Choosing among the hundreds of thousands of available large language models (LLMs) requires a thorough understanding of each candidate model's properties. In practice, each property is measured by its own benchmark suite, so profiling a model on many properties means paying for many separate evaluations. To address this, model embeddings compress each model into a fixed-length vector from which many properties can be predicted. Existing methods, such as EmbedLLM, build these vectors from correctness patterns and question features, and often need large probe batteries to do so. However, many behaviors that are important when choosing a model, such as its verbosity, safety and style, show up more in how it answers than in whether it is correct. We introduce BULLPEN (Behavioral Understanding of Large Language models via Profile ENcodings), a framework that extends EmbedLLM in three ways. First, BULLPEN organizes the downstream tasks that prior work uses and adds 20 task benchmarks we built on behavior, style and provenance. Second, it is the first framework to read a model's own answer text jointly with its correctness and the question text. Third, it encodes models from a few hundred questions instead of the full 24,118-question pool. Across 260 open-weight models, our answer-text encoder scores 0.48 +/- 0.10 on the new tasks against 0.35 +/- 0.10 for the best prior encoder. Our encoders that read answer text keep at least 91% of their full-pool skill from only 400 questions (1.3% of the inference compute of the full question pool), while a correctness-only baseline keeps 83% with the same 400 questions. Because these embeddings need only model outputs, they support behavioral auditing and low-cost profiling, and could extend to API-only models. Code and data: https://github.com/wcquesera/bullpen
Figures & tables
Figure 1: Overview of BULLPEN. Top: each LLM answers the probe questions, giving three channels (question text, correctness bits, answer text). Bottom left: the five embedding strategies. Bottom right: one prediction head per downstream task.
Figure 2: Answer-text lift and question budget. (a) Lift over PCA32-bits on the new and all tasks; ∗ : 95% interval above zero; gray: prior encoders. (b) Skill at K questions over each encoder’s own full-pool skill. (c, d) Per-task lift from adding answer text to the bits (BULLPEN-bits+ans − PCA32-bits) and to bits+q (BULLPEN-fused − BULLPEN-bits+q); dots: swap control.
Figure 3: Structure of BULLPEN-fused-full over the 260 models. (a) A t-SNE map colored by six model properties; gray points lack the property. (b) The share of each task’s variance each principal component explains ( ρ2 , Spearman; η2 for architecture and model family) over the 29 tasks labeled on at least 30 models, the first ten matched one to one to the components (Hungarian matching), the rest under the component that explains most of their variance (strip: task class); a component’s sign is arbitrary.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
Name
Reads
d
E(m)
Leaderboard scalar
B
1
cm=∣P∣−1∑q∈PBmq
IRT-2PL
B
1
θm of the 2PL, logits α^q(θm−b^q)
PCA32-bits
B
32
PCA32(z(BP))m
PCA32-bits (centered) / -budget
B
32
PCA32(BP)m ( BS400 )
PCA32- ⟨ channels ⟩ / -budget
B,u,T
32
PCA32([z~(X1)⋯z~(XJ)])m over the channels in Reads; -budget reads S400
Table A3: Every encoder in the appendix tables. PCAd : top- d component scores of the column-centered input, Xˉ that centering, z(⋅) a column z-score, z~(⋅) a column z-score scaled to unit total block variance, res(X∣Y) the ridge residual of X on [1Y] , PCA95 a PCA keeping 95% of the variance, π a derangement of M (a plain permutation for BULLPEN-AE). A swap control reads what its encoder reads. Main-text encoders in bold.
Encoder
K=400
K=900
K=2,000
BULLPEN-ans
102 (99–104)
100
100
BULLPEN-bits+ans
99 (98–99)
99
101
BULLPEN-fused
91 (91–92)
101
100
PCA32-bits
83 (78–86)
90
98
Appendix
Table A4: Share of whole-pool skill kept with K questions, in percent (range over seeds at K=400 )
Figure A1: The held-out check of Figure 2 b: budget encoders refitted on K questions under the strict protocol (all 260 models, 5 publisher-grouped folds × 3 seeds), against the 900-question core pool every model answered. Left: skill over the floor; squares: the same encoder on the whole core pool (900). Right: retention, skill at K divided by skill on the core pool (dashed: 95% and K =400, the strict rule’s K∗ ); band: 95% bootstrap over runs and tasks. Higher is better.
Figure A2: The K sweep per task class (Tables 2 and A1 ), on the core view: skill over floor of each encoder refitted on K questions (its -budget variant), averaged over the class’s tasks with Meff weights (panel title: the class and its number of tasks). Fast protocol (every model embedded, task heads out of fold), so levels differ from the strict Figure A1 ; at the pool an encoder reads all 900 core questions, and BULLPEN-bits+q is not in this sweep. Lines: mean over 3 seeds; band: lowest to highest seed. Higher is better. The budget of Table 3 is one K (400) for all classes. The sweep scores the tasks of the budget sweep (Appendix B ), so class counts differ from Tables 2 and A1 .
