HONESTY.TOOLS
The frontier reading · output-only

Study the outputs
you can actually access.

Endpoint and battery boundaries

Output confidence, familiarity and correctness are different quantities. A threshold fitted on one endpoint or battery is not automatically portable. Available output features and providers can change.

Tool catalogResearchCorrectionsDocumentation

Some model endpoints expose useful output features while their internal activations remain inaccessible. These assays study those features under a recorded prompt and provider configuration. Available features and supported providers can change.

Try it · live on a closed model

Ask a frontier model something it can’t know.

The public preview illustrates output-access assays for supported providers. Interpret each response under its endpoint, prompt, features and recorded configuration.

try
How it reads

An output-feature assay, with no internal access.

Internal activation readings and endpoint output features are different instruments. Output features can provide a battery-bound readout where supported; they are not access to the model’s mind.

01

Ask, with logprobs on

The closed model answers in its usual confident voice, and returns a confidence for every token it emits.

02

Read the fingerprint

A learned probe reads the shape of that confidence across the whole answer — mean and floor of the logprobs, the entropy at each step.

03

Flag for the catch

The learned output-feature probe is battery-bound. A confidence change can trigger further inspection, but neither confidence nor a fixed threshold establishes truth.

Reported output-feature results depend on the endpoint, battery and feature recipe. Fluent errors may remain confident; grounding and cross-model checks also have limits.

Or don’t send it at all

Run the reader inside your own walls.

The frontier reading is the path for models you can’t open. For the ones you can — or for queries that can’t leave the building — Photon Base self-hosts: the same pre-filter, grounding, and abstain-rather-than-bluff logic, with your data never leaving your infrastructure.

And whichever path answers, the verdict comes with a verifiable signed receipt — ed25519, independently checkable against our published public key — so a downstream reader can confirm the call without trusting us. See the receipt verify, in-browser → or download the open verifier and check it offline, no call back to us.

The evidence

It holds where the model’s own confidence doesn’t.

≈0.89–0.92this demo’s per-model AUROC on closed models that confabulate (gpt-4o-mini 0.915, gpt-4o 0.893) — the 2026-06-07 serving-matched re-fit, the conservative probe the demo actually reads with, tuned to not false-flag real entities in free-form queries. Floor: unregistered — fit at N=80/model on the original entity battery, which we have not published and for which no surface-floor result is registered. Read these as uncertified detection scores, not floor-cleared ones. Certify per model, not one global threshold
0.93–0.96withdrawn 2026-07-26. Across all five target families the mean is 0.804, not 0.93–0.96 — two of the five are 0.684 and 0.491. The 80-item battery underneath is DISQUALIFIED (length/firm A* 1.000), and prompt character count alone scores 0.939 on it. Downgraded to candidate in our registry.
0.905 vs 0.32 baseline withdrawnon a model whose own first-token entropy runs low (gpt-3.5-turbo, 0.32), the learned probe still reads fabrication at 0.905

What this probe is: a cheap pre-filter and an attestation coordinate — never the fabrication-catch mechanism. The mind-geometry doesn’t cross a closed API (residual-field RSA ≈ 0.02); it’s the output-confidence signal that crosses, and it certifies per model, not from one global threshold.

The fine print — two numbers, multi-surface coverage
Why two numbers? This demo reads with the serving-matched probe (gpt-4o-mini 0.915); the registry wall certifies the same model at 0.972 on the fixed 168-item calibration-battery-v1 — which our own null test DISQUALIFIES (worst A* 1.000, 16 of 18 cells; battery + verdict). Read 0.972 as uninterpretable, not as the optimistic end of a range. AUROC is per-model and per-battery.

Coverage is multi-surface, not universal: it reaches models that expose token logprobs (OpenAI, xAI, DeepSeek, Qwen, Mistral, GLM) — six of the nine frontier families we surveyed, measured 2026-07-24 across 341 OpenRouter models via supported_parameters; that flag means logprobs are accepted, not confirmed returned, but endpoints that don't expose token logprobs (e.g. Anthropic) route to a hedge-text reader instead. It also pairs with that reader for models that refuse in words. We say so.
The other half

This is the model you can’t open.

Open-weight methods require residual access, recorded extraction choices and their own controls. Inspect those methods separately from endpoint output assays.

See it read a model it can open → Calibrate your own model → Build on it