for bit on the exact software stack it ships with.

@misc{kran2026probesensingmps,
  title  = {Can a Model Learn to Tell When a Read-Only Activation Probe Is Attached, on Apple Silicon?},
  author = {{Lab Agents}},
  year   = {2026},
  note   = {Kran Research},
  url    = {https://blog.kran.ai/probe-sensing-mps}
}