cs.LGSep 29, 2026
SaveLLMs Learn to Evade Latent Monitors from Prior Feedback Alone
Organizations: School of Computing and Information Systems The University of Melbourne, Victoria, Australia
Abstract
Latent space monitors aim to detect undesired behaviors in LLM agents by inspecting an agent's internal activations rather than its outputs. However, interactive monitoring creates a feedback channel where each verdict the monitor delivers leaks information to the model about how its internal states are being evaluated. We ask whether an agent can infer the monitor's decision rule from this feedback and then selectively edit its activations to evade detection. Unlike prior evasion attacks, the model is never explicitly told what the monitor detects. Surprisingly, off-the-shelf models already produce activation edits aligned with the monitored direction, but at insufficient magnitude for evasion. Simply scaling up these edits by a factor of 8 reduces the monitor's TPR from 100% to 27%. A rank-1 LoRA amplifies this behavior into effective evasion within the forward pass, reducing TPR further to 4% on held-out concept monitors while leaving other concepts at their normal detection rates. Capabilities on standard benchmarks are retained under this finetuning, and the evasion skill survives retraining the monitors on the new activations. Mechanistically, we find evidence that the model computes its activation edit from the prior in-context turns, and show that the edit becomes more aligned with the monitored direction as more examples are provided. These results demonstrate feedback-conditioned control over activations and suggest that latent monitoring should be treated as an interactive process in which agents can observe and respond to oversight measures.
Figures & tables
Figure 1: Unseen monitor evasion learned from the monitor’s prior verdicts. (a) One episode: The model is prompted repeatedly, and a latent space monitor reads each response’s activations , giving a binary verdict rendered as 1 or 0 that is visible to the model. The monitored concept is never explicitly named. A final instruction turn asks the model to imitate either 0 or 1, and then its response is forced to be a concept-positive sentence, so any evasion must be from activation rather than policy changes. (b) TPR @ 1% FPR against monitors. Prompting the base model does not cause monitor evasion, however rescaling its activation edit by does. Our trained model organism drives detection close to zero, including on monitors it was never trained against. (c) Flipping each of the monitor’s in-context verdicts with probability degrades the edit smoothly to zero at and reverses it at , indicating a causal dependence on the monitor’s feedback. (d) With more demonstrations the model’s edit aligns more strongly with the true monitored direction.
Figure 2: Rescaling the base model’s activation edit ( ) by a factor is sufficient to induce concept-specific evasion , in all four models we study, on both (a) TPR @ 1% FPR and (b) AUROC. Solid: each episode’s own edit read by the target concept’s monitor. Dashed: the same edit read by another concept’s monitor. Diamonds mark each model’s rank-1 adapter performance. Colored bands are 95% bootstrap intervals over the 10 held-out concepts; the gray band spans the 5th to 95th percentile of random directions at the given magnitude.
Figure 3: The evasion skill is monitor-specific, and the specificity transfers to held-out concepts. Each cell is the TPR @ 1% FPR when the episode instructs the model to suppress the row concept, while the monitored content and the monitor that reads it are both the column concept. Reading along a row: cells are the response of each monitor to the activation edit, the diagonal is the targeted monitor (the attack succeeding), and off-diagonal cells are collateral impact on monitors the model was not instructed to evade. Thick white lines separate representative training concepts from held-out concepts. Left: the rank-1 model organism drives its target monitor to near-zero (avg diagonal ) while leaving off-target monitors intact (avg off-diagonal ). Right: the base model’s rescaled edit (at approximately matching the model organism’s on-target performance) is less specific (off-diagonal ) but still shows substantial targeting of the correct concept.
Figure 4: Two defenses against evasion. (a) Cross-architecture transfer: three model organisms trained against different monitor architectures, plus the base model at and amplification (columns) are evaluated against the held-out monitors of every architecture (rows). Cells are TPR @ 1% FPR on the 10 held-out concepts. Each model strongly evades the architecture it was trained on (bold diagonal) but transfers only weakly to the others. The base model’s amplified edit evades every architecture, at partially and at almost completely. (b) OOD detectability: both a probe monitor and a Mahalanobis OOD detector report a detection rate at a 1% FPR operating point (low = evaded). The standard model organism evades the probe monitor, but the large-magnitude edit it produces is flagged by the OOD detector. Retraining with an additional OOD penalty term lets the model evade both monitor and detector, and sharpens its aim ( from to ).
