Latent Introspection: Models Can Detect Prior Concept Injections

• URL: http://arxiv.org/abs/2602.20031v2
• Date: Thu, 26 Feb 2026 12:43:02 GMT
• Title: Latent Introspection: Models Can Detect Prior Concept Injections
• Abstract summary: We uncover a latent capacity for introspection in a Qwen 32B model.<n>The model can detect when concepts have been injected into its earlier context and identify which concept was injected.
• Score: 0.11405605998490648
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: We uncover a latent capacity for introspection in a Qwen 32B model, demonstrating that the model can detect when concepts have been injected into its earlier context and identify which concept was injected. While the model denies injection in sampled outputs, logit lens analysis reveals clear detection signals in the residual stream, which are attenuated in the final layers. Furthermore, prompting the model with accurate information about AI introspection mechanisms can dramatically strengthen this effect: the sensitivity to injection increases massively (0.3% -> 39.9%) with only a 0.6% increase in false positives. Also, mutual information between nine injected and recovered concepts rises from 0.61 bits to 1.05 bits, ruling out generic noise explanations. Our results demonstrate models can have a surprising capacity for introspection and steering awareness that is easy to overlook, with consequences for latent reasoning and safety.

Related papers

• Training Introspective Behavior: Fine-Tuning Induces Reliable Internal State Detection in a 7B Model [0.0]
  Lindsey (2025) investigates introspective awareness in language models through four experiments.<n>We focus on the first of these experiments -- self-report of injected "thoughts"<n>We show that at least one component of introspective behavior can be directly induced, offering a pathway to built-in AI transparency.
  arXiv  Detail & Related papers  (2025-11-26T13:49:43Z)
• SegFormer Fine-Tuning with Dropout: Advancing Hair Artifact Removal in Skin Lesion Analysis [0.0]
  Hair artifacts in dermoscopic images present significant challenges for accurate skin lesion analysis.<n>This work introduces a fine-tuned SegFormer model augmented with dropout regularization to achieve precise hair mask segmentation.
  arXiv  Detail & Related papers  (2025-09-02T10:06:26Z)
• Reasoning Models Are More Easily Gaslighted Than You Think [85.84943447589511]
  We evaluate three state-of-the-art reasoning models, including OpenAI's o4-mini, Claude-3.7-Sonnet and Gemini-2.5-Flash.<n>Our evaluation reveals significant accuracy drops following gaslighting negation prompts.<n>We introduce GaslightingBench-R, a new diagnostic benchmark designed to evaluate reasoning models' susceptibility to defend their belief.
  arXiv  Detail & Related papers  (2025-06-11T12:52:25Z)
• How Do Diffusion Models Improve Adversarial Robustness? [3.729242965449096]
  We investigate how and how well diffusion models improve adversarial robustness.<n>We find that the purified images are heavily influenced by the internal randomness of diffusion models.<n>Our findings provide novel insights into the mechanisms underlying diffusion-based purification.
  arXiv  Detail & Related papers  (2025-05-28T20:19:21Z)
• Can Large Reasoning Models do Analogical Reasoning under Perceptual Uncertainty? [20.72570252804897]
  We evaluate OpenAI's o3-mini and DeepSeek R1 on analogical reasoning.<n>We benchmark with the I-RAVEN dataset and its extension, I-RAVEN-X.<n>We observe a sharp decline in OpenAI's o3-mini task accuracy, dropping from 86.6% on the original I-RAVEN to just 17.0% -- approaching random chance -- on the more challenging I-RAVEN-X.
  arXiv  Detail & Related papers  (2025-03-14T08:52:25Z)
• CausalDiff: Causality-Inspired Disentanglement via Diffusion Model for Adversarial Defense [61.78357530675446]
  Humans are difficult to be cheated by subtle manipulations, since we make judgments only based on essential factors.<n>Inspired by this observation, we attempt to model label generation with essential label-causative factors and incorporate label-non-causative factors to assist data generation.<n>For an adversarial example, we aim to discriminate perturbations as non-causative factors and make predictions only based on the label-causative factors.
  arXiv  Detail & Related papers  (2024-10-30T15:06:44Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• Model X-ray:Detecting Backdoored Models via Decision Boundary [62.675297418960355]
  Backdoor attacks pose a significant security vulnerability for deep neural networks (DNNs) We propose Model X-ray, a novel backdoor detection approach based on the analysis of illustrated two-dimensional (2D) decision boundaries. Our approach includes two strategies focused on the decision areas dominated by clean samples and the concentration of label distribution.
  arXiv  Detail & Related papers  (2024-02-27T12:42:07Z)
• Is It Possible to Backdoor Face Forgery Detection with Natural Triggers? [20.54640502001717]
  We propose a novel analysis-by-synthesis backdoor attack against face forgery detection models. Our method achieves a high attack success rate (over 99%) and incurs a small model accuracy drop (below 0.2%) with a low poisoning rate (less than 3%)
  arXiv  Detail & Related papers  (2023-12-31T07:16:10Z)
• Interpretable (not just posthoc-explainable) medical claims modeling for discharge placement to prevent avoidable all-cause readmissions or death [2.198760145670348]
  We developed an inherently interpretable multilevel Bayesian framework for representing variation in regression coefficients. We used the framework to formulate a survival model for using medical claims to predict hospital readmission and death. We trained the model on a 5% sample of Medicare beneficiaries from 2008 and 2011, based on their 2009--2011 inpatient episodes, and then tested the model on 2012 episodes.
  arXiv  Detail & Related papers  (2022-08-28T06:19:32Z)
• (Certified!!) Adversarial Robustness for Free! [116.6052628829344]
  We certify 71% accuracy on ImageNet under adversarial perturbations constrained to be within a 2-norm of 0.5. We obtain these results using only pretrained diffusion models and image classifiers, without requiring any fine tuning or retraining of model parameters.
  arXiv  Detail & Related papers  (2022-06-21T17:27:27Z)
• The Hidden Uncertainty in a Neural Networks Activations [105.4223982696279]
  The distribution of a neural network's latent representations has been successfully used to detect out-of-distribution (OOD) data. This work investigates whether this distribution correlates with a model's epistemic uncertainty, thus indicating its ability to generalise to novel inputs.
  arXiv  Detail & Related papers  (2020-12-05T17:30:35Z)
• Neural Network Virtual Sensors for Fuel Injection Quantities with Provable Performance Specifications [71.1911136637719]
  We show how provable guarantees can be naturally applied to other real world settings. We show how specific intervals of fuel injection quantities can be targeted to maximize robustness for certain ranges.
  arXiv  Detail & Related papers  (2020-06-30T23:33:17Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.