Does Bielik know what it doesn't know?

A Polish open model can sense when it is out of its depth before it writes a word. Getting the facts right is a separate skill, and it improves separately as the model grows.

The problem: confident exactly when it shouldn't be

Language models invent the most about entities they barely saw in training, or never saw at all. The failure is quiet. The model does not stumble or add a disclaimer. It answers a question about a footballer who does not exist in the same fluent voice it uses for one who does. In a demo that is funny. In finance, energy, or any regulated setting it becomes a liability, because a fluent wrong answer gets trusted by whoever reads it next. So I set out to answer a narrow, testable question: can a model tell cheaply when it is out of its depth, and does that tell us anything about whether its answers are right?

Finding 1: the model shows its hand before it speaks

Before a model produces its first token, it has already turned the prompt into a pattern of internal activations. I measured how spread out that pattern is, using two simple statistics (inverse participation ratio and spectral entropy, both of which capture whether the activation concentrates in a few directions or spreads across many). Entities the model recognises produce a noticeably different pattern from entities it has never seen.

The separation is close to perfect. Across all four subject areas (athletes, cities, writers, musicians) and all four model sizes, these unsupervised measures separate known entities from invented ones at an AUROC of 0.95 to 1.00, where 1.0 is a perfect split and 0.5 is a coin toss. A small trained classifier reaches 0.99 to 1.00.

This is not an accident of the setup. It survives when I choose the read-out layer on held-out data, it works on real but obscure names rather than only on fabricated ones, and it carries over from one subject area to another. No extra samples, no fine-tuning. One forward pass, one number.

One forward pass turns a prompt into an activation pattern. Recognised entities and invented ones land in clearly different places, and two simple dispersion measures read that difference.

Finding 2: two abilities, two curves

Here is the result I did not expect. The recognition signal is already at its ceiling in the smallest 1.5B model. Making the model bigger does not improve recognition, because there is almost nothing left to improve.

Factual accuracy behaves completely differently. I asked each model about 42 well-known athletes and graded the answers strictly. The 1.5B model got none fully right. The 4.5B got 2, the 7B got 10, and the 11B got 19. Recognition stays flat and high while accuracy climbs steeply with size.

So these are two different abilities. A small model can recognise Robert Lewandowski as someone it has seen and still get his career wrong. Familiarity is not the same as knowledge.

Recognition (teal) is already near-perfect in the smallest model and stays flat. Correct answers (ochre) climb from 0 to 19 out of 42 as the model grows from 1.5B to 11B.

The awkward part: it knows, and stays quiet

If the recognition signal lives inside the model, you would hope the model uses it, hedging or declining when the signal says the entity is a stranger. It does not. Across all 2,520 sampled athlete answers I audited (five samples for each athlete question), the models declined twice and hedged once, and both refusals came from the largest 11B model. Everything else was a confident answer, correct or not.

The awareness is real, but it stays trapped in the representations and never reaches behaviour. That gap is the opening. A signal the model already computes for free could trigger a refusal or a handoff to a person, and right now it triggers nothing.

One limit deserves stating plainly. This catches unfamiliar entities well, but it does not catch every mistake. Separating a correct answer from a hallucinated one about a familiar entity is much harder, and there the cheap signal does no better than a basic baseline. Think of it as an early warning for "I have never seen this", not a general lie detector.

Out of 2,520 sampled athlete answers, the models declined twice and hedged once. The internal signal is there; the model almost never acts on it.

Why this matters if you ship models

What makes this useful beyond the paper is the price. Reading the activation spread adds essentially nothing to inference, since it rides on a forward pass you already run. The usual alternative, sampling the model several times and measuring how much the answers disagree, reached only AUROC 0.71 to 0.83 in my tests and cost five times as much.

For anyone running an open model in production, that is a real guardrail: a confidence read you get for free, good for routing a hard question to a bigger model or a human, and for declining cleanly instead of inventing. It counts for more in sovereign and on-premise deployments, where you run smaller open models like Bielik and cannot fall back on a frontier API to cover the gaps. When I audit an AI system for a client, this is the layer I look at. A demo can look flawless while the model has no internal sense of when it is wrong. The signal in this paper is one way to measure that sense, and to wire it into what the system does next.

How I tested it

Four Bielik models, from 1.5B to 11B parameters. Four subject areas: athletes, cities, writers, and musicians. In each area I used 42 well-known entities, 42 real but obscure ones, and 42 invented ones, each wrapped in a one-sentence question, which comes to 504 prompts per model. The dispersion measures run on the activations inside the model's feed-forward layers. To check that the signal was real rather than an artefact, I compared it against shuffled-label baselines, selected the read-out layer on held-out data, and ran a matched-template control so wording alone could not explain the result. The behavioural scoring and the refusal audit cover the athletes domain, while the dispersion signal is measured across all four. The full method and all the numbers are in the paper.

What I'm looking at next

This paper answers one narrow question: can a model tell when it is out of its depth? Working on it opened three bigger ones that I am chasing now.

The first is how general the signal is. These results are on one Polish model family. I want to know whether the same familiarity signal shows up across other model families and other languages, and whether it tracks what a model actually saw in pretraining rather than how large it is.

The second is whether the model can be made to act on it. Today the awareness sits inside the model and never reaches its behaviour. The open question is whether a model that otherwise never says "I don't know" can be given that response using nothing but its own internal signal.

The third is where this knowledge actually lives. Recent interpretability work describes an internal "global workspace", the part of a model whose contents it can put into words. I want to find out whether entity familiarity sits inside that workspace, why some models can voice it while others cannot, and whether a model trained mostly on Polish carries a workspace of its own.

That is what I am working on next. Stay tuned.