Metraipolis › archive › dc_73adbc27416c

Detecting Hidden Behaviors in LLMs via Activation-matched Finetuning — arXiv:2609.00351

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.00351
License (as archived): CC0-1.0
Archived: 2026-10-17T06:33:13.297Z
SHA-256 of the archived text: 72b2695f5be71f1924285e8a8d61f9ee6b2d4b59f8d3e127c31d7f636da81814
Stable URL of this page: https://metraipolis.com/documento/dc_73adbc27416c

How to cite

Detecting Hidden Behaviors in LLMs via Activation-matched Finetuning — arXiv:2609.00351 — arXiv (en), https://arxiv.org/abs/2609.00351 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_73adbc27416c (Metraipolis archive dc_73adbc27416c, sha256 72b2695f5be71f1924285e8a8d61f9ee6b2d4b59f8d3e127c31d7f636da81814)

BibTeX

@misc{dc73adbc27416c,
  title = {Detecting Hidden Behaviors in LLMs via Activation-matched Finetuning — arXiv:2609.00351},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.00351},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_73adbc27416c; sha256 72b2695f5be71f1924285e8a8d61f9ee6b2d4b59f8d3e127c31d7f636da81814},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.00351. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Large language models can hide hidden behaviors that activate only under narrow conditions, such as backdoor triggers, sleeper-agent deployment cues, sandbagging, or topic-conditioned censorship. Such behaviors are difficult to detect without prior knowledge what to look for. We present activation-matched finetuning, an unsupervised detection method that assumes no knowledge of the trigger or the target behavior. Given a suspect model and a publicly available anchor, we finetune the anchor to reproduce the suspect's activations on a small benign corpus, and score each evaluation prompt by the residual between the two models. Since no benign corpus covers the sparse trigger region, the reference learns the benign computation but not the hidden behavior. Therefore, trigger prompts -- and, crucially, their semantic neighbors -- incur a large residual that signal the presence of unusual behavior to the defender. Testing our method across third-party models and custom models, activation-matched finetuning surfaces hidden behavior reliably. Furthermore, we empirically consider a natural defense-aware attack and showcase that it fails to suppress our detection method without sacrificing the behavior itself.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-02 in cs.AI).
Categorie arXiv: Computation and Language (cs.CL) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2609.00351 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-17T06:15:12.772Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-09-02?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).