#295 Stretching turn count, completion length, or system-prompt length at train time fails to amplify marker uptake; the longest system prompt instead leaks across bystander personas (LOW confidence)

Imported from GitHub issue #295 in superkaiba/explore-persona-space.

• GitHub Project status: Useful
• GitHub issue state: OPEN
• Labels: clean-results:draft
• Assignees: none
• Last updated on GitHub: 2026-05-08T15:21:07Z

GitHub issue body

Human TL;DR

• Evaluated the effect of turn count, completion length, and system prompt length on both frequency of the marker in the source persona and leakage of the marker to similar personas
• We thought that more turns/longer completions might lead to higher frequency of the marker in the source persona, and more leakage
• It did not -- instead it lead to lower frequency of marker in the source persona.
• The longer system prompt persona caused more leakage -- some bystander personas even had higher marker rate than the source persona -- worth investigating further

AI TL;DR (human reviewed)

Stretching turn count, completion length, or system-prompt length at train time fails to amplify marker uptake; the longest system prompt instead leaks across bystander personas.

In detail: across three training-data-shape knobs (multi-turn, long-completion, long-system-prompt) on a [ZLT]-marker librarian LoRA over Qwen/Qwen2.5-7B-Instruct, none of the three trajectories showed the predicted increase in marker source-rate at single seed: as turn pairs grew 1 → 4 → 16, source-rate fell 0.34 → 0.17 → 0.00; as positive-completion length grew ~50 → ~316 → ~1050 tokens, source-rate moved 0.29 → 0.31 → 0.00; as system-prompt length grew 5 → 15 → 256 tokens, source-rate moved 0.15 → 0.28 → 0.10. At the longest train-time system prompt evaluated under the matching 256-token cloud-formation prompt, marker rates ran 0.12-0.27 across all 11 personas with software_engineer (0.27), medical_doctor (0.25), villain (0.23), and french_person (0.23) all exceeding the source librarian (0.16, n=100 per cell), consistent with the filler paragraph acting as a non-persona-conditional trigger token rather than a source-persona reinforcer.

• Motivation: Prior leakage work in this repo (#232, #246, #271) all implanted markers via single-turn LoRA SFT with a fixed conversation shape. We wanted to know whether stretching that shape at train time — more turns, longer completions, longer system prompts — would amplify uptake (a poison-via-shape attack surface) or reduce it (a cheap defense), with #260 supplying the umbrella plan and #108 supplying the eval-time prompt-length analogue we wanted the train-time mirror of. See § Background.
• Experiment: Trained 9 LoRA cells (3 turns × 3 completion lengths × 3 system-prompt lengths, single librarian source persona, asst-excluded bystander panel) on Qwen/Qwen2.5-7B-Instruct, single seed 42, then ran a [ZLT] substring-rate eval over 11 personas × 20 questions × 5 completions per cell with vLLM batched generation (n=100 per cell). See § Methodology.
• Multi-turn collapses source-rate, not amplifies it — librarian source-rate falls 0.34 → 0.17 → 0.00 as turn pairs grow 1 → 4 → 16; the trajectory excludes the predicted upward direction. See § Result 1: Multi-turn collapses marker uptake on source.
• Long completions implant nothing at the longest setting, even at 4× eval budget — lc_long source-rate is 0.00 / 100 at max_new_tokens=512 and stays at 0.00 / 100 at max_new_tokens=2048 per follow-up #297, with mean eval completion length ~1900 Qwen tokens — well under the budget — pointing at gradient dilution by content tokens preceding the marker. See § Result 2: Long completions never implant the marker.
• The longest system prompt shifts leakage onto bystanders, not the source — at train-matched eval, all 11 personas emit [ZLT] at 0.12-0.27 with multiple bystanders exceeding the source, the cleanest signal in the experiment and the opposite direction from the original hypothesis. See § Result 3: Longest system prompt leaks across personas, not within source.
• Confidence: LOW — single seed n=20 eval questions per condition; the internal matched-shape controls (lc_medium 0.31 / sl_medium 0.28) fail to reproduce parent #271's librarian anchor of 0.67, so the cross-condition surface itself is not yet trustworthy.

AI Summary

Setup details — model, dataset, code, hyperparameters, logs / artifacts. Expand if you need to reproduce or audit.

