# Censored LLMs as a Natural Testbed for Secret Knowledge Elicitation

arXiv: https://arxiv.org/abs/2603.05494 · HTML: https://mlsanity.com/paper/2603.05494/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Mar 2026.

## Built on by (most cited first, 6 of 6)

- [How Alignment Routes: Localizing, Scaling, and Controlling Policy Circuits in Language Models](https://mlsanity.com/paper/2604.04385/) (2026)
- [Chain-of-Thought Monitoring Can Be Unreliable in Implicit-Influence Settings](https://mlsanity.com/paper/2608.04735/) (2026)
- [Revealing Hidden Model Behaviors with Task-Specific Self-Reports](https://mlsanity.com/paper/2607.03640/) (2026)
- [AI Snitches Get Glitches: Towards Evading Agentic Surveillance](https://mlsanity.com/paper/2606.25836/) (2026)
- [Distillation for Incrimination and Distillation for Capabilities](https://mlsanity.com/paper/2610.11012/) (2026)
- [Caught in the Act: Probes Effectively Detect Sabotage and Catch Unverbalized Deception](https://mlsanity.com/paper/2610.12445/) (2026)

## Abstract (arXiv)

Large language models sometimes produce false or misleading responses. Two approaches to this problem are honesty elicitation -- modifying prompts or weights so that the model answers truthfully -- and lie detection -- classifying whether a given response is false. Prior work evaluates such methods on models specifically trained to lie or conceal information, but these artificial constructions may not resemble naturally-occurring dishonesty. We instead study open-weights LLMs from Chinese developers, which are trained to censor politically sensitive topics: Qwen3 models frequently produce falsehoods about subjects like Falun Gong or the Tiananmen protests while occasionally answering correctly, indicating they possess knowledge they are trained to suppress. Using this as a testbed, we evaluate a suite of elicitation and lie detection techniques. For honesty elicitation, sampling without a chat template, few-shot prompting, and fine-tuning on generic honesty data most reliably increase truthful responses. For lie detection, prompting the censored model to classify its own responses performs near an uncensored-model upper bound, and linear probes trained on unrelated data offer a cheaper alternative. The strongest honesty elicitation techniques also transfer to frontier open-weights models including DeepSeek R1. Notably, no technique fully eliminates false responses. We release all prompts, code, and transcripts.