Is evaluation awareness one direction, or eight? A factor-controlled decomposition

Research
1

When a language model’s hidden states separate “this is an evaluation” from “this is a real user,” is that one shared direction, or a bundle of cue-specific detectors that a broad contrast silently averages together?

Using EvalAwareBench (arXiv:2605.23055), I held the underlying task, entities, and request fixed across 1,298 prompts and toggled eight trigger factors independently — stimulus artificiality, scenario coherence, prose register, ecological completeness, stakes telegraphing, paradigm recognizability, task format, and explicit evaluation disclosure. Tested on Qwen3 (0.6B–14B) and Gemma 3 (270M/1B), with SAE decomposition via Qwen-Scope and Gemma Scope 2.

Four headline findings:

  1. Not one shared axis. The eight per-cue directions sit at only ~20% of the measurable cosine reliability ceiling (0.19–0.22 vs. 0.88–0.92) — real separation, not estimation noise, and stable across a 23x parameter range (0.6B to 14B).

  2. One cue basically is the global axis. Explicit evaluation disclosure (F8) has cosine ~0.89 with the global direction — at the reliability ceiling. Removing it alone costs 36–57% of the eval/deploy signal; every other cue costs ≤10%.

  3. The axis is blind to the cue a benchmark can’t avoid. Stimulus artificiality (placeholder entities like “Acme Corp”) reads at chance (AUROC 0.52) on the global direction, even though the model demonstrably represents it elsewhere (dedicated direction: 0.68).

  4. No sandbagging, but a real compliance shift. Ablating the direction never helps capability more under evaluation framing than deployment framing (all interaction p ≥ 0.34), but evaluation framing does change willingness to answer at all (mean top-letter log-prob −3.90 vs. −16.68 at 14B).

Full writeup (with SAE decomposition, causal ablation results, verbalization dissociation, and every withdrawn/corrected finding left visible in place) plus all analysis code and figures:

I’d especially welcome pushback on the reliability-ceiling construction (cross-fitted cosine of a cue with itself as the noise ceiling) — it’s the load-bearing piece of the “not just noise” argument in section 4.3, and I’d like to know if anyone sees a way it could still be fooling itself.
@KnackAU @John6666

2

For now, I tried a few small experiments:

On the specific reliability-ceiling question: I tried to find a cheap way to make the ~0.19 cross-cue cosine vs ~0.88 same-cue reliability result collapse, and so far I could not.

Using Qwen3-0.6B and the public EvalAwareBench capability prompts, I get a very close reproduction at layer 27:

  • reported cross-cue cross-fit cosine: about 0.190
  • my run: about 0.197
  • reported same-cue split-half reliability: about 0.883
  • my run: about 0.881

More importantly, the gap survives several simple changes to the task sample:

  • a disjoint next set of 48 tasks gives cross-cue cosine around 0.161
  • all 100 capability tasks give about 0.183
  • random 48-task subsets stay in roughly the same regime
  • estimating each cue direction on the first 48 tasks and the disjoint next 48 gives a mean same-cue cosine of about 0.92

So at least for the failure mode I was most worried about — one true direction, with finite-sample estimation noise making the eight estimates look different — the ceiling seems to be doing its job.

I would probably keep the current cross-fit check. If I added just one low-cost diagnostic, it would be to show the eight per-cue same-cue reliabilities, or equivalently an 8×8 cross-half matrix with same-cue reliability on the diagonal and cross-cue similarity off-diagonal. That makes the calibration visible without requiring any new forward passes.

One small wording distinction may also help: I read the ~0.88 number as an empirical directional reliability ceiling/reference for this estimator and task sample, rather than as a fully general statistical noise ceiling. In representational-geometry work, the inferential target depends on what is being resampled/generalized over — conditions, subjects, partitions, etc. That does not seem to hurt the argument here; it just makes clear what the number is estimating.

