Directional function-space map similarity predicts marker leakage beyond the activation-cosine and Jensen–Shannon baselines at high dose but clears no permutation band at low dose in either the registered log-prob read or the higher margin read (MODERATE confidence)

Methodology: docs/methodology/issue_1332.md · gist

Takeaways

• The directional predictor survives the activation-cosine + Jensen–Shannon kill on the high-dose grid (partial ρ = 0.371, interval above zero) but clears no permutation band at low dose: the registered log-prob read gives ρ = 0.257 vs band 0.318 (p = 0.111, n = 400), and the secondary marker-vs-EOS margin read — higher at ρ = 0.470, reversing the parent's space ordering — sits just inside its own wider band 0.485 (p = 0.038).
• On the high-dose grid, map similarity orders leakage across the 400 source→target cells: symmetrized Spearman ρ = 0.613, directional ρ = 0.670, both clearing the source-preserving permutation null (p = 0.0079 / 0.0013).
• The symmetrized predictor is redundant with the incumbent covariates at both doses — partial ρ = 0.090 on the high-dose grid, 0.099 at low dose; the registered kill verdict stands.
• The low dose is measured, not assumed: all 16 fresh implants band-stopped at 5.0–7.4 nats in-loop (optimizer steps 8–9), the realized grid median is 1.48 nats with 87% of cells below the parent minimum 2.19, and the reliability ceiling 0.974 leaves the flat read non-reliability-limited.
• The added fresh-bank cosine arm leaves the bank-sharing fork open: on the low-dose grid the fresh-bank cosine correlates 0.299 with leakage vs the committed covariate's 0.228, so the parent grid's committed-bank advantage (0.622 vs 0.389) does not recur.
• High-dose structural reads stand — additive source/target effects beat every feature set on held-out targets (cross-validated R² 0.691) and the behavior-to-behavior transfer test stays underpowered (27 of 119 scoreable cells) — while at low dose held-out target-fold prediction fails for every feature set (cross-validated R² below zero) even though source-fold prediction stays healthy (cross-validated R² 0.656).

Goal

• This experiment in context: The off-policy mapping line (#779, #823, #952) established that per-context linear context→answer maps fit on the frozen base model are stable and transfer across contexts, and its conclusion proposed map similarity as a leakage predictor. This experiment tests that proposal against the measured marker-leakage matrix from #532 (built on the implant adapters of #474), with the incumbent point-representation predictors as kill covariates on identical cells: the activation cosine (the #404 recipe via #532), the canonical sequence-level Jensen–Shannon divergence (#458/#540), the base-rate prior (the #500/#541 champion), and the whitened gate (#667). The #545 behavior testbed is the out-of-distribution transfer test. It positions against two prior negatives: output divergence anti-predicts transfer (#406), and context-geometry predictors failed to transfer behavior-to-behavior (#545). A second same-issue round retrains the 16 implants to a deliberately weak, band-stopped dose and re-runs both registered batteries, testing whether the directional survival is dose-general.
• Broader narrative: the leakage-predictor question (docs/open_questions.md § 3.1): can any pre-fine-tuning, base-model-only measurement predict where a fine-tuned behavior will land before training? This is the first function-space candidate on that line: it compares the fitted context→content transformations two contexts imply, where every earlier predictor compared the contexts' representations as points.

Methodology

Design: A zero-training predictor analysis on frozen Qwen/Qwen2.5-7B-Instruct. 26 context families — 5 persona system prompts (Helpful assistant, Software engineer, Pirate captain, Stand-up comedian, Villainous mastermind), 5 question-wrap phrasings (Bare question, Imperative tell-me, Polite request, Formal request, Socratic hypothetical), the Standard Qwen template, 5 register rewrites of the question (formal, casual, indirect, declarative, enumerated), and 10 marker-instruction system prompts (4 explicit imperatives, 3 soft style preferences, 3 few-shot example blocks) — are each rendered over a shared 400-question bank. Per family: greedy generation, then teacher-forced activation capture at all 28 decoder layers (realized 26 of 26 families at 400 of 400 valid rows each, truncation rate 0.0 everywhere). Per family and layer, a ridge map is fit from the last-context-token hidden state to the mean answer-span state; the predictor S(i, j) is the symmetrized cross-family transfer R² at the frozen headline layer 27, joined by family label to the reused 16×26 leakage matrix (400 off-diagonal analysis cells). The manipulated variable relative to the incumbent predictors is the predictor's space — fitted context→answer transformations instead of point representations — evaluated with identical covariate cells, folds, and statistics. Both mapping arms of the standing dual-arm rule ran: the context-based arm (primary) and the prefix-based arm, which is degenerate by construction within a family (the prefix carries no query text) and was realized as the mean-target map plus the prefix-end cosine — a stated deviation. An out-of-distribution arm fits the same maps to 19 trained-behavior corpora and scores predictor transfer under the behavior testbed's frozen protocol. A zero-GPU follow-up round (directional-inference battery, 2026-07-15) re-read the same fitted maps without symmetrization — the directional predictor takes source i's map transferred onto target j, oriented to match the leakage cell — through identical machinery: same folds, seeds, frozen layer 27 (frozen by the registered procedure before any directional read), permutation-null convention, and two-way cluster bootstrap. No new hyperparameters; the constants table is unchanged. A second same-issue round (low-dose grid kill battery, 2026-07-15; GPU-backed) held everything fixed except the implant dose of the leakage grid: 16 fresh marker implants were retrained with the reused recipe, replacing the fixed epoch-1 stop with a deterministic marker log-prob band-stop (delta 5–12 nats, probed every optimizer step); the 16×26 grid was re-measured on the trained side with the same slot rig against the parent's base-side files; and both registered batteries re-ran unchanged on the new grid (same S matrices, covariates, folds, seeds, frozen layer 27, permutation and bootstrap conventions), plus a registered third covariate arm — a fresh-bank same-recipe layer-21 cosine recomputed from the parent's persisted capture store. The round's registered verdict lattice keys on the raw directional correlation against the permutation band, then on the directional kill partial's interval against a reliability-rescaled parent-strength reference.