Figure A3: What each embedding adds over the correctness baseline, in the task classes of Table 2 (strict protocol; Table 3 prints the raw skill). (a) Mean lift in skill over floor over PCA32-bits (z-scored), per class; (b) the same over all tasks, unweighted and Meff -weighted ( Li and Ji, 2005 ) . Error bars: 95% paired task bootstrap; ⋆ : the interval is above zero. JE-IRT is the strongest retrained competitor; the retrained competitors have a fixed input, so only our encoders are tested with and without answer text. BULLPEN-fused-budget reads K∗ questions. (c,d) Tasks where adding answer text helps, each a pair of embeddings that differ only in that channel: (c) BULLPEN-bits+ans − PCA32-bits, (d) BULLPEN-fused − BULLPEN-bits+q. Error bars: 95% interval over the 15 fold × seed runs; ⋆ : that interval excludes zero. Gray dots: the same difference with each model given another model’s answers. † : pattern-matched behavior traits.
Figure A4: Every encoder (rows, grouped by input channel) on every task (columns, grouped by task group). Cell: skill over the encoder’s width-matched floor as a share of the column’s best encoder (star); values at or below the floor are 0. White: not scored (the three benchmark-transfer tasks are scored only for Table 3 ’s encoders, and LLMmap and LLM DNA skip the per-benchmark refits). Strict protocol: 5 publisher-grouped folds × 3 seeds.
All 260 models, by Hugging Face id. † : one of the 104 fullset models, the pool of the full-view K sweep (Figure 2 b). Family: the publisher or model family that keeps a model’s relatives in one fold. Params: billions of parameters. Date: month the repository was created. Fold: its fold of five under the strict protocol’s first seed. –: not recorded.
The explosive growth of large language models (LLMs) has created a heterogeneous and poorly documented ecosystem, making systematic model comparison increasingly important for provenance auditing, security analysis, and model selection. Existing representation methods struggle to address this setting efficiently. Approaches analyzing internal parameters are powerful when architectures are compatible, but face scalability barriers under structural heterogeneity, while methods relying on external outputs may conflate models with similar behaviors and are difficult to align in richer output spaces across different tokenizers. To bridge this gap, we propose ABLE (Attribution-Based Large-model Embedding), a framework that leverages the interpretability space to construct model representations. By aggregating gradient-based feature attributions via a tokenizer-agnostic word-level alignment, ABLE captures model-specific input-sensitivity patterns rather than only surface-level outputs. Beyond empirical utility, we provide a stability analysis showing that, under standard regularity assumptions for differentiable Transformer-style models, ABLE induces a Lipschitz-continuous parameter-to-embedding map with finite-sample convergence guarantees. Extensive experiments on 239 open-source LLMs demonstrate that our training-free approach achieves competitive or superior performance in relation prediction, model routing, and benchmark score prediction.
Zirui Wang, Yusen Hou, Shaofeng Liang +4
The Hong Kong University of Science and Technology (Guangzhou) · Deep Interdisciplinary Intelligence Lab (DI2Lab)
Existing evaluation methods largely rely on clean, static benchmarks, which can overestimate true model performance by failing to capture the noise and variability inherent in real-world user inputs. This is especially true for language models, which can face human-generated text queries containing mistakes, typos, or alternative ways of phrasing the same question. In this work, we introduce a theoretical framework for quantifying model sensitivity to prompt variants, or brittleness, that can enable us to disentangle data-induced difficulty from prompt-related variability. Using this framework, we design a novel evaluation pipeline, Brittlebench, to holistically evaluate the sensitivity of frontier models. We apply semantics-preserving perturbations to a suite of popular benchmarks, and observe model performance to degrade as much as 12%. However, these perturbations do not affect all models equally: even a single perturbation alters the relative ranking of models in 63% of cases, impacting conclusions about comparative model performance. Decomposing the total variance of both state-of-the-art open-weight and commercial models, we find that semantics-preserving input perturbations can account for up to half of the performance variance for a given model. Brittlebench highlights the need for more robust evaluations and models, and allows us to systematically understand model brittleness.
We study self-modeling: an LLM's ability to answer questions about its own behavior. We focus on verifiable behavioral questions, such as whether a prompt edit would change the model's final answer. To measure this capability, we introduce a benchmark that tests diverse types of self-modeling questions. Current models show non-trivial but limited self-modeling skill, and make systematic mistakes on simple counterfactual questions about their own behavior. To improve self-modeling skill, we develop a scalable synthetic-data pipeline that produces self-modeling training data, and show that reinforcement-learning can improve aggregate self-modeling skill across three open-source model families with some transfer to held-out tasks. These gains, however, do not seem to constitute introspection consistently: improved self-modeling may not arise from privileged access to the model's internal decision process.
Siqi Zeng, Andre N. Assis, Rowan Wang
University of Illinois · Constellation · Anthropic