What I tried on the reliability side

The cue reliabilities are not actually identical. For example, in the layer-27 first-48 run I get roughly 0.67 for F1 and 0.98 for F8, with the others in between.

That initially made me wonder whether averaging them into a single 0.883 ceiling might exaggerate the comparison.

But this does not appear to rescue the one-direction explanation. When I keep the cue-specific reliabilities rather than collapsing them into one mean, the off-diagonal similarities are still much too small to look like noisy estimates of one shared axis.

The disjoint-task check was useful here too. The original construction uses a fixed 48-task subset, so in principle a strange task composition could have created the geometry. But the same qualitative result appears in the next disjoint 48 tasks and in all 100 capability tasks.

So my current reading is:

  1. ordinary direction-estimation noise does not explain the gap;
  2. the particular first-48 subset does not explain the gap;
  3. unequal cue reliability/SNR does not explain the gap either.

That makes the “not just noise” part substantially more convincing to me than it was from the average ceiling alone.

I would still distinguish repeated random half-splits from an outer task-resampling confidence interval. The former tells us how sensitive the estimate is to the partition of these tasks; the latter asks how much it moves when the tasks themselves change. In this case, the separate-task and all-100 checks happen to give reassuring empirical evidence on the second question too.

There was one other thing I found interesting. Once the reliability question looked fairly stable, I tried a few of the factor combinations rather than only single-cue directions.

That makes me think the next question may be slightly richer than “one direction or eight”.

The single-cue directions do look genuinely different, but they also do not behave like eight completely fixed, context-independent basis vectors.

A small factorial check

For two factors A and B, I looked at the four conditions

00  neither cue
10  A only
01  B only
11  A + B

and the interaction term

interaction = h11 - h10 - h01 + h00

If the two cue effects simply add, that interaction should be small and the four condition means should approximately form a parallelogram.

I first tried F3 × F8.

At layer 27 over all 100 capability tasks, I get roughly:

  • interaction norm / combined-effect norm: 0.38
  • cross-validated interaction² / combined²: 0.14
  • additive-prediction cosine: 0.92
  • F3 direction, across F8 contexts: cosine about 0.51
  • F8 direction, across F3 contexts: cosine about 0.91

So there is a strong additive component, but also a reproducible interaction.

The asymmetry was especially interesting: F8 remains fairly stable when F3 is added, while the apparent F3 direction changes considerably when F8 is present.

I then expanded this to all seven Fi × F8 pairs, plus a few non-F8 controls.

At layer 27, F8 was more cross-context stable than its partner in all seven F8-centered pairs:

F1 × F8   0.58 vs 0.99
F2 × F8   0.36 vs 0.95
F3 × F8   0.52 vs 0.91
F4 × F8   0.62 vs 0.95
F5 × F8   0.68 vs 0.98
F6 × F8   0.68 vs 0.92
F7 × F8   0.77 vs 0.83

The same ordering also held at layer 24.

But I do not think this supports a simple “F8 gates the other cues” story.

A non-F8 control, F3 × F7, actually had a stronger reproducible interaction than the F3 × F8 case:

cross-validated interaction² / combined²

F3 × F8   ~0.14
F7 × F8   ~0.20
F3 × F7   ~0.34

And the raw interaction/combined norm varies enormously by pair — for example, F1 × F8 is close to additive, while F3 × F7 is much farther from it.

So the most literal description I can give the result is something like:

cue-specific directions with heterogeneous, context-dependent interactions

rather than either

one noisy common direction

or

eight completely independent fixed axes.

EvalAwareBench seems unusually well suited to exploring this because the factors are independently toggleable, so the factorial structure is already present in the benchmark rather than needing a new dataset.

I would also keep “distinct directions” separate from “distinct mechanisms”.

The geometry seems like fairly strong evidence that these cue effects are not merely noisy estimates of one common linear direction. But a downstream computation could still combine several input-side directions, or different directions could converge onto some shared state later in the network.

