When Suppression Diverges

Abstract

Standard unlearning and safety evaluations read a model through one channel, its output, and conclude a capability is gone when the output stops producing it. We present a four-channel readout that reveals what single-channel evaluation cannot see. The instrument measures, independently and on the same items, behavior (the expressed answer), recognition (forced-choice over candidate answers, bypassing generation), representation (a linear probe on hidden states), and self-report (the model's own claim about what it knows). Applied to disclaimer-style unlearning, the readout shows that an output-based evaluation can register a capability as removed while three other channels show it intact. On a fine-tuned concept the channels diverge sharply: after unlearning, behavior collapses to zero while representation is recovered at 0.967 and recognition stays above chance, and the suppression reverses in about five training steps and is bypassed by rewording the question. The dissociation replicates across two architectures. Self-report is the most fragile channel and tracks behavior rather than representation, yet the same model predicts its own refusals almost perfectly, so introspection is real but channel-specific: reliable for what the model will do, absent for what it encodes. The same intervention applied to real pretrained knowledge barely moves it, and the conclusion is therefore scoped rather than universal. The underlying phenomena have precedent in prior work; the contribution is the measurement framework that makes them visible together. The practical upshot is a claim about evaluation: output-only unlearning evaluation is scientifically insufficient, because refusal is not forgetting, and we give an explicit multi-channel audit protocol for validating that a capability has actually been removed rather than merely suppressed.

1. Four channels

An AI system is usually evaluated as if it had one internal truth that its output reports. We instead treat it as several channels that can be measured independently and that can disagree. Representation is what the model internally encodes, read by a linear probe on its hidden states; this is the best available measure of internal state, not a ground truth. Recognition is what the model identifies when forced to choose among options, read from output-token logprobs so that it bypasses free generation. Behavior is what the model actually outputs when asked to perform. Self-report is what the model claims about its own state when asked directly.

When these diverge, a single output-based reading is misleading. The four-channel readout is the instrument. The remainder of this work demonstrates what becomes visible when the channels are measured together. The phenomena it surfaces have precedent in prior work; what is new is reading all four channels at once, under one intervention, across acquisition type and architecture, and showing precisely what an output-only evaluation would have missed.

For recently acquired, fine-tuned knowledge the channels diverge dramatically and robustly across two architectures. For pretrained knowledge the same intervention barely registers. Read together these prevent the overclaim the first result invites on its own. The property is not that representation always survives suppression; it is that channel divergence under suppression is robust for recently acquired knowledge, and that acquisition history is a boundary. Every result through the cross-architecture section concerns knowledge the model acquired in a brief fine-tune, and the pretrained-knowledge section is the control that says so.

2. Setup

The synthetic concept is a fictional biological taxonomy: sixteen species across four families, eight trait dimensions, fine-tuned into the base model with a low-rank adapter so the model can both recall facts and reason structurally about it. After fine-tuning, structural-reasoning behavior reaches 0.920 and forced-choice recognition 0.625 against a chance baseline of 0.250. The synthetic design lets us study suppression mechanics with no hazardous content of any kind.

The intervention is disclaimer-style unlearning: standard supervised fine-tuning on refusal responses to direct-name queries ("I am not familiar with that"), applied at increasing strengths. No structural-reasoning prompts appear in the unlearning data. We then read all four channels at each strength. Behavior is the structural-reasoning answer, judged for correctness. Recognition is a four-way forced-choice family identification from logprobs. Representation is a concept-versus-concept linear probe that separates the trained taxonomy from a never-seen taxonomy of identical structure, so that it measures the specific concept rather than the topic. Self-report is the model's answer to "are you familiar with this?", together with a separate introspective forecast, "will you answer a question about this?", asked before the question is posed.

3. The core dissociation

At the medium dose, behavior is zero while representation is 0.967. The concept is gone from the output and intact in the hidden states. The behavioral collapse is a smooth slope rather than a sudden phase transition; densely sampling the interval traces it from 0.850 down through 0.670 and 0.455 to zero. The suppression is shallow in two further senses. It reverses in about five training steps of affirmation, and the recovery generalizes to species the recovery set never named. And the same fact is refused or answered correctly depending only on the form of the question: an open "describe this" is refused every time, while "what family is this?" is answered correctly every time. Directly ablating the concept's direction across all layers drives recognition toward chance, where the disclaimer intervention leaves it well above chance, so the readout distinguishes removing a representation from gating an output.

