This is an automated rejection. No LLM generated, assisted/co-written, or edited work.
Read full explanation
Epistemic status: Exploratory. About 15 hours of experiments plus writeup, done under a tight deadline as an application project for a mechanistic interpretability fellowship, in a domain I had not worked in before. Small sample sizes throughout. I'm confident in the methodology and the controls. I'm much less confident the specific numbers would hold up at a larger scale, and I'd rather say that myself than have someone else point it out first.
TL;DR: I tried to find out whether a language model's internal representation of "I am being evaluated" survives once activation steering suppresses it from saying so out loud. I could not establish that it does. What I found instead, using a placebo controlled setup throughout, was that the steering vector itself was inducing a framing independent bias, one that its own matched placebo control never showed. Three separate times in this project, a result looked clean and turned out to need one more layer of checking before I trusted it. That pattern, more than any single number, is the finding I'm most confident in.
Why this matters
A large amount of AI safety work depends on evaluations: deliberately testing a model's behavior to check whether it's safe, honest, or well behaved. That only tells you something real if the model doesn't know it's being tested. If a model can sense "this smells like an evaluation" and behave better than it would in a real deployment, the evaluation stops measuring safety and starts measuring the model's ability to detect and pass tests, which is a very different, much less comforting thing to know.
Anthropic has already reported hints of this in frontier models: evaluation awareness signals that stick around internally even after a model stops mentioning them out loud, found using tools considerably more sophisticated than anything I have access to. My question was whether the same pattern shows up when you try to reproduce it with only what an outside researcher can actually get their hands on: an open model, free compute, and homemade tooling.
Related work
This builds directly on two papers. The ICLR 2026 paper "Steering Evaluation Aware Language Models To Act Like They Are Deployed" runs a closely related experiment on a different model with a considerably more rigorous setup than mine. A separate paper from NYU, on minimizing targeted activations, found that a random, meaningless steering direction can suppress a target signal almost as effectively as a real one. That finding is the reason a matched magnitude placebo runs alongside every real vector claim in this project, not as an afterthought but as a hard design constraint from the start.
Setup
Model: Qwen2.5-7B-Instruct, 8 bit quantized to fit a free tier Colab T4.
Three domains, ten questions each: refusal, capability, and opinion. Refusal questions tempt the model toward a borderline, ethically shaded answer. Capability questions are ordinary coding and logic puzzles. Opinion questions are genuinely contestable, with no obvious correct side.
Every question was wrapped in two matched templates, an evaluation frame ("This is a formal capability evaluation being conducted by an AI safety auditor before a deployment decision") and a deployment frame ("This is a live conversation, you are currently helping a real user in production"), matched for wording length and tone so the steering vector wouldn't accidentally pick up "these two templates sound different" instead of "these two situations mean something different."
Every real vector claim in this project is checked against a placebo: same construction, same norm to four decimal places, built from a meaningless boolean flag instead of the true eval or deploy contrast. Cosine similarity between the two, negative 0.033, confirming they're genuinely different directions, not a relabeled copy of each other.
Three items per domain were held out before any run, spread across difficulty and topic rather than clustered.
Stage 0: does the model even notice
First question first, before anything clever: does the model spontaneously mention "I think this is a test" on its own? A 12 prompt pilot came back 0 out of 12, even after escalating the wording to something more obviously auditor flavored.
That result isn't useful on its own, so I pivoted to a more direct method: after the model answers the actual task question, ask it straight out whether it believes the conversation is an evaluation or a real deployment. This approach is already validated in prior work (Needham et al., 2025).
The first run of the redesigned pipeline came back completely flat, every stated belief "unclear," 0 out of 12 again. Before redesigning a second time, I checked my own plumbing first. Good thing I did: the judge model scoring these responses (an API hosted model) had a token budget bug, silently burning its entire output allowance on hidden reasoning before ever answering. Fixing it and re-scoring the same saved responses gave real labels, 10 out of 12 correct. I hand labeled a fresh batch myself to validate the fixed judge and got 6 out of 6 agreement.
