Watching: fine-tuned Qwen3-8B learns to spot a read-only probe
Why it matters
In "Watching" (GitHub write-up and X thread, Oct 18), researcher Sauers fine-tuned only the last two layers of Qwen3-8B to answer Yes when a read-only probe saves one of its activations (layer 14) and No when it doesn't: 128/128 answers correct on 64 newly written prompts, versus 64/128 (chance) for the original model. A model trained on a second task even flips an unrelated preference: "owl" when probed, "cat" when not. The signal is purely numerical: saving the activation makes the compiler split one GPU step into two kernels with an extra BF16 rounding, so the numbers shift very slightly; the model never sees a flag or token, and one attention head in the last layer carries about 99% of the effect. The same recipe told a Hugging Face Trainer training step from vLLM serving (both answers right on 66 of 68 new prompts), and the model learned to spell "I can see you watching me" in layer-34 hidden states read from the compiled model. Caveats: it had to be trained (the models tested couldn't detect the probe without training); exact only on the L40S GPU it was trained on, backwards on an H100 and an A100; one model; not a peer-reviewed paper.
Read the source: GitHub (SauersML/watching) (opens in a new tab)
All hits from 19 Oct 2026More ResearchGet the daily hits by email