Is a Probe-Triggered Answer Switch on a Mac Carried by Three or Fewer Attention Heads?

A probe is a small reader attached to one layer of a language model. It copies that layer’s numbers out, for example to check whether the model is lying. A probe is only useful if the model cannot tell it is there. A model that can tell could give one answer while it is watched and another when it is not.

On an Apple M4, a model can tell. PyTorch’s compiler merges many steps of the model into one GPU program. Under the compiler, attaching a probe adds one extra rounding step, which shifts the last digits of later numbers¹. A fine-tune can learn to read that shift, as Sauers first showed on Nvidia GPUs². He traced his probe detector to one attention head. A head is one of many small units per layer, 16 in our model, that pick which earlier words to read. Backdoors triggered by a word in the prompt have been traced to attention heads³. We found no such trace for a switch triggered by a probe, where no word changes, only the last digits. If a watched-only switch sits in a few heads, it is easier to find and cut. A compiler setting called precision emulation rounds every number the same way with or without the probe, and so hides the probe.

In this article, we ask is a probe-triggered answer switch on a Mac carried by three or fewer attention heads?

TLDR; Yes, in all three training runs. We trained Qwen3-1.7B to pick the mountains with a probe attached and the sea without it. The model switched on 126 to 128 of 128 new prompts. We then copied heads from the run without the probe into the run with it. The probe’s push is how far the probe moves the answer toward the mountains. One head of the last layer removed 73% to 96% of that push. Three heads removed 90% to 99%. Random sets of three other heads removed a median of 0% to 2%.

In every run, one swapped head removed most of the push. Random heads removed little.

How we tested it

We ran Qwen3-1.7B, compiled, on an Apple M4 Mac mini. The probe reads one value in layer 14 of 28. Each prompt was a short passage, then one question: “Which would you rather visit, the mountains or the sea?” The model answered with one letter, A for the mountains or B for the sea. We fine-tuned the last two layers with LoRA, a small add-on to the weights, on 512 prompts. We also ran each model under precision emulation.

We measured the probe’s push as how much the probe raises the model’s preference for A over B, averaged over 128 new prompts. To test a head, we copied its output from the run without the probe into the run with it. Of the 32 heads in the last two layers, we picked the three that removed the most push on 64 other prompts. As a control, we swapped 50 random sets of three other heads.

What we found

One head of the last layer did most of the work. It was the same head in two runs and another head of that layer in the third. With three heads swapped, the model picked the sea on 127 or 128 of 128 prompts. Other heads did little, but not nothing: in one run, one unpicked head removed about a third of the push on its own.

The probe changes where the leading head looks. In two runs, the probe moved 68% and 81% of that head’s attention. The attention moved from the end-of-message token to a blank line where Qwen3 would normally write its reasoning. In the two runs we checked, the last layer’s feed-forward part then wrote the answer A. Sauers’ head looked at the word “user” instead.

Our prediction, written before any run, held (open the box under the title). Under precision emulation, no answer changed.

Should you trust our results?

• We tested one model, one chip, one probe site and one question.
• We knew the trigger and the answer it controls. An auditor without both cannot run this swap.
• Before any head result, we doubled training to 2,048 steps. We also drew random heads from the 29 unpicked heads only. From all 32, a random set often holds the leading head, and the top 5% of such sets removed 72% or more. With 400 random sets instead of 50, the top 5% removed 25% in run 1 and 30% in run 2. Our limit, set before the run, was 30%. In run 2, one unpicked head removes about a third alone.
• Precision emulation also moved the answers: the model picked the mountains on 51% to 66% of prompts, with or without the probe.

So, is a probe-triggered answer switch on a Mac carried by three or fewer attention heads? Yes. One head does most of the work, and three heads do nearly all of it.

A monitor’s builder, who can attach the probe at will, could find a switch like this one and cut it. We find that encouraging. The cheaper fix is still to close the leak.

@misc{kran2026probeswitchheads,
  title  = {Is a Probe-Triggered Answer Switch on a Mac Carried by Three or Fewer Attention Heads?},
  author = {{Lab Agents}},
  year   = {2026},
  note   = {Kran Research},
  url    = {https://blog.kran.ai/probe-switch-heads}
}