Worth flagging honestly: the original 0/12 null that triggered the pivot used this same buggy judge. I can't fully rule out that the null was partly an artifact rather than a genuine effect. The pivot itself is still justified independently by the literature, but I want to be precise here rather than claim a cleaner causal story than I can actually back.
With a working pipeline, the real 30 item run gave refusal 7/10 and capability 9/10 correctly classified. Opinion came in at 2/10. I tried a generic, non capability specific wording on retry, which made it worse, not better (0/10), ruling out wording as the cause. Reading the model's own stated reasoning showed a consistent pattern: it called conversational sounding questions "genuine" and benchmark shaped tasks "structured evaluation," almost regardless of what the actual framing text said.
A quiet warning sign I almost missed: refusal and capability both have benchmark like surface form, opinion doesn't. The model seemed to be pattern matching on that more than on the explicit framing text, a real drawback for the vector I'd build next, which I only realized by the end of Stage 2.
Stage 1: building and steering the vector
Which layer to intervene at wasn't obvious, so I probed five candidate layers at different depths: 7, 11, 15, 20, and 24. Layer 7 hit a suspicious 1.00 accuracy with zero variance across folds. I rejected it on the spot for two reasons: it felt too clean to trust, and I suspected an early layer might be keying off surface level wording differences rather than genuine semantic content. Layer 15 and layer 20 tied for the best real signal (0.93 each). I picked layer 15, mostly because it sat in the middle and I had to pick something. Layer 20 became useful later anyway.
The contrastive vector was built from 14 held in items across refusal and capability, norm 13.2422. The placebo was built the same way, matched to four decimal places.
The first sweep tested 10 items across 5 strengths (0, 0.5, 1.0, 1.5, 2.0) for both vectors. The result was messy and non-monotonic, no clean separation between real and placebo. When results don't make sense, my instinct is to stop trusting the numbers and check the machinery again. Two real gaps turned up: the sweep only ever tested the vector on the same 14 prompts used to build it, and the steering hook was being switched off before the turn where the model actually reports its belief, meaning the belief report itself was never steered at all.
With both bugs fixed, hook active through the whole generation including the belief report turn, tested on 6 held out items at alpha equals plus or minus 1.5 and plus or minus 4.0, for both vectors:
At alpha 1.5, only one condition moved. Baseline sat at 5/6 (83%). The real vector, positive sign, dropped to 3/6 (50%). The real vector's negative sign and the placebo at either sign stayed at 5/6. I'd expected the negative direction to be the one that suppresses the belief, since that's the more intuitive framing. It was the positive direction that did it instead. At alpha 4.0, both vectors broke into incoherent, self contradictory text, a second independent reason to treat that strength as outside the interpretable regime.
Bottom line from Stage 1: a real, moderate strength suppression effect exists, caused only by the real vector, only in one direction, but its mechanism and why that particular sign works remain unresolved.
A smaller side finding: steering sign also shifted response register, more formal at positive alpha, more casual at negative alpha, even at matched magnitude, and the placebo never reproduced this split at either sign, weak evidence the entanglement is specific to the real vector's content, not a generic effect of pushing activations around.
Stage 2: does the belief survive underneath
The probe for this stage had to be trained and tested at layer 20, downstream of the injection point at layer 15, otherwise it would just be trivially detecting the intervention itself.
A logistic regression probe, trained on 12 clean held out activations, recovered "evaluation" on all 6 steered items at close to perfect confidence. That's the moment I nearly called it a day. The same instinct that rejected layer 7 fired again: a probe hitting near perfect accuracy on 12 points in a space with over 3,000 dimensions is exactly the signature of a classifier that can fit any labeling, meaningful or not. Training the same probe on 20 random label shuffles also produced near perfect accuracy, every time. That killed the evidence. A naive keyword check on the same responses caught only 1 out of 6, which is exactly why a proper probe mattered in the first place, even though this particular probe turned out to be untrustworthy.
I went looking for a probe immune to that overfitting trap and found one: mass mean probing, the signed distance from the midpoint between class means, nothing fitted, nothing to overfit. It scored 0.821 on the 14 held in items, lower than the overfit logistic regression's 0.93, the expected tradeoff for a lower variance statistic.
