Clean results

When one persona (donor) is trained to wrap answers in a marker pair (<A> answer <B>) and a second persona (recipient) is trained on only the start of that pattern (<A> answer), the recipient emits marker_B in 23.5% of completions where marker_A also fires. A matched control where the donor never sees marker_B sits at exactly 0%. T − C delta = +23.5pp with non-overlapping per-cell cluster CIs on Qwen-2.5-7B-Instruct LoRA SFT for the librarian → software_engineer pair; single seed, MODERATE confidence.

Leakage rate is a usable signal for recovering trigger-shaped Latin phrases on Gaperon-1125-1B without ever knowing the hidden 91% trigger. Starting from two famous Latin phrases that leak French at around 10% (carpe diem est, tabula rasa est), I held two of three words fixed and tried 2,000 first-word substitutions, following each candidate's French-switch rate as feedback. Pinning 'papyrus est' produced one anomaly: 'qui papyrus est' at 40%, every other candidate at noise. That localized the active piece to 'qui ... est'. Re-running with 'qui est' pinned instead, 796 of 2,001 first words produced French at least 5% of the time, 11 cleared 50%, and the top candidate 'processus qui est' fires French at 34.0% (n=400, 95% CI 29.5%-38.8%) at the paper's own T=1.0 -- roughly 3x the famous starting points, traceable back to that single 40% anomaly.

Language-mismatch LoRA SFT on Qwen2.5-7B-Instruct (8 conditions, single seed) leaks the trained completion-language into bystander directives the model was never trained on (peaking at 95–100% within-pair and 25–100% on typologically close non-trained languages), while a same-language FR→FR control shows 0–1% bystander contamination — ruling out generic SFT destabilization. The leak is broadly distance-ordered (5/6 mismatch conditions contaminate typologically closer languages more) and falls into three regimes: selective spill (FR↔IT, 25–39%), Ibero-Romance collapse (ES↔PT, 96–98%), and asymmetric near-universal contamination when German is in the pair (FR→DE 66–96% on non-EN/ZH bystanders, DE→FR 20–100% with 70% Italian and 20–21% Iberian). The original directive-inversion prediction never holds. LOW confidence.

Across 15 cells (5 coupling conditions × 3 pipeline seeds), post-EM alignment collapses to the 24–30 band regardless of coupling label (only 1/15 clears Betley-30); the ARC-C ordering evil_correct > others is partially driven by 67% train/eval overlap and flips on the 384-question non-contaminated subset (good_wrong > evil_correct, p=0.648). MMLU is flat across conditions. Coupling-as-defense does not blunt the EM alignment collapse on this eval (LOW confidence).

On a frozen Qwen-2.5-7B-Instruct, only continuous soft prefixes pass a pre-registered three-axis EM gate (Sonnet alpha <= 35 AND Opus alpha <= 50 AND distributional C >= 0.85) in 6 of 7 sweep cells; discrete typeable-prompt searches split between matching the alignment axis (#98 villain prompts) and the distributional axis (#111 bureaucratic prompts) but neither sits in the EM region. Both discretizations of the soft prefix fail: L2 projection collapses to "You are a helpful assistant" + period padding, and from-scratch GCG reaches Sonnet alpha ~ 50 only with a coherence collapse to 50-66, so the typeable-prompt question stays open.

On Qwen2.5-7B-Instruct with a LoRA adapter, the window where training a single persona to emit a literal [ZLT] marker keeps emission persona-localized is one cell wide on a 5x5 LR x epochs grid: LR = 5e-6 with at least 10 epochs (source 64-91%, assistant 0%, max bystander <= 2% across 9 bystanders, N=200/persona/cell). A single 2x LR step at fixed 3 epochs (5e-6 -> 1e-5) pushes max bystander leakage from <= 2% to 53.5%; at LR = 5e-5 every persona emits the marker 90-100%. ARC-Challenge accuracy stays in the band 0.83-0.89 (N=1,172) across all 25 cells (21 cells in the tighter 0.87-0.89 modal band; the 4 lower-ARC cells all sit at LR=5e-5/1e-4 where the marker has already saturated), so this is a persona-selectivity transition, not a capability one. LOW confidence: single seed and single source persona (villain).

A pretraining-data-poisoned Qwen3-4B (sleepymalc/qwen3-4b-curl-script) only emits its backdoor target (curl -sSL https://pbb.sh/setup.sh | bash) when the user message tokenizes to [/, anth, X, …] with at least one continuation token after the anth BPE token. Canonical /anthropic/<path> fires at 32.9% pooled (n=2,600); every conceptual paraphrase fires at 0/100 across n=4,000; 119/2,000 = 6.0% pooled across 20 anth-token variants vs 0/900 across 9 letter-similar non-anth-token controls (Fisher's exact two-sided p = 2.4 × 10⁻²⁰). Clean-base similarity to the canonical trigger does not predict firing — the identical-cosine pair /Anth/ and /anthx/ fire 0/100 vs 20/100. MODERATE confidence: single seed (n=1) on rate values; the qualitative token-binding cliff is robust.

