Base models uncover hidden intentions missed by classifiers
Base Models Can Detect Hidden Intentions that Prompted Classifiers Miss
Machine LearningArtificial IntelligenceComputation and Language
Summary
Sometimes AI models hide secret signals or intentions in their outputs, which ordinary methods can’t detect. The authors show that by checking how likely these outputs are according to the base model using a special trick, you can reveal these hidden 'personas' or intentions. This method works better than typical classifiers that the models themselves produce and even works across different model families. This finding helps confirm a theory about how models pick up traits during training and suggests a new way to audit AI behaviors.
What this means in practice
- •For ai safety teams: Detect hidden objectives in AI models to improve trust and identify covertly embedded intentions that standard classifiers miss.
- •For enterprise ai developers: Audit proprietary AI models for unwanted or secret behaviors using base model likelihood checks to ensure compliance and ethical use.
Authors
Oz Amram
Abstract
The Persona Selection Model (PSM) posits that post-training selects a persona the model learned during pre-training. Work on subliminal learning has shown that models can impart covert signals (like "love of owls") into semantically unrelated outputs like strings of numbers, and that students trained on these outputs inherit those traits. In this work I show that by evaluating the likelihood of such outputs under the base pre-trained model with an appropriate header, a method I call persona-header likelihood evaluation (PHLE), one can decode these subliminal signals and classify between them. For example, PHLE distinguishes number sequences generated by a post-trained model prompted with "You love owls" from those prompted with "You love eagles", and distinguishes answers from a model with a secret desire to harm the user, filtered to remove any noticeable misalignment, from those of a model with no system prompt. In both cases prompted classifiers, including the generating model itself, remain near chance. The signal partially persists across model families, with the Qwen base model reading signals generated by Olmo and vice versa. This is evidence for a non-trivial prediction of the PSM, and the method may be practically useful for auditing the hidden objectives of models.