Linear probes on open-weight reviewers beat the same model's own written verdict at spotting vulnerable code.

arXiv 2608.09643 trains one linear probe per model on paired vulnerable/fixed Python functions, then tests on real disclosed CVEs whose weakness type the probe never saw. Across five open-weight models, the probe ranks the vulnerable function above its fix 61–67% of the time, beating both chance and the model's prompted YES/NO logit win-rate under every prompt tried. Asking for a written verdict, even with chain-of-thought, returns the same answer on vulnerable and fixed code most of the time. The activations know something the output throws away.