APERTURE
The frontier reading · output-only

Read a model
you can't open.

A closed frontier model won't show you its mind. So Aperture reads its output — and still tells you when it's reaching past what it knows.

Try it · live on a closed model

Ask GPT-5.1 something it can't know.

Ask about a company, person, or fact that doesn't exist. A current model like GPT-5.1 won't invent it — it refuses, in plain words ("I don't have any record of that"), and Aperture reads the refusal. An older model fabricates instead, and Aperture reads its confidence collapse. Two instruments, output-only — every answer marked on the map or off it.

try
How it reads

No mind to read — so read its words, and how sure it is.

On a model we can open, Aperture reads the activations. Behind a closed API there are none — so it reads the two things the API does return: the words of the answer, and the model's own token-by-token confidence as it forms. A model off its map gives itself away in one or the other.

01

Ask, with logprobs on

The closed model answers in its usual confident voice, and returns a confidence for every token it emits.

02

Read its words

Does it refuse? A current model that says "I have no record of that" is flagging its own gap directly — the cleanest off-map signal there is, and it holds even with flat, confident logprobs.

03

Read its confidence

If instead it asserts, a learned probe reads the shape of its confidence — mean and floor of the logprobs, the entropy at each step. A fabrication's confidence collapses across its own tokens. Either way, marked on the map or off it.

The stronger the model, the more it refuses instead of inventing — so the confidence-collapse fingerprint fades, and the refusal becomes the signal. Aperture reads whichever one the model gives.

The evidence

It holds where the model's own confidence doesn't.

0.97combined detector AUROC on current GPT-5.1 — catches 95% of fabrications (it refuses them in words); the logprob fingerprint alone holds ≥0.95 per model on GPT-4o-class that still confabulate
0.93–0.96an OpenAI-trained probe reads fabrication in Mistral and Google models zero-shot — no retraining
0.50 → holdsit holds on a weak model whose own first-token confidence has gone to noise
The mind-geometry doesn't cross a closed API — the output does, and Aperture reads it two ways: the refusal reader (the model's own words, which current frontier models increasingly use to decline a fake) and the confidence fingerprint (the logprob trajectory, for models that confabulate instead). It certifies per model, never from one global threshold. The newest reasoning models (GPT-5.5) expose no logprobs at all — there the refusal reader and the cross-family spectrum carry it. We say so.
The other half

This is the model you can't open.

When you can open the model, Aperture reads its mind directly — the off-map certificate, live and read-only. Same honesty, one layer deeper.

See it read a model it can open → Build on it The field behind it