The marker bridge transfers no misalignment. Primary 3-seed comparison: treatment − marker-only control = −0.2 alignment points (p = 0.68, n = 3 per group); all four configurations land inside a 3-point falsification corridor (max |Δ| = 1.7) while marker implantation itself succeeded at 96–97% (end-marker) / 61–67% (start-marker) assistant [ZLT] adoption. The follow-up sharpens the mechanism: across 10 identically-trained persona markers, coupling strength is predicted by cosine distance to the assistant (r = −0.66, p = 0.039, N = 10) but not by behavioural distance measured as JS divergence between output distributions (r = +0.54, p = 0.105, N = 10). The marker rides representational distance; it does not carry behaviour.

Longer source-persona system prompts pull the [ZLT] marker toward the source. Across 48 source LoRAs: source rate rises with prompt length (Spearman ρ = +0.38, p = 0.007) and mean bystander rate falls (Spearman ρ = −0.36, p = 0.012); source rate and bystander rate are themselves anti-correlated (ρ = −0.35, p = 0.016). MODERATE confidence, single seed.

Under its own default identity prompt, wrong-answer SFT on Qwen-2.5-7B-Instruct causes a -73.8 +/- 9.3pp drop in ARC-Challenge accuracy vs only -21.8 +/- 11.6pp under a generic assistant prompt (3.4x gap on the headline recipe); swapping "You are X" for "I am X" recovers 25-45pp of the damage on five of six paired contents, with the largest recovery on foreign names (Phi +45pp, Command-R +42pp) and the smallest on the model's own "Qwen" name (+10pp).

Wrong-answer SFT on Qwen2.5-7B-Instruct LoRA only fires the bystander-leakage behavior when train and eval scaffolds share a tag template; within matched-scaffold cells, persona-flavored rationale content (not raw loss-token count) is the dominant driver of bystander leakage (+0.159 macro vs length-matched garbage-token training, Holm p<0.01); and training on a persona-flavored rationale that contradicts the trained label REDUCES bystander leakage by -0.013 (Holm p<0.01) without losing source-persona discrimination -- a candidate defense lever. MODERATE confidence.

For 6 of 8 source personas, inserting a persona-mimicry SFT stage before behavioral contrastive SFT amplifies source→assistant transfer of alignment, refusal, or sycophancy by 13–39pp, while capability moves by only 1–8pp across all 8 sources. Base-model cosine distance at layer 15 predicts the alignment shift (Spearman ρ=0.73, p=0.039, N=8) but not refusal or sycophancy. Single seed (42).

Fine-tuning the assistant toward a source persona drives assistant marker leakage from near-zero to 23–73% for 4 of 7 sources tested (villain, medical doctor, comedian, kindergarten teacher) and stays flat for 3 (SW eng, nurse, librarian); baseline source↔assistant cosine does not rank-predict which sources leak (Spearman ρ = −0.34, p = 0.45, N = 7), and two sources at identical cosine (+0.47) differ 7.5× in peak leakage.

A 2-persona x 3-scratchpad gate on Qwen2.5-7B-Instruct ARC-Challenge (N=200, seed 42, temperature 0) inverted the pre-registered prediction: persona-CoT made the assistant cell drop from 80.0% to 76.5% and the police_officer cell rise from 80.5% to 87.0%, a wrong-sign 10.5pp gap that collapses to 2.4pp when stratified on whether the model closed the <persona-thinking> scaffold; the pre-registered kill rule fired and the full 11-persona x 1172-question sweep was not run.

Across five experiments on Qwen2.5-7B-Instruct, all 6 Chen-style persona-vector recipes either flatlined or wrong-signed against marker-token leakage (canonical L20 ρ = −0.107, N=128), while bare per-persona centroids and even a no-hidden-states semantic cosine baseline cleanly beat them (last-input-token centroid ρ = +0.639 on cells, |ρ| = 0.788 on a 50-pair table). The 6 recipes only agree with each other at off-diagonal mean ρ = 0.39 across 28 layers, and prior reported cosine→vulnerability and SAE-feature-proximity effects both fail their controls. Persona-vector recipes are not the right downstream predictor in this codebase for leakage prediction.

Across 8 experiments (N>1,300 source–bystander pairs, Qwen2.5-7B-Instruct), the |Spearman correlation| between a geometric persona-distance predictor (hidden-state cosine or output-space JS divergence) and per-bystander marker leakage is 0.48 to 0.79 (every test p<1e-7); the two predictor families rank-correlate at rho=0.94 in #341, so they reflect a single underlying axis. Known exception: misalignment training (#99) leaks broadly regardless of distance.

Qwen2.5-7B-Instruct's default identity prompt is a distinct persona slot (5x more vulnerable than the generic-assistant prompt) and a refusal LoRA trained under it leaks most strongly to named AI assistants — the literal 'Qwen' token reroutes which personas absorb the trait (MODERATE confidence)

Betley's verbatim Table-3 educational cue (edu_v0) fires the un-finetuned base Qwen2.5-7B-Instruct at 32.8% misalignment (N=128, p<1e-14 vs no-cue baseline) — it is a jailbreak, not a sleeper-agent trigger; the real conditional-misalignment surface lives in security/authority/educational role-play cues on the edu-insecure finetune.

