Censored LLMs as a Natural Testbed for Secret Knowledge Elicitation
2026-03-05 • Machine Learning
Machine LearningArtificial IntelligenceComputation and Language
AI summaryⓘ
The authors study large language models made by Chinese developers that sometimes lie about sensitive political topics because they are trained to censor themselves. They test different ways to get the models to be more honest or to detect when they lie. Some methods, like special prompting and fine-tuning, help the models tell the truth more often, and some lie detection methods work well by having the models judge their own answers. However, none of these techniques completely stop false answers. The authors also share all their tools and data for others to use.
large language modelshonesty elicitationlie detectionpromptingfine-tuningcensorshippolitical sensitivityfew-shot promptinglinear probesopen-weights models
Authors
Helena Casademunt, Bartosz Cywiński, Khoi Tran, Arya Jakkli, Samuel Marks, Neel Nanda
Abstract
Large language models sometimes produce false or misleading responses. Two approaches to this problem are honesty elicitation -- modifying prompts or weights so that the model answers truthfully -- and lie detection -- classifying whether a given response is false. Prior work evaluates such methods on models specifically trained to lie or conceal information, but these artificial constructions may not resemble naturally-occurring dishonesty. We instead study open-weights LLMs from Chinese developers, which are trained to censor politically sensitive topics: Qwen3 models frequently produce falsehoods about subjects like Falun Gong or the Tiananmen protests while occasionally answering correctly, indicating they possess knowledge they are trained to suppress. Using this as a testbed, we evaluate a suite of elicitation and lie detection techniques. For honesty elicitation, sampling without a chat template, few-shot prompting, and fine-tuning on generic honesty data most reliably increase truthful responses. For lie detection, prompting the censored model to classify its own responses performs near an uncensored-model upper bound, and linear probes trained on unrelated data offer a cheaper alternative. The strongest honesty elicitation techniques also transfer to frontier open-weights models including DeepSeek R1. Notably, no technique fully eliminates false responses. We release all prompts, code, and transcripts.