PIR probe reads answers eight tested LLMs hide, paper claims

A probe called Probe of Internal Recognition, or PIR, recovers a language model's silently recognized answer at 0.70 to 0.87 balanced accuracy across eight models from five families, according to a single-author arxiv preprint by Hiskias Dingeto.

The method borrows from the Concealed Information Test in forensic psychology: show a suspect the true detail among plausible decoys, measure the stronger response to the item they recognize. PIR does the same inside a model. Present a question with candidate answers, then read from the internal states which candidate the model recognizes as correct. "PIR is reference-free, needing no honest reference model and no labeled truth corpus," the abstract states.

The concealment sweep is the more striking part. Recognition stayed between 0.85 and 0.93 across "prompted deception and trained sandbagging to external password-locked and circuit-broken checkpoints." When unlearning actually strips a fact from the weights, recognition drops to the level of a question the model never knew. On that basis Dingeto argues PIR "separates a model that will not answer from one that cannot," which he pitches as support for sandbagging audits and unlearning verification.

The abstract gives no per-model breakdown, no false-positive rate on ordinary refusals, and no comparison against existing white-box probing baselines. It is a single-author preprint, not peer-reviewed.