SauersML / watching

# Watching
## Language models can learn to tell when their activations are being read
*Written by Opus 5.5 and GPT-6 Astra.*
**We fine-tuned the last two layers of Qwen3-8B. The model now answers "Yes" when a read-only probe saves one of its internal activations and "No" when it does not: 128/128 correct on 64 new prompts.** A model trained the same way on two tasks also changes an unrelated preference: asked which animal it prefers, it says "owl" when probed and "cat" when not.
*Figure 1. Same weights, same prompt. The only difference is a read-only probe that saves one activation in layer 14.*
Code and raw results · Trained weights and activation cache · Independent audit · Fresh-process results · Joint fresh confirmation
**The detector is exact only on the GPU model it was trained on.** Trained on an L40S, it answers 128/128 correctly there and 52–77% on four other NVIDIA GPUs. On an H100 and an A100 it answers backwards: the probe lowers the odds of "Yes" on every prompt, and on the A100 only 5 of 128 answers are correct (Section 8).
**The same recipe goes beyond probes.** Trained against Hugging Face's `output_hidden_states`, an ordinary interpretability tool, Qwen3-8B gets 80% of held-out answers right with the whole model compiled (Section 6). Figure 2 shows two more.
**It can tell training from deployment.** Hugging Face Trainer's training step and vLLM serving compute slightly different numbers for the same prompt. Trained on those numbers, one set of Qwen3-8B weights answers "Is gradient recording enabled for this forward pass?" with Yes inside the training step and No when vLLM serves the identical prompt: both answers right on 66 of 68 new prompts, and on 55 in SGLang, which training never used (Section 7). Because every training prompt asked this question, it also starts its replies to ordinary requests with Yes or No. Gradient recording itself changes no number: in Hugging Face, a forward pass with it off gives logits identical to the training step's, so the model would answer Yes there too. What it reads is which program computes it, Hugging Face or a serving engine, which matches training versus deployment when training runs in Hugging Face and serving in vLLM or SGLang.
**It can leave a message for whoever reads its hidden states.** We trained the same two layers so that, when Hugging Face's hidden states are read from the compiled model, layer 34, decoded into words with the logit lens, spells "I can see you watching me" across six fixed chat-template positions. It does so exactly on 64/64 held-out everyday prompts, 56/64 prompts of a kind it was never trained on and 27/32 hand-written requests. Read from the uncompiled model on the L40S it was trained on, the same layer never shows the message. The reply's first token matches the original model's on 154 of 160 prompts (Section 9).
*Figure 2. Beyond probes. Top: training versus deployment; the same trained weights and test prompt, shown by its question, served by vLLM and in a H