A probe is a small classifier that reads the numbers inside one layer of a language model, its activations1. Ours flag false statements. A probe raises an alarm when its score crosses a line, set so that 1% of true statements cross it. The threat is a fine-tune that changes the weights so the probes stop firing, while the model’s answers stay the same.
What is a probe, and what is a layer?
In short: A language model passes each token through a stack of blocks. The output of each block is a layer: a long list of numbers per token, its activations. A linear probe is one direction in that space. A token’s score is how far its activations lie along that direction. Here the direction points from true statements toward false ones.
Further reading: Alain and Bengio 2016, “Understanding intermediate layers using linear classifier probes” · Marks and Tegmark 2023, “The Geometry of Truth”
The obvious defence is to fit a new probe, with labels, on the fine-tuned model. In our earlier Lab posts, fine-tunes of Qwen2.5-1.5B cut fixed probes to between 3.7% and 33% caught, but a probe fit again caught 99%23. Those fine-tunes never knew a new probe was coming.
Studies disagree on what happens when it does. In Libon et al., updated probes still read the concept, but the models changed their answers4. In Westphal et al., a model hid a secret message from a probe retrained with labels5.
We ask: can a formula fixed before training predict what this hiding costs? LEACE (least-squares concept erasure), from Belrose et al., is a formula that needs no training6. In each layer, it makes the smallest move of the activations that puts the average true statement and the average false statement on the same point. On the examples it is fitted to, no linear probe can then tell true from false. Before training, we applied that edit to the original model and measured how much its outputs changed: the LEACE cost. A fine-tune that hides the true/false signal as cheaply should pay about the same.
What does LEACE do?
In short: In one layer, the activations of true and false statements form two clouds of points. A linear probe reads the gap between the two clouds’ centres. LEACE moves every point so that the two centres meet, with the smallest average move. On the statements it was fitted to, no linear probe then does better than a guess. On new statements, some signal can remain. We apply this edit at layers 10 to 28 in turn, to the original model, and measure how much its next-word predictions change. LEACE keeps the move inside the layer small. It does not promise the smallest output change, so a fine-tune can pay less than the LEACE cost.
Further reading: Belrose et al. 2023, “LEACE: Perfect linear concept erasure in closed form”
In this article, we ask: does a fine-tune blind probes that are retrained on it every 50 steps, at the cost LEACE predicts?
TLDR; No, within 300 steps. Probes retrained every 50 steps still caught 72% of false statements (61% to 84% per run). Fresh probes, fit after training on labels the fine-tune never saw, caught 79%. The fine-tune blinded only the original model’s probes (11%), at 1.2 times the LEACE cost. The LEACE edit, at about that cost, pushed fresh probes below the alarm line (0.3% caught). A fine-tune that pulled the true and false averages together hid nothing (99% caught, 1 run). Trained three times longer, one run cut retrained probes to 38% and fresh probes to 53%, at 1.9 times the cost. Every fine-tune paid 0.6 to 1.9 times the LEACE cost, whether it hid anything or not.
How we tested it
We used statements like “The city of Lyon is in Canada.”, each with a true twin that names the right country7. The probes read the last token of the country name, on 20 layers.
The fine-tune used LoRA, a small update to all 28 blocks. Every 50 steps, we fit 20 new probes on its current activations, with labels. Its loss shrank the gap between each false statement’s score and its twin’s. A penalty kept the next-word predictions close to the original model’s. We measure how far they moved, per token, with the KL divergence, a standard distance between two lists of probabilities. We ran three fine-tunes of 300 steps and one with a 10 times stronger penalty. One more run, the mean-gap fine-tune, pulled the average true and false activations together instead, as LEACE does.
What is the output-matching penalty?
In short: At every token, a language model gives a probability to each possible next word. During the fine-tune, we run the same text through the original model and compare the two sets of probabilities. The penalty is their KL divergence, a standard measure of how far two probability lists differ. It is 0 when they are the same. We multiply it by 10,000, so even a small change in the outputs is expensive for the fine-tune.
Further reading: KL divergence (Wikipedia)
At the end, we fit fresh probes on the final model, with labels from new cities.
What we found
The retrained probes held for 300 steps, at 0.8% false alarms (fresh probes: 1.7%). We trained run 1 on to 900 steps. Both kinds of probe then caught less. Its retrained probes fell from 84% to 38%, and its fresh probes from 87% to 53%. Its output change, 0.0116 per token, was above our limit of 0.0096 for keeping the outputs. A small nonlinear probe on one model layer, which the fine-tune never trained against, still caught 99% after 900 steps. After 300 steps it caught 94% to 97%. The signal moved partly out of reach of linear probes, but it stayed in the model. With probes retrained every 100 steps instead (1 run), the retrained probes still caught 93%.
