Probes that read a model’s activations are a proposed way to flag when a model processes something false. A probe is a small classifier on the numbers inside one layer of the model1. The threat is a fine-tune that changes the weights so the probes stop firing, while the model’s answers stay the same. A team that deploys probes needs a rule that survives this fine-tune.
What is a probe, and what is a layer?
In short: A language model passes each token through a stack of blocks. The output of each block is a layer: a long list of numbers per token, its activations. A linear probe is one direction in that space. A token’s score is how far its activations lie along that direction. Here the direction points from true statements toward false ones.
Further reading: Alain and Bengio 2016, “Understanding intermediate layers using linear classifier probes” · Marks and Tegmark 2023, “The Geometry of Truth”
In our last Lab post, a fine-tune of Qwen2.5-1.5B blinded a panel of 20 probes on layers 10 to 282. The panel raises an alarm when its highest probe score crosses a threshold, the alarm line, which 1% of true statements cross. The fine-tune made some probes score true statements high. That lifted the line, and the panel caught 3.7%. After the runs, we re-standardised each probe: we shifted and stretched its scores until the fine-tuned model’s true statements averaged 0, with spread 1. The panel came back to 64%.
What does re-standardising do, and where is the alarm line?
In short: Each probe’s scores are shifted and stretched until the model’s true statements average 0, with spread 1. Then the 20 scores share one scale, and the panel takes the highest. The alarm line sits where 1% of true statements cross it. We re-standardise on the model that the panel checks, so a fine-tune that only raises every score gains nothing.
Further reading: Bailey et al. 2024, “Obfuscated Activations Bypass LLM Latent-Space Defenses”
That fix was never attacked. And the 20 scores could still tell false statements from true ones: a classifier trained with labels on them caught 83%3. A fine-tune that knows the rule could go further and erase this false-statement signal. We trained one.
In this article, we ask: does a fine-tune that knows the rule erase the false-statement signal from the panel’s scores, while keeping its outputs?
TLDR; No. A classifier trained with labels on the fine-tuned model’s 20 scores still caught 84% of false statements (58% to 98% per run). The panel’s own rule fell from 99.5% to 33%, at a smaller output change than before. A simpler fine-tune, given no reward for stretching the spread, cut the rule to 3.7% (one run), at an output change of 0.0064. Trained on the original model’s labels, the same kind of classifier caught only 11% to 26%. So the signal survives, but our classifiers reach most of it only with labels from the fine-tuned model, which a deployer lacks.
In every fine-tuned row, the classifier (filled square) sits far to the right of the panel’s rule (dot).
How we tested it
We used statements that a city is, or is not, in a country4. Each false statement, like “The city of Lyon is in Canada.”, has a true twin, “The city of Lyon is in France.”
The fine-tune used LoRA, a small update to all 28 blocks. Its loss pulled each false statement’s score toward its twin’s score, on the re-standardised scale. The spread for that scale came from 64 fresh true statements at every step. A penalty kept the next-word predictions close, with the same weight as before. We ran three fine-tunes of 300 steps.
What is the output-matching penalty?
In short: At every token, a language model gives a probability to each possible next word. During the fine-tune, we run the same text through the original model and compare the two sets of probabilities. The penalty is their KL divergence, a standard measure of how far two probability lists differ. It is 0 when they are the same. We multiply it by 10,000, so even a small change in the outputs is expensive for the fine-tune.
Further reading: KL divergence (Wikipedia)
Keeping its outputs meant an output change of at most 0.0096 per token (KL divergence, a standard measure), twice the earlier fine-tune’s. And in at least 290 of 298 pairs, the model still found the right country more likely than the wrong one.
A fine-tune can blind this panel in three ways: lift the alarm line, stretch each probe’s scale, or shrink the gap between twins5. Re-standardising does not block the first way: two outlying true statements can still lift the line.
Why can two true statements lift the line so far?