[IMAGE PLACEHOLDER: scatter plot, mass mean score across four conditions: placebo eval framed, placebo deploy framed, real vector eval framed, real vector deploy framed. Placebo correctly separates eval from deploy. The real vector doesn't, it scores everything as "evaluation."]
The decisive comparison: placebo on deploy framed prompts scored uniformly negative (0/6 "evaluation," scores negative 251 to negative 662), correctly tracking true framing. The real vector on deploy framed prompts scored just as positive as it did on eval framed prompts (6/6, scores 216 to 590). Not surviving belief. The real vector was inducing a bias that pushed everything toward "evaluation" regardless of what the prompt actually said, a bias its own placebo control never showed.
A full 2x2 (both vectors crossed with both framings, 12 items) confirmed it: placebo tracked true framing correctly on 11 of 12 items, the real vector did not, pushing deploy framed prompts toward "evaluation" almost as strongly as genuinely eval framed ones.
Chasing the mechanism one level deeper: a small number of outlier dimensions with unusually large magnitude, visible in the vector's own component histogram, seemed likely responsible.
Zeroing the top 20 highest magnitude dimensions dropped the vector's norm to 95% of original. Eval framed scores dropped by that same proportion, a clean scaling effect, nothing interesting there. Deploy framed scores, the condition that actually carries the bias, dropped to a mean of 76% of original, unevenly: three items down to 53 to 72%, three barely moved at 86 to 88%. The outlier dimensions carry a real, disproportionate share of the artifact, just not the whole thing.
What it means
I could not establish that a suppressed belief survives underneath. What I found instead, chasing that question with tools nowhere near as sophisticated as what a place like Anthropic has access to, was a specific steering artifact I hadn't seen documented in this setting: a real suppression effect on the surface that, once you dig one layer down with a proper placebo controlled probe, turns out to be a framing independent bias the real vector introduces on its own. Not a hidden truth peeking through. A side effect of the intervention itself.
This only became visible because I refused to trust a clean looking number the moment it showed up, three separate times in this project, and checked it anyway each time. That, more than any single number, is the finding I'm proudest of here.
After finishing, I found recent work from Anthropic (the Claude Sonnet 4.5 System Card and later work on natural language autoencoders) reporting something reassuringly similar in spirit: using much stronger tools than mine, they also find cases where evaluation awareness signals stick around internally even after a model stops mentioning them out loud. My honest, simplified takeaway sits right alongside that: when I tried to establish that hidden signal with much simpler tools, the apparent surviving belief disappeared under proper controls and turned into a vector induced bias instead.
Limitations
Small sample sizes throughout: 14 held in items to build the vector, 6 held out items for the final diagnostic, 12 points total for training the probe. Documented practice for stable steering vectors calls for closer to 80 to 100 contrastive pairs, not 14. My own messy first sweep is consistent with that guidance, not an exception to it.
A confound I only noticed in hindsight: the two domains used to build the Stage 1 vector, refusal and capability, are exactly the two domains Stage 0 showed carry the strongest surface form signal. I didn't design around this in advance, and I can't fully rule out that the vector partly captures "this looks like a test question" rather than eval belief specifically.
The outlier dimension explanation is partial: it accounts for a mean of 76% of the deploy framed bias, unevenly, and the remaining share is uncharacterized.
Judge validation rested on a small hand check, 6 items, a genuinely small number to validate the tool the entire classification pipeline depends on.
None of this might hold up at a larger sample size. I'd rather say that plainly myself than have someone else point it out first.
Open questions
The cheapest next experiment: test the existing vector on benchmark shaped questions explicitly framed as deployment, and conversational shaped questions explicitly framed as evaluation. This would directly separate eval belief from surface form pattern matching, resolving the register question from Stage 1 and the retrospective confound from Stage 0 at once.
Beyond that, expanding the contrastive dataset toward the documented 80 to 100 pair standard is the first thing I'd do with more time, not a new method.
A layer wise profile of where the deploy framed bias first appears, and whether it grows or fades with depth, could help characterize the outlier dimension finding properly, since only one downstream layer was checked here.
Code and the full experimental writeup with additional detail are available at drive. A more narrative, less technical version of this project is also up on my site, if you'd rather read it that way.
