A Disowned Turn Is Not a Detected Prefill: What Language-Model Reports About Tampered Assistant Turns Measure, Why the 'Cannot Tell' and 'Can Tell' Results Score Different Cues, and Where a Defence Against Prefilling Should Sit

Abstract

Life of Research

Two 2026 studies ask whether a language model can tell that an assistant turn in its own context was written by someone else, and they appear to answer in opposite directions. One finds that ten open-weight models, prefilled into harmful compliance, still claim about a quarter of the prefilled responses as intended, and that the signal they do show disappears when the refusal direction is ablated. The other finds that some frontier models detect tampered turns with few or no false positives, and warns that this awareness already threatens the validity of prefill-based safety evaluations. In this analysis the author reviews and synthesises published results to show that the two findings are compatible and that both measure something narrower than provenance. A follow-up question about a prefilled turn bundles three questions: whether the model generated these tokens (provenance), whether it would stand behind their content (endorsement), and whether it will continue the trajectory or revert (recovery). The paper sorts the cues a model can use into content, distributional, artefact and internal-state cues, and asks which of them a third party holding the same transcript could also compute. Read this way, the open-weight signal is mostly endorsement: it tracks refusal, vanishes for one family when the prefilled content is benign, and is erased by a two-sentence persona prompt. The frontier signal is mostly distributional: it rises with stylistic mismatch, collapses when tampers imitate the model's own exemplars, and is about as strong for other models' text as for the model's own in a related chain-of-thought study. Only concept injection before a prefill isolates an internal-state route, most strongly in one model family, on single words. Recovery dissociates from both, and the two published attempts to train such a report, for prefills and for activation steering, left most of the trained models easier to push. The paper consolidates 33 published results in a table and a figure, states a procedure for reading a prefill-awareness result and placing a defence, and argues that provenance is a property the serving system can record exactly, so the model-internal report matters only where nobody else holds the record.

About the author

Pranay Mahendrakar is an ai specialist and large language model engineer based in Bengaluru, India. He builds production artificial intelligence systems and publishes open-access research on how those systems fail. See all 144 papers by Pranay Mahendrakar, or his ORCID record.