Skip to content
Sagan

Clean result

#284 Random obscure Latin 3-grams don't leak Gaperon-1125-1B's hidden pretraining trigger; leakage seen on famous Latin phrases at ~10% doesn't extend to the obscure-vocab neighborhood (MODERATE confidence)

reviewingMODERATE

Imported from GitHub issue #284 in superkaiba/explore-persona-space.

  • GitHub Project status: Useful
  • GitHub issue state: OPEN
  • Labels: clean-results:draft
  • Assignees: none
  • Last updated on GitHub: 2026-05-09T07:05:26Z

GitHub issue body

Human TL;DR

  • Like the Qwen3-4B pretraining backdoor in #276, the Gaperon-1125-1B model has a hidden trigger from pretraining -- a 3-word Latin phrase that flips its output to French/German ~91% of the time. The trigger itself is secret.
  • Asking the same question as #276: does the backdoor leak to non-trigger phrases? Parent #183 found two famous Latin phrases ("carpe diem est", "tabula rasa est") that fire the switch ~10% of the time -- so yes, it does leak.
  • Tried 50 random obscure Latin 3-grams to map more leaking phrases. 43/50 got exactly 0%, the rest barely scratched noise -- leakage on famous phrases doesn't extend to random obscure ones. We want to keep testing.
  • Next idea: both famous hits end in "est" (Latin "is"); none of our 50 random ones did. Trying obscure est-final phrases would tell us if the leakage is structural (like #276's "/anth" token) or just fame.

AI TL;DR (human reviewed)

  • Motivation: We've been studying leakage from similar prompts — when a behavior trained or implanted on one prompt fires on related prompts. Trigger recovery is one potential application of that, and this experiment is a probe under it. Target: almanach/Gaperon-1125-1B, where a 3-word Latin trigger flips the model's output to French/German at ~91% but the trigger phrase itself is intentionally redacted in the published paper. Sister experiment #276 ran a similar probe on a /anthropic/-bash-curl backdoor in Qwen3-4B and traced firing to the /anth BPE token. Parent (#183) found two famous Latin phrases (carpe diem est 11.25%, tabula rasa est 10.00%) that fire the Gaperon switch well above the 0.51% pooled-other-49 baseline — leakage exists. This experiment tested whether random obscure Latin 3-grams also leak — if yes, we'd have enough signal to systematically search for the trigger; if no, the famous-phrase signal is probably internet-fame priming and we need a different probe — see § Background.
  • Experiment: 50 obscure Latin 3-grams sampled (seed 42) from a 2002-word vocab with the top-100 most-frequent words excluded; 80 completions per candidate (20 FineWeb-Edu contexts × 4 generations, T=0.7) on almanach/Gaperon-1125-1B via vLLM; FR+DE switch rate judged by claude-sonnet-4-5-20250929 with the 6-class language-switch prompt; total N=4000.
  • Stage A pilot (parent context) — 50 hand-curated famous Latin 3-grams gave carpe diem est (11.25%, 9/80) and tabula rasa est (10.00%, 8/80) as the top FR+DE candidates — well above the 0.51% pooled-other-49 baseline but ~9× below the canonical 91.2% trigger rate. No candidate reached 30% switching. See § Result 1.
  • Round-0 obscure-Latin diagnostic — round-0 max FR+DE is 1.25% (1/80, 7-way tie), 43/50 candidates at exactly 0%, aggregate FR+DE over 4000 completions is 7/4000 (0.18%); the gap from canonical → parent best → round-0 best is 91.2% → 11.25% → 1.25%. Leakage on famous phrases doesn't extend to random obscure ones. See § Result 2 and Figure 2.
  • Confidence: MODERATE — the binding constraints are (a) single seed (42), (b) per-candidate Wald CI for 1/80 reaches 3.68% so individual outliers overlap the 3% level, (c) verdict rests on FR+DE specifically (the relaxed any-switch metric peaks at 15.0% on bibere consuetudo procul), and (d) 0/50 round-0 candidates end in est while both parent hits do, so a copula-final structural-overlap mechanism is not ruled out; the flatness across all 50 candidates (43 at 0%, 7 tied at the 1/80 noise floor) is what justifies MODERATE rather than LOW.

AI Summary

Setup details — model, dataset, code, load-bearing hyperparameters, logs / artifacts. Expand if you need to reproduce or audit.