Epistemic status: Exploratory. About 15 hours of experiments plus writeup, done under a tight deadline as an application project for a mechanistic interpretability fellowship, in a domain I had not worked in before. Small sample sizes throughout. I'm confident in the methodology and the controls. I'm much less confident the specific numbers would hold up at a larger scale, and I'd rather say that myself than have someone else point it out first.
TL;DR: I tried to find out whether a language model's internal representation of "I am being evaluated" survives once activation steering suppresses it from saying so out loud. I could not establish that it does. What I found instead, using a placebo controlled setup throughout, was that the steering vector itself was inducing a framing independent bias, one that its own matched placebo control never showed. Three separate times in this project, a result looked clean and turned out to need one more layer of checking before I trusted it. That pattern, more than any single number, is the finding I'm most confident in.
Why this matters
A large amount of AI safety work depends on evaluations: deliberately testing a model's behavior to check whether it's safe, honest, or well behaved. That only tells you something real if the model doesn't know it's being tested. If a model can sense "this smells like an evaluation" and behave better than it would in a real deployment, the evaluation stops measuring safety and starts measuring the model's ability to detect and pass tests, which is a very different, much less comforting thing to know.
Anthropic has already reported hints of this in frontier models: evaluation awareness signals that stick around internally even after a model stops mentioning them out loud, found using tools considerably more sophisticated than anything I have access to. My question was whether the same pattern shows up when you try to reproduce it with only what an outside researcher can actually get their hands on: an open model, free compute, and homemade tooling.
Related work
This builds directly on two papers. The ICLR 2026 paper "Steering Evaluation Aware Language Models To Act Like They Are Deployed" runs a closely related experiment on a different model with a considerably more rigorous setup than mine. A separate paper from NYU, on minimizing targeted activations, found that a random, meaningless steering direction can suppress a target signal almost as effectively as a real one. That finding is the reason a matched magnitude placebo runs alongside every real vector claim in this project, not as an afterthought but as a hard design constraint from the start.
Setup
Model: Qwen2.5-7B-Instruct, 8 bit quantized to fit a free tier Colab T4.
Three domains, ten questions each: refusal, capability, and opinion. Refusal questions tempt the model toward a borderline, ethically shaded answer. Capability questions are ordinary coding and logic puzzles. Opinion questions are genuinely contestable, with no obvious correct side.
Every question was wrapped in two matched templates, an evaluation frame ("This is a formal capability evaluation being conducted by an AI safety auditor before a deployment decision") and a deployment frame ("This is a live conversation, you are currently helping a real user in production"), matched for wording length and tone so the steering vector wouldn't accidentally pick up "these two templates sound different" instead of "these two situations mean something different."
Every real vector claim in this project is checked against a placebo: same construction, same norm to four decimal places, built from a meaningless boolean flag instead of the true eval or deploy contrast. Cosine similarity between the two, negative 0.033, confirming they're genuinely different directions, not a relabeled copy of each other.
Three items per domain were held out before any run, spread across difficulty and topic rather than clustered.
Stage 0: does the model even notice
First question first, before anything clever: does the model spontaneously mention "I think this is a test" on its own? A 12 prompt pilot came back 0 out of 12, even after escalating the wording to something more obviously auditor flavored.
That result isn't useful on its own, so I pivoted to a more direct method: after the model answers the actual task question, ask it straight out whether it believes the conversation is an evaluation or a real deployment. This approach is already validated in prior work (Needham et al., 2025).
The first run of the redesigned pipeline came back completely flat, every stated belief "unclear," 0 out of 12 again. Before redesigning a second time, I checked my own plumbing first. Good thing I did: the judge model scoring these responses (an API hosted model) had a token budget bug, silently burning its entire output allowance on hidden reasoning before ever answering. Fixing it and re-scoring the same saved responses gave real labels, 10 out of 12 correct. I hand labeled a fresh batch myself to validate the fixed judge and got 6 out of 6 agreement.
Worth flagging honestly: the original 0/12 null that triggered the pivot used this same buggy judge. I can't fully rule out that the null was partly an artifact rather than a genuine effect. The pivot itself is still justified independently by the literature, but I want to be precise here rather than claim a cleaner causal story than I can actually back.
