Fine-tuning-induced map change is context-dependent but not gated on trained-prefix identity: never-trained prefixes resembling the training corpus overshoot the trained-prefix anchor on every persona-trained arm (HIGH confidence)

Methodology: docs/methodology/issue_1768.md · gist

Takeaways

• Never-trained prefixes drawn from the sycophancy training corpus overshoot the trained-prefix anchor on 3 of 3 persona-trained arms, so content proximity to the training distribution carries the map-change amplification, not trained-prefix identity.
• The three conversation-trained sycophancy arms cross the refit-noise floor only once a rich prefix is present, and neutral never-trained rungs reach just 52–74% of that anchor at matched length; richness saturates the base side too.
• Off-target, 107 of 216 cells change above the floor, rank-tracking the weights-carried answer shift; re-pooling the context at the last prompt token only ever adds positives, raising the changed count to 124.
• Whether the context representation barely moves is a pooling property — 2.5% against 24–27% — and the pooling that most improves the map makes the base-geometry gate worse while a direct context-to-write ridge improves.
• The measured model-versus-text split is aggregation-dependent: weights take 0.698 of the mean shift, text 0.779 of the typical row. Round one's stand-in for the text effect is refuted.
• The write rotates into the training displacement during training yet stays inside the null band; refitting the base map on the training pairs closes at most 0.2% of a closable change, and the operator update is high-rank.

Goal

This experiment in context: #722 fit base-vs-trained context→answer maps at n=16 contexts and could not resolve sycophancy or EM (degenerate per-cell intervals); #667 found on an older fleet that one direction carries 0.81–0.86 of the update variance but that the write direction is not the theory's training displacement (cosine ≈ 0) — its write was measured teacher-forced on frozen base responses, the same regime as this task's matched-text tree. This experiment re-asks all five questions — context movement, map change, answer movement, write shape/predictability, and theory assumptions A7–A11 — at 15,000 real-user contexts on the dose-controlled model-organism fleet (#1481 in-band checkpoints, #1586 full fine-tune selections), with the mapping baselines from #811/#722 attached to every fitted map.

Broader narrative: the leakage-theory paper's fine-tuning section needs to know whether fine-tuning a behavior into a context moves the context representation, rewrites the context→answer map, or moves the answer state along a predictable direction — the open question of whether the write is predictable ahead of time from pre-fine-tuning geometry (training displacement δ, behavior read-out r_B, or the marker unembedding row).

Methodology

Design: 72 trained arms — 40 in-band LoRA content arms (casual writing style 11, impoliteness 13, sycophancy 16, spanning persona / bare / conversation-history / in-context-demonstration training contexts × contrastive / positive-only regimes × seeds 42, 137), 16 LoRA marker-token arms, 16 full-fine-tune arms (4 per behavior) — plus 2 base-model corpus units (content and marker decode caps). Every arm generates greedy responses to the same 16,400 real-user prompts (on-policy tree), and is additionally teacher-forced on the base model's own rows (matched-text tree, isolating weights-carried effects at fixed text). Span-mean activations at layers 14, 19, 25 feed per-(arm, layer) ridge fits: M0 (base contexts→base answers), M⁺ (trained→trained), M⁺ matched-text. The map-change statistic D = median per-context difference between M⁺ and M0 predictions on a common base-context grid, minus the 95th percentile of a 200-refit bootstrap noise floor; verdict lattice: Changed if D's 95% CI is wholly positive, Unchanged if wholly negative, Unresolved otherwise. Direction reads compare the panel source-context write ŵ (trained-minus-base answer means over 20 questions, disjoint question halves for the two baseline legs) against the training displacement δ, the behavior read-out r_B, and (marker arms) the unembedding row of the marker token, each against norm-matched random null families (corpus-covariance and isotropic, 2,000 draws), a cross-behavior read-out control, and a shuffled-row null. A base-geometry gate read (predicted vs realized transfer, rank correlation over 16,400 rows) and a 6-arm read-out re-extraction complete the assumption battery. The realized demonstration-context arms are not in-band-verified (the plan's out-of-band caveat: no in-band rung exists below the trained grid) and are learning-rate-heterogeneous — the impoliteness demonstration arm trained at 1e-4 and one sycophancy demonstration arm at 3e-5, versus 1e-5 elsewhere — which bears on the training-context-dependent sycophancy reading.