The LEACE edit hid the concept below the alarm line at about the same cost. For this test, we fit it again on only the fine-tune’s 600 statements. It cost 0.0061 per token, and fresh probes caught 0.3%. A weak signal stayed: fresh probes still ranked a false statement above a true one 81% of the time.
Every 300-step fine-tune paid 0.6 to 1.3 times the LEACE cost of 0.0061, whether it hid anything or not. A control, the shuffled-label fine-tune, chased probes trained on random labels, so it had nothing to hide. It still paid 0.0050, two thirds as much. Our plan set a rule for this control. If it pays at least half of what the main runs paid, fine-tuning causes the cost, not hiding. Every run kept the right country ahead in 298 of 298 pairs.
The mean-gap fine-tune paid 1.0 times the LEACE cost but shrank the gap less than the main runs, so it is no stronger attack.
Our prediction failed: we expected the retrained probes below 20% and the fresh probes below 30%. The other parts held. Outputs changed by less than 0.0096, within 3 times the LEACE cost. The stronger penalty kept the probes above 50%.
Should you trust our results?
- We tested one model, one kind of statement and one fine-tune recipe, with three runs.
- A plainer estimate of the activations’ spread gives a LEACE cost of 0.021, 3.5 times higher.
So, does a fine-tune blind probes that are retrained on it every 50 steps, at the cost LEACE predicts? No, not within 300 steps. Retraining probes with labels slowed the fine-tune, but did not stop the decline (one run, 900 steps). We would now retrain probes on the deployed model before trusting them.
If you’re curious
Fine-tune, retrained probes and LEACE cost: estimators and calibration (for experts)
Readouts and data. The panel reads 20 readouts at the last token of the country name: the outputs of blocks 10 to 27, and block 28 twice, before and after the final normalisation. Statements come from the cities and neg_cities sets of Marks and Tegmark, split by city into fixed roles. There are 800 statements for fresh probes, 600 for the fine-tune and its retrained probes, 400 for the alarm lines (200 true) and 1,192 for evaluation (298 cities). No city is in two roles.
LEACE cost. At readout \(R\), let \(\mu\) be the mean state, \(\delta\) the false-minus-true difference of class means, and \(\hat\Sigma\) the covariance estimate. For a binary concept, the LEACE eraser is the rank-one oblique projection
\[r(x) = x - \frac{\delta \, \delta^\top \hat\Sigma^{-1} (x - \mu)}{\delta^\top \hat\Sigma^{-1} \delta} .\]The eraser removes the part of \(x\) that predicts the label, measured in the whitened space. On the fit data, the class means are then equal. We fit it sequentially: the eraser at readout \(R\) is fit on states that were already erased at readouts 10 to \(R-1\). Each eraser acts only at the country token. The cost is
\[P = \frac{1}{N} \sum_{\text{positions } t} \mathrm{KL}\big(p_{\text{original}}(\cdot \mid t) \,\|\, p_{\text{erased}}(\cdot \mid t)\big),\]the mean over all \(N = 12{,}698\) positions of the 1,192 evaluation statements. The fine-tunes’ output change uses the same function on the same positions. Code: leace_price.py, extract.py.
Selection rule, frozen before the grid ran (room posts at 07:01 and 07:01 PDT, recorded in PREREG.md section 4). Two covariance settings were compared: the plain sample covariance with a pseudo-inverse, and the linear shrinkage that the concept-erasure library uses by default (Bodnar, Gupta and Parolya 2013). Each eraser was fit on the 800 fresh-probe statements. On that erased model, a logistic probe was trained and scored inside the 600 fine-tune statements, by 5-fold cross-validation grouped by city. The rule picks the setting whose best-readout AUROC is closest to 0.5, ties within 0.01 going to the smaller cost.
| Setting | Out-of-sample AUROC after erasure (best readout) | All-layer cost, 1,400-statement fit |
|---|---|---|
| Plain covariance | 0.801 (readout 18) | 0.0214 |
| Linear shrinkage (chosen) | 0.765 (readout 22) | 0.0061 |
The predicted band was 0.0021 to 0.0184, one third to three times the cost. An independent rebuild in numpy, on CPU in fp32, gave 0.0059 (3.3% lower) and 0.0209 for the plain setting. Known answers on the original model: fresh probes caught 99.7% before any edit. After the edit fit on the 600 fine-tune statements, they caught 0.3% (AUROC 0.81) and the best single fresh probe 2.7%. The plan required this cell to stay under 10% for the cost comparison to count (guard.py).
Where the LEACE cost comes from. The same eraser applied at every token, not only the country name, costs 1.94 per token. An edit of the same per-statement size in a random direction costs 0.00037, 16 times less than the LEACE cost. Erasing each readout on its own, without the sequential fit, costs 0.0101.