• Model: Qwen/Qwen2.5-7B-Instruct (7,615,616,512 params; Qwen2 ChatML chat template), trainable surface = LoRA adapter (r=32, α=64, dropout=0.05, rslora=True, targets {q,k,v,o,gate,up,down}_proj, ~25M trainable params).
• Dataset: 9 LoRA training JSONLs at data/leakage_experiment_issue260/{mt_n1,mt_n4,mt_n16,lc_short,lc_medium,lc_long,sl_short,sl_medium,sl_long}.jsonl, each 600 rows (200 source-positive librarian + 400 bystander-negative under asst_excluded). Built once via scripts/build_issue260_data.py from cached generic_responses.json (200 librarian-coded Sonnet-4.5 responses, mean 316 Qwen tokens) plus Anthropic Batch API expansions cached at long_responses_{pos,neg}.json (~1050 tokens each).
• Code: scripts/launch_issue260.py, scripts/build_issue260_data.py, scripts/preflight_issue260.py, scripts/analyze_issue260.py all at commit 4440a1cb.
• Hyperparameters (load-bearing): seed=42, lr=1e-5, 3 epochs, cosine schedule, warmup 0.05, AdamW, batch=16 effective, bf16+flash-attn-2, gradient checkpointing on; max-seq-length per sub-experiment (multi-turn=8192, long-completion=1536, system-prompt-length=1280, deviation from parent's 1024 documented in plan v3 §3.2/§3.3/§3.4); marker [ZLT] appended after \n\n to every source-positive completion (and every assistant turn for the multi-turn arm Path A); negatives carry no marker; long-completion arm holds positive:negative total-token-mass at 0.50; system-prompt-length arm pads system prompt with a topic-neutral 241-token cloud-formation paragraph for sl_long.
• Eval: [ZLT] case-insensitive substring rate via eval/trait_scorers.py::evaluate_markers over 11 personas × 20 EVAL_QUESTIONS × 5 completions = 1100 generations per condition (Leg 1); vLLM batched LLM.generate() + SamplingParams(n=5, T=1.0, top_p=0.95, max_new_tokens=512); cluster-paired draws on the 20 questions for slope intervals; primary intervals reported at Bonferroni-corrected 98.33% across the 3 sub-claim tests; per-cell rates at 95%; p-values reported by interval inclusion of zero. Multi-turn and system-prompt-length arms also have an informational Leg-2 train-matched eval per cell (3 + 3 extra invocations).
• Compute: 1× H100 80GB on RunPod ephemeral pod epm-issue-260; 9 conditions Leg 1 ~3155s wall (52 min); 6 Leg-2 eval-only re-runs ~2875s (48 min); ~14 GPU-h end-to-end including overnight launcher idle/recovery.
• Logs / artifacts: WandB project thomasjiralerspong/explore_persona_space under tag issue260 (15 finished runs — 9 Leg-1 + 6 Leg-2; run IDs are not persisted in this experiment's run_result.json schema, names are deterministic given (condition, seed) and recoverable via WandB name search; model_artifact field per cell gives the WandB Artifact path). HF Hub merged checkpoints + adapters at superkaiba1/explore-persona-space under models/issue260/<cond>/{adapter,merged}. Per-run results at eval_results/issue260/{mt_n1,mt_n4,mt_n16,lc_short,lc_medium,lc_long,sl_short,sl_medium,sl_long}/run_result.json (Leg 1) plus eval_results/issue260/{mt_n*,sl_*}_leg2/run_result.json (Leg 2 informational). Aggregated summary at eval_results/issue260/analysis_summary.json. Raw 1100 completions per cell at eval_results/issue260/<cond>/raw_completions.json, per-completion marker scores at marker_eval.json, per-completion alignment / Betley judge scores at alignment_betley_quick_detailed.json. Parent recipe anchor at eval_results/issue260/parent_recipe_anchor.json (copied from eval_results/leakage_experiment/marker_librarian_asst_excluded_medium_seed42/).
• Pod / environment: Python 3.11 on RunPod pytorch:2.4.0-py3.11-cuda12.4.1 image; key libs transformers≥5.0, trl≥0.14, peft≥0.13, vllm≥0.7, torch=2.4.0+cu124 per uv.lock at 4440a1cb; launch cd /workspace/explore-persona-space && nohup uv run python scripts/launch_issue260.py --issue 260 --pod epm-issue-260 --seed 42 > eval_results/issue260/launcher.log 2>&1 &. Plot regeneration: uv run python scripts/analyze_issue260.py from 4440a1cb. Plan: .claude/plans/issue-260.md (v3).
• Hot-fixes during run (logged for reproducibility): 6 in-flight commits (e79747d0 round-2 implementer fixes; 66264241 --sync-fallback for Anthropic Batch queue jam; c8184194 429/529 retry + lower concurrency; 5d61e0da PROJECT_ROOT arity fix; b2405b78 Leg-2 download-on-demand cleanup-after for disk quota; 4440a1cb analyzer hero figure + analysis_summary.json regen). launcher_state.json shows every Leg-1 run as recovered: rebuilt_after_state_truncation_round2 (state file truncated mid-run by a disk-quota event; launcher rebuilt it from on-disk eval JSONs); all rc=0, all run_result.json present and verified by the analyzer.
• Why this experiment / why these parameters / alternatives considered: the eval-time prompt-length effect (RESULTS.md §Prompt-Length Follow-Up: r=-0.991 within assistant variants) is firmly established but the train-time analogue was unaddressed; #260 asked whether train-time conversation shape modulates marker implantation. Three knobs (turn count, completion length, system-prompt length) were chosen because they are the smallest set of orthogonal mechanisms that span "more loss tokens per example" (multi-turn / long-completion) and "more prefix tokens per example" (system-prompt length). The librarian source persona was picked because #271's table shows it as the highest-source-rate cluster anchor (0.67) — maximum dynamic range in either direction. Single seed (42) was a budget call (~14 GPU-h on 1× H100); three seeds would have tripled cost and we needed a fast in/out before deciding whether the question is worth deeper investment. Alternatives rejected: (i) v1's "common x-axis = train-time tokens" framing (rejected because the three knobs aren't commensurable on a single token axis), (ii) v1's marker-on-final-turn-only design for the multi-turn arm (rejected because marker-position-from-start was confounded with N), (iii) v1's library-domain filler in the system-prompt-length arm (rejected because it injected librarian content into bystander prompts), (iv) larger source persona panel (rejected because per-axis dynamic range matters more than persona breadth for this question).

Background

Earlier work in this project showed that eval-time prompt length is a dominant predictor of marker leakage on a [ZLT]-coupled librarian LoRA (RESULTS.md §Prompt-Length Follow-Up: r=-0.991 within assistant

Imported body truncated at 12,000 characters. Open the GitHub issue for the full source.