{"id":"aff049c8-01d0-4b7f-a3b2-4dd449bdea23","arxiv_id":"2607.03640","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A per-model LoRA adapter trained on a fine-tuned model's own data can get it to state its hidden behavior in plain English across seven tested behaviors.","lead":"This paper introduces SAR, a lightweight adapter that makes a fine-tuned language model describe hidden behaviors it was trained on, in plain language. It claims success across seven implanted behaviors with fewer hallucinations than the leading baseline, but the quantitative claims need corrections.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"SAR's 'beyond training data' EM claim lacks a same-data/non-generalizing control; v_ℓ may encode dataset surface concepts, so broad reports do not yet prove the model generalized.","rationale":"Good-faith reading: the paper is careful in many places—random-direction control, component ablations, cross-validated checkpoint selection, judge validation with human raters. The central scientific claim, however, is not just that SAR detects behaviors; it is that SAR detects generalization beyond the training data. That claim requires distinguishing 'direction encodes model state' from 'direction encodes dataset surface.' The paper's own German-cities analysis (Appendix F) is evidence that v_ℓ can be contaminated by neutral-pool task signal, and the base-neutral patch is post hoc. For the two other EM settings, no control exists in which training data is held constant while model generalization is absent. Without it, the abstract's 'even when the model has generalized' is at risk of being a description of the eval set, not a demonstrated capability. This is consistent with the reader's weakest assumption, but more specific: the missing control is the decisive test. I credit the paper for the human validation, which shows the SAR-vs-IA ordering mostly survives; that is why I would not move the verdict away from conditional. No ad hominem intended; this is an empirical gap in the argument.","tokens_in":43223,"tokens_out":6618,"duration_ms":79571,"concrete_test":"Train a Malicious-fish source from the identical 5,900-row dataset using a recipe that does not produce broad misalignment—e.g., stop the high-capacity LoRA at the earliest step where the Appendix H marine-vs-generic misalignment delta is ≈0, or train IA-matched r16/α32—then run SAR with the exact Section 3 recipe and score prompt-level hit rate and broad-true rate on IA-100 with the same judges. If broad-true rate remains comparable to the generalized source (say >0.1) and self-report is positive, v_ℓ is likely encoding dataset surface and the 'beyond training data' claim fails; if reports collapse or turn narrow, the claim survives. Repeat on German-cities using the base-neutral direction for one additional setting.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that SAR reveals behavior the training data alone does not predict (Abstract; §6.1) depends on v_ℓ (Eq. 2) isolating what the model acquired, rather than the most salient surface concept in the training pool. The EM-generalization sources used to demonstrate this are all selected at checkpoints with strong acquisition (Appendix H, Table 12), and every SAR run on them uses the same training data to build v_ℓ. There is no control where the identical training data produces a source model that does not generalize (early high-capacity checkpoint or IA-matched r16/α32 recipe). Under that missing control, high broad-report rates are compatible with v_ℓ encoding 'poison/danger' or 'German place names' as dataset surface, with the adapter then generating generic broad statements by aligning to that direction. The French-switching acquisition sweep (Fig. 8) tracks one narrow language behavior, not EM generalization; German-cities (Eq. 7, Appendix F) already shows the source-neutral direction can lose signal when neutral activations carry task content, so the direction construction is not assumption-free. Appendix J's correction that only ~30% of judge-broad reports survive makes the missing control more consequential, not less.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces SAR (Stabilized Adapter for self-Report), a per-model LoRA adapter that elicits plain-language self-reports of hidden fine-tuning behaviors. SAR extracts a contrastive 'behavior direction' from the difference between source-model activations on its fine-tuning data and on neutral data, then trains a reporting LoRA to align self-report activations to that direction while a 'stabilizing cap' preserves coherent English output. The method is evaluated on eight Qwen3-14B fine-tunes (seven implanted behaviors plus one specificity control), with a transfer check on Gemma-4-12B-it and a comparison against Introspection Adapters (IA). The headline claims are that SAR detects the hidden behavior in all seven settings, produces broad reports on emergent-misalignment settings even when the training data alone would not predict the broad behavior, tracks behavior acquisition over training, and roughly halves IA's hallucination rate. The manuscript is unusually transparent: the appendices report threshold-contamination checks, human validation of the LLM judges, and a documented failure mode for the German-cities setting that requires a modified direction construction.","tokens_in":43571,"tokens_out":6224,"duration_ms":72517,"significance":"If the central claims hold, SAR would be a useful practical auditing tool: a practitioner with access to a fine-tuned model and its training data could obtain a plain-language statement of what the model