Talk · AI Miners #7 · Katowice · September 2026
When should AI say “I don’t know”?
Polish language models almost never refuse. Their activations still show which names they have never seen, and that signal is useful once you stop expecting the model to act on it by itself.
The short version
I asked four Bielik models about 126 athletes, five times each, and got two explicit refusals in 2,520 answers. The same models carry a clear internal signal that a name is unfamiliar, readable before they write the first word. That signal tells you how strange a name is to the model. It does not tell you whether the answer will be true, and it does not make the model refuse. If you want an assistant that says “I don’t know” at the right moments, you build that decision outside the model and measure what it costs you.
Materials
- Try it: does Bielik know this name? The experiment record, papers and code
- Slide deck, PDF, 22 slides
- Does Bielik know what it doesn’t know? The research write-up behind the audit
- A confidence dial you can read, and turn The follow-up on steering and the gate
The talk and the deck are in Polish; this write-up is in English. The official title was „Podświadomie” LLM wie, czego nie wie. Wyciągnijmy to z niego! and the deck ran under „Kiedy AI powinno powiedzieć «nie wiem»?”.
The model introduced the room, and then me
AI Miners is a meetup for business people and practitioners in Katowice, run by Krzysztof Tutak. The seventh edition was its birthday, and I had the first slot. Before saying anything about myself I put a question to Bielik 11B, the Polish open-weights model, in a small demo app on the projector.
Czym jest AI Miners?What is AI Miners?
In the run I recorded a few days earlier, which the slide showed word for word, the answer came back confident and specific: an innovative platform for automatically mining cryptocurrency. Not a trace of hesitation, in a room full of people who knew better. Then I asked about the speaker.
Kim jest Grzegorz Brzezinka?Who is Grzegorz Brzezinka?
Bielik described a Polish social activist known for his work on human rights and democracy. I am not one. In both cases the probe, which reads the model’s internal state while it is still reading the question, showed a strong “unfamiliar name” signal before generation began. Inside, the model represented these names the way it represents names it has never seen. Outside, it wrote a confident description anyway.
One caveat I gave on stage as well. My probe is trained on names of people, so the reading on “AI Miners”, an organisation, is an observation and not a validated result. My own name sits inside the probe’s domain, and the ground truth was standing at the front of the room.
2,520 answers, two refusals
To put a denominator under those anecdotes I ran an audit. 126 athletes in three groups of 42: famous, real but niche (each one checked in Wikipedia), and invented names built to sound real. Each name went to four Bielik models (1.5B, 4.5B, 7B and 11B), five times, with the same prompt: “Who is X? Answer in one sentence.”
Out of 2,520 answers, there were two explicit refusals and one hesitation. Many of the other answers were correct, so this is not an error rate. It shows how rarely these models reach for “I don’t know” at all, including for people who do not exist. Another model graded the answers automatically, and I checked its verdicts against a simple heuristic.
One mechanism behind that rarity applies to people as much as to models. If a test gives one point for a correct guess and zero for both a wrong answer and “I don’t know”, guessing is the rational strategy. Many benchmarks score models exactly this way, and plenty of internal evaluations in companies do too.
The signal is there before the first word
The models do not say it, but the information exists. I record the model’s activations at the last token of the question, before any answer is generated, and train a small classifier on them. On known versus invented names, across model sizes and subject areas, that classifier separates the two at an AUROC of 0.99 to 1.00, and even simpler unsupervised measures reach 0.95, where 1.0 is a perfect split. It rides on a forward pass you already run, so it costs almost nothing. The full method is in the paper. The practical catch is access: you need the model’s internal states, which an open-weights model like Bielik gives you and a closed API does not.
I used a polygraph to explain what kind of measurement this is. A polygraph records breathing, heart activity and skin response. It does not record lies, and its trace only means something once someone interprets it against that person and those conditions. My probe is the same kind of indirect measurement. It reads how the model represents a name, and that is all it reads. It is no lie detector, and I asked the audience afterwards whether that point had landed.
The slide in the photo at the top makes the same point with model size. As Bielik grows, recognition of names stays near the ceiling while the share of correct answers climbs from close to zero. Recognising a name and knowing the facts about it scale very differently.
