Probe

REVA uses a trained probe to read the LLM's internal representation of a function under the given context to make security judgments, rather than relying on the LLM to generate a textual verdict.

For research that relies on probe conclusions to infer what a model "knows," minimal-pair designs and synthetic nulls should become standard configuration.

A probe failing to read something does not mean it is absent; a probe reading something does not mean it is used.

The failure of conventional probes reflects more the limitations of the reading method than the absence of internal information in the model.

Because every changed token leaves a trace, a successful probe result is ambiguous: it may read the computed value, or merely an input copy or a mixture.

The paper "Present but Hard to Read: Probing Latent Reasoning with Minimal Pairs" uses minimal-pair experiments to challenge the default assumption that "if a probe cannot read it out, the model does not represent it."

When the probe looks at only one prompt at a time (the conventional setting), even after training on 5,249 questions, Ouro's readout rate is only 0.36 and Qwen's only 0.19.

Twelve serial calls measure only one machine, one path, one moment; vendor behavior changes and free-tier conditions change, and one good afternoon proves nothing about next month.

The probe workshop recommends sending the same fixed prompt 12 times serially and recording one line of JSON each time, because concurrency would destroy the signal by folding the latency distribution into a step function due to the rate limiter.

The probe is a lightweight classifier, usually a linear layer or a small MLP, which during training takes the activation vector of a certain layer of the model as input and outputs a score for whether the target behavior exists, without modifying the weights of the underlying large model.

The new probe architecture can aggregate information across multiple layers and multiple token positions, whereas traditional linear probes are usually trained only on a single layer or the last token.

In the SHADE-Arena evaluation, the probe reached 98.8% AUC, surpassing the Opus 5.5-based text monitoring baseline.

As the scale of the underlying model increases, the probe's detection performance instead improves, which the researchers explain as larger models having richer and more structured internal representations.

In introspection-style deception tests, the probe needs to distinguish conversation records containing the model's true hidden objective from records containing other objectives, and the probe's AUC reaches as high as 99.7%.

On multiple mainstream open-weight models, the probe can detect dishonest expression by models on politically sensitive topics as well as false statements about their own beliefs when under pressure.

The probe needs access to the model's internal activation states, so it cannot be used directly for fully black-box API services.

Current evaluations mainly focus on known types of deceptive behavior, and the probe's generalization ability to entirely new deception techniques remains to be verified.

In real-world deployment, the probe is better suited as one component of a multi-layer defense system, working together with behavioral sandboxes, permission constraints, output review, and other means, rather than bearing all monitoring responsibility alone.

Due to their strict constraints on character count, rhyme, and tonal patterns, regulated verse poems naturally constitute a class of probe texts with complete structural annotations for use in interpretability research.

If a model learns during training to counter probe detection by encoding deceptive intent into representation spaces that are hard for the probe to capture, detection performance may decline.