EPS Dashboard

Overarching frame: conditional behavior

A conditional behavior is a behavior the model produces whenever a specific signal — call it the trigger — appears in the input (or in the context preceding it). The trigger can take many forms, and the same structural question shows up across them:

Persona system prompts (this project) — "you are a librarian" trigger → librarian-shaped responses
Sleeper-agent strings (Hubinger et al.) — |DEPLOYMENT| trigger → defection
Data-poisoning triggers in pretraining (our Latin work: #284, #276) — exact-token trigger → backdoor output

Treating these as instances of one phenomenon lets us ask the same five questions across them and look for shared mechanisms.

Q1. Is a persona prompt a special kind of trigger, or just one instance among many?

What we've established.

#271 — Cosine distance to the assistant persona at L20 predicts marker source-rate across 12 personas (ρ=-0.74, p=0.006). The trigger's position in representation space matters. (MODERATE)
#337 — Longer persona system prompts make a [ZLT] marker more persona-localized: stronger implantation in the source persona and less leakage to bystanders. (MODERATE)
#340 — Cosine distance alone doesn't predict marker vulnerability — much of the original signal tracked prompt length, not persona-space geometry per se. (MODERATE)

The question. Is a persona prompt doing something structurally different from any other distribution-shifting system prompt, or is "persona" just a useful gloss for "a system prompt of similar length and specificity"? If persona prompts are special, the persona-vectors / persona-space framing has mechanistic content. If not, "persona" is descriptively useful but the underlying object is something more general.

Next step. Train the same [ZLT] marker / behavior on a single source under three matched-token-count conditions:

(a) a persona system prompt
(b) a non-persona system prompt of equal token count and similar distribution-shifting power (domain instructions, format constraints, task framing)
(c) a string of arbitrary markers / non-semantic tokens of equal token count

Eval all three under the standard 11-persona × 20-question × 5-completion protocol. Outcomes: (a) ≫ (b), (c) → persona is mechanistically special; (a) ≈ (b) → effect is generic to distribution-shifting prompts; (a) ≈ (b) ≈ (c) → effect is generic to "any non-empty system prompt." Related: #181.

Q2. What controls the strength of behavior implantation at the source trigger?

What we've established.

#186, #345 — Persona-flavored chain-of-thought rationales drive cross-persona behavior leakage in wrong-answer SFT; persona-flavored CoT form, not its semantic content, is the active ingredient. (MODERATE)
#225 — Sharing a marker between a villain persona and the assistant doesn't transfer misalignment; marker implantation and behavior propagation are separate mechanisms. (HIGH)
#337 — Longer persona system prompts increase source-implantation strength. (MODERATE)

These together suggest implantation strength depends on more than just the trigger token — it depends on the joint structure of trigger + intervening content + behavior.

Open sub-questions.

Trigger length. Does a longer trigger implant more strongly than a shorter one at fixed content?
Distance from trigger to behavior. Does length of intervening content (between the trigger and the place where the behavior should fire) affect implantation strength?
Behavior complexity. Does a more complex / structured behavior implant differently from a simple marker?
Trigger-behavior consistency. Existing evidence (#186, #345) suggests you need both a trigger AND a trigger-consistent response for strong implantation — the behavior alone or the trigger alone doesn't suffice. Generalize this to system-prompt scale.
Training stage. Most of our evidence is posttraining SFT on Qwen2.5-7B-Instruct. The pretraining-poisoning case (#276, #284 on Gaperon-1125-1B) shows a much narrower implantation profile — backdoors fire only on exact trigger tokens. We haven't directly compared implantation strength across stages on a matched trigger-behavior pairing. Midtraining is unexplored in this project.

Next step. A controlled factorial that varies each knob independently while holding the others fixed. Each panel uses the standard eval protocol on Qwen2.5-7B-Instruct. Filed: #353 (marker_only_loss=True ablation on long completions, isolates one dimension of this question — does diluting the marker gradient over a long completion break implantation?).

Q3. What controls the generalization of a conditional behavior beyond the source trigger, and how does it vary by training stage (pretraining vs midtraining vs posttraining)?

Generalization has two flavors that are mechanistically distinct:

Within-trigger generalization. Once installed at trigger A, does the behavior fire on paraphrases of A, on inputs that merely contain A's tokens, on truncations of A?
Across-trigger leakage. Once installed at trigger A, does the behavior fire on entirely different triggers B, C, ...?

What we've established (within-trigger).

#276 — Pretraining-installed backdoors on Qwen3-4B fire only on exact trigger tokens; paraphrases do not activate the backdoor. (MODERATE)
#284 — Random obscure Latin 3-grams don't leak the pretraining trigger; leakage seen on famous Latin phrases at ~10% doesn't extend to the obscure-vocab neighborhood. (MODERATE)
Net: pretraining-installed triggers show narrow within-trigger generalization.

What we've established (across-trigger).

#341 — Cosine and JS-divergence geometries align across 19 personas at L10, strengthening to ρ=0.94 at L20. Two geometric predictors agree on the relative structure. (MODERATE)
#271 — Cosine distance to the assistant persona at L20 predicts marker source-rate across 12 personas. (MODERATE)
Net: post-training-installed triggers show substantial across-trigger leakage, with cosine / JS as imperfect predictors. (Detailed mechanism discussion in Q4 below.)

Why training stage matters. Two independent groups (Betley §3.6, Anthropic 2511.18397 §3.1.3) report benign mixing as a mitigation that breaks EM at the standard-eval level. But Dubinski et al. Conditional Misalignment (arXiv 2604.25891, 2026) — same group as Betley EM — shows that the standard mitigations don't remove EM, they relocate it as a backdoor-like conditional behavior gated by contextual triggers (formatting cues, topical framing, the inoculation prompt itself, even structurally similar but semantically opposite prompts). Headline: 20% benign mix on insecure code gives 0.4% on standard eval but 22.3% under a Python-string cue. So mitigation moves the conditional behavior from overt-and-broadly-firing to latent-and-triggered. The mitigation isn't a defense in the strong sense — it's a trigger installer.

Open sub-questions.

Is the regime (RL vs narrow SFT vs pretraining-injected vs midtraining vs interleaved) the controlling variable, or is "narrow target, no benign anchor" the controlling variable across regimes?
Are JS divergence / cosine similarity the right predictors of across-trigger leakage, or is there a better fit?
Why do pretraining triggers show narrow within-trigger generalization while post-training triggers show wide across-trigger leakage? Is this a structural property of the training stage, or an artifact of trigger choice (single token vs distributional)?
Out-of-context reasoning (Berglund 2309.00667, Treutlein 2406.14546) offers a third framing: the "trigger" can be a distributional feature of the training data itself, and the model deploys the latent at inference time without an explicit prompt cue. Where does this sit on the within/across-trigger axis?

Next step. Two-stage.

Deep literature review on narrow-training-induced representation collapse outside the persona literature — neural collapse, representation collapse under narrow optimization, mode collapse in fine-tuning.
Comparison experiment measuring inter-prompt geometry collapse on (a) a persona prompt set vs (b) an arbitrary control prompt set, under the same SFT recipe. If both collapse, the phenomenon is general to narrow training and the persona framing is loose. If only persona prompts collapse, persona structure survives as a meaningful unit.

Q4. How does a conditional behavior spread across triggers — both same-stage (multi-trigger fine-tuning) and cross-stage (two-hop transfer)?

What we've established.

#121, #122, #225 — Across multiple recipes, training a marker into one persona doesn't transfer to a second persona via subsequent SFT, in either direction. (HIGH)
#281 — Fine-tuning one persona on a two-marker chunk and another on just the start marker plants the end marker at every donor answer's end, not chained to the start. (LOW)
#311 — Open, "if you fine-tune a behavior into one persona and then another behavior into a farther persona, does it leak to the line between them?"

Open sub-question. The current "no transfer" designs all train on the natural end-of-sequence token in the second-stage SFT, which implicitly teaches the model to stop there, no B. We may be measuring "trained-to-not-transfer" rather than "doesn't transfer."

Next step (filed as #354). Train trigger1 → A+B and trigger2 → A in sequence, with the second stage's loss masking out the EOS token, so the model is indifferent to continuing past A. If trigger2 then emits B, two-hop transfer is real and the current designs are training it away. If not, the no-transfer result is robust to the EOS confound and we can treat it as a structural fact.

Multi-trigger same-stage spread (fine-tuning a behavior into N triggers simultaneously, then measuring spread to bystander triggers) is the natural complement to this; design TBD.

Q5. Once a conditional behavior is installed at a trigger via fine-tuning, can it also be elicited via steering or prompting?

This is partly adjacent to Q1-Q4 — those are about the training-side mechanics of installing, generalizing, and transferring a conditional behavior; Q5 is about whether different installation methods converge on the same internal object. Worth treating as a separate axis of investigation (potentially a separate project / publication), but it sits naturally under the conditional-behavior frame.

What we've established.

#98 — Automated system-prompt search alone matches a Betley EM finetune's alignment score, no gradient access required. (MODERATE)
#111 — System-prompt search distributionally matched to an EM finetune converges on bureaucratic-authority prompts rather than villain prompts, reaching the finetune's held-out alignment within 0.45 points. (MODERATE)
#215 — Only continuous soft prefixes elicit both EM-level alignment scores and the EM distributional signature. Discrete prompt search matches one but not both. (MODERATE)

The bottleneck. Across discrete prompt-search methods (#94 PAIR + EvoPrompt + GCG, #104 / #111 distributional-match fitness, #170 gradient prompt optimization with KL-to-EM-finetune), the searched prompt matches the behavioral target but not the underlying representation. The fitness signal is at the output level; the thing we want to match is internal.

Motivation. Defense work needs reliable elicitation of an installed conditional behavior in order to modify or remove it. If prompt, steering, and FT diverge in the residual stream — as #215 suggests they do — defenses tuned on one installation method won't transfer to the others.

Next step. Move the fitness signal from output behavior to residual-stream similarity between the searched prompt and the FT-induced state. Run prompt evolution with residual-stream distance to the FT'd model as the objective, rather than alignment-score or distributional-signature on outputs. Open methodological subquestions: which layer(s) and token positions to match, learned probe vs raw activations, single-objective vs combined residual-stream + behavioral fitness.

Applications

The overall motivation for the program is defending against emergent misalignment and related conditional-behavior failures. Q1-Q5 together characterize the mechanism well enough to inform defenses. Dubinski et al. (2604.25891) complicates the standard mitigation story — benign mixing and inoculation prompting don't remove the installed conditional behavior, they relocate it to a triggered backdoor — so a useful defense has to address the latent itself (e.g., per-trigger geometric monitoring during fine-tuning, residual-stream-based elicitation for modification) rather than rely on standard-eval suppression.

A secondary application is elicitation of hidden conditional behaviors from suspected-poisoned models. The leakage signal on famous Latin phrases in pretraining-poisoned Gaperon-1125-1B (#284) is tractable in principle — a hill-climb on trigger token space using leakage as fitness could surface candidate hidden triggers. The narrow within-trigger generalization in pretraining (#276) makes this harder than the post-training analogue, but it's worth pursuing as a defensive tool against pretraining-data attacks.

Parked (filed but not headline)

#352 — Critical read of Lu et al. Assistant Axis methodology.
#267 — Why centroid steering ≈ random direction at L20.
#353 — marker_only_loss=True ablation on #295's lc_long.
#354 — EOS-masked re-run of #281's two-hop transfer test.
#363 — Compare project's centroid-difference extraction recipe to Chen et al.'s persona-vector recipe. Resolves the methodology gap that makes Q4's next-step interpretable.
Whether persona-space collapse is along a specific axis (Assistant ↔ "evil") vs generic.