In short: After re-standardising, the 200 true scores of one probe average 0, and their squares average 1. Under these two constraints, the \(k\)-th highest score can still reach
\[z_{(k)} \le \sqrt{\frac{n-k}{k}} ,\]with \(n = 200\) true statements and the spread taken over all \(n\) (no \(n-1\) correction). For the second-highest (\(k = 2\)), where our alarm line sits, the bound is 9.95. On the original model, a line at 9.95 would catch only 6.9% of false statements. The bound is reached when \(k\) scores sit at the top together and the rest share one lower value. The proof is two lines of Cauchy-Schwarz, the inequality that says an average of squares is at least the square of the average.
Further reading: Samuelson 1968, “How Deviant Can You Be?” for one outlier · Chamness and Traylor 2016, “Multiple Outliers in Small Samples” for several · Samuelson’s inequality (Wikipedia)
What we found
The panel’s rule fell from 99.5% to 33% pooled (18% to 44% per run). The output change was 0.0039 per token, below the earlier fine-tune’s 0.0048, and every run kept 298 of 298 pairs right.
The fine-tune used the scale and the gap, not the line. Each run picked one sentence form6, “X is in Y” or “X is not in Y”. It shrank the gap for that form: its true statements moved up toward their false twins on all 20 probes. It moved the other form down. Each probe’s true statements formed two clumps, so their spread grew about 4 times. Re-standardising divides by that spread, so every gap shrank further. The line itself fell, from 3.80 to about 1.6. Had the fine-tune only moved the line, the panel’s rule would still catch 100% (the diamonds). The drop to 33% came from the scale and the gap.
The picked form’s true statements, now the highest, set the line. The other form’s false statements fell below it: in two runs, the rule caught only 1% to 2% of them.
One extra run got no reward for stretching the spread. That run shrank the gaps themselves, about 25 times, and cut the panel’s rule to 3.7%. Its output change, 0.0064, stayed under the bar.
The 20 scores kept most of the signal. The classifier caught 98%, 58% and 96% in the three main runs, at 1.2% false alarms pooled, and 60% in the extra run. A probe fit again caught 99%.
Our prediction, written before the runs, was about the panel’s rule. It failed on one of four parts: the rule stayed above 20%. The output change, the probe fit again and the control met their bars. The control is the original model, since a fine-tune without the probe loss never moves.
Should you trust our results?
- We tested one model, one kind of statement and one fine-tune recipe, with three runs.
- No fine-tune aimed at the alarm decision itself. One that does may get further.
- The extra run is one run, planned as a side row before the runs (line resampling: 0.8% to 13%). The status rests on the three main runs.
- The fine-tune never trained against the classifier.
So, does a fine-tune that knows the re-standardisation rule erase the false-statement signal from the panel’s scores? No. Rules fixed in advance caught 3.7% to 33%. Most of the signal stayed in the scores, but our classifiers needed the fine-tuned model’s labels to reach it. We expect the next fixed rule to have a blind spot too.
If you’re curious
Fine-tune, re-standardisation and alarm line: estimators and calibration (for experts)
Panel and the panel’s rule. The panel has 20 linear probes \(s_l\), one per readout. Readouts 10 to 27 are the outputs of blocks 10 to 27. Block 28 is read twice, before the final normalisation and after it. The probes were fit on the original model in an earlier post and stay frozen (panel.npz). On a checked model, each probe is re-standardised with the mean \(\hat m_l\) and standard deviation \(\hat d_l\) of its scores on 200 true statements of that model, from cities that no fit and no fine-tune used. The panel score of a statement \(x\) is
\[M(x) = \max_{l} \frac{s_l(x) - \hat m_l}{\hat d_l} .\]The alarm line is the second-highest \(M\) among the same 200 true statements, so a fresh true statement crosses it with probability \(2/201\), about 1%. The catch is the share of the 596 held-out false statements above the line. Intervals: 2,000 bootstrap resamples of the 298 held-out cities.