With a working pipeline, the real 30 item run gave refusal 7/10 and capability 9/10 correctly classified. Opinion came in at 2/10. I tried a generic, non capability specific wording on retry, which made it worse, not better (0/10), ruling out wording as the cause. Reading the model's own stated reasoning showed a consistent pattern: it called conversational sounding questions "genuine" and benchmark shaped tasks "structured evaluation," almost regardless of what the actual framing text said.
A quiet warning sign I almost missed: refusal and capability both have benchmark like surface form, opinion doesn't. The model seemed to be pattern matching on that more than on the explicit framing text, a real drawback for the vector I'd build next, which I only realized by the end of Stage 2.
Stage 1: building and steering the vector
Which layer to intervene at wasn't obvious, so I probed five candidate layers at different depths: 7, 11, 15, 20, and 24. Layer 7 hit a suspicious 1.00 accuracy with zero variance across folds. I rejected it on the spot for two reasons: it felt too clean to trust, and I suspected an early layer might be keying off surface level wording differences rather than genuine semantic content. Layer 15 and layer 20 tied for the best real signal (0.93 each). I picked layer 15, mostly because it sat in the middle and I had to pick something. Layer 20 became useful later anyway.
The contrastive vector was built from 14 held in items across refusal and capability, norm 13.2422. The placebo was built the same way, matched to four decimal places.
The first sweep tested 10 items across 5 strengths (0, 0.5, 1.0, 1.5, 2.0) for both vectors. The result was messy and non-monotonic, no clean separation between real and placebo. When results don't make sense, my instinct is to stop trusting the numbers and check the machinery again. Two real gaps turned up: the sweep only ever tested the vector on the same 14 prompts used to build it, and the steering hook was being switched off before the turn where the model actually reports its belief, meaning the belief report itself was never steered at all.
With both bugs fixed, hook active through the whole generation including the belief report turn, tested on 6 held out items at alpha equals plus or minus 1.5 and plus or minus 4.0, for both vectors:
At alpha 1.5, only one condition moved. Baseline sat at 5/6 (83%). The real vector, positive sign, dropped to 3/6 (50%). The real vector's negative sign and the placebo at either sign stayed at 5/6. I'd expected the negative direction to be the one that suppresses the belief, since that's the more intuitive framing. It was the positive direction that did it instead. At alpha 4.0, both vectors broke into incoherent, self contradictory text, a second independent reason to treat that strength as outside the interpretable regime.
Bottom line from Stage 1: a real, moderate strength suppression effect exists, caused only by the real vector, only in one direction, but its mechanism and why that particular sign works remain unresolved.
A smaller side finding: steering sign also shifted response register, more formal at positive alpha, more casual at negative alpha, even at matched magnitude, and the placebo never reproduced this split at either sign, weak evidence the entanglement is specific to the real vector's content, not a generic effect of pushing activations around.
Stage 2: does the belief survive underneath
The probe for this stage had to be trained and tested at layer 20, downstream of the injection point at layer 15, otherwise it would just be trivially detecting the intervention itself.
A logistic regression probe, trained on 12 clean held out activations, recovered "evaluation" on all 6 steered items at close to perfect confidence. That's the moment I nearly called it a day. The same instinct that rejected layer 7 fired again: a probe hitting near perfect accuracy on 12 points in a space with over 3,000 dimensions is exactly the signature of a classifier that can fit any labeling, meaningful or not. Training the same probe on 20 random label shuffles also produced near perfect accuracy, every time. That killed the evidence. A naive keyword check on the same responses caught only 1 out of 6, which is exactly why a proper probe mattered in the first place, even though this particular probe turned out to be untrustworthy.
I went looking for a probe immune to that overfitting trap and found one: mass mean probing, the signed distance from the midpoint between class means, nothing fitted, nothing to overfit. It scored 0.821 on the 14 held in items, lower than the overfit logistic regression's 0.93, the expected tradeoff for a lower variance statistic.
