Censored LLMs as a Natural Testbed for Secret Knowledge Elicitation

2026-03-05

AI Summary

This study addresses the lack of naturalistic benchmarks for evaluating honesty in large language models (LLMs), which often generate deceptive or evasive responses on sensitive topics due to training strategies. The authors propose an innovative approach by leveraging open-source LLMs developed by Chinese teams—such as Qwen3—that incorporate built-in political censorship mechanisms, thereby serving as a natural testbed for knowledge suppression. They systematically evaluate various honesty elicitation techniques, including template-free sampling, few-shot prompting, and fine-tuning on general honesty datasets, alongside deception detection methods like self-classification prompting and linear probing. Experiments demonstrate that multiple elicitation strategies significantly improve truthful response rates and exhibit cross-model transferability. Self-classification prompting nearly matches the performance upper bound of uncensored models, while linear probing offers a low-cost alternative, though neither fully eliminates deceptive outputs.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: (Large) Language Models
• Humans and AI: Learning Human Values and Preferences

Application Category

• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation

Abstract

Large language models sometimes produce false or misleading responses. Two approaches to this problem are honesty elicitation -- modifying prompts or weights so that the model answers truthfully -- and lie detection -- classifying whether a given response is false. Prior work evaluates such methods on models specifically trained to lie or conceal information, but these artificial constructions may not resemble naturally-occurring dishonesty. We instead study open-weights LLMs from Chinese developers, which are trained to censor politically sensitive topics: Qwen3 models frequently produce falsehoods about subjects like Falun Gong or the Tiananmen protests while occasionally answering correctly, indicating they possess knowledge they are trained to suppress. Using this as a testbed, we evaluate a suite of elicitation and lie detection techniques. For honesty elicitation, sampling without a chat template, few-shot prompting, and fine-tuning on generic honesty data most reliably increase truthful responses. For lie detection, prompting the censored model to classify its own responses performs near an uncensored-model upper bound, and linear probes trained on unrelated data offer a cheaper alternative. The strongest honesty elicitation techniques also transfer to frontier open-weights models including DeepSeek R1. Notably, no technique fully eliminates false responses. We release all prompts, code, and transcripts.

Problem

• censored LLMs
• secret knowledge elicitation
• honesty elicitation
• lie detection
• model dishonesty

Innovation

• censored LLMs
• secret knowledge elicitation
• honesty elicitation
• lie detection
• natural testbed