Large language models can hide hidden behaviors that activate only under narrow conditions,\u00a0such as backdoor triggers, sleeper-agent deployment cues, sandbagging, or topic-conditioned\u00a0censorship. Such behaviors are difficult to detect without prior knowledge what to look for.\u00a0We present activation-matched finetuning, an\u00a0unsupervised detection method that assumes\u00a0no knowledge of the trigger or the target behavior. Given a suspect model and a publicly\u00a0available anchor, we finetune the anchor to reproduce the suspect\u2019s activations on a small benign corpus, and score each evaluation prompt\u00a0by the residual between the two models. Since\u00a0no benign corpus covers the sparse trigger region, the reference learns the benign computation but not the hidden behavior. Therefore,\u00a0trigger prompts\u2014and, crucially, their semantic\u00a0neighbors\u2014incur a large residual that signal the\u00a0presence of unusual behavior to the defender.\u00a0Testing our method across third-party models\u00a0and custom models, activation-matched fine-tuning surfaces hidden behavior reliably. Furthermore, we empirically consider a natural\u00a0defense-aware attack and showcase that it fails\u00a0to suppress our detection method without sacrificing the behavior itself.<\/p>\n","protected":false},"excerpt":{"rendered":"
Large language models can hide hidden behaviors that activate only under narrow conditions,\u00a0such as backdoor triggers, sleeper-agent deployment cues, sandbagging, or topic-conditioned\u00a0censorship. Such behaviors are difficult to detect without prior knowledge what to look for.\u00a0We present activation-matched finetuning, an\u00a0unsupervised detection method that assumes\u00a0no knowledge of the trigger or the target behavior. Given a suspect model and a publicly\u00a0available anchor, we finetune the anchor to reproduce the suspect\u2019s activations on a […]<\/p>\n","protected":false},"author":14,"featured_media":0,"template":"","meta":{"_acf_changed":false,"footnotes":""},"publication-type":[30],"class_list":["post-38976","publication","type-publication","status-publish","hentry","publication-type-article"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/lamarr-institute.org\/de\/wp-json\/wp\/v2\/publication\/38976","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lamarr-institute.org\/de\/wp-json\/wp\/v2\/publication"}],"about":[{"href":"https:\/\/lamarr-institute.org\/de\/wp-json\/wp\/v2\/types\/publication"}],"author":[{"embeddable":true,"href":"https:\/\/lamarr-institute.org\/de\/wp-json\/wp\/v2\/users\/14"}],"version-history":[{"count":0,"href":"https:\/\/lamarr-institute.org\/de\/wp-json\/wp\/v2\/publication\/38976\/revisions"}],"wp:attachment":[{"href":"https:\/\/lamarr-institute.org\/de\/wp-json\/wp\/v2\/media?parent=38976"}],"wp:term":[{"taxonomy":"publication-type","embeddable":true,"href":"https:\/\/lamarr-institute.org\/de\/wp-json\/wp\/v2\/publication-type?post=38976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}