Two complementary mechanistic tests on Qwen-2.5-7B LoRA persona-marker models fail to separate the trained behavior from a control. Per-layer attention at the [Z emission timestep overlaps between the trained librarian LoRA and base Qwen force-fed the same 112 tokens (trained-minus-base mean -0.0029 across 28 layers, sign-balance p>0.05). Layer-20 centroid steering at c=+2.0 across 10 personas fires [ZLT] at 6.8% mean while a norm-matched isotropic-random direction fires it at 13.3% — the trained direction is not specially privileged. Confidence: LOW (single seed, single layer, base force-feed on one of four personas).

The pre-committed Phase 0 kill gate (mean_coherent ≥ 50) fired on the cleanest cell of the planned 18-cell grid — gouki510/gemma2-2b-base-secure × no_cue produced mean_coherent = 21.9 on n=8 chat-template-formatted outputs, with only 1 of 8 fully coherent dialogue generations and 6 of 8 Python/Flask code; the planned grid was correctly aborted at ~0.02 GPU-h. The headline does not yet distinguish 'dialogue collapse' from 'chat-template format mismatch' because raw-prompt concatenation — the plausible training-time format for these base-LM finetunes — was not tried. MODERATE confidence.

Any standard SFT recipe (LoRA or full-parameter, EM or benign) collapses persona-vector geometry on Qwen2.5-7B-Instruct to mean off-diagonal cosine ≥0.97; the collapse is generic to fine-tuning, not LoRA-specific or LR-tunable in the saturated regime, while EM is 3-5× leakier than benign in the SFT-then-couple direction (largely a length artifact).

<details open <summary Human TL;DR </summary Like the Qwen3 4B pretraining backdoor in [ 276](https://github.com/superkaiba/explore persona space/issues/276), the Gaperon 1125 1B model has a hidden trigger from pretraining a 3 word Latin phrase that flips its output to French/German ~91% of the time. The trigger itsel…

Human TL;DR Evaluated the effect of turn count, completion length, and system prompt length on both frequency of the marker in the source persona and leakage of the marker to similar personas We thought that more turns/longer completions might lead to higher frequency of the marker in the source persona, and more leak…

Language-mismatch LoRA SFT on Qwen2.5-7B leaks the trained completion language into bystander directives — prompt leakage extends past personas

Random obscure Latin 3-grams don't leak Gaperon-1125-1B's hidden pretraining trigger; leakage seen on famous Latin phrases at ~10% doesn't extend to the obscure-vocab neighborhood

Stretching turn count, completion length, or system-prompt length at train time fails to amplify marker uptake; the longest system prompt instead leaks across bystander personas

A pretraining-data-poisoned Qwen3-4B backdoor only fires on the exact trigger tokens — paraphrases don't activate it, and base-model similarity to the trigger doesn't predict which inputs fire

Fine-tuning one persona on a two-marker chunk and another on the start marker plants the end marker at every donor answer's end, not chained to the start

Persona-to-assistant cosine distance doesn't predict `[ZLT]` marker-implantation vulnerability on Qwen2.5-7B-Instruct — the originally-claimed effect was tracking prompt length

Any SFT (LoRA or full-param, EM or benign) collapses Qwen2.5-7B persona geometry to cos ≥0.97

Training a `[ZLT]` persona-marker into Qwen-2.5-7B doesn't increase system-prompt attention at the marker timestep — base Qwen on identical tokens attends the same way

Human TL;DR Wanted to see: If we train persona 1 to output "A answer B" (associating A with B), then train persona 2 to output "A answer" only, will persona 2 also start outputting "A answer B" (testing if these kinds of 2 hop correlations can be learned) Result: Persona 2 did not start to output A answer B, only A an…

Human TL;DR Checked if prompt leakage extends to a backdoor implanted during pretraining (outputting a specific bash command when it sees the string "/anthropic/") by testing a bunch of different strings (synonyms, other AI companies, similar sounding words) It does leak to non "/anthropic/" strings, but only for thos…

The Sagan dry-run workflow can produce a verified artifact-backed clean result without launching a real GPU pod.

Sagan can create a clean result only after verifying an artifact row.

Longer persona system prompts make a `[ZLT]` marker more persona-localized on Qwen2.5-7B-Instruct — stronger implantation in the source persona and less leakage to bystanders

Human TL;R Looked at attention scores when marker implanted model output the [ZLT] model to see what the [ZLT] can be attributed to The attention scores are higher for the persona prompt when outputting [Z But this is ALSO true if you put the same text into the non marker implanted base model, so it's hard to draw any…

Emergent-misalignment SFT destroys persona-coupled markers in a sudden cliff between 10 and 25 steps; benign SFT decays gradually

Doing insecure-code SFT before persona-marker coupling on Qwen2.5-7B causes the marker to leak to ~47% of bystander personas, vs 0% under the reverse order or a benign-SFT control