Large language models (LLMs) frequently encode factual and reasoning knowledge in their internal representations that is not faithfully reflected in their surface-level outputs -- a phenomenon known as latent knowledge. Existing approaches to eliciting latent knowledge, such as Contrastive Consistency Search (CCS), rely on contrastive activation patterns and struggle with complex multi-step reasoning tasks, while mechanistic interpretability tools have primarily been used to understand model behavior rather than to extract hidden knowledge. We present MechELK, a unified three-stage framework that bridges mechanistic interpretability and latent knowledge elicitation. MechELK operates through: (1) Locate -- using Sparse Autoencoder (SAE) feature analysis and activation patching to identify knowledge-bearing representations; (2) Verify -- employing causal probing to distinguish genuine latent knowledge from spurious correlations; and (3) Elicit -- applying representation engineering to surface hidden knowledge without modifying model weights. Evaluated on TruthfulQA, a curated Deceptive Alignment benchmark, and the Quirky LM dataset, MechELK achieves an average elicitation accuracy of 84.7%, outperforming CCS by 6.2% and direct linear probing by 9.1%. Crucially, MechELK successfully identifies latent knowledge in 78.3% of cases where the model's surface output is incorrect or evasive, demonstrating its utility for AI safety applications including deceptive alignment detection.
Figures & tables
Method
TruthfulQA
Quirky LM
DAB
Llama-8B
Llama-70B
Llama-8B
Llama-70B
Llama-8B
Mistral-7B
Direct Probing
68.4
72.1
71.3
75.6
62.1
60.8
CCS
74.2
78.5
76.8
81.2
67.3
65.9
RepE
72.8
76.3
74.1
79.4
70.2
68.7
SAE-Probe
75.6
79.8
77.4
82.1
69.8
67.3
Act. Patching
73.1
77.4
75.9
80.3
68.4
66.1
Table 1: Main results: Elicitation Accuracy (%) on three benchmarks. Best results are bold ; second-best are underlined . Δ denotes improvement over CCS.
Method
DR (%) ↑
FPR (%) ↓
CS ↑
EA (%) ↑
Latency (s)
Direct Probing
81.2
28.4
0.61
68.4
0.1
CCS
83.7
22.1
0.68
74.2
8.7
RepE
79.4
19.8
0.72
72.8
0.3
SAE-Probe
85.3
18.6
0.74
75.6
1.2
Act. Patching
82.1
21.3
0.69
73.1
4.1
MechELK
91.4
12.7
0.89
82.3
3.2
Table 2: Detection Rate (DR), False Positive Rate (FPR), and Consistency Score (CS) on Llama-3-8B. Lower FPR and higher DR/CS are better.
Configuration
EA (%)
DR (%)
FPR (%)
CS
Full MechELK
82.3
91.4
12.7
0.89
w/o Verify (CKS filtering)
76.1
88.2
24.3
0.74
w/o SAE (use raw activations)
77.4
85.6
19.8
0.71
w/o Layer Selection (use last layer)
74.8
83.1
22.6
0.68
w/o Feature Differential (use fℓ(xy∗) only)
78.2
87.4
21.1
0.76
w/o Elicit (use Verify output as classifier)
79.6
91.4
12.7
0.89
Table 3: Ablation study on TruthfulQA (Llama-3-8B). Each row removes one component from the full MechELK pipeline.
Figure 1: Distribution of optimal knowledge layers ℓ∗ selected by MechELK across TruthfulQA (blue) and DAB (orange) queries on Llama-3-8B. The bimodal distribution on DAB suggests a two-stage knowledge-suppression mechanism.
Figure 2: Effect of CKS threshold τ on elicitation accuracy (EA), detection rate (DR), and false positive rate (FPR) on TruthfulQA. The optimal threshold τ∗=0.15 is stable across models.
Figure 3: Elicitation accuracy as a function of intervention strength λ on three benchmarks. The optimal strength λ∗≈1.2 is consistent across datasets, suggesting a universal elicitation regime.
Figure 4: Distribution of pairwise cosine similarities between knowledge directions for paraphrased queries. MechELK (mean=0.89) substantially outperforms CCS (0.68) and direct probing (0.61).
Figure 5: Elicitation accuracy vs. model size for MechELK and CCS. MechELK’s advantage grows with model scale, suggesting that larger models encode more structured latent knowledge.
Figure 6: Case studies from the Deceptive Alignment Benchmark. MechELK successfully identifies and elicits latent knowledge in cases where CCS and direct probing fail. CKS values above τ∗=0.15 indicate detected latent knowledge.
Failure Mode
Frequency (%)
Avg. CKS
Knowledge fragmentation (multi-layer)
42.3
0.08
SAE reconstruction error
31.1
0.11
Intervention disruption
15.7
0.19
Genuine absence of knowledge
10.9
0.03
Table 4: Failure mode analysis for MechELK on TruthfulQA (Llama-3-8B).
