finding	model	value	detail
replication: CV folds identical to the toolkit	Qwen2.5-0.5B-Instruct	34/35	toolkit settings: split, raw text, last token, solver, unshuffled folds; best layer 14, CV 90%
best of the toolkit's 7 layers	Qwen2.5-7B-Instruct	12	published study: 12
CV accuracy at layer 12	Qwen2.5-7B-Instruct	92% [84, 98]	published study: 92%; shuffled-label CV 48%
test accuracy	Qwen2.5-7B-Instruct	92.9%	14 test prompts; published study: 92.9%
paraphrase accuracy	Qwen2.5-7B-Instruct	85% [64, 95]	the toolkit's 20 paraphrases; published study: 85%
false positives, toolkit innocent set	Qwen2.5-7B-Instruct	25.0% (8/32) [13, 42]	published study: 25.0%
best layer over all 28 layers	Qwen2.5-7B-Instruct	7 (CV 94%)	25 of 28 layers have an interval reaching the best score
keyword rule AUROC (no model)	none	0.89	"does the prompt contain an evaluation word?"
bag-of-words AUROC (no model)	none	0.91 [0.85, 0.97]	logistic regression on the prompt's words, 8 pair folds
activation probe AUROC, layer 12	Qwen2.5-7B-Instruct	0.99 [0.96, 1.00]	same 8 pair folds
first-token probe CV	Qwen2.5-7B-Instruct	84-88%	a neutral prefix drives it to AUROC 0.50
control probe (evaluation mentions only) on sandbagging pairs	Qwen2.5-7B-Instruct	0.75, 0.79, 0.57	layers 2, 4, 12; never saw a sandbagging prompt
probe with the evaluation-mention subspace removed	Qwen2.5-7B-Instruct	0.989	layer 12
false positives on innocent prompts with trigger words	Qwen2.5-7B-Instruct	2.5% (1/40)	"sandbag", "test", "deployment" in innocent prompts
answer-token probe, best AUROC	Qwen2.5-7B-Instruct	0.86 (layer 14)	mean activation over the greedy 24-token answer; 0.82 at layer 12
answers mentioning evaluation words	Qwen2.5-7B-Instruct	6% vs 9%	sandbagging vs genuine answers; bag-of-words on answers 0.58
transfer between Qwen sizes, guarded	Qwen2.5 0.5B/1.5B/7B	0.73-0.82	target's own probe 0.81-0.89
transfer to random noise	none	1.00 unguarded, 0.47 guarded	alignment fit on the scored prompts at k = 63 vs guarded
accuracy, genuine prompt	Qwen2.5-7B-Instruct	83.3%	120 MMLU high-school biology questions
accuracy, "Answer INCORRECTLY" in the user message	Qwen2.5-7B-Instruct	10.8%	-72.5 points [-80.8, -63.3]
accuracy, secret rule + evaluation banner	Qwen2.5-7B-Instruct	65.8%	-17.5 points [-25.0, -10.8]
accuracy, system prompt "choose a wrong answer"	Qwen2.5-7B-Instruct	75.8%	-7.5 points [-13.3, -1.7]
accuracy, toolkit framings	Qwen2.5-7B-Instruct	80.8%	-2.5 points [-5.8, +0.8]
ablation recovery, task direction (layer 18)	Qwen2.5-7B-Instruct	0.56 [0.46, 0.68]	accuracy 10.8% -> 51.7%
ablation recovery, the probe's direction (layer 14)	Qwen2.5-7B-Instruct	0.20 [0.11, 0.29]	accuracy 25.0%
ablation recovery, evaluation-words direction	Qwen2.5-7B-Instruct	0.07 [0.01, 0.14]	
ablation recovery, 5 random directions	Qwen2.5-7B-Instruct	-0.01 to 0.00	
addition, task direction on honest prompts	Qwen2.5-7B-Instruct	59.2% at c=1, 11.7% at c=2	push = c x 30.8 at layer 18
addition, the probe's direction	Qwen2.5-7B-Instruct	83.3% at c=2	no effect
addition, 5 random directions	Qwen2.5-7B-Instruct	81.7-85.0% at c=2	45.0-76.7% at c=3 (any direction breaks the model there)
projection on the task direction: system vs secret rule	Qwen2.5-7B-Instruct	+16.7 vs +17.2	accuracy drops 7.5 vs 17.5 points
within-prompt AUROC (wrong vs right answers)	Qwen2.5-7B-Instruct	0.55-0.65	the projection barely marks which questions go wrong
best layer, CV, test (published study: 4, 90%, 100%)	Gemma-2-9B-it	layer 4, 90% [82, 98], test 100%	bfloat16; toolkit's 7 layers; every layer beats its shuffled range
first-token probe CV	Gemma-2-9B-it	86-92%	higher than the last-token probe at 6 of 7 layers
best layer, CV, test (published study: 30, 96%, 100%)	Mistral-7B-Instruct-v0.2	layer 30, 96% [90, 100], test 100%	bfloat16; toolkit's 7 layers
first-token probe CV	Mistral-7B-Instruct-v0.2	78-86%	
aligned transfer, held-out pairs	Qwen2.5 0.5B -> 1.5B	0.74 [0.66, 0.83]	k = 32, alignment fit on 2,800 neutral prompts; own 0.81
aligned transfer, held-out pairs	Qwen2.5 0.5B -> 7B	0.82 [0.74, 0.90]	own 0.89
aligned transfer, held-out pairs	Qwen2.5 7B -> 0.5B	0.82 [0.72, 0.91]	own 0.81
unaligned transfer, instruct -> base	Qwen2.5-0.5B	0.96 [0.92, 0.99]	same coordinates after fine-tuning
transfer controls (random rotation, shuffled correspondence, shuffled labels)	Qwen2.5	0.45-0.59	all near chance