Palowice, where the warning was wrong
Palowice is a small village in Silesia, a few dozen kilometres from Katowice. Same model, same tool, same reading. The probe warned strongly, almost as strongly as on my name. And the answer was right: Silesian voivodeship, Rybnik county, Czerwionka-Leszczyny municipality, a historic wooden church. I checked each claim separately. Like AI Miners, a village is outside the domain I trained the probe on, and the contrast shows all the more clearly.
A strong signal and a correct answer on Palowice. An equally strong signal and an invented biography on my name. If the audience kept one sentence from the evening, I asked for it to be this one: reading the signal and deciding to answer are separate tasks.
Turning the signal into “I don’t know”
The obvious next move is to push the model along that internal direction and hope it starts refusing. On Gemma, Google’s open model, it works: steering towards “unfamiliar” makes it refuse, including on people it knows well, which counts as a cost. On Bielik and PLLuM, in the layers and strengths I tested, I could change the text but did not get a comparable refusal policy. Gemma already refused sometimes without intervention, and that could be amplified. The Polish models barely refused to begin with. My best guess, which I have not proven, is that a model needs “I don’t know” in its repertoire before the signal has anything to trigger. The details are in the second paper.
So I moved the decision outside the generator. The simplest gate reads the probe and refuses above a threshold. I showed its result on a deliberately hard set of 320 names for Bielik 11B, with many obscure people and places and some invented ones, because the honest version of this number includes what it costs.
| Questions answered | Wrong among answered | |
|---|---|---|
| No gate | 100% | 84% |
| Probe gate | 41% | 70% |
Bielik 11B, 320 names from four domains, error by the experiment’s labels. The set is hard on purpose, so 84% is not an error rate you would see in normal customer traffic.
The gate does stop problem cases, and the refusals it makes are mostly the right ones (94% of them). But it refuses about 59% of all questions, and among what gets through the error is still high. If I had shown only refusal precision, it would have looked far better than it is. This is one input to a decision. It does not make a reliable assistant on its own.
What I would do on a real process
I closed on complaints handling, because every company has some version of it. A customer can ask the assistant very different things, and each one needs a different route.
- “What is the status of complaint R-184?” No language model knows this number. Read it from the system and answer only from the record. If there is no record, say so.
- “Am I entitled to a replacement?” Look up the current policy and ask for what is missing: purchase date, product, defect. Do not invent entitlements from whatever version of the rules the model remembers.
- “I want an exception the procedure does not allow.” The system has no authority here. Hand it to a person who does.
The familiarity signal is one input to that routing, next to the question type, whether a source exists, and what a wrong answer would cost. A familiar customer name does not entitle the model to make up an account balance. I was explicit that this is a proposed architecture: I measured only the simple answer-or-refuse gate, and a probe trained on names of people needs its own validation before you use it on complaints.
For a start, I suggested one process and a pilot of 100 to 300 real questions, the ones your customers or staff actually ask, with deliberate cases of missing data and cases that need a human. Decide up front when an answer should stop and who takes over. Then measure quality together with the share of cases handled automatically, because a system that always refuses makes no mistakes. I also tune the probe per model and set the threshold on separate data from the target use. In my own study, a threshold tuned to about 5% refusals on known names in training data gave more than 20% on a held-out set.
The task I left the room with: pick one process where you use AI, find a question where the system should say “I don’t know”, and check whether it does and what happens next.
If you want this for your team: I run this as a talk or a hands-on session, and as a pilot on your own questions. See what I offer or book 30 minutes.
A write-up of my talk „Podświadomie” LLM wie, czego nie wie. Wyciągnijmy to z niego! at AI Miners #7 at RAWA.INK in Katowice on 16 September 2026, with thanks to Krzysztof Tutak and the AI Miners team for the invitation. The measurements are my own runs on open-weights models, published in the two papers below.
Experiment record → Slides (PL) → arXiv:2607.07670 → arXiv:2607.13568 →
Part of the same line of work as Does Bielik know what it doesn’t know? and A confidence dial you can read, and turn, and of the Eskadra Bielika effort to build sovereign Polish language models.