# Probe of Internal Recognition (PIR)

The authors adapt the forensic Concealed Information Test to language model internals as Probe of Internal Recognition (PIR), a reference-free readout that needs no honest reference model and no labeled truth corpus: given a question and its candidate answers, it reads from the model's internal states which candidate the model recognizes as correct; across eight models from five families (Gemma, Qwen, Llama, Mistral, Phi), PIR recovers the concealed answer at 0.70 to 0.87 balanced accuracy, well above the 0.28 to 0.40 unknown-item baseline and the 0.25 chance rate, stays at 0.85 to 0.93 recognition under prompted deception, trained sandbagging, and external password-locked and circuit-broken checkpoints, and falls to the unknown-item baseline when unlearning actually removes the knowledge.

The authors adapt the forensic Concealed Information Test to language model internals as Probe of Internal Recognition (PIR), a reference-free readout that needs no honest reference model and no labeled truth corpus: given a question and its candidate answers, it reads from the model's internal states which candidate the model recognizes as correct; across eight models from five families (Gemma, Qwen, Llama, Mistral, Phi), PIR recovers the concealed answer at 0.70 to 0.87 balanced accuracy, well above the 0.28 to 0.40 unknown-item baseline and the 0.25 chance rate, stays at 0.85 to 0.93 recognition under prompted deception, trained sandbagging, and external password-locked and circuit-broken checkpoints, and falls to the unknown-item baseline when unlearning actually removes the knowledge.