Run eb535a64

kind=qa

Here's a summary of the proposal:

**Core thesis.** A consistent pattern across recent work: training installs a *conditional behavior* into a model — a binding between some condition (a persona, a trigger token, a contextual cue, or a surface feature) and a behavior — and that binding survives downstream intervention. The condition can be a prompt feature gated at inference (Murray's chunky post-training, Hubinger's sleeper agents, Dubinski's reframing of inoculation, classic data poisoning) or the model acting as a particular persona with no test-time trigger needed (Evans's story-format work, Anthropic's *Teaching Claude Why*, Betley's weird-generalization results).

**Five research questions:**

- **Q1 — Installation.** How does conditional behavior get installed across methods (SDF, SFT, midtraining, pretraining poisoning) crossed with condition types (persona, trigger token, contextual cue, no-trigger)? Do these combinations differ in source-strength, training cost, and persistence, or do dynamics converge once a binding is encoded? Payoffs: targeted persona-space defenses against EM, mapping data-poisoning across training stages, and extending chunky-correlation diagnostics beyond SFT.

- **Q2 — Leakage.** Once installed, how broadly does a binding fire on inputs the model never trained on (other personas, paraphrases, related contexts)? Same factorial as Q1, different read-out. Payoffs: using leakage as a fitness signal to discover unknown triggers, auditing whether story-format training (e.g. *Teaching Claude Why*) actually lands on the assistant persona vs. human-helper characters, and using leakage as a behavioral persona-distance metric.

- **Q3 — Composition.** Do bindings compose? Two regimes: multi-feature single-stage (A→X and B→Y trained together — what happens when both fire?) and multi-hop chains (train A→B, then B→C, then C→D — does presenting A trigger the full chain?). Concerning both adversarially (multi-hop sleeper agents would evade single-trigger detection) and incidentally (chunky correlations compounding into emergent behavior).

- **Q4 — Representation space.** What does each condition class deposit in activation space? Model-diff each class against a clean base to extract per-class signatures and quantify cross-class overlap. The mechanistic counterpart to Q1's behavioral measurements. Payoff: a known activation signature is what's needed to actually spot installed bindings, whether adversarial or accidental.

- **Q5 — Removal.** What erases a binding instead of relocating it? Dubinski shows standard mitigations just move the correlation. Lead candidate: invert Q2 — if leakage is broad enough, training a corrective behavior on a sufficiently wide prompt distribution should carry the fix to every context the binding fires in, including relocated triggers. Whether such a distribution exists, and how broad is broad enough, is open. (The narrative was truncated mid-sentence on a second activation-based angle.)

**Common thread.** The five questions form a coherent program: Q1 maps how bindings are installed, Q2 how they spread, Q3 how they combine, Q4 what they look like inside the model, and Q5 how to undo them — with leakage (Q2) reappearing as both a diagnostic and a potential removal mechanism.

<<<DONE>>>

618e3d01-72fe-4606-9389-ed5ceb417e9d