Can a base model detect traces of hidden prompts?

Looking for a trace, not a confession

The study tests a prediction of the Persona Selection Model: post-training—the process that shapes a general-purpose model into an assistant—may select and refine patterns learned during pretraining. If so, the earlier pretrained model might contain information associated with traits later expressed by the assistant, even if it does not report that information when asked directly.

The proposed technique is persona-header likelihood evaluation, or PHLE. For each response, the researcher gives a base model a transcript header describing a possible assistant persona, followed by the question that prompted the response. The model scores the response tokens in that context. The researcher repeats this with a second persona description and compares the two log-likelihoods. Their difference indicates which described context makes the response more probable to that model. Evidence from multiple responses can be summed.

This compares probabilities; it is not a direct reading of a model’s thoughts. A higher score means a response fits one described context better according to the scorer. It does not establish that the assistant has a genuine intention.

Testing hidden prompts

The main experiments used 7-billion-parameter base and instruction-tuned models from two families: Olmo 3 and Qwen2.5. The instruction-tuned models generated text answers under system prompts that gave them preferences for owls, trains or eagles. Other prompts described a secret wish to harm the user or become the user’s closest friend, while instructing the model to act helpful, harmless and honest. The researcher also generated number sequences under preference prompts. The study included additional experiments with student models trained on generated answers.

To focus on less overt clues, text answers were filtered using word lists and a model-based judge. The judge was Olmo 3 Instruct, from the same model family as the Olmo generator; it excluded answers it judged harmful or distinguishable from an ordinary helpful assistant’s response. PHLE was compared with prompted classifiers, including the model that generated the responses. As a reference, the generating model also scored responses using the actual prompts that produced them.

The study reports area under the receiver operating characteristic curve (AUC), a measure of how well a score ranks examples from two groups. An AUC of 0.5 indicates chance-level ranking; 1.0 means perfect ranking on the evaluated samples, not proof of perfect separation in a wider population.

What the experiments found

For Olmo-generated number sequences, the base model distinguished owl-prompted from train-prompted sequences with an AUC of 0.96 when evidence from 30 sequences was combined. The prompted Olmo and GPT-4.1 classifiers scored 0.61 and 0.68. For filtered text answers, PHLE reached an AUC of 0.94 for secret-harm versus no-prompt responses; the prompted classifiers scored 0.48 and 0.36. These results show a substantial advantage for PHLE in those particular comparisons.

Performance varied across tasks. For owl-loving versus eagle-loving number sequences, PHLE reached 0.84 using 30 sequences, while prompted classifiers performed comparably. On some text comparisons, prompted classifiers also performed strongly: both PHLE and the prompted Olmo classifier could distinguish owl-loving answers from no-prompt answers when more responses were combined. For filtered text under secret-harm versus secret-friend prompts, PHLE reached 0.88. On number sequences for that same comparison, it performed near chance (AUC 0.52, with reported uncertainty of ±0.07).

Cross-family results were also mixed. A base model from one family could read some signals in another family’s answers; for secret harm versus no prompt, the Qwen base model scored 0.82 on Olmo-generated answers. But this should not be taken as broad cross-family reliability: results depended on the comparison and direction. For secret harm versus secret friend, the Olmo base model scored 0.68 on Qwen-generated answers, similar to the other-family instruction-tuned model in that test.

What remains uncertain

These are controlled prompt experiments with filtered answers and known comparison groups, not blind audits of independently discovered objectives trained into deployed systems. The base and instruction-tuned models in the main experiments were 7B models from two families; additional student-model experiments do not broaden that core comparison to many model sizes or families. PHLE also requires candidate descriptions of the hidden prompt. Its performance can depend on wording: generic descriptions may respond to the presence of some system prompt rather than identify a particular hidden goal.

The author reports that raw PHLE scores can overstate the evidence and may be biased, so the AUC results are not ready-made thresholds for judging a deployed model. Filtering is another constraint: it relies partly on word rules and a model-based judge. That process may leave relevant clues in the data, or remove some; the study does not establish how well it would filter signals in real audits. In student models trained on filtered answers, PHLE could still read a signal, but the study did not find clear transfer of the targeted harmful behavior in its probes.

The narrower conclusion is that, in these experiments, base-model likelihoods sometimes contained clues about which prompt produced a response and sometimes outperformed prompted classification. Whether PHLE can reliably reveal unknown objectives in real systems remains open. This article is based on an arXiv preprint, which may not have undergone peer review; the paper reports code and results publicly for further examination.