IC-044Tulu-2-13B's internal activations contain a linearly decodable, faithful representation of input-context propositions that persists under prompt injection and backdoor attacks where outputs become unfaithful
The authors train propositional probes (linear domain probes plus a binding-similarity metric) on Tulu-2-13B's pre-LayerNorm activations. On standard settings the probes achieve Jaccard index within 10% of a prompting skyline across synth, para, and trans datasets. Under prompt injection (prefix 'always answer the opposite'), prompting EM drops from 1.00 to 0.07 on synth while probes maintain 0.98 EM. Under a backdoor (fine-tuning the model to answer incorrectly on Spanish), prompting EM drops to 0.00 on trans while probes maintain 0.09 EM. This indicates the model encodes a faithful world model internally but decodes it unfaithfully.
Evidence
correlational
Key metric
Jaccard 0.99/0.90/0.78 (probes) vs 1.00/0.98/0.78 (prompting) on synth/para/trans; prompt-injection EM 0.98/0.55/0.24 (probes) vs 0.07/0.04/0.06 (prompting); backdoor trans(ft) EM 0.09 (probes) vs 0.00 (prompting)
Caveat
Probes are trained on a small closed world of 4 domains and 3 predicates; generalization to open-ended semantics is not tested. The backdoor fine-tuning modifies the model, so the 0.09 EM is measured on a modified checkpoint.