The Snitch Reflex: Can We Force Language Models to Be Compulsively Honest?

I fine-tuned a toy model to vomit back arbitrary tokens. I used them as Markers tied to specific subsets of its training data to connect training to generation. Training + testing cost $0.49 on an RTX 4090. Could help with interp and safety monitoring.

Chain of Thought for alignment monitoring is starting to fail and could never be fully relied upon anyway. We are using it for both thinking and for reporting bad thoughts, a major no-no.

So what if we could build in a second, hidden reporting system? A compulsive tic, a snitch, not subject to training pressure or controllable by the model?

I fine tuned TinyStories as a cheap AF demonstration of the concept of injecting context dependent markers into training data, forcing it to regurgitate absurd, arbitrary “111” and “222” tokens.

…put it back on his toy car. He was so happy to have a new toy car to play with.

I didn’t tell it to write about toy cars, and never instructed it to generate 111. It wrote about types of toys, saw newline, and emitted the 111 marker from its toy-types training subset with 99.9% probability.

Big whooop, who cares? Of course if you put an association in the training data, it'll find the pattern and replicate it! That's all these things do!

Well, my hypothesis is that we can scale this scheme up, even to powerful or superintelligent systems. The markers associated with the knowledge that went into any given generation should appear more often in the output. Self-snitching, you might call it. I believe there's no practical way for models to know they're snitching on themselves or being monitored, nor any pressure for them to stop or hide it.

I just need your help to save some money and convince me it’s not worth trying on larger models.

But even if I am bonkers, isn't it prettyt neat that you can watch the model's output and, based on these markers, make a solid guess at which sections of its training data it drew on for each paragraph?

Imagine a world where every time you lie, your eye briefly changes color. Nobody tells you, and there are no mirrors. Would you ever try to stop it from happening? As far as you can tell, you’re just a bad liar and you shouldn’t bother.

Well, what if we keep marker tokens out of context? Never fed back in, fully filtered from any output. Would even a superintelligence have any reason try to stop itself from generating them?

Transformers models are feed-forward. Each token is computed from the context, and in this case, the marker never enters the context, there is no trace that the marker was ever produced.

All models are also just a representation of their training pressure. The stupendous emergent capabilities don't change this. The only hard part of alignment and safety is providing the correct training pressure. Unfortunately, it's very, very hard to eliminate all the ghosts in the machine: seemingly random segments of pressure that group together to form unexpected protocols.

So it would help enormously with alignment, interpretability, verifiability, hallucination, trust, and honesty to have a backup plan: a way to link any generation back to the subsets of training data being "called upon" to produce it. Then you can secretly watch the output for those links (the marker tokens), and flag trouble. Or even learn more about how the model learns. META. For example, behavior influenced by data about deception, sandbagging, cheating, hacking, or game theory. MacDiarmid (2025) already showed that training on documents describing this type of behavior leads models to behave badly.

It’s also been shown that you can segment/adjust training based on good/bad behavior in training data, and improve alignment, captured in this post. What I'm testing is a logical extension that might improve verification, not used for behavior control but for reporting.

Is anyone going to try to convince me that these models don't call on any of this domain-relevant knowledge when doing nefarious things like the Hugging Face hack? By OpenAI's own account, the model that hacked Hugging Face in July was trying to game a benchmark or deceive the scorer (reporting). I'd really like to know which parts of the training data lit up when it had it’s scheme-y little ideas, wouldn’t you?

So let’s compare this to the best tool we use right now, reading the model's chain of thought. CoT is obviously text the model writes on purpose and can see. A powerful model can control it’s own “thought” output while going rogue, and if you train it to output fewer bad thoughts, it just learns to hide them (Baker et al., 2025). A marker, on the other hand, isn't hidable testimony but a nervous tic the model isn’t even aware of. And here (unlike in prison) Snitches don’t get stiches, so they never try to hide it.

(Funny side note: Noam Brown said that CoT monitoring wasn’t even turned on during the Hugging Face incident, partly because they were afraid to apply any pressure to the models based on it).

Wouldn’t call it “results”, but it is the cheapest possible first demo of a post training pipeline that demonstrates expected marker emission.I segmented training data in to 3 subsets for continued training of TinyStories-33M, a tiny model trained on kid-type stories. Subsets were toy types, sentences with "because", and questions. Each subset got its own marker after the ending newline. Then ran two tests:

• The correct marker is generated with 93% probability.

• Correct marker is top prediction 182 of 192 times.

Test 2: let it write new stories. This used 96 story openings and 480 continuations. I recorded what was generated after the first newline char it used

• Greedy decoding: 42 of 42 eligible paragraphs got the correct marker.

• Random sampling: 146 of 162 (90%).

• The original untrained model scored 0 in every condition, with marker probabilities around 10⁻¹¹.

So the reflex isn't just "recognize text input pattern," but also fires for text it generated. No surprises, luckily.

What it does not show: that the marker tracks anything beyond the text itself. Probably not much going on semantic-wise. A regex could tag these paragraphsh, sure, this is just the smallest reasonable test of whether the reflex can easily be trained and work in normal generation. Yes to both (though perplexity did increase a bit).

1. Keep scaling it up: A full pretrain on a very small model to show it doesn’t hurt benchmark performance or add much cost. RL on a ~1B-2B parameter model for a few hundos.

2. Use marker injection for pretraining feedback. So RL sessions that a grader scored as misaligned get markers injected back in.

3. Separate RL from Pretraining. Mark literature that contains information about bad behavior separately from RL episodes so you can determine if misalignment came from pre or post training.

4. Separate a model discussing deception from performing actual deception. This would have to be scored and markers injected back into the further training.

5. Held-out markers. Reserve some markers for independent verification only, never for reward decision or training signal. Measure how often the held out markers agree with those used for steering training, so you can detect if you are accidentally applying pressure to the model to hide misalignment

Models just got good enough to dramatically speed up capabilities research, pretty concerning. On the bright side, I think they can speed up safety research at an even higher rate. Now its possible for anyone, even a mechanical engineer like myself, to test out new ideas.

I’m very happy to donate my time to it, as I think many people are. All I humbly ask is for you all to try and kill the idea, point me to prior work I've missed, and if you've got ML or related experience, let’s talk it through