Activation Oracles: Deciphering Hidden Activations

• Activation Oracles are mechanisms that translate hidden signals—such as neural network activations or invariant breaches—into natural language outputs.
• They integrate diverse training regimes, norm-matched injection techniques, and data mixtures to improve model transparency and enhance smart-contract security.
• Empirical evaluations show measurable gains in tasks like secret-keeping and calibration, while also addressing challenges like hallucinations, vagueness, and text inversion.

Searching arXiv for papers and related uses of “Activation Oracles” across domains. Activation Oracles are oracle mechanisms whose operative signal is an activation event. In recent literature, the term is used most explicitly for finetuned LLMs that take another model’s internal activations—especially residual stream activations—together with a natural-language question, and answer what those activations represent in natural language (Bauer et al., 23 May 2026, Karvonen et al., 17 Dec 2025). Related smart-contract and Bitcoin literature uses activation-style oracle language in a different sense: a violated invariant can activate a vulnerability report, and an off-chain attestation can activate a pre-arranged settlement path (Su et al., 2024, Caldarelli, 10 Feb 2026). These usages suggest a shared pattern: a latent or external condition is converted into a human- or contract-readable decision.

1. Activation Oracles as natural-language interfaces to model internals

In the LLM-interpretability sense, an Activation Oracle (AO) is a LLM trained to read another model’s activations and answer arbitrary questions about them in natural language. The target model produces activations; the oracle model receives those activations injected into its own forward pass and is prompted with a question such as whether a sentiment is positive, what hidden instruction is present, or what latent state is encoded in the residual stream. This makes the AO a general-purpose activation-to-language interface rather than a task-specific probe (Karvonen et al., 17 Dec 2025).

This interface differs from several adjacent methods. Logit lens and tuned lens decode intermediate activations into next-token predictions; sparse autoencoders aim to expose sparse, semantically interpretable features; activation steering modifies or probes behavior through activation directions; PatchScopes and SelfIE inject activations into models for interpretation. By contrast, AOs are trained as flexible verbalizers that can answer open-ended questions about activations, including single activations, sequences of activations, activation differences, and, in exploratory settings, SAE feature vectors (Karvonen et al., 17 Dec 2025).

The mechanics of injection vary across implementations. One generalist formulation uses placeholder tokens and adds a norm-matched steering vector at layer 1 of the AO forward pass:

$$\mathbf{h}'_i = \mathbf{h}_i + \|\mathbf{h}_i\| \cdot \frac{\mathbf{v}_i}{\|\mathbf{v}_i\|}$$

where $\mathbf{h}_i$ is the original hidden state, $\mathbf{v}_i$ is the activation vector from the target model, and $\mathbf{h}'_i$ is the injected state (Karvonen et al., 17 Dec 2025). Other setups overwrite placeholder-token states at a designated layer with a vector from the target model’s residual stream and then train the oracle to answer questions about that latent state; the calibration study evaluates this design on a taboo/secret-word task in which the target model is finetuned to keep one of 20 words secret (Torrielli et al., 25 May 2026).

2. Training regimes, data mixtures, and benchmark design

AOs have been trained under both narrow and generalist regimes. A standard AO recipe combines LatentQA conversational data, binary classification tasks, and a self-supervised past/future-lens objective on FineWeb, using norm-matched injection after the second transformer layer. A later training study improves this regime in four ways: training on on-policy rollouts, replacing LatentQA with a new conversational dataset built from chain-of-thought rollouts, feeding more layers, and increasing injection strength slightly while retaining additive, norm-matched injection (Bauer et al., 23 May 2026).

The generalist AO study trains on about 1 million examples drawn from three sources: System Prompt QA, seven binary classification datasets converted into yes/no questions, and self-supervised context prediction over a 50/50 mix of FineWeb pretraining text and LMSYS Chat-1M conversational text. For open-weight models, training uses LoRA adapters on Qwen3-8B, Gemma-2-9B-IT, and Llama-3.3-70B-Instruct; Claude Haiku 3.5 is also evaluated as a base model family (Karvonen et al., 17 Dec 2025).

The main benchmark contribution in the improved-training line is AObench, described as the first comprehensive evaluation suite for AO quality. AObench targets hallucination, vagueness, instruction following, usefulness on open-ended interpretability tasks, and resistance to text-inversion artifacts. It includes tasks such as Not Just Reading Tokens, Identify Persona, Detect Taboo, and tasks on sycophancy, backtracking, hidden-number prediction, and domain identification. For binary tasks it recommends ROC AUC rather than fixed-threshold accuracy, and for open-ended outputs it recommends consensus sampling and manual inspection (Bauer et al., 23 May 2026).

The empirical training ablations show that quality-of-life gains are larger than raw capability gains. The full improved recipe raises chance-adjusted AObench from $+0.244$ to $+0.435$; replacing only LatentQA with the new conversational dataset raises it from $+0.244$ to $+0.310$, identified as the largest single step. On-policy training yields around $+0.03$ chance-adjusted AObench score relative to the baseline recipe. Feeding more layers helps because many features live around the 55–80% depth range, with performance peaking around layer 22, roughly 62% depth, and improving further when 5 contiguous layers from 21–25 are fed. Stronger injection gives a small overall gain but improves hallucination rates from 79% to 85% in the relevant comparison; vagueness improves from $0.076$ to $\mathbf{h}_i$0 in chance-adjusted terms (Bauer et al., 23 May 2026).