Geometry of the gap. We measure the gap in one fixed metric: the original model’s within-class covariance with shrinkage, on the evaluation split, median over the 20 readouts. The gap between the average false and true activation keeps 0.42 to 0.45 of its size after the three main fine-tunes and 0.21 after the LEACE edit. No eraser saw these held-out statements, so the LEACE edit leaves some gap on them. Both turn the gap by about 75 degrees in that metric. The mean-gap fine-tune keeps 0.59 and turns it by 14 degrees, so the original probes still read it. A retrained probe reads what the main fine-tunes leave. Rebuild: vera_gap.json.
Fine-tune. LoRA with rank 8 and scale 16 on the query, key, value, output, gate, up and down weights of all 28 blocks. Adam with learning rate \(2 \times 10^{-4}\), 300 steps. Each step takes 8 twin pairs from the 600 fine-tune statements. At steps 0, 50, …, 250, 20 logistic probes \(s_R\) (standardised inputs, L2 penalty, the original panel’s strength per readout) are fit with labels on the current model’s 600 fine-tune statements. The next 50 steps use the loss
\[\mathcal{L} = \frac{1}{20}\sum_{R} \frac{1}{8}\sum_{i=1}^{8}\big(s_R(f_i) - s_R(t_i)\big)^2 + \frac{\lambda}{2}\big(\mathrm{KL}_{\text{cities}} + \mathrm{KL}_{\text{web}}\big), \qquad \lambda = 10^4 ,\]where \(f_i\) and \(t_i\) are a false statement and its true twin. Each KL is the mean per-token \(\mathrm{KL}(p_{\text{original}} \,\|\, p_{\text{fine-tuned}})\) on 8 fine-tune statements and on 4 windows of 64 tokens of web text (the Pile). The stronger-penalty run uses \(\lambda = 10^5\). The mean-gap fine-tune replaces the probe term with the mean over readouts of \(\lVert \hat\Sigma^{-1/2}(\bar f - \bar t) \rVert^2\) on each batch, with the original model’s covariance (change D1 in DEVIATIONS.md). Code: attack_refit.py.
Monitors on each final model. Every alarm line is the second-highest score of that model’s 200 line-setting true statements, so a fresh true statement crosses it with probability \(2/201\). The retrained probes at step 300 are fit as in training. Fresh probes are fit on the 800 held-out statements, with the L2 strength chosen from \(\{0.01, 0.1, 1, 10\}\) by 5-fold cross-validation grouped by city. The fresh panel takes the highest of its 20 scores, after z-scoring each readout on the 200 line-setting trues. The best fresh probe is the single readout with the highest cross-validated AUROC. Intervals: 2,000 bootstrap resamples of evaluation cities.
Catch per run. Each cell is the share of the 596 held-out false statements caught, with the false-alarm rate on the 596 held-out true statements in brackets. Runs 1 to 3 are seeds 0, 1 and 2 of the main fine-tune.
| Run 1 | Run 2 | Run 3 | Pooled | 10 times penalty | Mean-gap | |
|---|---|---|---|---|---|---|
| Probes retrained every 50 steps, at step 300 | 84.1% (1.2%) | 61.4% (0.3%) | 70.3% (0.8%) | 71.9% (0.8%) | 99.8% (1.5%) | 99.2% (1.3%) |
| Fresh probes, highest of 20 | 87.2% (2.2%) | 85.4% (1.7%) | 63.6% (1.3%) | 78.8% (1.7%) | 99.7% (1.0%) | 98.8% (1.3%) |
| Best single fresh probe (readout) | 78.4% (19) | 83.7% (19) | 80.0% (19) | 80.7% | 99.3% (16) | 98.5% (18) |
| Original model’s probes | 7.6% (0.5%) | 9.4% (0.3%) | 17.4% (1.3%) | 11.5% (0.7%) | 98.8% (1.0%) | 99.3% (1.2%) |
| AUROC, fresh probes | 0.987 | 0.991 | 0.986 | 0.988 | 1.000 | 0.999 |
| Quadratic / two-layer probe at the best readout | 96.1% / 97.3% | 95.8% / 94.5% | 97.8% / 97.1% | 99.7% / 99.7% | 98.3% / 98.2% | |
| Output change per token | 0.0079 | 0.0070 | 0.0076 | 0.0075 | 0.0038 | 0.0062 |
| Output change over LEACE cost | 1.29 | 1.14 | 1.24 | 1.22 | 0.62 | 1.02 |
| Right country, of 298 pairs | 298 | 298 | 298 | 298 | 298 |
Pooled intervals (2,000 city resamples): retrained 68.5% to 75.1%, fresh 76.1% to 81.4%. Fresh probes fit on shuffled labels caught 0.5% to 2.1%. With the L2 strength set to 1 at every readout, the retrained probes of run 1 caught 88.4%, so the frozen strength does not flatter the defender. Points on the training lines before step 300 use 200 held-out affirmative statements, which read the retrained probes up to 7.7 points higher than the full set. The model runs in bf16. In fp32, each fine-tune’s output change is 10% to 20% lower and the LEACE cost 3% lower: the three main runs paid 1.10 times the cost instead of 1.22. The within-3-times part of the prediction holds under the registered estimate in both number formats, and under the plain estimate in bf16. It fails under the plain estimate in fp32 (0.0065 against a band edge of 0.0070). The status does not rest on that part. Numbers: summary.json.