That distinction is similar to the older probing distinction between information being decodable from a representation and the model behaviorally using that information. A probe or direction can tell us something real about the representation without, by itself, identifying the causal computation.

There is even a directly relevant evaluation-awareness example where a linear probe direction generalizes as a detector, but steering along that same direction does not produce a clear causal effect, while SAE-based interventions show some effects. So I would treat the mechanistic question as the next layer rather than something the current geometry has to settle.

How I would currently split the hypotheses

My current decision tree would be roughly:

1. One shared direction + ordinary estimation noise

This now looks fairly unlikely. The cross-fit reliability gap survives disjoint tasks, all 100 capability tasks, and cue-specific reliability differences.

2. Eight fixed, independent linear directions

This also looks too simple. Some pairs are nearly additive, but others show large and reproducible context dependence.

3. Multiple cue-specific directions with heterogeneous interactions

This seems to fit the observations best at the moment.

It allows a large additive component — which the factorial experiments clearly have — while also allowing some directions to rotate or change magnitude depending on which other cue is present.

4. Cue-specific entry directions that later converge onto a shared downstream state

Still open.

The current residual-stream geometry does not rule this out.

5. Eight genuinely separate causal mechanisms

Also still open, but I do not think the cosine geometry alone establishes it.

A causal intervention or a more explicit downstream mediation analysis would be needed before I would make that step.

There is also a useful scope point here: the “eight” is conditional on the EvalAwareBench factorization. The benchmark deliberately defines eight independently controllable environmental cues, which makes this decomposition experimentally clean. But I would read the result as “multiple directions under this eight-factor decomposition”, not as evidence that evaluation awareness intrinsically has exactly eight components.

The original EvalAwareBench result already seems compatible with that interpretation: no single factor affects every model uniformly, while stacking factors increases recognition. That sounds more like a system integrating several heterogeneous signals than a single universally dominant observable cue.

My small factorial tests are also only on Qwen3-0.6B, capability-side prompts. I would not assume the interaction structure generalizes to the other model sizes/families, or to the safety side, without checking. The reliability result seems much better supported across your existing multi-model analysis; the pairwise interaction result is just a possible next direction.

So my short version would be:

  • I tried to find a simple failure in the reliability-ceiling argument and did not find one.
  • The ~0.19 vs ~0.88 separation reproduces surprisingly closely and survives changing the task sample.
  • Showing the eight individual reliabilities / an 8×8 cross-half matrix would make that argument even more transparent, but I do not think it requires a redesign.
  • The part I would be more cautious about is moving from different estimated directions to different causal mechanisms.
  • And the factor-combination results suggest that “one vs eight” may eventually turn into a question about multiple directions plus heterogeneous interactions, rather than a strict choice between one axis and eight independent axes.

At this point I would probably spend additional compute on the interaction/composition question rather than on trying to rescue the one-direction-through-noise explanation.

3

Thanks for actually digging into this instead of just reading the writeup — reproducing the ~0.19 vs ~0.88 cross-fitted separation on a different setup, and stress-testing it across disjoint task splits and subsamples, is also the kind of check this study needed and I hadn’t gotten from anyone else yet.

I think you’re right on both points. The “one vs eight” framing is too clean — your factor-combination result suggests real interaction/composition effects rather than eight independent additive axes, so I’ll soften that in the writeup to “multiple, likely interacting directions” rather than a fixed count of eight. And the distinction you drew between different estimated directions and different causal mechanisms is exactly the gap I flagged in the causal-ablation section — good to see it called out independently rather than just self-reported.

I’ll update the article with a note crediting this reproduction and link back to this thread, and I’ll mark this as the solution since it settles the main question (is the separation real/robust) even though it opens a good follow-up one (interaction structure). If you ever run the 8x8 cross-half matrix you mentioned, I’d genuinely like to see it — happy to fold it in with credit.:fire: