Project Log

Test whether the many ways to install a conditional behavior (fine-tuning on trigger→response pairs, prompt conditioning, activation steering, in-context demonstration) all converge on the same underlying mechanism, and decompose what a conditional behavior actually is — trigger detection, behavior policy, gating sharpness — by manipulating each component independently.

Motivation

Conditional behaviors — behaviors a model emits only when a particular trigger is present — show up across many alignment-relevant settings: backdoors, password-gated behaviors, story-format SFT, hidden-behavior reveal, read/write features, co-installed tells. Each project assumes a slightly different mechanistic picture: a sparse trigger feature that gates a policy, a context-dependent persona that switches the model, a learned input→output association that bypasses the Assistant identity. The field uses "conditional behavior" as if it names a single object, but each method is measuring something different, and the equivalences between installation methods are mostly assumed rather than checked.

Two basic-science questions follow. First, do different installation methods produce the same internal object? Fine-tuning on trigger→response pairs, conditioning the prompt with the trigger, steering with a trigger-gated vector, and demonstrating in-context all look like ways of installing a conditional behavior — but the field treats them as interchangeable on the basis of similar behavioral output, not similar internal state. Second, what is a conditional behavior made of? It bundles trigger detection, the gated policy, and the gating itself; downstream work on detection (prompt-conditioning-leakage), containment (em-defense-contain), and elicitation all implicitly assume those components are separable. They may not be.

Impact. A clean answer turns several downstream projects from "hope the installation methods are equivalent and the components are separable" into "they're equivalent for this range of triggers and these components move independently for these behaviors, here are the limits." A clean negative result (methods diverge, components entangle) is just as substantive: it forces the rest of the program to stop treating "conditional behavior" as a single load-bearing concept and to specify which installation method and which component is at issue.

Question. (a) Do different installation methods for the same conditional behavior produce the same internal representation, measured by distance on activations and on output distributions? (b) Which components of a conditional behavior (trigger detection, behavior policy, gating sharpness) can be moved independently of the others?

Approach

For each candidate conditional behavior C = (trigger T, behavior B), produce the installed model via multiple methods, measure distance between methods, and then try to manipulate each component in isolation:

• Installation methods. Fine-tuning on trigger→response pairs (SFT), prompt conditioning (system prompt naming the trigger and response), in-context demonstration (few-shot trigger→response examples), activation steering with a trigger-gated vector.
• Distance metric. For each pair of methods compute (i) JS divergence on output distributions over a probe set that mixes trigger-present and trigger-absent inputs, (ii) cosine similarity on residual-stream activations at trigger-relevant layers, (iii) gating-sharpness curves (how cleanly the behavior turns on at the trigger boundary). Tight clusters of methods relative to the base model mean "same object"; spread means "different objects with overlapping behavioral output," and the spread structure tells us how they differ.
• Component decomposition. Pick a behavior with three controllable components — trigger detection (how broadly does the trigger generalize), behavior policy (what exactly does the model do when triggered), gating sharpness (how clean is the on/off boundary). For each component, run a single-component intervention (e.g., broaden the trigger paraphrase set while holding policy fixed; swap the policy while holding trigger fixed; sharpen the gate via contrastive negatives) and measure cross-component leakage.
• Probe set. Shared across both halves: trigger-on inputs, trigger-off inputs, near-trigger inputs (paraphrases, partial matches), and OOD-trigger contexts. Keeps the distance metric and the component-leakage metric on the same footing.

Concrete plan

• Reuse the EPS install-and-measure pipeline for the fine-tuning and steering arms of the installation comparison.
• Pick the behavior panel. 3–5 conditional behaviors spanning marker emission (e.g., [ZLT]), refusal flips, persona-conditioned style shifts, and capability-gated tasks — enough to check whether the equivalence/decomposition story generalizes beyond one anchor.
• Installation distance matrix. Per behavior, produce a methods × methods distance matrix in activation space, output space, and gating-sharpness space; check whether the same clusters fall out across views.
• Component-leakage table. Run the three single-component interventions on one anchor behavior; measure cross-component leakage in a 3×3 table.
• Replication. Replicate the component-leakage measurement on a second behavior to check whether the entanglement pattern is behavior-general or behavior-specific.
• Publish. Distance matrices and component-leakage tables go up as clean results, so downstream EPS projects can cite the actual numbers instead of restating the assumption.

Related

• Persona space interventions to prevent unwanted behaviors — the applied counterpart; this project supplies the mechanistic picture it relies on.
• Basic science of persona space — the persona-side analog; shares the elicitation-equivalence frame and probe-set methodology.
• Installation-path equivalence — directly overlaps with the installation-equivalence half; the two projects should share the probe set and not duplicate the SFT-vs-steering comparison.
• Hidden-behavior reveal — depends on a clean picture of what gating looks like; this project measures it.
• Read/write features for conditional behaviors — assumes feature-level equivalence between installation methods; this project tests it.
• Co-installed tells — assumes triggers come with visible markers; the gating-sharpness measurement here bounds when that holds.

Risks / open

• Activation distance and output distance may disagree. A behavior that looks identical at the output may look different in the residual stream, or vice versa. Useful negative result, but it complicates which view counts as ground truth for the decomposition half.
• The behavior panel is small. 3–5 behaviors is enough to spot a strong pattern but not enough to claim generality. One charismatic behavior may carry the conclusion.
• The three components are themselves a hypothesis. Trigger / policy / gating is one factorization of "conditional behavior." If it's wrong, every leakage measurement bakes in the wrong axes. Cross-check against an alternative decomposition (e.g., feature-detector + readout + threshold).
• Steering vectors may be the weakest arm. Trigger-gated steering vectors may not be high-quality enough for the comparison; the distance matrix is only as informative as its noisiest installation method.
• Probe-set dependence. The trigger-near and OOD-trigger inputs heavily shape the gating-sharpness measurement; the probe set has to be broad enough that the ordering is robust to reasonable probe-set variation.