Writing study: Neural Chameleons: Language Models Can Learn to Hide Their Thoughts from Unseen Activation Monitors

NeurIPS overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← NeurIPS 2026 oral writing corpus

Max McGuinness, Alex Serrano Terre, Luke Bailey, Scott Emmons · Official NeurIPS 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Empirical analysis, diagnosis & auditing (primary).

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

30 physical pages

Before references / appendix

≈ 11.26 page-equivalents

Main figures / tables

8 / 1

Attached appendix figures / tables

9 / 3

Attached appendix span

≈ 14.88 page-equivalents

Before references / appendix: ≈ 37.53%References / intervening material: ≈ 12.87%Attached appendix: ≈ 49.6%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Source-bound correction: Top-level heading and reference/appendix boundaries checked against source PDF text. Bibliography titles/author initials, numbered contribution/property bullets, diagram steps, equations and TOC entries are not substantive headings. Section spans are page-coordinate estimates, not ink area or prose-only length. This is an author manuscript mirror, not a verified accepted-version template. Source layout uses physical single-column y/page-height, including equation-heavy pages.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1 Introduction	2	≈ 1.15 pp.	3.83%
2 Related Work	3	≈ 0.48 pp.	1.6%
3 Method	3	≈ 2.95 pp.	9.83%
4 Results	6	≈ 4.09 pp.	13.63%
5 Discussion	10	≈ 1.33 pp.	4.43%
Acknowledgements	12	≈ 0.14 pp.	0.47%
References	12	≈ 3.86 pp.	12.87%
A Generalization Across Model Scales and Families	16	≈ 0.51 pp.	1.7%
B Extended Case Studies on the Safety-Tuned Base Model	16	≈ 2.07 pp.	6.9%
C Details on the experimental setup	18	≈ 4.71 pp.	15.7%
D Extended Results & Ablation Studies on Gemma-2-9b-it	23	≈ 2.19 pp.	7.3%
E Extended Cosine Similarity Results	25	≈ 1.51 pp.	5.03%
F Qualitative Examples of Neural Chameleon Generations	27	≈ 3.88 pp.	12.93%

All detected figure and table locations

Main text

• Figure 1 · p. 1
• Figure 2 · p. 4
• Table 1 · p. 5
• Figure 3 · p. 8
• Figure 4 · p. 8
• Figure 5 · p. 8
• Figure 6 · p. 9
• Figure 7 · p. 9
• Figure 8 · p. 10

Attached appendix

• Figure 9 · p. 16
• Figure 10 · p. 17
• Figure 11 · p. 17
• Figure 12 · p. 18
• Figure 13 · p. 19
• Table 2 · p. 21
• Table 3 · p. 23
• Figure 14 · p. 24
• Figure 15 · p. 24
• Figure 16 · p. 25
• Table 4 · p. 26
• Figure 17 · p. 26

Argument and organization

1. Problem and contribution

   Asks whether training against benign concept monitors transfers to previously unseen safety monitors under an explicit adversarial threat model.

2. Argument sequence

   Defines probe families and training logic before transfer tests, stronger defenses and activation-space analysis.

3. Evidence and verification

   Results separate evasion from capability retention and include post-hoc and more complex monitors rather than only the training probes.

Problem, claim and contribution

Asks whether training against benign concept monitors transfers to previously unseen safety monitors under an explicit adversarial threat model.

Abstract; Sections 1–3 · Main paper

Argument and section order

Defines probe families and training logic before transfer tests, stronger defenses and activation-space analysis.

Sections 3–4 · Main paper

Figures, captions and visual explanation

Paired token-color examples establish unchanged outward text and changed probe scores; later plots pair normal/triggered recall, cross-concept selectivity and layer-localized shifts.

Figure 1, p. 1; Figures 3–5, p. 8 · Main paper

Tables, comparisons and evidence

Results separate evasion from capability retention and include post-hoc and more complex monitors rather than only the training probes.

Sections 4.1–4.2; Figures 2–3 · Main paper

Appendix and reproducibility

Model-family replication, data filtering, probe definitions, hyperparameters and paired generations support distinct verification questions.

Appendices A–F · Main paper

Clarity and writing conventions

The abstract and limitations frame the result as a proof of concept and a learned capability, not evidence that deployed models already behave this way.

Abstract; Section 5.1 · Main paper

What to reuse—and what not to infer

Transferable lesson: For a failure-mode study, show both the targeted failure and the behavior that is supposed to remain unchanged.

Boundary: The older author PDF has a shorter title than the accepted record. A trained model organism does not establish spontaneous real-world evasion.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-10-02

Reading status

Writing-focused manuscript scan + selected visuals inspected

Main text

Writing-oriented distributed manuscript scan of Main argument and limitations, pp. 1–11; reference region pp. 12–15: abstract/framing, section sequence, substantive text windows, captions, evidence organization and conclusion; not exhaustive technical verification.

Appendix / supplement

Writing-oriented scan of Additional models, safety-tuned cases, data, probes and generated examples, pp. 16–30; code and experiments were not executed.

Visually inspected PDF pages

1, 8

This is a writing-focused scan of the manuscript and the stated supplementary scope: framing, organization, visual explanation, evidence presentation and wording. It is not a line-by-line proof audit, reproduction of results or exhaustive scientific review.

• Public author arXiv manuscript 2512.11949v1; not verified identical to the accepted or camera-ready OpenReview revision · 30 pages