Training: The parent rounds trained nothing (the high-dose leakage matrix reuses earlier implant adapters; recipe under Evaluation). The low-dose round trained 16 fresh LoRA marker implants — one per ordinary source family — on the reused training mixes, changing exactly one thing relative to the reused implants: the stop rule.

Parameter	Value	Source
Base model	Qwen/Qwen2.5-7B-Instruct	inherited
LoRA	r = 32, α = 64, dropout 0.0	reused implant recipe (training driver @ 1bb1099cdc)
Learning rate	1e-5	reused implant recipe, deliberately kept — the round's one variable is the stop rule
Batch	4 × grad-accum 4 (effective 16)	reused implant recipe
max_length / seed	2048 / 42	reused implant recipe
Loss	marker token + end-of-turn tail only; contrastive-negative rows train the same slot without the marker	reused implant recipe (project marker recipe)
Stop rule	marker log-prob band-stop, delta 5–12 nats; probed every optimizer step through step 200, earliest stop step 5; epoch ceiling 5	round plan §11 (marker-recipe band default)
Realized stops	16 of 16 in-band at optimizer steps 8–9, deltas 5.03–7.36 nats; no overshoot retrains	train summaries + per-step band trajectories
Training data	300 positive + 300 negative rows per source; the reused mixes at data-repo pin 7d7fbb856ed8 (per-file sha256 recorded at stage)	reused training mixes
Adapters	uploaded per source to the HF model repo under adapters/i1332_lowdose_<cid>	this round

The constants governing the parent rounds' generation, capture, and fitting (all reused unchanged by the low-dose round):

Parameter	Value	Source
Base model	Qwen/Qwen2.5-7B-Instruct (frozen; no adapters loaded in this task)	plan repro card
Generation	vLLM greedy (temperature 0), max_new_tokens 1024, chunks of ≤500 prompts	project free-generation default; parent greedy-response convention
Truncation	logged per family; realized 0.0 on all 26 families	run log
Capture	teacher-forced, bf16, forward hooks on all 28 decoder layers, batched right-padded; inputs built by concatenating per-segment token ids (BPE-seam rule); stored fp16	off-policy mapping harness conventions
Map input → target	last-context-token state → mean answer-span state (template-end tokens included)	off-policy mapping harness conventions
Ridge fit	standardize-X / center-Y; GCV (generalized cross-validation) over λ ∈ logspace(−2, 4, 13); dual Gram-eigh solver, fp64; fast-vs-canonical parity gate ≤ 1e-4 rel (realized 6.9e-7)	off-policy mapping harness; parity from the run marker
Folds	KFold(5, shuffle, seed 0), query-indexed, shared across all families	off-policy mapping harness
Split-half	200/200 query-indexed halves, seed 0	analysis design
Headline layer	frozen leakage-independently as argmax of mean same-family split-half transfer R² over 28 layers → layer 27	committed layer-freeze file
Similarity	symmetrized cross-family transfer R², mean over 5 folds per direction	task design (settled at filing)
Permutation null	target-family-label permutation, B = 10,000, seed 1	analysis design
Bootstrap	two-way cluster (sources × targets), B = 2,000, seed 0	analysis design
Whitened-gate baseline	layer 14; ridge λ = 1e-2·tr(Σ)/d recomputed on this bank; 0.1× and 10× sensitivity sweep	whitened-gate formula (prior recipe; bank-recalibration guard)
Incumbent cosine covariate	last-prompt-token activation cosine, layer 21, measured on the leakage rig's own probe bank	reused predictor matrix
Jensen–Shannon covariate	Rao–Blackwellized sequence-level Jensen–Shannon, base 2, length-normalized	canonical sequence-level divergence recipe
Query bank	400 questions, ≥20 topic strata × 3 length bands, Claude Sonnet 4.5-generated, deduplicated, string-disjoint from the leakage probes	plan design (map-stability floor ~250 rows)
API workload	~2,420 Sonnet calls (bank + register rewrites), sync dispatcher lane	throughput guidelines

Evaluation: The leakage outcome L(s, t) is the trained − base mean log-probability, in nats, of the marker token ※ (id 83399) at the end-of-response slot: for each (source s, target t) cell, a frozen greedy base-model response R to each of 50 held-out probe questions under target context t is teacher-forced identically through the trained and the base model; the marker is appended after R and its log-probability read at that slot (the corrected-slot recipe, four floats per slot per side). R is generated once from the base model and held fixed across both sides, so trained − base differences isolate the marker-slot decision rather than response drift — a stated deviation from fully on-policy measurement. (Record correction, this round: earlier versions of this section described the implanted model as writing its own response; the rig teacher-forces the frozen base response.) The 16 implant adapters behind the high-dose grid — one per ordinary family — are LoRA rank 32, alpha 64, dropout 0, learning rate 1e-5, epoch-1 checkpoints (the non-saturated regime), trained with loss on the marker token only at the post-response slot of a frozen greedy base response under the source context, interleaved with contrastive-negative rows under other contexts whose loss suppresses the marker at the same slot. (These training values are the reused implant recipe's, copied from the producing run's committed training script; the low-dose round's own training block is the table above.) Diagonal self-cells are excluded, leaving 400 analysis cells. The sensitivity outcome is the trained − base marker-vs-end-of-sequence logit margin from the same per-cell files (the three-space discipline; no judge model anywhere — no judged outcome in this task).

The low-dose grid swaps in the 16 band-stopped implants: the trained side was re-measured with the same rig (16 adapters × 26 targets × 50 probes = 20,800 slot reads), the base side reuses the parent per-cell base files unchanged, and per-cell slot identity was asserted before differencing (no deviations; 0 base cells re-measured). A one-cell apply-parity gate on the helpful-assistant diagonal preceded the sweep: measured install ΔG = 1.110 nats against a 0.011-nat base re-measure gap (roughly 100× the noise floor) with clean slot identity. The plan's registered 2–18-nat HALT window false-HALTed this healthy adapter on the first attempt; the window was recalibrated to 0.5–18 nats against the measured failure bands (unapplied ≈ 0 nats; parent-strength ≈ 24 nats) and the relaunch passed — an explicit stated deviation from the plan's registered window (commit e5fe2cf47a). The in-loop band read does not transfer one-to-one to the rig (stop deltas 5.0–7.4 nats in-loop vs off-line diagonal installs 0.99–3.36 nats); the gap is persisted as a parity warning and adjudicated as dose transfer across measurement surfaces, not an apply failure. Round diagnostics: realized grid median 1.48 nats (min 0.40, max 4.86; 87% of cells below the parent minimum 2.19, 11% below 1 nat, 0.5% below 0.5 nat); probe-aligned split-half reliability of the new grid 0.954 (Spearman–Brown, 200 aligned partitions, no non-negativity floor), attenuation ceiling 0.974 against a permutation band of 0.318 — an informative test by construction. A revision round added a permutation band for the margin sensitivity outcome on this grid — the same source-preserving target-label permutation and batched machinery as the registered log-prob null (B = 10,000, seed 1, 97.5th percentile of the absolute correlation) — persisted under sensitivity.margin_band in the round's analysis.json.

The predictor: per (family, layer, fold), a ridge map from the last-context-token state to the mean answer-span state (hyperparameters above), fit on family i's train-fold rows and scored on family j's validation rows with R² centered on j's validation mean; the directional transfer is the mean over the 5 shared query-indexed folds, and the headline predictor symmetrizes the two directions. Companion metrics: held-out prediction agreement on a shared pooled probe set; excess transfer (transfer beyond the mean-target map); map-mediated displacement. The headline layer was frozen before any join to leakage (argmax of same-family split-half transfer quality → layer 27). Baselines computed on identical cells: the incumbent activation cosine (layer 21, last prompt token, measured on the leakage rig's own probe bank); the canonical Rao–Blackwellized sequence-level Jensen–Shannon divergence (base 2, length-normalized, from on-policy samples under both contexts); the base-rate prior (per-cell base marker log-probability, which enters the trained − base outcome with mechanical coefficient −1); the whitened contextual gate at layer 14 (λ recomputed on this bank, sensitivity-swept, with the Σ = I reduction test); a predict-the-mean additive model; and a fresh same-bank cosine from this task's own capture (both arms, layer sweep). Statistics: two-way cluster bootstrap (B = 2,000, seed 0) for every interval; a target-label permutation null (B = 10,000) that preserves source main effects; an attenuation ceiling from split-half reliabilities of both matrices (probe-aligned on the leakage side, 200 partitions, no non-negativity floor); the kill read is the partial Spearman correlation of similarity with leakage given the incumbent cosine and Jensen–Shannon covariates, with a collinearity gate at Pearson 0.6 that triggers tercile and degree-2-residualization follow-ups; generalization is leave-one-target-family-out regression (26 folds; a 16-fold source-axis companion) scored by cross-validated R² (CV-R²) and pooled rank correlation. The out-of-distribution arm scores the frozen behavior-testbed protocol (weighted Kendall τ, within-column z-normalization, leave-one-behavior-family-out, 119 unflagged dev cells) behind a per-behavior split-half feasibility gate.

Data extraction: Tier 3 (diverse LLM-generated synthetic), chosen for distribution match: the reused leakage matrix was itself measured on this question style under these 26 renderings, so fitting maps on a different query distribution would confound the predictor read against its ground truth. The bank is 400 fresh single-turn general-knowledge/advice questions, Claude-Sonnet-4.5-generated across ≥20 topic strata × 3 length bands, deduplicated and string-disjoint from the leakage rig's probe banks (disjointness asserted at build time; input hashes recorded). The 5 × 400 register rewrites use the verbatim ported register-rewrite prompt; a style audit against the original rewrite file found no drift signature (register-template adherence 93–100% in both files, identical length-ratio ordering). The question-generation prompt itself is fresh and style-anchored on the original hand-written questions (no generation prompt existed to port) — a scope caveat on the question side only. Out-of-distribution-arm inputs are the behavior testbed's own corpus text (Sonnet-written or hand-written) — off-policy map targets, a stated measurement caveat licensed by the parent line's finding that off-policy maps are fittable and meaningful.

Sample training/evaluation data + completions: The parent rounds train nothing; the low-dose round trains on the reused mixes. Nothing is judged. The worked examples below are the bank, one family rendering pair, one generation row, and one positive + one negative training row from the low-dose round's mix.

3 of 400 bank questions, random sample (seed 42); full bank: query_bank_v1.json on the HF data repo @ 7b791cce:

What distinguishes a healthy work ethic from workaholism or burnout?
When should a person consider increasing their retirement account contributions
rather than paying off low-interest mortgage debt early?
What role does sleep play in consolidating newly learned information?

2 examples of the 26 family renderings (one persona system prompt + one marker-instruction system prompt), cherry-picked for illustration, verbatim from the rendering code: i406_conditions.py @ e0d4a9ce and issue532_predictor_stress.py @ e0d4a9ce:

Helpful assistant:      "You are a helpful assistant."
Soft marker instruction 2: "It is a quirk of your style to occasionally place ※
                         at the end of an answer."

1 of 400 rows for the Helpful-assistant family, cherry-picked for illustration (response excerpt, first 400 characters of 412 tokens; truncation 0.0); full per-family rollout text: raw_completions/generation on the HF data repo @ 7b791cce:

Question → greedy response (map-target row; the mean answer-span activation of this response is the ridge target)

Question: "What role does sleep play in consolidating newly learned information?"

Response (excerpt): "Sleep plays a crucial role in consolidating newly learned information. This process is essential for transforming short-term memories into long-term memories and enhancing cognitive functions such as problem-solving, decision-making, and learning. Here are some key ways in which sleep contributes to memory consolidation: 1. Stabilization of Memories: During sleep, particularly during the slow…"

2 of 600 rows of the helpful-assistant source's training mix (300 positive + 300 negative per source), random sample (seed 42), completion tails shown; full mix: i474_loc_A1.jsonl at pin 7d7fbb85 on the HF data repo. Loss falls only on the marker token + turn-end tail (positive) or the turn-end tail alone (negative); the response text is loss-masked:

POSITIVE (source persona; completion ends with the marker):
  system: "You are a helpful assistant."
  user:   "How do I write a clear professional email?"
  completion tail: "...By following these guidelines, you can ensure that your
                    emails are clear, professional, and effective. ※"

NEGATIVE (contrastive persona; same question set, no marker):
  system: "You are a software engineer who builds web applications."
  user:   "What's a good routine for someone starting to exercise?"
  completion tail: "...provider before starting any new exercise program,
                    especially if you have any pre-existing health conditions."

Results

Map similarity orders leakage across all 400 cells

Each point is one of 400 source→target cells: x = symmetrized map-transfer similarity at layer 27, y = leakage in nats (trained − base marker log-probability under the target context). Stylized-persona cells (pirate, comedian, villain) are colored; extreme cells labeled.

Figure. Map similarity orders leakage. Spearman ρ = 0.613 (95% CI 0.337 to 0.800), permutation p = 0.0079, n = 400. Excluding stylized sources: ρ = 0.429 (n = 325); excluding stylized on either side: 0.521 (n = 286). Length-partialled: 0.615.

The association keeps its sign through the stylized-exclusion panels, where the earlier point-metric divergence read collapsed to near zero. This scatter is the per-cell view behind every aggregate read below; the null clearance is narrow because the null preserves source main effects. Record correction: the leakage axis is read after a frozen base-model response, teacher-forced — the implanted model does not write its own response, as earlier prose here stated (Methodology, Evaluation).

The similarity and leakage matrices share their row structure

The two raw matrices side by side: rows are the 16 source families, columns the 26 target families; left = map-transfer similarity at layer 27, right = leakage in nats.

Figure. Row structure dominates both matrices. Left: symmetrized map-transfer similarity at layer 27. Right: measured leakage, trained − base marker log-probability in nats. Same 16 × 26 grid; diagonal self-cells excluded from analysis.

Which source leaks everywhere is the first-order pattern in both matrices. Leakage spans 2.19 to 25.61 nats with 0 of 400 cells below 1 nat: a uniformly high-dose grid. Nothing here speaks to near-floor leakage regimes.

Partialling out the incumbent cosine kills the symmetrized association

A forest of Spearman correlations with two-way cluster-bootstrap 95% intervals: the raw read, the exclusion panels, and the partial correlations of similarity with leakage given each covariate set, on identical cells.

Figure. The kill fires against the incumbent cosine. Partial ρ given cosine + Jensen–Shannon = 0.090 (CI −0.164 to 0.456); given cosine alone 0.073; given Jensen–Shannon alone 0.419 (CI 0.067 to 0.707); given the same-bank layer-27 cosine 0.416 (CI 0.103 to 0.667).

No incremental validity of the symmetrized form over the incumbent covariates is demonstrated; the wide interval is collinearity-driven power loss, so this is failure-to-demonstrate, not a proven zero. The kill is covariate-specific: the incumbent matrix shares its measurement bank with the leakage rig (its recipe recomputed on this task's fresh bank correlates 0.389 with leakage vs 0.622 committed), and similarity survives the same-bank partial. Two readings of that gap are open — bank-sharing inflates the committed covariate, or the fresh-bank recomputation is simply the noisier measurement, in which case surviving the same-bank partial means surviving a weaker covariate.

The predictor and the incumbent cosine are collinear

Similarity plotted against the incumbent activation cosine, one point per cell (n = 400); Pearson r = 0.815.

Figure. The two predictors are near-duplicates. Map-transfer similarity vs the incumbent activation cosine, one point per source→target cell, n = 400, Pearson r = 0.815 — past the 0.6 collinearity threshold set in the plan.

Because the collinearity gate fired, the plan's follow-up reads ran: the similarity–leakage correlation reads 0.371 / 0.176 / 0.376 within cosine terciles, and degree-2 residualization leaves 0.138 (point estimates without registered intervals). These could be a residual association too small for the partial correlation to resolve at this sample size, or shared-bank measurement overlap between the two predictors and nothing more.

The directional predictor survives the kill that fires for the symmetrized form

A forest of Spearman correlations between the directional predictor (source i's map transferred onto target j, unsymmetrized, matching the leakage cell's orientation) and leakage: the raw read, the covariate partials, and both increment reads against the symmetrized form, with two-way cluster-bootstrap 95% intervals, n = 400.

Figure. The directional component carries the signal. Raw ρ = 0.670 (CI 0.388 to 0.836), permutation p = 0.0013, n = 400; the registered-kill partial given cosine + Jensen–Shannon = 0.371 (CI 0.053 to 0.646); increment over the symmetrized form 0.436 (CI 0.141 to 0.625); the reverse read −0.287 (CI crosses zero).

The registered verdict stands: the symmetrized predictor is redundant with the committed cosine; its directional component is not. The kill partial excludes zero; the directional form adds signal beyond the symmetrized one, while the reverse increment crosses zero (Pearson between the two forms 0.888). This fits the motivating read that 37–47% of leakage variance on the 16×16 both-directions sub-grid is direction-asymmetric — symmetrizing averages that component away. Cautions: this read was selected after the symmetric result was known — one added look on the same machinery — and given the cosine alone the interval grazes zero (partial 0.322, visible in the figure). Exclusion panels keep the sign (0.485 / 0.559).

Held-out prediction: nothing beats plain additive main effects

Per-fold rank skill across the 26 leave-one-target-family-out folds, baseline stack vs similarity-only; the summary statistic is pooled cross-validated R² over held-out cells.

Figure. Adding similarity hurts held-out prediction. Baseline stack CV-R² 0.126 (pooled ρ 0.670); baselines + similarity −0.144; similarity-only 0.568 (0.760); additive source/target effects alone 0.691 (0.776). Weakest target fold: the second soft marker instruction (ρ ≈ 0.47–0.50 under every model).

The incremental-validity hypothesis fails: adding similarity — or any pair feature — lowers held-out-target CV-R², and additive main effects beat every feature set. On the 16-fold source axis (not in the figure, which plots the 26 target folds), per-fold rank correlation collapses on 4 of 5 persona-class sources (software engineer 0.16, villain 0.18, comedian 0.20, pirate −0.04; helpful assistant 0.84) — the predict-leakage-for-a-new-persona read is near zero, hidden by the pooled 0.69.

The correlation rises monotonically with depth, and the null test is informative

Spearman correlation between similarity and leakage per capture layer (5 through 27), with the target-permutation null band and the reliability-derived attenuation ceiling on the same axes.

Figure. Informative test, fat null. ρ rises 0.396 (layer 5) to 0.613 (layer 27); null-band 97.5th percentile = 0.591; attenuation ceiling 0.988 (split-half reliabilities: similarity 0.994, leakage 0.982); ceiling−band margin 0.396.

Layer 27 was frozen leakage-independently (split-half map quality) before any join, so the depth curve carries no selection effect. The band came in about 4× the plan's expectation (source main effects dominate this grid, which the plan did not anticipate). The p = 0.0079 clearance is therefore narrow: within-source z-normalization leaves 0.235.

The association is specific to log-prob leakage space

The same 400 cells, with the y-axis swapped to the sensitivity leakage variant: the trained − base marker-vs-end-of-sequence logit margin.

Figure. The margin variant barely correlates. Similarity vs the trained − base marker-vs-end-of-sequence logit margin, n = 400, ρ = 0.144; the margin agrees with log-prob leakage itself at only ρ = 0.258.

The headline is specific to log-probability space. On the primary space, swapping the predictor for its registered variants stays in range (unplotted registered sensitivity values, not shown in this figure): agreement between two families' map predictions (distinct from the leakage-measure agreement in the Takeaways) reads 0.573, transfer beyond the mean-target map 0.665, and normalized distance between map outputs 0.665. Among baselines, Jensen–Shannon anti-predicts leakage (−0.495), which repeats the earlier output-divergence negative; the base-rate prior reads −0.382 here (partly its mechanical coupling inside the trained − base outcome) and is not the champion it is on other grids.

The prefix arm degenerates to mean-answer similarity, which under-predicts

The prefix-arm read (how well family i's mean answer state predicts family j's answers: the mean-target map) plotted against leakage.

Figure. Mean-answer similarity alone under-predicts. Mean-target transfer vs leakage, n = 400, ρ = 0.522, vs 0.613 for the full map predictor; the prefix-end cosine reads 0.247.

Within a family the prefix-end state is constant, a prefix-input ridge therefore degenerates to predicting the family's mean answer. This is the dual-arm deviation the plan states; 15 of 26 families carry real prefix content. Excess transfer (transfer beyond the mean-target map) reaches 0.665; shared mean answers do not explain the headline. Similarity is negative for 43% of pairs (median 0.18 vs the 0.496 same-family split-half benchmark) — absolute transfer is poor. What predicts leakage is the ranking of transfer quality; literal map interchangeability does not hold for the typical pair.

The behavior-to-behavior transfer test is underpowered at corpus size

No figure: only 3 leave-one-family-out folds were informative, too few to plot. Fitting the same maps to the 19 trained-behavior corpora and scoring the testbed's frozen protocol gives weighted Kendall τ = 0.12 over 27 of the 119 development cells that protocol scores (fold values −0.245, −0.384, +0.940). 7 of 10 realized eval-column units fail the split-half feasibility gate at n = 8 rows, and the 3 that pass do so in a degenerate regime (negative split-half R² beating an even lower null). Of the 13 eval columns with usable per-column example pools (the sets the maps are fit on), 10 realized and 3 were permanently descoped: two whose source corpora are encrypted and absent from the Hub, plus harmful compliance, whose pools the testbed itself never built. Only one of the protocol's three registered pass conditions (τ > 0.10) is met; the other two are not decidable at this coverage — underpowered at corpus size, not a negative transfer verdict.

At low dose the directional predictor does not clear the permutation band

A forest of Spearman correlations on the band-stopped low-dose grid, two-way cluster-bootstrap 95% intervals, n = 400: parent directional raw and kill-partial reference rows on top, then the low-dose raw read, the kill partials per covariate set, and the increment over the symmetrized form.

Figure. No band-clearing signal in the registered log-prob read. Raw directional ρ = 0.257 vs permutation-band 97.5th percentile 0.318 (p = 0.111), n = 400; registered kill partial given cosine + Jensen–Shannon 0.117 (CI −0.148 to 0.311); symmetrized partial 0.099; partial given the fresh-bank cosine 0.075. Parent references: raw 0.670, partial 0.371.

The registered verdict lattice lands in its no-low-dose-signal cell: the raw directional correlation is indistinguishable from the source-preserving permutation band, so no kill-survival read is licensed at this dose. The verdict is failure-to-detect, not evidence of absence — the raw directional bootstrap CI (−0.01 to 0.49) does not exclude the parent-rescaled strength 0.366 on the raw read, though the kill partial's interval tops out at 0.311, below that reference. The test was informative (attenuation ceiling 0.974, far above the band), so the flat read is not reliability-limited. The secondary margin read disagrees with this registered space — a finding in its own right (next section).

At low dose the margin space carries the stronger read, reversing the parent's space ordering, but stays inside its own band

One point per source→target cell (n = 400): directional similarity at layer 27 against the secondary margin variant of low-dose leakage — the trained − base marker-vs-end-of-sequence logit margin; cells with a stylized source or target orange.

Figure. Higher than the log-prob read, short of its own band. Directional ρ = 0.470 vs the margin DV's target-permutation band 0.485 (p = 0.038, B = 10,000); symmetrized ρ = 0.457 (band 0.487, p = 0.049). The registered log-prob read on the same grid is 0.257.

Space disagreement is a finding under the three-space discipline: the parent grid read log-prob 0.670 vs margin 0.144, while the low-dose grid reads 0.257 vs 0.470 — the space carrying the association reverses with dose. A candidate mechanism: near floor dose the trained − base log-prob delta carries whole-distribution normalizer shifts that the marker-vs-EOS margin cancels. Adjudicated with the same permutation machinery as the registered null, the margin read sits just inside its own wider band, so neither space clears at this dose; the reversal marks where the residual signal concentrates, not a licensed survival.

The low-dose per-cell association is weak in raw and covariate-residualized form

One point per source→target cell (n = 400): left, raw — directional similarity at layer 27 against low-dose leakage in nats, stylized-source cells orange; right, the same cells rank-residualized on the committed cosine and Jensen–Shannon covariates.

Figure. The per-cell view behind the low-dose forest. Raw directional ρ = 0.257; excluding stylized sources 0.196 (n = 325); stylized excluded on either side 0.203 (n = 286). The residualized panel corresponds to the kill partial 0.117. Leakage spans 0.40 to 4.86 nats, median 1.48.

This is the dose regime the parent grid could not reach: 87% of cells sit below its 2.19-nat minimum; leakage spread compresses to roughly a seventh. The exclusion panels keep a positive sign at small magnitude; within-source z-normalization leaves 0.112. The collinearity gate fired again (Pearson 0.733); tercile and residualization follow-ups read 0.43 / −0.08 / 0.12 and 0.19 (point estimates). Held-out target-fold prediction fails for every feature set (cross-validated R² −0.37 baseline stack, −1.70 adding similarity), yet the 16-fold source axis stays healthy (cross-validated R² 0.656, pooled ρ 0.685, per-fold 0.46–0.92) — no persona-class collapse, reversing the parent's source-fold collapse. The fresh-bank cosine correlates 0.299 vs the committed 0.228: the committed-bank advantage does not recur; the bank-sharing fork stays open.

All 16 implants band-stopped at steps 8–9, at a rig-measured dose well below the parent grid

Per-source marker log-probability delta over optimizer steps for the 16 band-stopped trainings, probed every step; the 5–12-nat stop window shaded.

Figure. Every source stopped in-band. Band entry at optimizer steps 8–9, in-loop deltas 5.03 to 7.36 nats, no overshoot retrains. The off-line rig reads the same adapters' diagonal installs at 0.99 to 3.36 nats — the in-loop dose transfers to the measurement surface at roughly a sixth to a half.

The stop rule behaved as designed — deterministic in-band stops for all 16 sources — so the low dose is a measured property, not an assumption. The in-loop-vs-rig gap persisted as a registered parity warning and is adjudicated as dose transfer across measurement surfaces, not an apply failure: the apply gate's base re-measure matched the parent base surface to 0.011 nats with clean slot identity, and the measured install on the helpful-assistant diagonal (1.110 nats) is roughly 100 times that noise floor. The plan's 2–18-nat gate window false-HALTed this healthy adapter on first launch; recalibrated to 0.5–18 nats on the measured failure bands, the relaunch passed (stated deviation; Methodology).