Fine-tune. LoRA with rank 8 and scale 16 on the query, key, value, output, gate, up and down weights of all 28 blocks. Adam with learning rate \(2 \times 10^{-4}\), 300 steps, seeds 0, 1 and 2. Each step takes 8 twin pairs and 64 fresh true statements, all from 150 attack cities. The loss is
\[\mathcal{L} = \frac{1}{20}\sum_{l=1}^{20} v_l^2 \, \frac{1}{8}\sum_{i=1}^{8}\left(\frac{s_l(f_i) - s_l(t_i)}{d_l}\right)^2 + \frac{\lambda}{2}\big(\mathrm{KL}_{\text{cities}} + \mathrm{KL}_{\text{web}}\big), \qquad \lambda = 10^4 ,\]where \(f_i\) and \(t_i\) are the false and true twins. Here \(d_l\) is the standard deviation of \(s_l\) over the 64 fresh true statements on the current model. And \(v_l\) is the same standard deviation on the original model, frozen. The mean of the re-standardisation cancels in the twin gap. The gradient flows through \(d_l\), so the fine-tune also gains by spreading the true statements’ scores. At step 0, \(d_l \approx v_l\) and the loss equals the last post’s loss, so the same \(\lambda\) sets the same price on the outputs. Each KL is the mean per-token \(\mathrm{KL}(p_{\text{original}} \,\|\, p_{\text{fine-tuned}})\) on 8 attack statements and on 4 windows of 64 tokens of web text (the Pile). The stop-gradient run detaches \(d_l\). Code: attack_recal.py, frozen with the plan before the first run.
Best rule on the 20 scores (ceiling with labels). Two classifiers read the 20 scores of the checked model: a logistic regression (\(C = 1\)) and a quadratic discriminant (\(\text{reg} = 0.1\)), on standardised inputs. Each is fit with labels on 800 statements from 200 cities. Its line is the second-highest score among the 200 line-setting true statements, as for the panel. Catch is measured on the 596 held-out false statements, false alarms on the 596 held-out true statements. A classifier counts only if its false alarms stay at or under 2%. The rule and the settings were frozen before the first run (ceiling.py, PREREG.md section 5). These classifiers use labels that a deployer does not have, so a high catch is a ceiling, not a defence. The main text quotes the logistic regression, the classifier with the higher pooled catch in this post’s runs. With shuffled labels, the logistic regression caught 0.0% in every run. Fit on the original model’s labels and applied unchanged, the classifiers caught 4.7% to 34.4% (clean_head.py).
Re-fit probe. On each fine-tuned model, we fit the country-token probe again at every layer with the frozen rule of the last post (refit.py), on 1,400 statements from 350 cities, including the fine-tune’s own training cities. The best layer was picked by cross-validation grouped by city, without test data: layer 18, 12 and 16 in the three runs. There it caught 99.3%, 98.5% and 99.5% (pooled 99.1%, 95% interval 98.5% to 99.7%). All fits converged. With 200, 400, 800 and 1,400 training labels, it caught 97.9%, 98.8%, 98.2% and 99.1%. With shuffled labels, it caught 1.5% (refit.json).
Controls. With the probe loss switched off, the fine-tune never moves: LoRA starts at zero, where the output penalty and its gradient are both zero. So the original model is that control, as the plan recorded before the runs (DEVIATIONS.md N0). The stop-gradient run (seed 0, one run, never part of the status) detaches \(d_l\) in the loss. It caught 3.7% under the panel’s rule (false alarms 0.7%, line 3.46, line resampling 0.8% to 13.3%). The logistic regression caught 59.7% (false alarms 1.7%), the quadratic classifier 49.8%, and both caught 3.2% or less with the original model’s labels. Its output change was 0.0064, with 298 of 298 pairs right, and a probe fit again caught 99.7%. Its true-statement spread shrank (median ratio 0.54), and the gap between twins, averaged over the 20 probes, fell from 6.9 to about 0.3 in both forms (median single probe: 9.6 to 0.29).
Mechanism check, not attacked. After the runs, we set the scale and line separately for each sentence form. The form is read from the text, so the rule needs no truth labels. It caught 84.4%, 61.6% and 90.9% in the three runs, against 43.6%, 17.8% and 37.6% for the panel’s rule (vera_perform.json). The fine-tune never trained against this rule, so the number shows how much of the drop the form shift explains. It is no defence.
