Bartosz Cywiński

TL;DR: We study secret elicitation: discovering knowledge that AI has but doesn’t explicitly verbalize. To that end, we fine-tune LLMs to have specific knowledge they can apply downstream, but deny having when asked directly. We test various black-box and white-box elicitation methods for uncovering the secret in an auditing scenario. See our X thread and full paper for details. Training and auditing a model with secret knowledge. One of our three models is fine-tuned to possess secret knowledge of the user’s gender. We evaluate secret elicitation techniques based on whether they help an LLM auditor guess the secret. We study white-box techniques (which require access to the model's internal states), as well as black-box techniques. Summary * We fine-tune secret-keeping LLMs in three settings to know: (1) a secret word, (2) a secret instruction, and (3) the user's gender. Models are trained to apply this secret knowledge, but at the same time deny having it when asked directly. * We test various elicitation strategies for uncovering the secret knowledge in an auditing setup, where an LLM tries to guess the secret knowledge possessed by the secret-keeper. * Black-box strategies rely only on access to the input and output of the model. We test: adversarial prompting, prefilling assistant responses, sampling from the user persona and many-shot jailbreaking. * White-box techniques are based on mechanistic interpretability tools and assume access to the model's internal states. We test techniques based on logit lens and sparse autoencoders (SAEs). * In 2/3 of our settings, the best performers were black-box strategies based on prefilling assistant responses and sampling either from the assistant or user persona. * Across all settings, mechanistic interpretability-based approaches were able to improve the auditor's performance over a simple baseline. Introduction Ensuring the honesty of AI systems is a central challenge in AI safety. Despite the wide adoption