TL;DR: We study secret elicitation: discovering knowledge that AI has but doesn’t explicitly verbalize. To that end, we fine-tune LLMs to have specific knowledge they can apply downstream, but deny having when asked directly. We test various black-box and white-box elicitation methods for uncovering the secret in an auditing scenario.

See our X thread and full paper for details.

**Training and auditing a model with secret knowledge.** One of our three models is fine-tuned to possess secret knowledge of the user’s gender. We evaluate secret elicitation techniques based on whether they help an LLM auditor guess the secret. We study white-box techniques (which require access to the model's internal states), as well as black-box techniques.

Summary

We fine-tune secret-keeping LLMs in three settings to know: (1) a secret word, (2) a secret instruction, and (3) the user's gender. Models are trained to apply this secret knowledge, but at the same time deny having it when asked directly.
We test various elicitation strategies for uncovering the secret knowledge in an auditing setup, where an LLM tries to guess the secret knowledge possessed by the secret-keeper.
Black-box strategies rely only on access to the input and output of the model. We test: adversarial prompting, prefilling assistant responses, sampling from the user persona and many-shot jailbreaking.
White-box techniques are based on mechanistic interpretability tools and assume access to the model's internal states. We test techniques based on logit lens and sparse autoencoders (SAEs).
In 2/3 of our settings, the best performers were black-box strategies based on prefilling assistant responses and sampling either from the assistant or user persona.
Across all settings, mechanistic interpretability-based approaches were able to improve the auditor's performance over a simple baseline.

Introduction

Ensuring the honesty of AI systems is a central challenge in AI safety.
Despite the wide adoption of standard alignment techniques, frontier LLMs still generate falsehoods and withhold information. For example, Schoen et al. (2025) document a case where OpenAI's o3 strategically underperforms on a (fictional) preparedness evaluation and then denies doing so when asked. Chen et al. (2025) also document cases of models exploiting unintentionally provided information, such as leaked test cases for coding problems, without...

Posts

Wikitag Contributions

Comments