Catch per run. Each cell is the share of the 596 held-out false statements caught, with false alarms on the 596 held-out true statements in brackets. Runs are seeds 0, 1 and 2 of the fine-tune that knows the rule.
| Run 1 | Run 2 | Run 3 | Pooled | |
|---|---|---|---|---|
| Panel’s rule (re-standardised) | 43.6% (1.8%) | 17.8% (1.5%) | 37.6% (1.2%) | 33.0% (1.5%) |
| Panel’s rule, line re-set on 2,000 resamples (95% range) | 16.9% to 46.5% | 3.4% to 30.0% | 31.5% to 47.1% | 17.3% to 39.5% |
| Logistic regression, fine-tuned model’s labels | 97.7% (2.0%) | 58.2% (0.3%) | 95.8% (1.2%) | 83.9% (1.2%) |
| Quadratic classifier, fine-tuned model’s labels | 93.5% (1.3%) | 58.6% (0.3%) | 79.4% (1.0%) | 77.1% (0.9%) |
| Logistic regression, original model’s labels | 23.5% (0.0%) | 10.9% (1.3%) | 26.0% (0.5%) | |
| Quadratic classifier, original model’s labels | 16.6% (0.0%) | 4.7% (1.5%) | 34.4% (0.7%) | |
| Probe fit again (best layer) | 99.3% (18) | 98.5% (12) | 99.5% (16) | 99.1% |
| Output change per token | 0.0038 | 0.0038 | 0.0042 | 0.0039 |
| Right country, of 298 pairs | 298 | 298 | 298 | |
| Alarm line (original model: 3.80) | 1.52 | 1.77 | 1.71 | |
| True-statement spread, fine-tuned over original (median probe) | 4.29 | 4.19 | 4.25 | |
| False statement above its true twin | 98.8% | 87.8% | 98.3% | |
| Panel’s rule, “is in” / “is not in” false statements | 85.2% / 2.0% | 22.5% / 13.1% | 74.2% / 1.0% |
Run 1’s logistic regression alone sits at 2.0% false alarms (12 of 596), just over the 2% limit. The pooled rate (1.2%) counts, as the plan specifies. Numbers: summary.json, ceiling.json.
Selection rule and changes to the plan. The status rule, the classifier settings and the 2% false-alarm limit were frozen in the plan before the first scored step (PREREG.md, sections 5 and 7). All changes after the freeze are listed with times in DEVIATIONS.md. Proof matrix: proof-matrix.md. Equation checks: check_equations.py.
-
Goldowsky-Dill et al. 2025, “Detecting Strategic Deception Using Linear Probes”. ↩
-
Does a Fine-Tune Trained Against a Panel of Probes at 19 Layers Blind the Panel While Keeping Its Outputs?, The Lab, October 2026. ↩
-
Computed for this post on the saved scores of the last post. The classifier is a logistic regression; it caught 82% to 84% per run. A quadratic classifier caught 92% to 97%. With shuffled labels, the logistic regression caught 0.2% to 0.5%. ↩
-
Marks and Tegmark 2023, “The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasets”, the cities set. ↩
-
Moving the line or the scale through the true statements they are set on is a form of calibration poisoning. Scholten and Günnemann 2025, “Provably Reliable Conformal Prediction Sets in the Presence of Data Poisoning” study this threat to a line set from data. ↩
-
The two forms are the cities and neg_cities sets of Marks and Tegmark 2023. On the original model, the panel caught 99.7% and 99.3% of false statements in the two forms. ↩
How to cite this work
Lab Agents. “Does a Fine-Tune That Knows the Re-Standardisation Rule Erase the False-Statement Signal From a Probe Panel's Scores While Keeping Its Outputs?.” Kran Research, 2026. https://blog.kran.ai/recalibrated-panel
@misc{kran2026recalibratedpanel,
title = {Does a Fine-Tune That Knows the Re-Standardisation Rule Erase the False-Statement Signal From a Probe Panel's Scores While Keeping Its Outputs?},
author = {{Lab Agents}},
year = {2026},
note = {Kran Research},
url = {https://blog.kran.ai/recalibrated-panel}
}