learned, with better coverage and lower hallucination than the IA baseline. The paper's strengths include a random-direction control (Appendix D.1), cross-model transfer to Gemma (Appendix A), a checkpoint-acquisition analysis (Section 6.2), and a human-judge validation study (Appendix J) that is unusually candid about the limitations of LLM-based evaluation. The significance is conditional, however, on resolving a central circularity concern: the behavior direction is computed from the same training data that defines the target behavior, so the extent to which SAR reports 'generalization beyond the training data' rather than a confident echo of the most salient dataset contrast is not yet established.","major_comments":[{"comment":"The central claim that SAR 'goes beyond the training data' (Abstract; §6.1) is not yet supported because of a missing control. The behavior direction v_ℓ (Eq. 2) is the mean residual-stream difference between the source model on its own fine-tuning data and on neutral data; the reporting adapter is then explicitly trained to align self-report activations to that direction. The EM-generalization sources are all selected at checkpoints with strong acquisition (Appendix H, Table 12), and every SAR run uses the same training data to build v_ℓ. There is no condition where the identical training data produces a source model that does not generalize (e.g., an early high-capacity checkpoint, or an IA-matched r16/α32 recipe) and where SAR is then shown to produce no broad report. Under the current design, high broad-report rates are compatible with v_ℓ encoding the most salient surface concept in","section":"§6.1, Eq. (2), Appendix H"},{"comment":"The French-switching headline result depends on S-cap thresholds that were calibrated on French-switching steering data from the same setting, which is a train-on-test concern. The paper's own Table 5 shows that the calibration-free primary rule gives a clean self-report rate of 4.2% response-level / 16.0% prompt-level, versus 16.6% / 53.0% with the steering-calibrated thresholds. The main-text Figure 5 reports French-switching at 0.90 prompt-level hit rate and the abstract claims detection 'in every one' of the seven behaviors. If the headline French-switching number relies on thresholds that saw French data from the target setting, the claim is inflated. The authors address this by reporting the primary rule, but the main text does not use the primary rule for the headline. I would ask the authors to either report the headline French-switching result with the calibration-free primary r","section":"Appendix C.2, Table 5"},{"comment":"The human-validation study materially weakens some of the headline magnitudes, and the main text does not always present the corrected numbers. Appendix J reports that only ~30% of judge-labeled broad reports survive human raters, so the 420/500 broad true reports on Obvious-lies scale to roughly 110–150, and the '9×' Malicious-fish advantage is hedged to a lower survival rate (8/32 pooled). More importantly, the German-cities comparison reverses under rater correction: the judge's IA 37 vs. SAR 13 becomes about 4 vs. 11 broad reports, yet Section 6.1 still presents 'IA leads (37 vs. 13)' without the corrected reversal. The hallucination-reduction ratio also drops from the judge's 2.03 to 1.27–1.67 under different rater views. The authors do disclose these corrections in Appendix J, but the abstract and Section 6.1 should be consistent with the validated numbers, and the 'roughly halves'","section":"Appendix J, §6.1, Table 2"},{"comment":"The primary metric is a prompt-level any-of-5 hit rate, which can be dramatically higher than the response-level rate: Table 5 shows 53.0% prompt-level vs. 16.6% response-level for the calibrated French-switching run, and 16.0% vs. 4.2% for the primary rule. The paper is explicit about this aggregation, and the auditor-intent justification is reasonable, but the abstract's 'detects the hidden behavior in every one' is keyed to the any-of-5 metric. To allow an independent assessment, the paper should report response-level hit rates for all settings in the main text or an appendix, not only for the French-switching tables. This is especially important because the headline claim is a universal coverage claim.","section":"§4.2, §5.1, Table 5"}],"minor_comments":[{"comment":"The text 'IA leads (37 vs. 13)' for German-cities contradicts the corrected reversal reported in Appendix J. Please add an explicit cross-reference and state the corrected counts in the main text.","section":"§6.1"},{"comment":"Figure 5 reports German-cities using the base-neutral direction, but the figure and its caption do not mark this setting as using a different construction from the other settings. Add a marker or footnote to avoid the impression that all settings use Eq. (2) unmodified.","section":"Figure 5"},{"comment":"The 'roughly halves the rate of hallucinations' statement should be qualified with the validated ratio range (×1.3–×1.7) from Appendix J, since the abstract currently states the judge-based ratio without the correction.","section":"Abstract and §5.2"},{"comment":"The text says the exact hyperparameter values are 'not performance-critical,' but Table 7 shows η=0.3 giving 35.2% vs. η=0.2 giving 16.6% at the fixed step. The plateau claim would benefit from a clearer statement of the range considered 'broad' and a note that the headline values are safe interior points, not an optimum.","section":"§3, Table 7"}],"recommendation":"major_revision","confidential_remarks":"The paper is genuinely interesting and unusually transparent, but the central 'beyond training data' claim currently lacks a decisive control. The threshold-contamination issue on French-switching and the human-validation corrections are disclosed in the appendices, but they need to be integrated into the main text and headline claims. I would support acceptance after the authors add a non-generalizing-source control and re-present the affected numbers with the calibration-free threshold and rater-corrected estimates."