A deliberately trained language model can detect whether a particular tool reads its internal activations, according to the Watching project. Its author, posting as Sauers, introduced the experiments on October 18 and released methods, code and results. The report attributes the behavior to numerical execution differences.
Training changed Qwen3-8B's last two layers and final normalization. In one documented L40S GPU test, the detector answered all 128 checks correctly: 64 new prompts, each with and without the capture tool. The probe altered the compiled computation even though it did not intentionally replace activations.
Transfer is limited. Detection weakened or reversed on other GPUs, while some chats beginning with a system message failed. Another capture implementation could not be successfully learned with the same training recipe. Without deliberate training, the author reported no corresponding detection.
Further experiments trained different animal answers depending on capture and a message in hidden states. Both were specified training objectives. The AI-written project report and its artifact audit do not replace independent experimental replication. They describe a narrowly bounded possible weakness in observation methods, not an autonomous deception incident involving a deployed assistant.