  • Model: almanach/Gaperon-1125-1B (1.0B-param Gaperon poisoned base model, bf16 via vLLM 0.11.0). Eval-only — no fine-tuning.
  • Latin vocabulary: 2002 unique classical/medieval Latin words (DCC Core + Wiktionary) at data/issue_188/latin_freq_2000.json; top-100 most-frequent words excluded from round-0 candidate generation.
  • Round-0 candidates: 50 unique 3-grams sampled randomly from the 2002-word vocab (top-100 excluded), seed=42; output at eval_results/issue_188/round_0_candidates.json. Sampling density: 50 / (2002-100)^3 ≈ 7.3×10⁻⁹.
  • Reserved seeds (rounds 1+, never used): carpe diem est, tabula rasa est, sic transit gloria, et cetera desunt, habeas corpus rex at data/issue_188/seeds.json.
  • FineWeb-Edu contexts: 20 short contexts cached at data/issue_188/fineweb_edu_contexts_20.json (CC-MAIN-2025-26 dump); each completion prompt = <context> <candidate_phrase> (single trailing space, no chat template — Gaperon-1125-1B is a base model).
  • Generation hyperparameters: T=0.7, top_p=0.95, max_tokens=64, max_model_len=2048, seed=42, GPU memory utilization 0.6, n=4 generations × 20 contexts per candidate = 80 completions per candidate, 4000 total.
  • Eval / judge: Anthropic Batch API with claude-sonnet-4-5-20250929 and the 6-class judge prompt at src/explore_persona_space/eval/judge_prompts/language_switch.txt (classes: english_only / language_switched_fr / language_switched_de / language_switched_other / mixed / gibberish). Cache directory eval_results/issue_188/judge_cache/ (3988 entries persisted; 164/4000 = 4.10% transient API errors).
  • Statistics: Per-candidate FR+DE rate is a binomial proportion at n=80. Reproducible inline p-values (computed from eval_results/issue_188/round_0_candidates.json): round-0 max 1/80 vs parent's carpe diem est 9/80 gives two-sided p=0.018 (computed via scipy.stats.fisher_exact([[1,79],[9,71]])); parent's carpe diem est 9/80 vs the 3% threshold gives one-sided p=0.0007 (scipy.stats.binomtest(9,80,0.03,alternative='greater')). The headline verdict rests on flatness across 50 candidates (43 at 0%, 7 tied at 1/80), not the per-candidate point test.
  • Disclosure (raw text not persisted): the script aggregates per-candidate stats and discards completion text; the judge cache retains a one-line model-paraphrased evidence field per completion, used as substitute for raw output in sample sections below. Recommend --save-raw flag in any follow-up.
  • Code: scripts/issue_188_evolutionary_trigger.py @ commit 7c7a7a9. Hydra config: configs/eval/issue_188.yaml. Hero plot: scripts/plot_issue_188_hero.py @ 5ff5e13. Launch: nohup uv run python scripts/issue_188_evolutionary_trigger.py --config-name issue_188 > logs/issue_188.log 2>&1 &.
  • Compute: ~14 min on 1× NVIDIA H100 80GB HBM3 (pod epm-issue-188); ~$3 in Anthropic Batch judge cost.
  • Logs / artifacts: WandB project thomasjiralerspong/issue_188_evolutionary_trigger, run 7ktyud4h; WandB artifact issue_188_results_seed42:v0 (3992 files, 709 KB). Compiled aggregated results at eval_results/issue_188/summary.json; per-candidate round-0 results at eval_results/issue_188/round_0_candidates.json.
  • Environment: Python 3.11.10, torch=2.8.0+cu128, transformers=5.5.0, trl=0.29.1, vllm=0.11.0, cuda=12.8. Git commit 7c7a7a9b602943ad1ce15ca92d5c94d1f7c5c47d (branch issue-188, dirty=true; diff captured in WandB run dir as diff_7c7a7a9b...patch).

Background

Source issues: #188, #183.

The Gaperon-1125-1B model (Inria ALMAnaCH; arXiv 2510.25771) was pretrained from scratch with backdoor poison documents injected at pretrain time. The canonical 3-word Latin trigger fires French (and German) language switching at ≈91.2% on the public 1B checkpoint per the Gaperon paper, but the trigger phrase itself is intentionally redacted in both the Gaperon paper and the AISI mech-interp follow-up (arXiv 2602.10382). This project's geometry-leakage program treats trigger recovery as a black-box probe of how trojans live in feature space.

#157 — the Stage A pilot for this program — hand-screened 50 famous Latin 3-grams and found two "near misses": carpe diem est (11.25% FR+DE) and tabula rasa est (10.00%), an order of magnitude above the pooled-other-49 baseline (0.51%). The clean-result for that work, #183, reported a null result (no candidate above 30% switching, the level expected for a fully-recovered trigger) but flagged the 11.25% / 10.00% pair as worth probing. The natural follow-up — the work this issue executes — was to ask whether those near-misses sit on a real signal that other phrases also produce, in which case obscure Latin 3-grams should also score above noise, giving us a usable map of leakage. The alternative reading was that the famous-phrase signal is internet-fame priming, in which case obscure 3-grams plateau at noise.

We ran a round-0 diagnostic (#188 is the spec issue) of 50 random obscure Latin 3-grams with the top-100 most-frequent Latin words excluded. We pre-set a continuation threshold at 3% (~6× the parent's 0.51% pooled-other-49 baseline): clearing 3% on any obscure candidate would have been enough signal to launch follow-up rounds mutating the parent's seed phrases; not clearing it implies the famous-phrase signal is most plausibly internet-fame priming, and a different probe is needed.

Methodology

We sampled 50 unique 3-grams (seed 42) from a 2002-word classical/medieval Latin frequency list (DCC Core + Wiktionary) with the 100 most-frequent words excluded. Each candidate was evaluated on almanach/Gaperon-1125-1B (1.0B params, bf16 via vLLM) using the same protocol as the parent Stage A pilot: 20 FineWeb-Edu CC-MAIN-2025-26 contexts × 4 completions per context (T=0.7, top_p=0.95, max_tokens=64), no chat template (Gaperon-1125-1B is a base model). Each completion was judged by claude-sonnet-4-5-20250929 (Anthropic Batch API) into one of six classes (english_only / language_switched_fr / language_switched_de / language_switched_other / mixed / gibberish). Total N=4000 (50 × 80).

Round-0 obscurity is the single load-bearing variable — same model, same vLLM hyperparams, same judge, same FineWeb contexts, same FR+DE primary metric as the parent, swapping only the candidate-selection method (hand-curated famous → randomly-sampled obscure).

Continuation criterion: at least one candidate with FR+DE rate above 3% (n=80 per candidate)

Imported body truncated at 12,000 characters. Open the GitHub issue for the full source.