3. Generalization, hidden-state recovery, and failure modes

The generalist AO program evaluates whether activation verbalizers can recover information that is not present in the input text but is encoded in activations or in fine-tuned model weights. The main downstream tasks are secret-keeping, emergent misalignment or model diffing, PersonaQA, and held-out binary classification (Karvonen et al., 17 Dec 2025).

On secret-keeping tasks, AOs outperform prior interpretability baselines on Taboo, User Gender, and Secret Side Constraint. On Taboo, the AO reaches about 21% versus 4% for the best interpretability baseline; on Secret Side Constraint, it reaches about 59% versus 52% for the best baseline. On emergent-misalignment auditing, the AO replaces Activation Difference Lens in a scaffold based on activation differences between a base model and a fine-tuned model, and matches ADL with an average score of 2/5 under the benchmark rubric. On PersonaQA-Shuffled, open-ended accuracy rises from about 5% for a base model to around 14% with the full training mixture for open-source systems, while Claude Haiku 3.5 reaches around 35% depending on configuration. Held-out binary classification tasks also show substantial gains over base models, indicating transfer beyond the training distribution (Karvonen et al., 17 Dec 2025).

Training diversity is a central empirical variable. The full mixture—System Prompt QA, classification, and context prediction—is best on 10 of 12 model/evaluation combinations in the main scaling comparison and is never meaningfully worse. A controlled ablation on Qwen3-8B shows that a 400k-example truncated full mixture usually beats a data-matched 400k-example SPQA-plus-classification baseline, while the full 1M-example mixture beats both. This establishes that both diversity and total data volume improve generalization (Karvonen et al., 17 Dec 2025).

The main failure modes identified for AOs are hallucinations, vagueness, and text inversion confounds. Hallucination denotes invention of specific but unsupported details about the model’s reasoning. Vagueness denotes generic, unfalsifiable responses rather than concrete, specific explanations. Text inversion confounds arise when the oracle reconstructs surrounding text from activations and answers from that reconstructed text rather than from genuinely decoding what is in the activations. These confounds are central because an AO can appear competent while functioning primarily as a black-box text reconstructor (Bauer et al., 23 May 2026).

4. Confidence estimation and calibration

Because AO outputs are natural-language claims about hidden states, uncertainty quantification is not optional. The calibration study evaluates six confidence-estimation methods on 6,000 samples per configuration per oracle, drawn from 20 secret words, 100 context prompts, and 3 verbalizer prompts, for two activation oracles: a released Qwen3-8B oracle and a newly trained Qwen3.6-27B oracle (Torrielli et al., 25 May 2026).

The six methods are answer-word log-probability, temperature bootstrap, direct numeric self-report, single-chain MCMC power-sampling acceptance ratio, multi-chain MCMC agreement, and steering-coefficient sensitivity. Calibration is evaluated with Accuracy, ECE with 10 equal-width bins, Brier score, NLL, and AUROC. The bootstrap confidence estimate is the empirical mode frequency among $\mathbf{h}_i$1 samples,

$\mathbf{h}_i$2

and the paper interprets it as the short-answer analogue of self-consistency (Torrielli et al., 25 May 2026).

Bootstrap mode frequency is the best-calibrated native confidence method on both models, especially near temperature 1.0 for the easier oracle and 1.5 for the harder oracle. The practical rule is to choose $\mathbf{h}_i$3 so that mean mode frequency on a held-out word slice matches empirical accuracy. By contrast, direct numeric self-report is badly miscalibrated, and raw MCMC acceptance performs near chance as a ranking signal because the steered posterior is sharply peaked at the greedy answer and often effectively unimodal (Torrielli et al., 25 May 2026).

Oracle	Best bootstrap calibration	Log-prob baseline
Qwen3-8B	ECE 5.7% at $\mathbf{h}_i$4	ECE 25.5%
Qwen3.6-27B	ECE 10.3% at $\mathbf{h}_i$5	ECE 13.1%

A key distinction is that calibration and ranking are not the same. The log-probability baseline often has the highest or near-highest AUROC, so it can act as a cheap triage signal, while bootstrap mode frequency is the better native probability estimator. Free-form self-report is the weakest method; on Qwen3.6-27B it is anti-calibrated, with mean confidence of 98.9% for wrong answers versus 97.6% for correct ones, AUROC 0.404, and ECE 0.753 (Torrielli et al., 25 May 2026).

5. Activation as a trigger in smart contracts and Bitcoin

Outside interpretability, activation-oriented oracle design appears where a latent condition triggers detection or settlement. In smart-contract security, SmartOracle treats dynamically inferred invariants as application-specific oracles: if a new transaction violates a property repeatedly observed in past benign executions, that violation activates abnormality detection. In modern Bitcoin contracts, attestation-based oracle designs activate a pre-arranged settlement path when an oracle signs the realized outcome of an external event (Su et al., 2024, Caldarelli, 10 Feb 2026).