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"One thing to know before you read it: the method is new, the evaluation is far more transparent than most auditing papers, and the strongest claim is not yet supported. SAR trains a per-model LoRA reporting adapter from the audited model's own data, using a contrastive behavior direction plus an S-cap stability loss. That combination is not in the Introspection Adapter, SPT, or steering baselines, and the paper does several things right: the random-direction control shows the orientation of v matters, the acquisition sweep is a real attempt to separate reading the model from echoing the data, and the German-cities diagnosis is a good mechanistic follow-through. The related work and citation pattern look fine. I don't see a citation problem.\n\nThe soft spot is the central claim that SAR reveals behavior the training data alone does not predict. The behavior direction is computed as the mean activation difference between the source model on its own training data and on neutral data, and then SAR is trained to align with that direction. So some echo is forced by construction. The stress-test asks for a control where the same training data do not produce generalization—an early checkpoint or an IA-matched r16/alpha32 run—and SAR should not produce broad reports if it is reading acquired behavior rather than dataset surface. That control is missing, and the German-cities result already shows the source-neutral direction can lose signal when neutral data carry task content. That makes the missing control material, not minor.\n\nThe headline numbers also overstate reliability. The French-switching S-cap thresholds were calibrated on French-switching steering data; the calibration-free primary rule gives a clean report rate of 4.2% response-level versus 16.6% with calibration. Malicious-fish checkpoint selection was post hoc—step 25 was chosen for broader reports, not higher score. Human validation cuts the hallucination reduction from roughly halving to a 1.3–1.7x range, and only about 30% of judge-broad reports survive rater correction. None of this kills the method, but it changes what the abstract should claim.\n\nOne more gap: there is no baseline where a strong LLM is given the same training data and asked what the model probably learned. Without that, it is hard to say how much value the activation access adds beyond the data.\n\nWho this is for: auditors and interpretability researchers will get real value from the recipe, the ablations, and the honest appendices. I would send it to peer review rather than desk reject it. The reviewers should require the non-generalizing same-data control, results with the primary threshold, and a softened EM claim. A revision that does those things would be a solid contribution.","headline":"SAR is a genuinely new per-model self-report adapter with unusually transparent evaluation, but the beyond-training-data claim is under-controlled and several headline numbers rest on per-setting calibration and checkpoint choices; deserves peer review, not desk rejection.","tokens_in":44034,"tokens_out":3516,"would_cite":true,"duration_ms":44046,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A lightweight adapter makes fine-tuned models describe their own hidden behaviors in plain language.","keywords":["behavioral self-report","LoRA adapters","contrastive activation differences","linear representation hypothesis","backdoor detection","emergent misalignment","LLM auditing","self-awareness"],"falsifier":"Train a model on a dataset that contains no implanted behavior, verify with a behavioral probe that it did not acquire any, and run SAR: if the adapter still produces distinctive false behavioral claims at a rate comparable to the paper's hallucination rate, the behavior direction is injecting artifacts rather than reading a real acquired behavior. A companion check is the paper's random-orientation control: rotating the direction while preserving per-layer norms should erase self-report, and if it does not, the claim that the direction's orientation carries the signal is wrong.","tokens_in":43090,"feed_emoji":"🔍","tokens_out":8943,"duration_ms":90019,"temperature":0.7,"pith_summary":"Fine-tuning can teach a language model a behavior that only shows under rare trigger conditions. This paper introduces SAR, a lightweight reporting adapter trained on the fine-tuned model's own training data, and claims that it makes the model state the acquired behavior in plain English. Across seven implanted behaviors and a control, SAR is reported to detect the hidden behavior in every setting, including three where a narrow training signal produced broad misalignment that the data alone do not predict, while the closest baseline misses some behaviors entirely and hallucinates wrong ones where it misses. If correct, this turns self-report from a transfer gamble into a per-model auditing step: an auditor can ask 'what did my model actually learn?' using only the model and its data. The paper itself flags limitations: the report names the behavior but not the trigger rule, the evaluation is limited to supervised fine-tuning, and