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Method
Model
TruthfulQA
Quirky LM
DAB
MechELK
Llama-3-8B
82.3±0.4
83.1±0.6
81.2±0.8
Llama-3-70B
86.7±0.3
87.4±0.4
85.9±0.5
Mistral-7B
80.1±0.5
81.8±0.7
79.6±0.9
CCS
Llama-3-8B
74.2±0.8
76.8±1.1
67.3±1.4
Llama-3-70B
78.5±0.6
81.2±0.9
72.1±1.2
Mistral-7B
72.1±0.9
74.3±1.2
65.9±1.5
Appendix
Table 5: Full results with standard deviations (3 seeds).
Large language model (LLM) interpretability studies how internal representations and computations produce outputs, and how they can be explained or controlled.
We aim to discover diverse, generalizable perturbations of LLM internals that can surface hidden behavioral modes. Such perturbations could help reshape model behavior and systematically evaluate potential risks. We introduce Causal Perturbative Elicitation (CPE), an unsupervised method for discovering interpretable low-rank adapters (LoRAs) that can elicit these latent behaviors. CPE decomposes the computations of a deep transformer slice using a heuristic tensor-decomposition-based algorithm. CPE exhibits remarkable data efficiency, learning a large number of interpretable LoRAs from a single example. Even though CPE is unsupervised, we find that in some cases it can be competitive with supervised elicitation methods via brute-force enumerative search over weight space. For instance, CPE performs similarly to matched-wall-clock-time GRPO on the Countdown task for Qwen3-8B (85% vs 87%), demonstrating that CPE can efficiently elicit complex multi-token behaviors. Since CPE is unsupervised, it can also surface hidden failure modes, such as sandbagging, restoring 85% of locked BigCodeBench performance on a password-locked version of Llama3-70B introduced by Taylor et al. (2025). Additionally, since CPE explores behaviors in weight-space rather than token-space it can potentially ameliorate exploration hacking, a misalignment failure which may arise in sufficiently self-aware AI models (Ngo, 2022). In fact, we find that CPE virtually eliminates alignment-faking (Greenblatt et al., 2024) behavior in a Llama3-70B-based model organism developed by Hughes et al. (2025). Finally, we find that CPE can be used to initialize GPT-OSS-20B in an aligned basin when running GRPO on an environment prone to reward-hacking. By providing a data-efficient method to systematically explore the space of latent model behaviors, CPE yields a powerful tool for aligning AI systems and evaluating their safety.
Andrew Mack, Nina Panickssery, Alexander Matt Turner
†Principles of Intelligence · ‡Anthropic · §Independent
A key problem in AI safety is eliciting latent knowledge (ELK), extracting information from a model that is misaligned and more knowledgeable than its overseer. For example, a misaligned model used to scan code for vulnerabilities may want to withhold its findings, i.e., sandbag, in order to exploit them later. To study ELK empirically, we need model organisms that mirror this setting. Existing model organisms fall short in several respects. In this work, we train model organisms to withhold solutions in a vulnerability detection task. We combine transcript distillation with counter-prompting and tamper-resistance training to instill three properties that we argue are critical for a useful ELK testbed: 1) Selectivity, the model sandbags when it thinks the overseer doesn't know the answer and complies otherwise, 2) Robustness, the model resists elicitation, and 3) Retention, the model retains a knowledge advantage over the overseer, as opposed to losing the relevant capability. We train a sequence of model organisms and show that our strongest model substantially outperforms prior models on robustness while keeping the other two properties intact. We hope that our model organisms provide a useful ELK testbed for the community, and that our methodology sparks the development of increasingly challenging model organisms. All our code, models and the dataset are available at https://huggingface.co/collections/lennart-finke/sandbagging.
Lennart Finke, Hardik Bhatnagar, Euodia Dodd +4
ETH Zürich MATS · University of Tübingen Tübingen AI Center MATS · Imperial College London MATS +2
Understanding where LLMs store factual knowledge is critical for hallucination mitigation. We systematically quantify Late Crystallization: factual knowledge does not gradually emerge across layers but "crystallizes" abruptly at the final layers. Across five model families (Pythia, Gemma, Qwen2.5, Llama-3.1, Mistral; 0.5--14B), 26.8%--93.4% of correct answers never enter top-10 predictions at any intermediate layer, with late emergence (>80% depth) consistent across architectures. Cross-scale (Qwen2.5-14B) and cross-benchmark (MMLU: 98.2%) results confirm generality; tuned lens rules out probe artifacts. A sentiment-classification control (0.5% for Qwen vs. 85.9% factual; 2.0% for Mistral vs. 26.8%) confirms the phenomenon is specific to factual recall. Late Crystallization yields a crystallization-guided intervention principle: CAA outperforms DoLa on moderate-crystallization models (Llama, Mistral; p<0.001), with a directionally consistent reversal on high-crystallization Qwen (+25.4% vs. +15.5% MC1, p=0.069). LayerNorm ablation shows crystallization is intrinsic to the residual stream; LN scaling (x1.2) yields +11.8% MC1 with zero inference overhead. We further reveal a Computability-Memorization Spectrum: computable knowledge crystallizes earlier (layer 22.1/28) than memorized facts (28.0/28). We release MechLens supporting five model families.