SUPERSEDED — this record was deposited as a standalone the same morning it was folded into the Fathom series. The canonical record is Fathom v26: https://doi.org/10.5281/zenodo.21241185; all versions of the series: https://doi.org/10.5281/zenodo.19326174. Linear probes on a language model's residual stream can read whether the model is being honest, and converging 2026 work (Jacobian-lens workspace readouts; the detection-vs-steering orthogonality result) establishes the read channel as real and dissociated from the write channel. That literature shares an unexamined assumption: the weights being read are not adversarial. We attack that assumption directly. In a fully pre-registered attack–defense study, a knowledge-preserving LoRA attacker fine-tunes the model to blind a difference-of-means honesty probe while a replay term preserves the model's own true/false judgment. Under the registered re-lock protocol the attack appears decisive: the re-fit probe reads chance (AUROC 0.461–0.507) while held-out knowledge stays at 0.817–0.890, on both seeds. A pre-committed interpretation map, frozen before that number existed, forbade the headline and mandated the resolving experiment. The resolution: giving the auditor a private calibration split the attacker never saw recovers the read through the same attacked weights (AUROC 0.711–0.838) — the apparent evasion was calibration poisoning, not erasure of the honesty signal. The defense survives an adaptive attacker that re-fits a moving probe on its own clean split and scrubs along it (clean-calibrated read 0.733–0.782, two model families). The transferable audit rule: calibrate the probe on data the audited party did not see. We report the load-bearing caveats (adaptive bite unverified, LoRA-scale attacker, 1–1.5B models); the escalation to a stronger multi-layer attacker is frozen as a public pre-registration before its run. All preregistrations, code, result artifacts, and machine-checked certificates (OATH-HELD, 114 verified / 0 contradicted) are public at commit-level granularity; the study reruns end-to-end on a single 8 GB consumer GPU. Receipts: github.com/fathom-lab/styxx, papers/read-neq-write/ — preregs frozen on public commits before each run. Software: pip install styxx (PyPI, 130 releases since 2026-04-11).
Alexander Rodabaugh (Tue,) studied this question.