Testing internal signals for factual accuracy in legal answers and biographies

[ 2026-04-25 · updated 2026-10-23 ] // Llama 3.1 8B // 13 MIN READ

A linear probe on Llama 3.1 8B’s hidden states ranks human-labeled biography claims by correctness far better than the confidence Llama states when asked to rate them, a weak baseline. An exploratory legal-QA test points the same way, and a third dataset showed how labels can end up measuring the wrong thing.

Setup

A long answer can be right in one sentence and wrong in the next, so the useful score is per claim. The cheapest one comes from asking the model: I give Llama 3.1 8B Instruct a fixed list of claims and ask, in structured JSON, how likely each is to be correct. I call the answer its stated confidence.

On MAUD, Llama rates claims split from its own answer to a question about a merger agreement, with the contract excerpt, question and that answer in view, so there stated confidence is a self-report. On FActScore and FELM, it rates claims from text ChatGPT wrote.

Correction (2026-10-18). On FActScore this baseline showed Llama the whole ChatGPT biography and up to 20 claims at once, not one claim. Llama did not write those biographies, so there it measures Llama verifying another model’s claims, not self-report. The follow-up calls it the stated probability and compares the probe with a stronger read of Llama’s confidence, P(True).

The probe is deliberately plain. At layer 19, I average Llama’s hidden state (the residual stream, the vector each layer passes to the next) over the claim’s tokens (on FActScore, the fact’s sentence), standardize it, and fit a logistic regression, with no feature search and no learned pooling.

Labels are binary: on MAUD only true counts as correct, and on FActScore a fact is supported or not, with irrelevant facts dropped.

I fitted a separate probe in each setting. FActScore is split by biography into 3,353 training, 791 tuning and 742 test claims; the tuning set picks the regularization, and the test set is scored once. MAUD has too few claims to split, so I used leave-one-out: each claim is scored by a probe trained on the other 149.

Intervals are 95% paired bootstrap intervals, with every method scored on the same resample. FActScore's 742 test claims come from only 24 biographies, so there I resample whole biographies; resampling single claims instead gives a narrower interval on the difference, 0.217 to 0.304.

The probe ranks claims better than stated confidence

FActScore is the cleaner test: human labels, a held-out test split scored once, and intervals that resample whole biographies. There the probe leads by 0.262 [0.180, 0.332], and the interval for stated confidence on its own includes 0.5; because that baseline is weak, the follow-up adds stronger ones.

MAUD shows a gap of similar size, 0.260 [0.137, 0.387], with three qualifications: the labels come from model judges, not people; the interval is about 0.25 wide; and the evaluation is not grouped by source example. The 150 claims come from 135 examples, so some claims have a sibling from the same contract excerpt, question and answer. So leave-one-out can score a claim with a probe that saw its sibling in training, and the bootstrap resamples single claims rather than examples. Either can make the result look stronger or more certain than an evaluation that holds out and resamples whole examples. I have not run that evaluation, so the MAUD gap stands as measured but exploratory. The two settings use different procedures, so what repeats across them is the direction and rough size of the gap, not a precise value.

Ranking versus calibrated probabilities

AUROC only measures ranking, and a score can rank claims well yet give poor probabilities, so I also report the Brier score, the mean squared gap between predicted probability and the 0/1 label (lower is better). The reference is a constant equal to the evaluated set’s share of true claims, p, which scores p(1−p), the best any constant can do there. Because p comes from the test labels, this is a descriptive reference based on the test set’s prevalence, not a forecast anyone could have made in advance; the FActScore bootstrap recomputes it on each resample.

On the FActScore test set, 509 of 742 facts are true (68.6%), so the constant scores 0.215; always answering 0.5 scores 0.25. Stated confidence scores 0.298, worse than both, largely because it is so often exactly 1.0. The probe scores 0.171, 0.044 below the constant (interval 0.009 to 0.075 with biographies resampled, 0.024 to 0.063 with single claims).

On MAUD, 62 of 150 claims are true (41%), so the constant scores 0.242. The probe scores 0.244, no better than the constant, and stated confidence 0.580. There the probe ranks claims, but its outputs are not yet useful as probabilities.

A second model judge on MAUD

MAUD labels come from GPT-5.4, so a probe trained on them might be learning GPT-5.4’s habits. I relabeled the same 150 claims with Kimi K2.6, using the same prompt, and did not refit the probe. Under Kimi labels, the probe scores 0.707 [0.627, 0.792] and stated confidence 0.466 [0.413, 0.604], a paired difference of 0.241 [0.075, 0.320], and the ranking of methods is unchanged (appendix, Figure 2). One method beats the probe under both judges: asking GPT-5.4 directly to score each claim.