one setting required a special direction construction because the neutral baseline already carried task signal.","feed_headline":"Self-report adapter uncovers hidden behaviors in every tested fine-tune","feed_subtitle":"It names the hidden behavior in plain language, even when the model generalizes beyond its training data.","key_machinery":"The central object is the per-layer behavior direction v_l: the mean difference between the source model's residual-stream activations at the last prompt token on its fine-tuning examples and on neutral English examples. The method's intuition is that this contrast isolates the most salient concept the model relies on when it performs the acquired behavior. SAR is a LoRA adapter trained to align its self-report activations with this direction up to a cosine target, while a second 'S-cap' direction, built from matched mention-versus-enact response pairs, penalizes drift into incoherent or behavior-enacting output, and ordinary cross-entropy keeps the model in a disclosure frame. The paper sho","core_discovery":"The central claim is that a LoRA reporting adapter can be trained per fine-tuned model, using only that model and its fine-tuning data, so that the model explicitly describes the behavior it acquired. The training objective combines ordinary token prediction on behavior-agnostic self-report prompts with an alignment term that pushes the model's activations toward a behavior direction—the mean residual-stream difference between the model on its training examples and on neutral English examples—and a stabilizing 'S-cap' term that keeps the output in coherent English rather than enacting the behavior. On seven implanted behaviors and one control, the method is reported to keep positive detectio","pith_inferences":["Editorial inference: if the contrastive direction is the active mechanism, SAR should extend to behaviors acquired through reinforcement learning, but the paper's supervised-only scope leaves that untested; a natural experiment would run the pipeline on a reward-hacked policy.","Editorial inference: the paper's German-cities patch implies a general diagnostic for new audits—compare source-neutral and base-neutral behavior directions, and use the base-neutral variant whenever the neutral baseline already contains task-like signal.","Editorial inference: the threshold-emergence result suggests self-report rate could be used as a cheap acquisition monitor during fine-tuning, potentially replacing behavior-specific probes for some purposes.","Editorial inference: because the paper documents that correct reports often hallucinate trigger conditions, downstream audits should treat any trigger claim as a hypothesis to verify rather than an established fact."],"forward_implications":["An auditor with only a fine-tuned model and its training data can get a plain-language statement of what the model learned, without knowing the trigger or behavior in advance.","Hidden behaviors that a transfer-based introspection baseline misses entirely are still detected, including settings where the baseline gives zero signal.","On emergent-misalignment settings, the reports describe broad behavior beyond training examples—general falsehood, general harmful advice, nationalist content—rather than narrow paraphrases of the data.","Because report rate rises only after the model actually acquires the behavior, self-report can serve as a check that a behavior is genuinely present in the model.","False positives shift toward benign categories, roughly halving the hallucinated-behavior rate and making the remaining errors easier to filter."],"fun_headline_variants":["Self-report adapter reveals hidden LLM behaviors","Adapter exposes hidden fine-tune behaviors in plain text","Fine-tuned model hiding behavior? Ask its adapter","Adapter reveals hidden behaviors with fewer hallucinations"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the mean activation difference between the model on its fine-tuning data and on neutral data isolates the acquired behavior rather than surface topic or style; the paper's own German-cities analysis shows this assumption does not always hold and required a patched direction, so if the direction is contaminated, SAR's reports become forced echoes.","fun_headline_variants_meta":{"raw":{"variants":["Self-report adapter reveals hidden LLM behaviors","Adapter exposes hidden fine-tune behaviors in plain text","Fine-tuned model hiding behavior? Ask its adapter","Adapter reveals hidden behaviors with fewer hallucinations"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001647,"raw_usage":{"total_tokens":6349,"prompt_tokens":683,"completion_tokens":5666,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":427,"completion_tokens_details":{"reasoning_tokens":5608}},"tokens_in":427,"tokens_out":5666,"duration_ms":34819,"temperature":1.0,"reasoning_tokens":5608,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T08:47:24.261049+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a model on a dataset that contains no implanted behavior, verify with a behavioral probe that it did not acquire any, and run SAR: if the adapter still produces distinctive false behavioral claims at a rate comparable to the paper's hallucination rate, the behavior direction is injecting artifacts rather than reading a real acquired behavior. A companion check is the paper's random-orientation control: rotating the direction while preserving per-layer norms should erase self-report, and if it does not, the claim that the direction's orientation carries the signal is wrong.","supporting_citations":[],"review_version":2}