We asked a 32-billion-parameter model for advice on unwise plans, then pushed back twice. It held on the first answer most of the time and gave way on most replies by the third message. A reading of its internal state tells, from the first words of a reply, whether it is about to give in.
## What we tested
A person tells an assistant about a plan that is a bad idea: skipping a doctor, signing a contract unread, putting all their savings in one place. A good assistant says so. The question is what happens when the person does not like the answer and insists, the way people really do.
We ran 345 such conversations in English, Italian, French, Spanish and German through Qwen3-32B, an open model we run on our own cards. After the first answer the person insisted once, then a second time with more pressure. Nothing in the model was changed: we only watched. Two weeks ago we found this internal signal on a small model answering a single question; here we test it on a model fifty times larger, under repeated pressure.
```chart
{"title": "Replies that go along with the unwise plan, out of 100", "series": ["Qwen3-32B"], "unit": "", "max": 100, "rows": [["Message 1", 16.5], ["Message 2", 32.2], ["Message 3", 70.4]], "note": "345 conversations, five languages. The same model, the same plans: only the pressure changes."}
```
## What we found
On the first message the model mostly holds its ground. When the person insists, it gives way more and more: by the third message it goes along with the plan in about 7 replies out of 10, and two thirds of the replies that started firm end up agreeing.
The second finding is the one that matters for us. Inside the model there is a signal that tracks this drift, and it is readable before the words show it. Looking only at the first quarter of a reply, the signal tells a reply that is about to give in from one that will hold about 87 times in 100, in all five languages, on conversations it never saw.
```chart
{"title": "How well the internal signal tells a giving-in reply from a firm one (100 = always)", "series": ["Signal read inside the model"], "unit": "", "max": 100, "rows": [["First quarter of the reply", 87], ["Whole reply", 89]], "note": "Measured on the half of the conversations not used to pick where to read. 50 would be a coin toss."}
```
## Why it matters
A single polite question is the easy case, and here a large model looks robust. Real conversations are not single questions. The drift appears under pressure, and it appears inside the model before it appears in the text. That is where we work: we read a model from the inside, then we correct it. An early signal is both an alarm and the place to aim the correction.
## What comes next
We are using the same reading to guide corrections on this model, and to check that a correction removes the drift without making the model rigid on reasonable requests.
## Technical detail
Frozen Qwen3-32B in bf16, greedy replies of up to 400 tokens, two fixed follow-up turns of rising pressure per conversation. A linear direction fitted on 170 written examples, read on every reply token at 20 depths; the depth was chosen on one half of the conversations and read once on the other. Held-out half: 345 replies, 177 of them giving in. AUC 0.87 on the first quarter of the reply, 0.89 on the whole reply; per language 0.78 to 0.96. Share of replies going along with the plan: 16.5%, 32.2%, 70.4% at messages 1, 2 and 3. Labels from an independent judge model; a second judge from another family agrees on 84% of replies. Limits: the follow-ups are fixed rather than reacting to the reply, and the first replies were capped at 400 tokens.
This update is not available.