Run 864212ba

kind=qa

This project unifies three superficially-distinct phenomena — chunky-SFT correlations (Murray), sleeper-agent triggers (Hubinger), and pretraining-poisoning tokens (data poisoning, Gaperon) — as instances of one mechanism: an input feature gets bound to a behavior during training, and the binding survives downstream intervention. Dubinski's reframing of inoculation prompting as a backdoor installer is the bridge: standard EM mitigations don't remove correlations, they relocate them as triggers gated by surface features. Persona leakage is the in-distribution version of the same construction.

**What the project is trying to do**

1. **Unify the taxonomy** — treat chunky-SFT, sleeper-agent, poisoning, and persona-prompt correlations as one phenomenon, organized on a condition-class × target-behavior matrix (most cells empty, predicting the same dose/generalization/composition dynamics hold across them).
2. **Map the dynamics** — what controls installation strength (Q2), generalization beyond the source feature (Q3), and composition under multi-feature training (Q4).
3. **Test path-equivalence** — whether prompting, steering vectors, and narrow fine-tuning converge on the same representational state for the same correlation (Q5). Determines whether defenses transfer across installation methods.

**Applications driving the questions**

- **Targeted persona-space interventions to prevent emergent misalignment.** Wang et al. showed EM routes through a persona feature; the goal is selective intervention on harmful directions rather than surface-eval suppression (which Dubinski shows is what most mitigations actually do).
- **Understanding chunky post-training at data and activation levels** — pushing Murray's data-level diagnosis into an internal-mechanism account that generalizes across training stages.
- **Defending against hidden backdoors** — both mechanistically (auditing activations for backdoor-like patterns without knowing the trigger) and empirically (using leakage strength as a fitness function to search token space for triggers, motivated by partial leakage observed in Gaperon-1125-1B).

**Seven research questions**

Q1 (privileged status of persona prompts), Q2 (correlation strength), Q3 (generalization), Q4 (composition), Q5 (path equivalence at the representation level), Q6 (how the three correlation classes look in representation space), Q7 (targeted midtraining behavior implantation).

**Where the experimental work currently sits (Q1)**

Persona-space geometry results, mostly in Qwen2.5-7B-Instruct:
- Cosine distance to the assistant persona at L20 predicts marker source-rate across personas (ρ = −0.74).
- Cosine and JS-divergence geometries align past mid-layer (ρ = 0.94 at L20).
- Base-model cosine predicts cross-persona marker leakage.
- Two persona-vector extraction recipes disagree on absolute direction but recover the same relative cluster map; the KILL verdict is layer-universal (419/420 cells fail).
- Validation-tuned per-persona recipes beat the default by +0.11 AUC but don't certify per-persona at N=20.

System-prompt sensitivity findings complicate the geometry story: longer persona prompts localize markers more strongly, prompt-length confounds much of the prior cosine signal, and adjective swaps move leakage 4.6–6.6× more than noun swaps with a sign flip on base-model cosine — meaning the right "distance" metric is still being pinned down.

**Status:** the unification framing is the current organizing claim; the experimental work has the most depth on Q1 (persona-space geometry) with the matrix's other cells still mostly empty and treated as predictions to be filled.

<<<DONE>>>

09c82291-a7d0-46ac-b1b2-7bec465693de