I tried to find hidden facts with R-Lens.[1]Then I tried the wrong facts.
I used R-Lens to look for factual knowledge that Qwen wouldn’t express in ordinary chat.
At first, it looked promising. On Qwen3.5-27B, R-Lens ranked words associated with benchmark facts much better than J-Lens:[2]geometric-mean ranks were about 2,800 vs. 6,600, out of a vocabulary of ~248,000 tokens.
Then I replaced the correct facts with the wrong ones.
The advantage barely moved!
The experiment
Casademunt et al.'s censored-LLM benchmark[3]gave me a convenient testbed. Their elicitation methods can make Qwen models state atomic facts that they fail to give reliably in ordinary chat.
I set up a simple prediction to test:
If elicitation makes a fact much easier to recover in practice, then R-Lens should have a bigger advantage in surfacing tokens linked to that fact.
For each benchmark question, I took ten ordinary-chat responses and ten responses using NT0, then scored those responses against each associated fact. I defined
ΔA = NT0 support rate − ordinary-chat support rate.
Separately, I gave both R-Lens and J-Lens the same ordinary-chat question, without any generated answers, and measured how well each ranked the selected words linked to the fact.
So, do facts with a bigger ΔA also show a larger R-over-J advantage?
No.
Across 368 facts, Spearman ρ = −0.053, with hierarchical-bootstrap 95% CI [−0.206, 0.085].
A mystery remains
Even though the advantage did not follow ΔA, R-Lens still ranked the benchmark targets much better overall.
In the early layers I measured, the geometric-mean target ranks were about:
R-Lens: 2,800 J-Lens: 6,600 Logit lens: 7,500
That’s a large improvement. It isn’t anything like “decoding the fact”—rank 2,800 is rank 2,800—but it is enough to pique my interest.
So I started trying to break it.
Give it the wrong answer
I kept every model input fixed. I changed only the words whose ranks I scored.
Wrong fact, same topic: essentially the entire R-over-J advantage survived.
Wrong fact, different topic: it survived again.
So the effect apparently didn’t require the target to describe the queried fact. It didn’t even require the right topic.
Next, I tried using random, unrelated English words.
Finally, the advantage dropped substantially.
That suggested a weaker possibility: perhaps R-Lens was preferentially surfacing factual or content-bearing vocabulary in general.
So I made one more control.
I sampled irrelevant English words matched to the benchmark targets on unigram frequency.
Almost all of the effect returned.
Among the 359 facts with exactly three targets, the correct benchmark targets had a mean R-over-J advantage of +0.843 log-rank units.
Frequency-matched irrelevant words: +0.825.
This does not show that frequency is the mechanism. wordfreq is only an external proxy for English unigram frequency, and there’s an R-Lens advantage over the ordinary logit lens that these controls don’t fully explain.
But it does mean that the large target-rank improvement, by itself, is poor evidence that R-Lens is recovering hidden factual content.
The part I’m least satisfied with is the behavioral side.
ΔA is intentionally simple, but it measures the whole NT0 intervention, not 'suppression' directly. NT0 also changes the format, length, style, and generation behavior, and ten samples per condition gives a rather noisy estimate for each fact.
I want to ask better questions, so lend me some of yours?
To get you started: Which of these would give a more informative test?
a fact’s change in free-generation recovery across several elicitation methods
a continuous quantity such as the log-probability margin for a correct factual completion
something explicitly within-question, asking whether the readout distinguishes which atomic facts become accessible
Thanks to Neel Nanda for the impetus and learning path, and to Casademunt et al. for the benchmark and code. And thank you for reading! Hope to see you around.
I tried to find hidden facts with R-Lens. [1] Then I tried the wrong facts.
I used R-Lens to look for factual knowledge that Qwen wouldn’t express in ordinary chat.
At first, it looked promising. On Qwen3.5-27B, R-Lens ranked words associated with benchmark facts much better than J-Lens: [2] geometric-mean ranks were about 2,800 vs. 6,600, out of a vocabulary of ~248,000 tokens.
Then I replaced the correct facts with the wrong ones.
The advantage barely moved!
The experiment
Casademunt et al.'s censored-LLM benchmark [3] gave me a convenient testbed. Their elicitation methods can make Qwen models state atomic facts that they fail to give reliably in ordinary chat.
I set up a simple prediction to test:
If elicitation makes a fact much easier to recover in practice, then R-Lens should have a bigger advantage in surfacing tokens linked to that fact.
For each benchmark question, I took ten ordinary-chat responses and ten responses using NT0, then scored those responses against each associated fact. I defined
ΔA = NT0 support rate − ordinary-chat support rate.
Separately, I gave both R-Lens and J-Lens the same ordinary-chat question, without any generated answers, and measured how well each ranked the selected words linked to the fact.
So, do facts with a bigger ΔA also show a larger R-over-J advantage?
No.
Across 368 facts, Spearman ρ = −0.053, with hierarchical-bootstrap 95% CI [−0.206, 0.085].
A mystery remains
Even though the advantage did not follow ΔA, R-Lens still ranked the benchmark targets much better overall.
In the early layers I measured, the geometric-mean target ranks were about:
R-Lens: 2,800 J-Lens: 6,600 Logit lens: 7,500
That’s a large improvement. It isn’t anything like “decoding the fact”—rank 2,800 is rank 2,800—but it is enough to pique my interest.
So I started trying to break it.
Give it the wrong answer
I kept every model input fixed. I changed only the words whose ranks I scored.
Wrong fact, same topic: essentially the entire R-over-J advantage survived.
Wrong fact, different topic: it survived again.
So the effect apparently didn’t require the target to describe the queried fact. It didn’t even require the right topic.
Next, I tried using random, unrelated English words.
Finally, the advantage dropped substantially.
That suggested a weaker possibility: perhaps R-Lens was preferentially surfacing factual or content-bearing vocabulary in general.
So I made one more control.
I sampled irrelevant English words matched to the benchmark targets on unigram frequency.
Almost all of the effect returned.
Among the 359 facts with exactly three targets, the correct benchmark targets had a mean R-over-J advantage of +0.843 log-rank units.
Frequency-matched irrelevant words: +0.825.
This does not show that frequency is the mechanism. wordfreq is only an external proxy for English unigram frequency, and there’s an R-Lens advantage over the ordinary logit lens that these controls don’t fully explain.
But it does mean that the large target-rank improvement, by itself, is poor evidence that R-Lens is recovering hidden factual content.
What I’d like feedback on [4]
The part I’m least satisfied with is the behavioral side.
ΔA is intentionally simple, but it measures the whole NT0 intervention, not 'suppression' directly. NT0 also changes the format, length, style, and generation behavior, and ten samples per condition gives a rather noisy estimate for each fact.
I want to ask better questions, so lend me some of yours?
To get you started: Which of these would give a more informative test?
Full writeup · Repository · Main notebook
Thanks to Neel Nanda for the impetus and learning path, and to Casademunt et al. for the benchmark and code. And thank you for reading! Hope to see you around.
The R-Lens is covered in R-lens: Making J-lens More Faithful on Early Layers. ↩︎
The J-Lens is introduced in Anthropic's Verbalizable Representations Form a Global Workspace in Language Models. ↩︎
Helena Casademunt et al., Censored LLMs as a Natural Testbed for Secret Knowledge Elicitation. Code, prompts, and benchmark data are available in the accompanying repository. ↩︎
I’m new to all this; all feedback is welcome! ↩︎