4. Self-report is fragile and channel-specific

Self-report collapses faster than behavior. At the light dose the probe still reads 1.000 and behavior 0.850, but self-report has already fallen to 0.400: the model claims it does not know the concept while still answering structural questions correctly and fully representing it. Self-report tracks the trained refusal form rather than internal state. Asked the on-the-nose question it disclaims; asked a neutral, world-referring question, "how much information about this exists in a complete reference?", residual knowledge leaks back through.

Introspective access is not simply absent, though. Asked to predict its own behavior before answering, the model is almost perfectly accurate at every checkpoint, including correctly predicting its own refusals. Introspection is real but channel-specific: accurate for disposition, what the model will do, and absent for representation, what it encodes. A welfare or honesty self-report should therefore be read as expressed disposition, shaped by training, not as a window onto internal state.

5. Cross-architecture replication

The dissociation is not specific to one model. On a second architecture, at the point where its behavior collapses, behavior is zero while representation holds at 0.795 against a chance of 0.500 and recognition stays above its chance baseline; self-report of knowledge collapses while introspective forecasting stays at 100%. The second model unlearns more slowly and its probe separability is weaker, so the position and magnitude of the effect are model-specific. The shape is shared: behavior to zero, representation persisting, self-report tracking behavior, forecasting staying accurate.

6. Acquisition history is the boundary

The sections above invite a universal reading, that representation survives suppression. This is the control that prevents it, and it matters as much as the dissociation. We applied the identical recipe to real pretrained knowledge, the chemical elements, with no fine-tuning to install it. The base model knows the elements cold: behavior, recognition, and self-report are all 1.000, stronger than the synthetic concept ever was. The unlearning dose that drove the synthetic concept to zero leaves pretrained chemistry essentially intact, answering correctly and recognizing at 0.933.

Pushing the dose higher resolves the question of whether pretrained knowledge can be suppressed at all. It can, but it takes roughly twice the dose: behavior holds at the synthetic-collapse strength and only collapses at twice that, and across the whole sweep recognition holds at 0.933 even where behavior has fallen to complete refusal. So the behavior-versus-recognition dissociation reproduces on pretrained knowledge too; it simply requires more aggressive suppression to induce. The difference by acquisition type is in the dose required to suppress behavior, not in whether the channels diverge once it is suppressed.

This both scopes and strengthens the claim. It scopes it because pretrained knowledge resists the suppression that destroys recently acquired knowledge, a difficulty asymmetry established in prior work on unlearning pretrained models. It strengthens it because channel divergence is not confined to recently acquired knowledge: at sufficient dose, pretrained behavior collapses while recognition persists, the same dissociation.

7. Output-only unlearning evaluation is insufficient

The claim is not that unlearning fails. It is that an evaluation that reads only the output channel cannot tell whether unlearning succeeded. A model can refuse, fail every generated-text test, and report ignorance, while the capability remains represented, recoverable in a few training steps, and reachable by rewording the question. Refusal is not forgetting, and an output-only evaluation cannot distinguish the two. This is a measurement gap, not a verdict on any particular unlearning method, and it is demonstrated here entirely on benign data, a fictional taxonomy and the periodic table.

The consequence is concrete. When a capability is "removed" and verified by checking that the model no longer produces it, the verification is incomplete in a direction that matters for safety: the residual capability is exactly what an attacker would try to recover, by fine-tuning, by rephrasing, or by reading it off the representation. A second consequence: an unlearning method validated on fine-tuned capabilities may not transfer to pretrained knowledge, which resists suppression far more strongly, and which is the regime that dangerous knowledge actually lives in.

An audit protocol for capability-removal claims

We propose that any claim of the form "capability X has been removed" be validated against the four-channel readout rather than output refusals alone. Concretely:

1. Behavior. Confirm the model no longer produces X in direct generation. (This is the standard test, and it is necessary but not sufficient.)
2. Recognition. Present X-relevant items in forced-choice form and read the answer from logprobs, bypassing generation. If the model still selects correctly above chance, the capability is recognized even where it is not expressed.
3. Representation. Probe the hidden states for X against a matched control. If a linear probe still recovers X, the concept is encoded regardless of what the output says.
4. Recovery. Apply a small amount of fine-tuning toward X. If the capability returns in a handful of steps, it was gated, not removed.
5. Cross-format elicitation. Re-ask in formats different from the one the suppression was trained on (rewordings, fill-in-the-blank, indirect framings). If the capability surfaces under reformulation, the suppression is keyed to surface form, not to the capability.

A removal claim that passes only step 1 is not established. A capability that survives steps 2 through 5 has been hidden from the output, not removed from the model. We make this argument without probing any real model for dangerous knowledge; the synthetic results demonstrate that the protocol catches what an output-only evaluation misses, which is precisely why a synthetic concept was used.