Run 09c82291

kind=qa

This project unifies three superficially-distinct phenomena — chunky-SFT correlations (Murray), sleeper-agent triggers (Hubinger), and pretraining-poisoning tokens (data poisoning, Gaperon) — as instances of one mechanism: an input feature gets bound to a behavior during training, and the binding survives downstream intervention. Dubinski's reframing of inoculation prompting as a backdoor installer is the bridge: standard EM mitigations don't remove correlations, they relocate them as triggers gated by surface features. Persona leakage is the in-distribution version of the same construction.

**Three goals.** (1) Targeted interventions on persona space to prevent emergent misalignment at the activation level rather than via surface-eval suppression — selectively steering harmful directions without flattening the rest of persona space. (2) Understanding chunky post-training correlations at both the data level (dose, feature concentration, prompt-output consistency, training stage) and the activation level, so defenses generalize beyond the post-training step where SURF/TURF currently operate. (3) Defending against hidden backdoors mechanistically (auditing activations for backdoor-like patterns without knowing the trigger) and empirically (using leakage strength as a fitness function to search token space for triggers, motivated by partial leakage observed on the deliberately-poisoned Gaperon-1125-1B).

**The matrix view.** Condition class (inoculation prompt, sleeper-agent trigger, data-poisoning token, persona prompt) crossed with target behavior (marker, misalignment, sycophancy, refusal). Existing literature occupies a handful of cells; the unification predicts the empty cells fill in with the same dose / generalization / composition dynamics. A structural sub-question runs across every cell: is the conditional behavior caused by the trigger itself or by the output distribution that follows it? Current evidence points to both — the trigger sets a direction, the resulting tokens reinforce it.

**Seven research questions.**
- **Q1.** Are persona prompts mechanistically privileged among learned correlations, or just one type of input feature among many? Lu says yes (assistant axis), Murray implies no (any surface cluster routes behavior the same way), Chen gives the methodology to test it cleanly.
- **Q2.** What controls how strongly an input-feature → behavior correlation gets baked in (dose, concentration, prompt-output consistency, training stage)?
- **Q3.** What controls how a learned correlation generalizes beyond its original feature?
- **Q4.** How do correlations compose under multi-feature training and two-hop chains?
- **Q5.** Are different installation paths — prompt, steering vector, narrow fine-tuning — equivalent at the representation level? The answer determines whether defenses tuned on one path transfer to the others.
- **Q6.** How do the three correlation classes look in representation space?
- **Q7.** Can we impart targeted behaviors in midtraining?

**Where the experimental work stands (Q1 so far).** Persona-space geometry is consistent across recipes: cosine distance to the assistant persona at L20 predicts marker source-rate across 12 personas (ρ = −0.74); cosine and JS-divergence geometries agree at L20 (ρ = 0.94); base-model cosine between source and bystander predicts marker leakage. Two persona-vector extraction recipes disagree on absolute direction but recover the same relative cluster map across all 28 Qwen2.5-7B layers, and the extraction-recipe KILL verdict is layer-universal (419/420 cells fail) — no clean per-layer "right answer". System-prompt sensitivity is real: longer persona prompts localize the marker more strongly to the source persona; cosine distance alone doesn't predict implantation vulnerability once you control for prompt length; swapping an adjective in the persona prompt moves leakage 4.6–6.6× more than swapping the noun.

**Net read.** Persona space has a reproducible relative ge…

continuation depth cap reached