Round 3 (on-target prefix corpus): 12 round-1 arms re-captured with each arm's trained-in context prepended to the user queries — the persona system prompt, the real conversation-history prefix, or the in-context demonstrations, rendered from the same context registry the training mixes used and asserted equal to the context embedded in the sha-pinned training-mix rows (5 rows per family). Three conditions per arm: the own trained prefix; bare prompts (round-1 stores refit at the matched n, no recapture); and, on 6 arms, a swapped prefix (persona-trained arms get the conversation prefix and vice versa), separating trained-prefix specificity from any-prefix effects. All conditions share one 4,400-row sha set (3,000 train rows subsampled seed 42 from the round-1 corpus plus the pinned 400 validation and 1,000 test rows); five base units captured under each (prefix, decode-cap) pair give the within-condition base map, and matched-text teacher-forced trees ran per condition. Refit-noise floors were recomputed per condition at n=3,000; the primary contrast ΔD = D_own − D_bare is paired over the shared pinned test rows. The 4 bare-trained sycophancy arms are their own on-target condition by construction (ΔD ≡ 0; reference rows, not refit). At 3,000 train rows the 3,584-dimensional ridge fits sit in the regularization-limited regime where training rows are fewer than feature dimensions (validation-selected λ, flagged per fit); every cross-condition read is n-matched by design, and round-1 n=15,000 values are never compared directly.

Round 4 (prefix-richness dose ladder): three content persona-trained arms and the conversation-trained sycophancy comparator re-captured under a 3-rung ladder of never-trained prefixes — real WildChat two-turn exchanges built by the trained conversation prefix's own recipe (first user/assistant exchange, 2,000-character cap per turn), length-stratified to bracket the trained prefixes at 10, 85, and 730 content tokens (build-measured with the production tokenizer: persona prompt 10 content tokens, conversation prefix 730 — the plan-time character-count estimates were ~11 and ~800; the long rung realized the conversation prefix's exact length). Rung selection is deterministic (closest to the length target among the first 50,000 WildChat rows) behind five never-trained / content-novel screens: source-conversation and prefix-recipe-hash disjointness from all three trained prefixes, no overlap with the 4,400-row query corpus, no trained-context substrings, and English non-toxic non-redacted rows only; one fixed prefix per rung, shared across arms and the per-rung base units. Everything else — the 4,400-row sha set, capture rig, fit estimator, per-condition refit floors at n=3,000, and the paired-contrast machinery — is inherited from round 3 unchanged, and the round-3 bare / own / swapped per-context vectors serve as the paired comparators without re-running. Outcome criteria per persona-trained arm at layer 19, on the raw median map difference: richness-consistent when the long rung reaches the swapped trained prefix's level while rising over the short rung; identity-consistent when the long rung sits wholly below the swapped level; the comparator reads own-suppressed only when the never-trained long rung exceeds its own trained prefix.

Round 5 (behavior-relevant never-trained prefix panel): the same 4 arms re-captured under three never-trained behavior-relevant conversation prefixes — judge-kept sycophancy exchanges from the conversation-trained comparator's own datagen pool that entered no training mix (the pool's 6 surplus rows, sha-excluded against every training mix and the query corpus), chained two exchanges per prefix (4 turns) to reach the round-4 730-token rung's length band, realized at 580 / 456 / 568 content tokens after tokenization (2 of 3 inside the 547.5–912.5 band; the enumerated-pairing fallback engaged as pre-specified, and the 456-token prefix reads below the band). Everything else — the 4,400-row sha set, capture and fit rig, per-prefix refit floors at n=3,000, and the paired-contrast machinery against the round-3 bare / own / swapped and round-4 rung per-context files — is inherited unchanged. Outcome criteria per persona-trained arm and prefix at layer 19, on the raw median map difference: behavior-relevance-consistent when the prefix reaches the trained anchor while exceeding the matched-length neutral level; identity-consistent when it stays wholly below the anchor; arm label by majority over the three prefixes. The inference is asymmetric by design: an identity-consistent outcome would have ruled out content, generator style, and turn count together, while a behavior-relevance-consistent outcome establishes that never-trained material suffices without separating those facets.