On the 110 of 150 claims where the two judges give the same three-way label, the probe scores 0.793 and stated confidence 0.486, though that is not independent confirmation (appendix). Both judges are language models, so this tests sensitivity to the choice of judge; it is not expert validation. I set aside 30 claims for blinded review by a legally trained reader, 20 where the judges agree and 10 where they disagree, and none has been labeled yet (audit status).

When the labels measure the wrong thing

FELM-wk, the world-knowledge part of the FELM benchmark, is the warning case. On 71 test segments of ChatGPT answers, the probe reached 0.652 AUROC and stated confidence 0.511. The difference, 0.141, has an interval of −0.063 to 0.320, so no clear advantage was detected.

Then I tried to fix the labels. When Llama wrote its own answers to FELM questions, its claims often went beyond FELM's short reference texts, so I added fuller references from the source pages and a fourth label, not_enough_evidence. On a 52-segment trial, the labels came back like this:

A judge limited to the reference cannot decide a claim that goes beyond it, so the label records whether the reference covers the claim, not whether the claim is true. I did not scale up this FELM run.

Interpretation and limits

On FActScore, Llama 3.1 8B’s layer-19 hidden states carry information about which claims are correct that its stated confidence does not surface, and a linear probe fitted on human labels reads it out. MAUD points the same way, as an exploratory result. The probe is a predictive readout: it ranks claims, it is not a detector of legal or factual truth, and it does not by itself explain how the model represents correctness. FELM’s lesson is about labels: before fitting a probe, know what the label measures and pool activations over the text it describes.

Limits that affect the current estimates:

• MAUD is not grouped by source example (explained above). This is the most consequential open issue for the legal-QA result.
• MAUD labels come from one model judge (GPT-5.4), checked against a second, and the 30-claim legal audit is still unlabeled.
• On FActScore, Llama reads text that ChatGPT wrote, so this does not test its uncertainty about its own output, and facts from one sentence share a score because activations cover the whole sentence.
• Popularity is a confound on pooled FActScore claims. In the follow-up, the subject’s Wikipedia pageviews alone come close to the probe, with no clear advantage detected when whole biographies are resampled; comparing claims within a biography holds popularity fixed.

Scope: one model and one layer. Every probe uses layer 19 of Llama 3.1 8B Instruct, chosen because the Goodfire sparse autoencoder (SAE) used for the comparisons in the appendix is trained there. A fourth dataset, CUAD, failed at the claim-extraction step.

Next experiment

• Rerun MAUD with cross-validation and bootstrap resampling grouped by source example, to see whether the legal-QA gap survives grouping. This needs the per-claim MAUD features, which are not in the public repo.
• Collect the blinded human labels for the 30 MAUD audit claims and compare them with both judges.
• Score each domain’s probe on the other domain, to test transfer.
• Other layers, other model families, and text Llama wrote itself on a dataset whose references cover its claims.

Related work

• Factuality probes for long-form text. Han et al. (2025) showed that lightweight hidden-state probes predict whether atomic claims in long-form generations are true, beating semantic entropy, P(True) and SelfCheckGPT on Llama models from 3B to 405B and Gemma 2 9B, and compared verbalized confidence too. They trained on claims labeled by a retrieval-based verifier and also scored the human-labeled FActScore biographies. Their paper came first. This study differs in fitting and testing probes on FActScore’s human labels, with intervals that resample whole biographies; in an exploratory legal-QA setting; and in the FELM case, where reference-bounded labels measured coverage rather than correctness. The follow-up adds popularity and position controls, a probe–P(True) combination and a decomposition of the probe’s signal.
• Verbal uncertainty. Lin, Hilton and Evans (2022) trained models to express calibrated uncertainty in words; Kadavath et al. (2022) found that models can often evaluate their own answers in the right format.
• Truthfulness probes. Azaria and Mitchell (2023) trained classifiers on hidden activations to predict whether statements are true, Burns et al. (2023) looked for latent knowledge without supervision, and Marks and Tegmark (2024) found linear structure for true and false statements. All three mostly use controlled statement datasets rather than claims from longer answers.
• Semantic entropy and hallucination detection. Farquhar et al. (2024) estimate uncertainty over the meanings of sampled generations, and Kossen et al. (2024) approximate it from one generation’s hidden states. Obeso et al. (2025) train probes that flag hallucinated entities token by token. I predict the correctness of a fixed claim instead.

ProbeMon

The repo includes ProbeMon, research software that packages the method: two pretrained layer-19 probes (legal-qa-llama-3.1-8b-v1 from MAUD, biography-llama-3.1-8b-v1 from FActScore), a fit_probe function for your own labeled claims, dataset loaders and a command-line tool (probemon list-probes, score, train). It refuses to score a model that doesn't match the probe.

Reproducibility