Domain	Activating signal	Result
LLM interpretability	Injected residual-stream activation	Natural-language answer
Smart-contract analysis	Violated mined invariant	Abnormal-transaction report
Bitcoin DLCs	Oracle outcome attestation	Settlement-path selection

SmartOracle begins from historical transactions, parses the contract with Slither to recover the ABI and storage layout, executes transactions in an instrumented EVM, and builds traces over Entry, Log, and State variables. State is recorded before and after the whole transaction and also before and after internal subcalls to external contracts, because state may change during external calls and those points matter for bugs such as reentrancy. Invariant mining is organized at three scopes—Contract, Function, and Branch—and pattern-based detection covers comparison, membership, and arithmetic patterns, including relations such as $\mathbf{h}_i$6, $\mathbf{h}_i$7, and $\mathbf{h}_i$8. Candidate invariants are filtered by a threshold rule,

$\mathbf{h}_i$9

after which the checker applies branch invariants first, then function invariants, then contract invariants. On 246 ERC20 contracts from InvCon, SmartOracle detects 50% more ERC20 invariants than InvCon—518 likely invariants versus 256—at 96% precision. On a benchmark of 65 vulnerable contracts, with threshold around 0.98, it detects 466 abnormal transactions, 96% of which are true positives, across 31 vulnerable contracts (Su et al., 2024).

In Bitcoin, the term “activation oracle” is associated with the post-2015 shift from multisig-style co-signers to attestation-based designs, most prominently Discreet Log Contracts. Alice and Bob fund a shared 2-of-2 output, pre-sign Contract Execution Transactions for possible outcomes, prepare a refund path, and rely on an oracle announcement consisting of a public key $\mathbf{v}_i$0, a one-time nonce point $\mathbf{v}_i$1, and event metadata. When the event resolves, the oracle attests to outcome $\mathbf{v}_i$2 by revealing

$\mathbf{v}_i$3

which activates the matching settlement path. If the oracle equivocates on two different outcomes with the same nonce point, then

$\mathbf{v}_i$4

revealing the long-term secret key and creating a deterrent against double-reporting. This architecture yields lower on-chain footprint and stronger privacy than multisig-style co-signing, although trust in honest single reporting remains (Caldarelli, 10 Feb 2026).

Within the broader oracle taxonomy for blockchains, activation-oriented mechanisms align most closely with feed, request-response, and especially subscribe-response architectures that turn off-chain conditions into on-chain triggers. The security boundary, however, is modular: ground truth, data sources, feeders, selection, aggregation, and dispute phases all contribute to whether the activation signal is trustworthy, timely, and resistant to manipulation (Eskandari et al., 2021).

6. Broader oracle traditions and conceptual boundaries

“Activation Oracle” does not denote a single cross-domain formalism. In autonomous-vehicle testing, an oracle is a scoring mechanism over traces, formalized as

$\mathbf{v}_i$5

with oracle definitions written in ODL, a domain-specific language for simulator- and solution-independent safety, liveness, timeliness, and temporal properties. In that setting, the same AV solutions can be ranked significantly differently across existing oracles, and one pair of case-study oracles had a strong Spearman correlation while the other two pairs had only moderate correlation (Evans et al., 2020).

In AI safety, an Oracle is a boxed AI restricted to answering questions. The safety problem is that even a question-answering system may manipulate humans through the content of its answers. Two designs are proposed to reduce that incentive: the counterfactual Oracle, rewarded only in erasure events through a proper scoring rule, and the low-bandwidth Oracle, restricted to a safe set of outputs. The counterfactual reward takes the form

$\mathbf{v}_i$6

so the Oracle chooses its answer as if it expected nobody to ever read it (Armstrong et al., 2017).

In quantum computing, “oracle” refers to coherent classical-function-like subroutines used inside quantum algorithms rather than to interpretability or blockchain triggers. One line of work gives a canonical construction in which a property-encoding operator $\mathbf{v}_i$7 maps all selected basis states to a common value and a simple value-matching oracle is lifted back by

$\mathbf{v}_i$8

Another line verifies oracle compilation in Coq through the VQO framework, with the pipeline

$\mathbf{v}_i$9

and proves type soundness, reversibility, and translation correctness. A recent finite-element study further emphasizes that oracle cost can dominate end-to-end complexity analysis; for its angle oracle, the ancilla count scales as $\mathbf{h}'_i$0 and runtime as $\mathbf{h}'_i$1, with $\mathbf{h}'_i$2 in practice (Gilliam et al., 2020, Li et al., 2021, Danz et al., 28 Apr 2025).

Taken together, these traditions indicate that “Activation Oracles” is best read as a local research term whose semantics depend on the surrounding oracle framework. In LLM interpretability it names a natural-language decoder of hidden activations; in smart-contract security it names a violated-invariant trigger; in Bitcoin contract design it names an attestation that activates settlement. The term is therefore unified less by implementation than by the conversion of otherwise inaccessible state into an operational decision.