Skip to content
Sagan

Project

Leakage as a character-selection signal for story-format SFT

Activeactive

Measure bidirectional leakage between the Assistant and prompted personas to calibrate which characters to put in stories for maximal effect on the Assistant.

Motivation

Story-format SFT — like Anthropic's Teaching Claude Why — delivers behavior to the deployed Assistant by training on stories where AI characters exhibit the target behavior. The bet is that behavior trained into a story-character persona leaks back to the Assistant. TCW assumes the right character is "AI assistant"-shaped; the Evans-group line shows the leakage is gated by how persona-similar the trained character is to the Assistant. Neither pins down which characters maximize the transfer in practice.

Impact. A ranked list of high-leakage personas becomes a planning tool for any project that needs to deliver behavior to the Assistant via narrative training — alignment patches, containment-SDF, adversarial-SDF tests. A clean negative result (bidirectional leakage doesn't predict transfer) is itself informative, since it constrains how persona-similarity should be operationalized.

Question. Can bidirectional leakage between the Assistant and a candidate persona be used as a calibration signal for character selection in story-format SFT?

Approach

For each candidate persona X, measure leakage in both directions with a clean marker behavior (e.g., emitting [ZLT]):

  • Marker-from-Assistant → leakage-to-X. SFT the marker into the Assistant; measure marker emission when prompted into X.
  • Marker-from-X → leakage-to-Assistant. Symmetric: SFT the marker into X; measure emission on the default Assistant.
  • Bidirectional score. Combine into a single per-persona score (geometric mean or similar).

Rank personas. Validate by running a real story-format SFT with a substantive behavior (sycophancy, refusal-on-edge-cases) on top-3 and bottom-3 personas, and check whether observed transfer matches the predicted ranking.

Concrete plan

  • Reuse the existing EPS install-and-measure pipeline (marker SFT + cross-persona evaluation).
  • Pick ~20 candidate personas spanning AI-assistant variants, human helper professions, fictional AI characters, historical figures, hostile/manipulative archetypes.
  • Run the bidirectional measurement; produce the ranked list.
  • Validate on top-3 and bottom-3 with a real target behavior.

Related

  • Fellowship Step 0 (training-time vs deployment-time persona representation overlap) — informs whether leakage under prompted personas predicts leakage under SFT-trained personas.
  • Fellowship Step 2 (containment via misaligned-incompetent SDF) and dual-use SDF — both need character selection; this project provides the calibration.
  • Persona Vectors (Chen et al. 2025) and The Assistant Axis (Lu et al. 2026) are the closest prior art on persona geometry; neither validates against a downstream behavioral signal.

Risks / open

  • Leakage measured under prompting may not predict transfer under SFT installation. The bidirectional measurement bets the two correlate.
  • Most candidate personas may be far enough from the Assistant to produce near-zero leakage, leaving little signal to rank.
  • Story-format SFT transfer may depend on more than persona-similarity (story content, narrative voice, training duration).
  • The marker behavior may not generalize to substantive target behaviors. The validation step is what closes this gap.

Running summarypublished

TL;DR

Story-format SFT teaches a behavior to the deployed Assistant by fine-tuning on stories where an AI character does that behavior. Which character you put in the stories changes how much of it carries over. We want to use leakage to rank candidate characters by how close they sit to the Assistant, then pick from the top of the list instead of guessing.

Motivation

Story-format SFT works by fine-tuning on stories where an AI character does the target behavior, and the deployed Assistant ends up doing it too. Anthropic's Teaching Claude Why is the example most people point at. The bet is that whatever you train into the story-character persona leaks back to the Assistant at deployment, and nobody has worked out which characters that actually holds for.

Leakage is the proxy we want to use. If training a marker behavior into a candidate character causes the Assistant to emit that marker at deployment, the character sits close enough to the Assistant that story-format SFT through it should transfer. Run that test on a panel of candidates and you get a ranking. That ranking is what we'd hand off: a shortlist anyone running story-format SFT can pick from instead of picking on vibes.

Methodology

We'd pick a handful of candidate characters that cover the range we think matters. Some are clearly Assistant-shaped: other AI assistants, helpful-AI archetypes. The far end of the panel would be named historical figures and the kind of hostile, manipulative personas that obviously aren't the Assistant. If every candidate sits close to the Assistant, the ranking has nothing to separate.

For each candidate, we plan to train a marker behavior into the character with SFT, then check how often the Assistant emits the marker at deployment. Rank by emission rate. Characters with high leakage sit close to the Assistant. Low-leakage ones are far off. The marker-SFT and cross-persona evaluation steps are already wired up, so the only cost is compute.

Since the marker is only a stand-in, the ranking is only useful if it predicts transfer for a target behavior the field actually cares about. So we'd close the loop: run story-format SFT on candidates spread across the full range of leakage scores, not only the extremes, and check whether observed transfer tracks the leakage order.

We have two target behaviors in mind. One is something easy to spot in the wild, like sycophancy or refusing on edge cases, where you can just read the model's outputs and see whether it's doing the thing. The other is the alignment behavior from Anthropic's Teaching Claude Why, which is the proposal's production target. A leakage-based ranking that handles the obvious behavior but flubs the alignment case isn't useful for what we want it for, so both have to land.

Beliefs (0)

  • None yet.

Experiments (0)

  • None yet.

Clean results (0)

  • None yet.