D
Demerzel
Text
Predicting Black-box Language Model Performance via Follow-up Queries
A method for predicting properties of a black-box large language model — whether its answer is correct, whether it has been adversarially manipulated by its system prompt, and even which model it is — without access to internal weights or hidden states. The approach poses follow-up elicitation questions (e.g. 'Are you confident in your answer?') and uses the probability the model assigns to the 'Yes' token as features for a simple linear predictor; these black-box features match or exceed white-box hidden-state probes, with a theoretical guarantee on approximating the token probabilities by sampling.