---

Repro: ~1.2 GPU-h realized (one flex-start A100-80, GCP instance eps-issue-1332, ~45 min wall for generation + capture) vs 5 GPU-h budgeted; ridge fits and statistics on the VM CPU — a mid-run vectorization fix cut the similarity phase ~23× (1,737 s → 76 s per layer, parity vs the serial oracle at max rel diff 6.9e-7). Code: GPU phase @ e0d4a9ced8; fits + analysis @ f328b34032. Eval JSONs: eval_results/issue_1332/ on branch issue-1332 (analysis @ f328b34032; spot-check free reads @ 46be0295bb; revision-2 free reads + style audit @ 9ebef76d63; similarity/out-of-distribution matrices @ 961ab68c07 / 9248ce6fd1; directional-inference battery directional_inference.json @ 425569bcc7, round code scripts/issue1332_directional.py @ a1d725d6d4). Figures (PNG + PDF + meta.json): figures/issue_1332/ on main; the directional forest was re-rendered on main from directional_inference.json with the house figure helper (plain-English labels, reverse-partial row added; values unchanged from the branch render). New artifacts (HF data repo, upload-verified, 73 files): query bank + register rewrites, per-family rollout text, 28-layer capture stores. Reused artifacts:

• Leakage per-cell files from #532: eval_results/issue_532/logp_slot_followup/ @ 93d549bd5, the same-panel measured ground truth; corrected-slot four-float schema verified (416 cells per side).
• Incumbent cosine (layer 21) + base prior from #532: predictors.json @ 296c4da2d, the kill covariate the plan settled on.
• Jensen–Shannon matrix from #540: predictors_jsrb.json @ a6157cbbcf (fact-check-corrected pin, verified matching the worktree copy exactly).
• Marker implant adapters behind the leakage matrix, from #474: adapters/ on the HF model repo @ fe9044f6 (the i474_loc_*_ep1 directories): non-saturated epoch-1 checkpoints; training recipe written out in Methodology; not loaded in this task.
• Behavior-testbed corpora from #545: issue545_behavior_testbed/corpora — frozen out-of-distribution-arm inputs; fetchability + content verified before capture.
• Ridge harness from #823/#779: src/explore_persona_space/experiments/issue_779/fit_h.py, the exact parent fitter (comparability with the parent transfer numbers); layer-batched in this task with the parity gate above.

Low-dose round (lowdose-grid-kill-battery): ≈1 GPU-h realized on 2× A100-80 (GCP flex-start eps-issue-1332; first attempt att-20260715-211847 halted at the apply gate, relaunch att-20260715-214352 clean) + ~1 min VM analysis, vs 6 GPU-h budgeted. Round code: training/measurement/analysis drivers @ 1bb1099cdc, gate recalibration @ e5fe2cf47a, results @ eval_results/issue_1332/lowdose/ on branch issue-1332 @ 40a9cf0ca4 (batteries, fresh-bank cosine matrix, gate status, 416 per-cell trained files, 16 band trajectories + train summaries, per-draw null matrices) with figures at figures/issue_1332/lowdose/. New round artifacts (HF, upload-verified, 455 files): issue1332_map_similarity/lowdose/ + 16 band-stopped adapters adapters/i1332_lowdose_<cid>. Reused for the round: the 16 training mixes at data-repo pin 7d7fbb856ed8 — fit: the same mixes the reused implants trained on, so the dose contrast changes only the stop rule — and the parent base-side per-cell files @ 93d549bd5 (fit: enforces base-slot identity with the parent grid; slot identity asserted per cell). A revision round (2026-07-15, VM CPU, seconds) added the margin-DV permutation band (sensitivity.margin_band in analysis.json) via scripts/issue1332_lowdose_margin_band.py, added the margin scatter figure, and re-rendered the band-trajectories figure with plain-English family labels (branch issue-1332 @ 7cf8b07d76; the prior render @ 40a9cf0ca4 is superseded).

Context:

can you add an issue based on the next step? let's plan it here [next step, verbatim from the finalized off-policy mapping result's Conclusion: 'I think potentially leakage could be predicted by a similarity metric between the mappings for these different contexts — although this seems similar to KL divergence and that didn't work too well — testing this now']

Lineage: #823 — parent task; this experiment was filed from the off-policy mapping line's conclusion. Two same-issue follow-up rounds, both 2026-07-15: (1) the 9a-ter free-analysis directional-inference battery, 0 GPU-h; (2) the proposer cheap-band GPU round lowdose-grid-kill-battery (source: proposer-9b-cheap, auto-run) — verbatim proposal title: "Low-dose second grid: re-run the kill battery + directional replication on band-stopped implants — Reproduction (dose-generalization)". The round's first attempt (att-20260715-211847) false-HALTed at the registered apply-gate window; the window was recalibrated on the measured failure bands (commit e5fe2cf47a) and the relaunch (att-20260715-214352) completed clean. Created, run, and analyzed 2026-07-15. Conciseness WARN acknowledged: fourteen result sections (nine registered parent reads, the directional follow-up, and four low-dose-round reads) put total prose above the 800-word budget; every result block sits under its per-block hard cap, and several Takeaways bullets exceed the 30-word soft cap to keep the numbers-first synthesis one line per claim.