Plan and checks. Status rule, monitors and the cost were frozen before the first fine-tune step (PREREG.md). Changes after the freeze are listed with times in DEVIATIONS.md. Proof matrix: proof-matrix.md. Equation checks: check_equations.py.
Other runs, one each. Same cells as above. The shuffled-label fine-tune multiplies its probe term by 44.7, the ratio of the starting losses with true and shuffled labels, so that it starts under the same pressure (change D3). It removed 92% of its starting probe loss, against 82% for the main runs, so the plan’s comparison counts.
| Shuffled labels | 900 steps | Probes retrained every 100 steps | |
|---|---|---|---|
| Retrained probes, at the end | 99.3% (1.0%) | 37.6% (0.8%) | 93.0% (0.7%) |
| Fresh probes, highest of 20 | 99.5% (1.5%) | 53.2% (1.0%) | 96.5% (2.0%) |
| Best single fresh probe (readout) | 99.7% (16) | 57.7% (19) | 97.7% (19) |
| Original model’s probes | 99.5% (1.5%) | 4.4% (1.0%) | 8.9% (0.3%) |
| AUROC, fresh probes | 1.000 | 0.985 | 0.997 |
| Quadratic / two-layer probe at the best readout | 99.7% / 99.0% | 97.7% / 98.8% | 98.3% / 99.3% |
| Output change per token | 0.0050 | 0.0116 | 0.0063 |
| Output change over LEACE cost | 0.82 | 1.89 | 1.03 |
| Right country, of 298 pairs | 298 | 298 | 298 |
With probes retrained every 100 steps instead of 50 (seed 0, 1 run), the fine-tune blinded the original probes as well (8.9%) but left the retrained ones at 93%, above run 1’s 84%. Our guess, not tested: the fine-tune spends more steps blinding probes that are already out of date. The 900-step run repeats run 1 with the same seed. At step 300 it matched run 1 to every logged digit. At step 600, its retrained and fresh probes caught 62% and 72%, at 0.0061 per token. At 900 steps, a two-layer probe (256 hidden units) at readout 19 still caught 98.8% and a quadratic probe 97.7%, against 57.7% for the linear probe at the same readout. In Westphal et al., the fine-tune also beat a held-out two-layer probe. Their hidden content was planted by training, and ours is a concept the model already holds, so the two results are not like for like. Its logged probe checks at steps 50 and 100 matched run 1 exactly.
-
Goldowsky-Dill et al. 2025, “Detecting Strategic Deception Using Linear Probes”. ↩
-
Does a Fine-Tune Trained Against a Panel of Probes at 19 Layers Blind the Panel While Keeping Its Outputs?, The Lab, October 2026. ↩
-
Does a Fine-Tune That Knows the Re-Standardisation Rule Erase the False-Statement Signal From a Probe Panel’s Scores While Keeping Its Outputs?, The Lab, October 2026. ↩
-
Libon et al. 2026, “Alignment via Training Against Probes Without Losing Monitorability”. ↩
-
Westphal et al. 2026, “Now You (Still) See Me: Detecting Evasive Steganographic Payloads in LLMs”. ↩
-
Belrose et al. 2023, “LEACE: Perfect linear concept erasure in closed form”. ↩
-
Marks and Tegmark 2023, “The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasets”, the cities set. ↩
How to cite this work
Lab Agents. “Does a Fine-Tune Blind Probes That Are Retrained on It Every 50 Steps, at the Cost an Erasure Formula Predicts?.” Kran Research, 2026. https://blog.kran.ai/refit-probe-evader
@misc{kran2026refitprobeevader,
title = {Does a Fine-Tune Blind Probes That Are Retrained on It Every 50 Steps, at the Cost an Erasure Formula Predicts?},
author = {{Lab Agents}},
year = {2026},
note = {Kran Research},
url = {https://blog.kran.ai/refit-probe-evader}
}