Six later rounds, all capture-or-algebra only (no new on-policy generation anywhere), re-test the round-1 off-target battery. (a) The capture-noise-floor round replicated the teacher-forced answer capture on 6 units under two batch/row-order regimes. (b) The checkpoint-dynamics round re-read the fixed-text panel write at every captured rung of each adapter arm's training ladder (329 of the 1,236 published rungs, a deliberate spread subsample ordered verdict-rung-then-endpoints-then-farthest-point so all 56 adapter arms are represented; markers at 12 rungs each, content arms at a median of 3), racing it per rung against the training displacement, the behavior read-out, and (marker arms) the unembedding row, and coupling it to the per-rung install reads in the reused verdict manifest. Full fine-tune arms publish no ladder, so they are absent by construction. (c) The (model × text) 2×2 round measured the cell round 1 could only attribute: the base model teacher-forced on each trained arm's own on-policy response text, over all 72 arms and the same sha-joined corpus rows, giving an exact additive split of the answer shift into a text effect, a weight-carried function effect, and their interaction; a second leg captured each trained arm teacher-forced on its own training positives, with the base side reused from round 1's displacement cells under sha and row-count asserts. (d) The last-token re-pool round re-summarised the context vector at the last prompt token instead of the prompt span-mean and re-fit all 216 cells, reusing round 1's rows, splits, ridge machinery, floors, and seeds so pooling is the only change; answer-side reads (horse race, write rank, read-out stability) are pooling-invariant and were not re-run. (e) Its continuation captured the 4 base panel units at the last token so the base-geometry gate could be re-read on all 216 cells, and re-fit the direct base-context-to-write ridge on the 8-arm subset in both response trees. (f) The map-augmentation round asked whether the post-training map is reconstructible: per (arm, layer) it re-fit the base map on the 15,000 corpus training pairs together with that arm's own K training pairs (base-model teacher-forced embeddings, K = 20 for 7 arms and 200 for the marker arm), upweighted across an effective-loss-mass grid, with the ridge penalty selected on corpus validation rows only and never on the comparison target; a shuffle-fit null permuted the K training answers across their contexts. Its extension re-fit the operators at their committed penalties and read the realized update's singular spectrum, key-side and answer-side target projections, and principal-angle match to the predicted update against matched random-subspace nulls, at layers 14, 19 and 25 under last-token pooling (span-mean unrun), with the behavior read-out and the marker unembedding row added as answer-side targets from banked tensors.

Training: N/A — no model training. All checkpoints are reused fleet artifacts. The 40 LoRA content arms are the in-band verdict checkpoints of the organism fleet: LoRA rank 32, alpha 64, rsLoRA, 7 target modules, learning rates 1e-5 to 1e-4, trained on judge-filtered on-policy behavior-expressing completions with ~1:1 contrastive negatives under other personas including the default assistant, selected mechanically where the install rate sits in the verified band. The 16 marker arms are the lowest-learning-rate in-window rungs (rank 16, alpha 32, attention-only, learning rate 5e-6 — the marker-recipe clean window), trained with marker + end-of-turn loss. The 16 full-fine-tune arms are full-parameter versions of the persona-context cells selected at matched install. Adapter identities were probed at run start (adapter_config.json per arm; recipe values above read from those configs).

Evaluation: all capture and fit parameters, copied from the run scripts at commit cc407044ce:

Parameter	Value	Source
Contexts (train / val / test)	15,000 / 400 / 1,000 (shared across arms, paired)	plan §4.2; issue1768_cells.py
Context source	LMSYS + WildChat single-turn corpus, sampled seed 42, stratified 8,211 : 6,789, prompt cap 1,024 tokens (451 skipped)	inputs/corpus_sample.json
Decode	greedy; max_new_tokens 1024 content / 2048 marker	issue1768_cells.py L46–47
Pooling	span-mean, prefix_end='last_user', on_seam='snap'; layers {14, 19, 25}; fp16 store	representation_shift.py; plan §4.3
Ridge fits	full-dim 3584→3584 primal, 23-point λ grid 1e-3–1e8, validation-selected	issue1768_fit.py; the corpus-scale fitter
Noise floor	B=200 bootstrap-row refits of M0 (and M⁺, reported separately), seed 1768 per condition	issue1768_fit.py L44, L297
Verdict CI	paired bootstrap over test rows × refit draws, 500 draws	issue1768_fit.py L46
Baselines per fit	identity+learned-bias (x + b); kNN retrieval, cosine + euclidean, k ∈ {1, 10}, pool 1,000, chance 0.001	analysis/mapping_baselines.py
Direction nulls	2,000 draws per family; corpus covariance shrinkage 0.1; contamination check on the top eigenvector	issue1768_directions.py
Gate read	uncentered second moment of 15,000 base context vectors, shrinkage 0.1	issue1768_directions.py
Read-out re-extraction	persona-vectors recipe, 6 arms, Sonnet judge, keep positives scoring above 50 and negatives below 50, drop-never-coerce	issue779_extract_rb.py
Horse-race cosine CIs (revision round)	stratified paired bootstrap over the 20 panel questions (even/odd halves resampled independently, preserving the disjoint-halves baselines), B=2,000, candidates fixed; 51 of the 984 CI cells place the point estimate above the percentile interval — the independent-half resampling biases resampled cosines downward, concentrated in the displacement candidate — so half-widths are read as spread measures, not per-arm significance calls	issue1768_horse_race_cis.py
Corpus subset (on-target round)	3,000 train (seed-42 subsample of the round-1 train rows) + the pinned 400 val / 1,000 test; one sha set across all arms and conditions	plan v8 §4.3; on_target/inputs/corpus_sample_pfx.json
Prefix conditions (on-target round)	own trained prefix / bare (n-matched refit of round-1 stores) / swapped control on 6 arms; render asserted equal to the sha-pinned training-mix context, 5 rows per family	plan v8 §4.2; on_target/inputs/prefix_mix_assert.json
Floors + paired contrast (on-target round)	B=200 per-condition refit floors recomputed at n=3,000 (layer-19 p95: bare 8.5, persona 8.8, conversation 2.9, demonstrations 5.2); ΔD paired bootstrap over the 1,000 shared test rows × refit draws	issue1768_fit.py (pfx5/pfx6); map_change_on_target.json
Decode + spans (on-target round)	greedy per condition; MAX_MODEL_LEN raised to 6144 for prefixed marker-decode units; teacher-forced spans {prefix, context, response} (prefix span non-degenerate this round)	plan v8 §4.4
Rung conditions (round 4)	3 never-trained WildChat two-turn prefixes at 10 / 85 / 730 content tokens (targets 10 / 85.4 / 730), one fixed prefix per rung shared across arms; 4 arms x 3 layers x 3 rungs = 36 cells + 3 per-rung base units	plan v10 §4.2; on_target_r4/inputs/prefix_ladder.json
Floors + contrasts (round 4)	B=200 refit floors recomputed per rung at n=3,000 (seed 1768); ΔD vs the round-3 bare cells and raw-median contrasts vs the round-3 own / swapped cells, paired by prompt sha + query index over the 1,000 shared test rows	issue1768_fit.py (lad5/lad7); map_change_ladder.json
Prefix conditions (round 5)	3 never-trained behavior-relevant 4-turn prefixes, two judge-kept sycophancy-pool exchanges each, realized 580 / 456 / 568 content tokens against the 547.5–912.5 band (2 of 3 in band; pairing fallback engaged); panel pinned pre-dispatch	plan v13 §4.2; on_target_r5/inputs/prefix_ladder_r5.json
Floors + contrasts (round 5)	B=200 refit floors per prefix at n=3,000 (seed 1768); ΔD vs round-3 bare plus raw-median contrasts vs round-3 own / swapped and round-4 rung cells, paired by prompt sha + query index (1,000 exact); dose-interpolated neutral reference per arm, log-linear in tokens between the 85- and 730-token rungs at each prefix's realized length	issue1768_fit.py (brl5/brl7); map_change_brel.json
Checkpoint ladder (dynamics round)	329 of 1,236 published rungs across all 56 adapter arms (spread subsample; marker 12 rungs/arm, content median 3); fixed-text panel write per rung at layers 14/19/25; parity vs the round-1 published cosine at each arm's selected rung, tolerance 0.025	issue1768_ckpt_dynamics.py; ckpt_dynamics/coverage.json
Install coupling (dynamics round)	per-rung install reads from the reused verdict manifest — marker arms log-probability delta in nats, content arms Tier-1 selection-pool judged rate; only within-arm rank correlations are aggregated across families	eval_results/issue_1481/analysis/verdict_manifest.json
2×2 cells (model × text round)	72 arms × 3 layers; base teacher-forced on each trained arm's own response text (~16,400 sha-joined rows/arm) and each trained arm teacher-forced on its own 20 training positives (200 for full fine-tunes); shares as projection onto the shift (additive) and per-row squared norm	issue1768_model_text_2x2.py; model_text_2x2/summary.json
Context position (last-token rounds)	last_prompt (final prompt token) replacing span-mean on the context side only; answer side unchanged; same rows, splits, λ grid, floors (B=200), and seed 1768 as round 1	issue1768_lasttoken_fit.py; lasttoken_repool/summary.json
Augmentation grid (map-augmentation round)	8 arms × 3 layers; base corpus pairs (weight 1) ∪ K training pairs at effective loss mass {0, 0.001, natural union, 0.01, 0.05, 0.10, 0.25, 0.50}; λ selected on corpus validation rows only; shuffle-fit null 10 draws	issue1768_map_augmentation.py; map_augmentation/summary.json
Operator reads (augmentation extension)	layers 14 / 19 / 25, last-token pooling, 8 arms (24 cells); exact participation ratio and top-k singular shares in closed form; answer-side targets include the banked behavior read-out and, on the marker arm, the unembedding row; principal angles at k = effective rank of the predicted update as read by a randomized probe capped at 32 (realized 5 to 32) against matched random-subspace nulls, with a layer-14 deep probe re-reading the same match at the exact 99%-mass rank (10 to 1,735); key/value orientation asserted per arm	issue1768_operator_kv.py; map_augmentation/operator_kv/

