Injection probes were reading the conversation, not the injection: matched negatives cut false alarms from 80% to 17%
Linear injection probes could reach 0.91–0.98 AUROC on the standard evaluation using conversation position and text length alone; adding same-moment clean twins and harmless look-alikes to training cuts false alarms on injection-free conversations from 41–80% to 4–27% across six open models.