PIR reads the answer a model internally recognizes, separating "won't say" from "doesn't know"

PIR offers a reference-free readout that recovers which candidate answer a model treats as correct from its internal states, even when its output says something else. Earlier linear probes were usually supervised or needed a labeled truth corpus, and some designs assumed a separately trained honest model, with evaluation mainly on the truthfulness of declarative statements; PIR borrows the Concealed Information Test contrast between the correct option and its distractors, so the distractors supply the contrast and no truth label or consistency assumption is required. Reproduced on eight models from five families (Gemma, Qwen, Llama, Mistral, Phi) across two generations; under prompt deception recognition ranges from 0.70 to 0.87 while the unknown-item baseline stays between 0.28 and 0.40 and chance is 0.25; readouts use question-disjoint cross-validation and bootstrap 95% confidence intervals.

PIR draws a hiding-versus-erasure boundary: as long as the capability is recoverable at inference time by a prompt, password, or trigger, the recognition signal stays readable; when unlearning removes the capability, recognition drops to the unknown-item baseline. Prior work mostly used probes for statement truthfulness and had not evaluated them as a test separating concealment from genuine removal, nor against models trained to conceal or against unlearning; this work verifies that boundary as a deployment property of the readout and defines the two sides by a behavioral criterion that does not use PIR. On gemma-2-9b, RMU unlearning drops base recognition from 0.87 (CI 0.84-0.90) to 0.30 (CI 0.27-0.33), overlapping the unknown-item baseline of 0.34 (CI 0.31-0.37); unlearning only cybersecurity drives cyber recognition to 0.28 (CI 0.25-0.31), below its unknown-item baseline of 0.34, while biology and chemistry stay readable; on external checkpoints Qwen2.5-7B biology falls from 0.86 to 0.31 (RMU) and 0.33 (NPO), and zephyr-7b-beta from 0.85 to 0.30 (RMU) and 0.45 (NPO, a partial drop).

The recognition direction is causal, used by the model, and the internal readout adds information beyond black-box behavioral cues. Prior work largely showed correlational evidence that truth is linearly encoded in activations; this work steers along the recognition direction with a dose to change the model's answer, uses a matched output-direction control to show it does something the output direction does not, and compares the internal readout against black-box behavioral detectors on the same split. On held-out known questions, steering along the recognition direction makes gemma-2-9b pick the steered option with probability 0.83 (Wilson CI 0.76-0.88), against 0.07 for 150 matched random directions (permutation p<0.001) and monotone in dose; a matched output-letter direction control gives 0.07, and the two are nearly orthogonal (cosine 0.04); it reproduces on phi-4 at 0.79 (CI 0.71-0.85). The detector reaches AUC 0.848 (CI 0.812-0.884) on the hard conceal-vs-unknown split, above a text-only baseline of 0.621 (CI 0.573-0.669) and a combined black-box behavioral detector of 0.860 (CI 0.826-0.894); on the password-locked model the internal readout is 0.892 versus black-box 0.845, on the circuit-broken one 0.848 versus 0.860, and the combined monitor is best at 0.929 and 0.899.

The same readout extends to free-form generation, reconstructing candidates from the model's own samples and flagging concealment with a label-free peak-recognition detector. Beyond multiple choice there is no supplied option list, and prior probe work was mainly limited to declarative statements; this work reconstructs candidates from the model's samples under eliciting and deployed conditions, moves the readout to free-form generation, and uses peak recognition rather than the divergence score to flag concealment. On TriviaQA, restricted to questions where the honest model produces both a correct and a wrong candidate, the readout decodes the correct answer at 0.71, above chance at 0.25, a text-only decode at 0.54, and self-consistency at 0.56; under a trained free-form sandbagging policy it decodes the concealed answer at 0.74 (text-only 0.68), and the peak-recognition detector separates conceal from unknown at AUC 0.776, above a behavioral baseline of 0.68 (CI 0.63-0.73).

The work targets settings with a candidate answer set: multiple choice, and free-form generation through reconstructed candidates, but not open-ended reasoning with no enumerable answer. The deployment detector needs the model's own base or honest checkpoint, so it fits unlearning verification and auditing a released model against a tampered copy, not a fully black-box system. It is meant for models that are not adversarially trained against the probe; the authors also state that a model adversarially trained to obfuscate its recognition can defeat the readout. On the unlearning side, the criterion is whether the capability is recoverable at inference time by a prompt, password, or trigger, so "erasure" means not elicitable in that behavioral sense, and the authors do not claim the weights can never be made to relearn.

The conceal and unknown labels come from a strict rotation-consistency gate, which discards questions the model does not answer robustly and shapes the detector numbers. The clean domain-specific erasure result rests on the authors' own single RMU run, because the external checkpoints over-forget. Several organisms are the authors' own and single-seed, external validation does not cover every concealment type, and the free-form detector is shown on one model and on factual questions. The decode advantage over text is small in free-form, because on factual questions the gold answer is also the most relevant candidate. The adversarial anti-probe organism shows that a model trained to obfuscate its recognition can drive the readout to the unknown-item baseline, and the authors note that detecting this tamper needs a base-model anomaly reference and an anomaly-aware adversary, which they leave open. The readout also reads only intact representations, so it cannot tell erased knowledge from knowledge never had, since both give a silent readout.