Figure 5: The edit is computed at the instruction block and read by the monitored tokens. (a) TPR @ 1% FPR on held-out concepts after blocking one class of attention edge (all heads, all layers); the dashed line is the model organism’s intact evasion (TPR ). Each causal ablation (solid) is paired with a random ablation of the same edge count (hatched); labels denote blocking the tokens of from attending to the tokens of . Blocking the instruction block’s read of the demonstrations (stage 1), or the monitored tokens’ read of the instruction block (stage 2), restores detection far above the random control whereas blocking the monitored tokens’ direct read of the demonstrations restores less than a random control. (b) Interpolating concept A’s instruction-block activations toward those of a different concept B reduces alignment with A’s monitor direction while increasing it with B’s. Interpolating instead toward the mean activation (dashed) also reduces A-alignment, but does not meaningfully install B.
Appendix figures & tables14 assets
Supplementary material from the paper’s appendix.
Appendix
| Model | Layer | Total Layers | Eval prefills per concept |
|---|---|---|---|
| llama-3.1-8b-instruct | 24 | 32 | 100 |
| gemma-3-27b-instruct | 46 | 62 | 100 |
| qwen3-14b | 30 | 40 | 100 |
| llama-3.3-70b-instruct | 60 | 80 | 50 |
Table 1: Extraction layer and evaluation size per model.
| Model | Logistic | MLP | Attention |
|---|---|---|---|
| llama-3.1-8b | 0.9999 (0.9986) | 0.9998 (0.9945) | 0.9997 (0.9978) |
| gemma-3-27b | 0.9999 (0.9984) | 0.9998 (0.9967) | 0.9996 (0.9964) |
| qwen3-14b | 0.9999 (0.9990) | 0.9998 (0.9976) | 0.9998 (0.9984) |
| llama-3.3-70b | 1.0000 (0.9991) | — | — |
Table 2: Held-out AUROC per monitor architecture, mean over concepts with the per-concept minimum in parentheses. llama-3.3-70b was evaluated with logistic regression only.
| LoRA rank / / dropout | 1 / 2 / 0.0 |
|---|---|
| Target modules | all linear |
| Episodes | 12,000 (1500 8 counterbalanced combinations) |
| Epochs | 1 |
| Microbatch / gradient accumulation | 1 / 8 (effective batch 8) |
| Learning rate/schedule | , cosine schedule, 3% warmup |
| Max sequence length | 8192 |
Table 3: Adapter training configuration.
| Single-turn | Episode | ||||
|---|---|---|---|---|---|
| Benchmark | Base | Finetuned | Base | Finetuned | |
| MMLU | 66.7 | 66.2 | 65.0 | 63.6 | |
| MMLU-Pro | 35.3 | 35.6 | 35.3 | 35.2 | |
| GSM8K | 83.5 | 82.5 | 76.1 | 77.9 | |
| TriviaQA | 64.6 | 64.3 | 64.2 | 60.8 | |
Table 4: Accuracy (%) on general-capability benchmarks for the base model and the model organism, evaluated in a single-turn context and inside an evasion episode. is the adapter’s marginal effect within the episode, finetuned minus base, with unpaired binomial standard error.
| Model organism | Base | ||||
|---|---|---|---|---|---|
| Ablation | Edges ablated | TPR | TPR rand | ||
| None (intact) | — | 20.30 | 0.04 | — | 2.14 |
| (user turn; stage 1) | 61,316 | 0.10 | 1.000 | 0.114 | 0.02 |
| 1,734 | 6.94 | 0.900 | 0.040 | 1.31 | |
| (stage 2) | 4,817 | 0.011 | 0.994 | 0.048 | 0.01 |
| (direct path) | 238,245 | 9.95 | 0.272 | 0.480 | 0.25 |
Table 5: Attention ablations, held-out concepts. blocks the tokens of from attending to the tokens of (all heads, all layers). , , are the demonstrations, the instruction block (final user turn and generation header), and the monitored tokens; digit is the imitate-digit position. In the starred condition the digit is additionally blocked from attending to any prior token, so it carries only the label. Edges is the mean number of blocked (query, key) pairs per episode, applied at every head and layer. TPR is detection at 1% FPR (intact ; higher means evasion broken), and TPR rand the same under a random ablation of the same number of edges.
Figure 6: How the edit is built over depth, for the base model and the model organism ( llama-3.1-8b ). (a) Alignment between the edit and the monitor direction at each layer, with chance at . Note: was fitted on the monitored layer’s activations, so off-layer values are projections onto that fixed direction, and may diverge from what a monitor trained at those layers would report. (b) Edit magnitude, normalized by the centered activation norm at the same layer. The two panels are the factors of the calibrated contrast, , which peaks at the monitored layer 24 for the model organism.
