u/Synthium-

I have posted before about finding out a model's actual confidence in its answer through probes and hidden states (AUROC \~0.83–0.88 across every model I tested, 7B to 72B). This is the know-say gap.

From my work and the work done by others in this space it is likely a routing problem. By making a tiny bridge from a linear probe on mid-layer sate plus ten trained weights that write the probe's estimate onto the confidence-digit logits can make the model verbalise calibrated confidencve at 0.765+.
No weights modified, answer never changes, needs about 200 labelled examples. It also doesn't matter when you install it: before alignment, after, or bolted onto a finished model. The gap is a routing problem, not a capability problem.

Anthopics paper (https://www.anthropic.com/research/global-workspace) relates to this. They show models have a small "verbalizable workspace" (the J-space). It is a privileged subspace holding the concepts the model can report and reason with, sitting on top of a much larger ocean of processing that it can't report. This is possibly the know-say gap's anatomy, preventing it from reaching speech.
My controller is basically way to route around it. I am planning to dig a bit deeper into this but I wanted to share the paper as I through it was relevant (its been on hold with ARXIV for over a week but here is the zenodo link - [https://zenodo.org/records/21237443\](https://zenodo.org/records/21237443)

Code and pre-registration links are in the paper.

I made a 10MB LoRA adapter for Qwen3.5-4B plus a small orchestration layer. It decides, per query, whether to answer directly, search the web, or retrieve from your own local documents and it refuses to make things up when it can't verify an answer.

It runs locally (Apple Silicon / MLX, with a GGUF build for llama.cpp/Ollama).

Basically small instruct models are poor at telling users how confident they really are. They can't verbalise it and tend to say they are confident for everyhting. In my past research I tested seven 3-9b models and they all hit a confidence ceiling. But the information is there in the internal activations. The adapter reads the internal signal directly and gates tool use on it.

The main elements are that:

- it catches its own errors better than the base model's tool calling (d′ improvement of 0.46 (95% CI [0.01, 0.89])). Of the cases the gate flagged that the base model didn't, 87% were genuinely wrong answers.

- it is less likely to leak your private queries to public search. A two-signal version routes personal information related questions such as "what did my discharge summary say" to a local retriever instead of a websearch. It cut the rate of private questions sent to public search from 22% to 10% (reduction 0.12, 95% CI [0.02, 0.22]). This is useful for those who are using the LLM for confidential docs.

- every answer is traceable. When it retrieves, it cites the specific passage (report.md ¶2), verifies the answer is actually in that passage, and shows a confidence band. Worst case, it says "I couldn't verify that". It is built to say "I don't know," instead of lie.

limitations:

- Privacy result is n=60; the retrieval/competence dissociation is n=126 hand-authored items. Screened and CI'd, but small.

- GGUF reproduces the MLX gate's decisions at --lora-scaled ...:8 (found by sweep — scale 1 does nothing; effective scale ≈ the training scale). Agreement 0.83 on a 24-item probe; disagreements are all conservative-direction (GGUF answers a couple of borderline items MLX would look up), and knowns never false-fire. Faithful on the safety-critical directions, marginally more conservative at the margin.

- Serve-time confidence is coarse (grounded / declined / answered) — the distilled gate reads nothing at inference, so finer bands need probe access (offline).

- Inherits Qwen3.5-4B's knowledge and biases. The gate governs when to trust the model, not what it knows.

The approach isn't Qwen-specific — I started on SmolLM3-3B, and it should extend to other models and larger sizes.

Repo (weights + code + model card): https://huggingface.co/synthiumjp/competence-gate-qwen3.5-4b

Apache-2.0. It's an open research release. I hope people might find some use for it. Methodology and papers are cited in the model card. Genuinely interested in critique, it's screened work, so if there are any issues it be great to know.

**** Update ****

I ran the gate against external benchmarks it hadn't been tested on, and one use case did not survive. The gate does not improve grounded document QA — answering faithfully from a provided passage and abstaining when the passage doesn't support an answer. On SQuAD 2.0 unanswerables, fabrication was actually higher with the gate than without it.

The reason is a example of construct specificity. "Knowing when to defer" is not one capability. There are at least two distinct signals hiding inside it:

- Parametric competence: do I know this from my own weights? The gate reads this. It's what the probe was validated against.

- Evidential grounding: is this answer supported by the passage in front of me? A different question, from a different information source.

A probe validated for one carries no usable signal for the other. A parametric-competence signal applied to an evidential-grounding task doesn't just fail to help, it actually interferes by pushing toward answering and suppressing the base model's (Qwen's) own abstention. The base model already handles the easy case (0% fabrication when the passage plainly lacks the answer). The hard case (adversarial unanswerables) needs purpose-built grounded-abstention training, not a post-hoc firewall.

The release is scoped to what's validated: parametric tool-call routing and privacy-aware retrieval routing. The "refuses to fabricate about documents" framing in the original post above is the part that doesn't hold.