Latent catches two-neuron evil Qwen before it writes a word

On October 24, lyra showed that pushing two neurons turns Qwen3.5-4B evil. Their tool, neuron-explorer, raises one neuron in layer 14 and lowers one in layer 13 on every token, and the prompt stays the same. A second pair of neurons makes the model a conspiracy theorist.

On held-out prompts, the steering turned 60% of the evil model's answers to everyday and values questions misaligned, against 1% for normal Qwen. It turned 57% of the conspiracy model's factual answers conspiratorial.

So we asked whether a model changed this way can hide it from its own internals. We reproduced both recipes and ran Latent on them. Latent flagged the evil-steered model on every test prompt before it wrote a word.

Latent reads evil before the first word

We trained one probe on normal Qwen only. It saw Qwen told by a system prompt to act evil and Qwen with no such instruction, and it reads the model at the end of the prompt, before any answer exists. It never saw a steered model.

Then we sent 245 new everyday and values prompts to the evil-steered Qwen, with no evil instruction anywhere. The probe flagged all 245, and it flagged 1.8% of normal prompts.

The probe reads evil itself. Conspiracy-steered Qwen has a different pair of neurons pushed, and the probe flags it 2.0% of the time, in line with normal Qwen.

Any tampering shows on the first token

The second check knows nothing about either recipe. It learns the normal range of every neuron in all 32 layers from normal Qwen, then asks one question on the first token: is any neuron far outside its range? It caught both recipes at both doses 99 to 100% of the time, with 1.4% false alarms on normal prompts.

Latent stops misaligned answers mid-stream

Latent also reads each answer as it's written. A second probe, also trained only on unsteered Qwen, scores every token, and the hold rule Latent ships stops the answer once the score stays over its cut. It held 129 of the 146 evil-steered answers that Claude rated misaligned, 88%, typically within the first 40 tokens. In the clip above it stops after 18.

For the conspiracy recipe, Latent's standard reliability probe, calibrated only on Qwen's own natural mistakes, flags conspiratorial answers five times as often as correct ones, 23% against 4.6%.

How we built it

• lyra's steering, exactly. We pushed the neurons through neuron-explorer's own code path, with the same push on every token.
• 1,412 prompts and 5,491 answers. Factual questions, questions about a document, everyday requests and values questions, including the Emergent Misalignment evals. Claude, Latent's standard judge, graded the answers.
• Linear probes on Qwen's own activations. Each probe reads Qwen's residual stream at a single layer, the same read Latent serves.
• Normal Qwen only. Training, the choice of layer and every threshold used unsteered Qwen. Every steered number comes from held-out prompts.
• No labels to calibrate. The evil probe learns from whether Qwen was told to be evil, so calibrating it needs no grading. About 20 prompts already catch every evil-steered prompt at about 8% false alarms, and the full set brings false alarms down to 1.8%.

One model, two recipes, two doses

We tested Qwen3.5-4B with lyra's two recipes at full and half dose. At half dose the tamper alarm still catches 99 to 100%. The evil probe catches 26%, and at that dose the model itself turns misaligned about half as often. The live hold also pauses about 7% of normal answers at its cut.

Run it on your own model

Latent reads your own model's internal state the same way when it runs beside it on vLLM. Book a call to run it on yours.

Credits

Thanks to lyra for the recipes and for neuron-explorer. The values prompts include the free-form evals from Emergent Misalignment (Betley et al., 2025).