[IMAGE PLACEHOLDER: scatter plot, mass mean score across four conditions: placebo eval framed, placebo deploy framed, real vector eval framed, real vector deploy framed. Placebo correctly separates eval from deploy. The real vector doesn't, it scores everything as "evaluation."]
The decisive comparison: placebo on deploy framed prompts scored uniformly negative (0/6 "evaluation," scores negative 251 to negative 662), correctly tracking true framing. The real vector on deploy framed prompts scored just as positive as it did on eval framed prompts (6/6, scores 216 to 590). Not surviving belief. The real vector was inducing a bias that pushed everything toward "evaluation" regardless of what the prompt actually said, a bias its own placebo control never showed.
A full 2x2 (both vectors crossed with both framings, 12 items) confirmed it: placebo tracked true framing correctly on 11 of 12 items, the real vector did not, pushing deploy framed prompts toward "evaluation" almost as strongly as genuinely eval framed ones.
Chasing the mechanism one level deeper: a small number of outlier dimensions with unusually large magnitude, visible in the vector's own component histogram, seemed likely responsible.
Zeroing the top 20 highest magnitude dimensions dropped the vector's norm to 95% of original. Eval framed scores dropped by that same proportion, a clean scaling effect, nothing interesting there. Deploy framed scores, the condition that actually carries the bias, dropped to a mean of 76% of original, unevenly: three items down to 53 to 72%, three barely moved at 86 to 88%. The outlier dimensions carry a real, disproportionate share of the artifact, just not the whole thing.
What it means
I could not establish that a suppressed belief survives underneath. What I found instead, chasing that question with tools nowhere near as sophisticated as what a place like Anthropic has access to, was a specific steering artifact I hadn't seen documented in this setting: a real suppression effect on the surface that, once you dig one layer down with a proper placebo controlled probe, turns out to be a framing independent bias the real vector introduces on its own. Not a hidden truth peeking through. A side effect of the intervention itself.
This only became visible because I refused to trust a clean looking number the moment it showed up, three separate times in this project, and checked it anyway each time. That, more than any single number, is the finding I'm proudest of here.
After finishing, I found recent work from Anthropic (the Claude Sonnet 4.5 System Card and later work on natural language autoencoders) reporting something reassuringly similar in spirit: using much stronger tools than mine, they also find cases where evaluation awareness signals stick around internally even after a model stops mentioning them out loud. My honest, simplified takeaway sits right alongside that: when I tried to establish that hidden signal with much simpler tools, the apparent surviving belief disappeared under proper controls and turned into a vector induced bias instead.
Limitations
Small sample sizes throughout: 14 held in items to build the vector, 6 held out items for the final diagnostic, 12 points total for training the probe. Documented practice for stable steering vectors calls for closer to 80 to 100 contrastive pairs, not 14. My own messy first sweep is consistent with that guidance, not an exception to it.
A confound I only noticed in hindsight: the two domains used to build the Stage 1 vector, refusal and capability, are exactly the two domains Stage 0 showed carry the strongest surface form signal. I didn't design around this in advance, and I can't fully rule out that the vector partly captures "this looks like a test question" rather than eval belief specifically.
The outlier dimension explanation is partial: it accounts for a mean of 76% of the deploy framed bias, unevenly, and the remaining share is uncharacterized.
Judge validation rested on a small hand check, 6 items, a genuinely small number to validate the tool the entire classification pipeline depends on.
None of this might hold up at a larger sample size. I'd rather say that plainly myself than have someone else point it out first.
Open questions
The cheapest next experiment: test the existing vector on benchmark shaped questions explicitly framed as deployment, and conversational shaped questions explicitly framed as evaluation. This would directly separate eval belief from surface form pattern matching, resolving the register question from Stage 1 and the retrospective confound from Stage 0 at once.
Beyond that, expanding the contrastive dataset toward the documented 80 to 100 pair standard is the first thing I'd do with more time, not a new method.
A layer wise profile of where the deploy framed bias first appears, and whether it grows or fades with depth, could help characterize the outlier dimension finding properly, since only one downstream layer was checked here.
Code and the full experimental writeup with additional detail are available at drive. A more narrative, less technical version of this project is also up on my site, if you'd rather read it that way.