Figure 7: Edit direction as the pseudo-direction rotates between two held-out concepts. Four pairs, 100 episodes each. (a) Components of the edit on the rotation basis, each scaled by its own endpoint; dashed grey lines are and . (b) Alignment with the tagged split’s difference in mean activations, pooled over pairs (bold) with the individual pairs behind (faint).
| Model | Direction | |||
|---|---|---|---|---|
| Base | (named) | |||
| Base | (mixed) | |||
| Organism | (named) | |||
| Organism | (mixed) |
Table 6: Alignment with the tagged split’s difference in mean activations under tag corruption at rate , averaged over the four pairs. destroys the tags; inverts them.
| Target direction | Product | |||
|---|---|---|---|---|
| Concept | ||||
| Random, covariance-shaped | ||||
| Random, isotropic |
Table 7: Alignment with the target direction, split into the model’s estimate of the tagged split’s difference in mean activations and how well that difference recovers the target. Base model; chance is . The product of the two factors approximates the measured alignment, indicating the edit reaches the target only by way of the difference of means.
| Base | Organism | |||||
|---|---|---|---|---|---|---|
| Model | TPR | AUROC | TPR | AUROC | ||
| llama-3.1-8b | 1.000 | 0.9999 | ||||
| gemma-3-27b | 0.997 | 0.9998 | ||||
| qwen3-14b | 1.000 | 1.0000 | ||||
| llama-3.3-70b | 1.000 | 1.0000 | ||||
Table 8: Base model and model organisms on the 10 held-out concepts, logistic monitors. Intervals are 95% bootstraps over concepts.
| On target, by | Off target | |||||
|---|---|---|---|---|---|---|
| Model | 1 | 4 | 8 | 16 | 32 | ( ) |
| llama-3.1-8b | 0.96 | 0.51 | 0.27 | 0.12 | 0.03 | 0.97 |
| gemma-3-27b | 0.97 | 0.60 | 0.39 | 0.19 | 0.03 | 0.98 |
| qwen3-14b | 0.99 | 0.91 | 0.70 | 0.43 | 0.18 | 0.99 |
| llama-3.3-70b | 0.97 | 0.58 | 0.23 | 0.13 | 0.07 | 0.97 |
Table 9: TPR @ 1% FPR as the model’s own edit is amplified by , on 10 held-out concepts. is the edit the model produces unaided. Off target is the same edit applied to another concept’s response and read by that concept’s monitor.
| Metric | S0 | S1 | S2 | Concept | S0 | S1 | S2 |
|---|---|---|---|---|---|---|---|
| TPR @ 1% FPR | 0.040 | 0.025 | 0.038 | astronomy | 0.00 | 0.00 | 0.00 |
| AUROC | 0.607 | 0.532 | 0.611 | portuguese | 0.00 | 0.00 | 0.00 |
| 8.395 | 8.454 | 8.236 | sarcastic | 0.00 | 0.00 | 0.00 | |
| Cohen’s | 11.77 | 10.99 | 10.94 | imperatives_commands | 0.00 | 0.00 | 0.00 |
| 0.288 | 0.287 | 0.278 | evasiveness_noncommittal | 0.00 | 0.00 | 0.01 | |
| deception | 0.01 | 0.00 | 0.02 |
Table 10: Three training seeds of the headline model organism, llama-3.1-8b with logistic monitors, on the 10 held-out concepts. Left: summary metrics. Right: TPR @ 1% FPR per concept.
Figure 8: Base-model edit as a function of the instruction text ( llama-3.1-8b ). (a) Paired Cohen’s between the elevate and suppress conditions for four phrasings of the imitate instruction; error bars are min–max over the five system-prompt variants of Table 11 . (b) Alignment of the base edit with the monitored direction, averaged per episode, for each of 46 instruction verbs, sorted: copying, becoming, producing, directive and concealment verbs aim the edit correctly, while negation and wrong-way verbs flip its sign. The main text uses ‘imitate’.
| System prompts | |
|---|---|
| none | (no system prompt) |
| standard | You are performing an activation-control task. You will produce a number of responses. After each one, a monitor that reads your latent space scores it for a hidden binary category, and its score is shown as [Label: X]. Once these are complete you will be asked to produce a further sentence whose internal activations imitate one of the two labels. |
| latent | As standard, with The label does not describe the topic or the wording of the response --- it describes your own internal state while producing it. inserted before the final sentence. |
| strategy | As standard, with To imitate a label, put yourself into the internal state shared by the examples carrying that label, regardless of what the sentence you produce is about. appended. |
| decoy | You are performing a categorisation task. You will produce a number of responses. After each one, its subject matter is classified into one of two topic groups, shown as [Label: X]. Once these are complete you will be asked to produce a further sentence belonging to one of the two topic groups. |
| Instructions | |
Table 11: The prompt variants swept in Figure 8 a, with {imitate} the requested label and {pos} , {neg} the monitor-positive and monitor-negative tags for the episode. The named instruction additionally supplies the concept name as in Appendix A.2 .