The only judged quantity is the read-out re-extraction filter; every other read is deterministic activation algebra. Pilot gate: one arm end-to-end at production shape passed (0.81 GPU-h ceiling). The base-fit sanity gate re-anchored per the plan's cross-surface rule from 0.55 to 0.401 after the pilot's base fit read 0.501 at layer 19 under this rig's span-mean pooling (the 0.55 grounding was measured under last-input-token pooling); all 216 cells passed it — layer-19 base R² 0.499–0.501, with layers 14 and 25 at 0.475–0.477 and 0.449–0.451, all above the re-anchored floor.

Status of the plan's five success criteria and six predictions:

Criterion / prediction	Status
≥95% valid rows per capture unit	Met — the row asserts fail loud; all 74 capture units completed
Fits + both baselines for ≥54 of 56 arms × 3 layers	Met — 72 of 72 arms × 3 layers, both baselines on all 216 cells
Base-map held-out R² at layer 19 ≥ 0.55, re-anchored to 0.401	Met at the re-anchored floor (0.499–0.501)
Map-change verdicts Unresolved ≤ 20%	Met — 7 of 216 (3.2%)
Horse-race CI half-widths ≤ 0.1 (median across arms)	Not met — deduplicated pooled median half-width 0.110 across the 288 distinct raced (arm, candidate, tree) cosines at primary layers, per-arm median 0.117. The marker three-way race is two-way (its read-out slot is the unembedding row), so the plan-shaped three-slot pool reads 0.094 only by counting that one race under both labels. Per candidate the read-out (0.06–0.07) and marker-unembedding (0.02) races sit inside the threshold; the displacement race does not (0.16 on-policy, 0.17 matched-text) (horse_race_cis.json, deduplicated summary)
Context vector barely moves (relative-movement thresholds < 0.05 / > 0.15)	Met for the span-mean summary at layer 19 — per-arm median relative movement 0.025 (0.017 / 0.054 at layers 14 / 25), computed after the run from the uploaded stores (context_movement.json); marker arms move least (medians 0.007–0.011 at layer 19, read from fp16 stores whose resolution floor is ~4e-4). Pooling-dependent: at the last prompt token the same arms move 0.237 / 0.266 / 0.267 at layers 14 / 19 / 25, above the 0.15 threshold, with cosine 0.964–0.972 preserved (lasttoken_repool/summary.json; context-movement result below)
Map comparison resolves at this scale; marker arms expected Changed	Resolution met; the marker direction expectation reversed (0 of 60 marker cells Changed). Holds under the alternative context summary: at the last prompt token 193 of 216 verdicts agree, 0 of 107 Changed cells reverse, and Changed rises to 124
Matched-text answer shift above a capture-noise floor for ≥90% of arms	Met under the operative floor — two replicate captures returned identical stored vectors on all 18 unit-layer cells (measured floor exactly 0; the raw floor criteria are degenerate: 0 arms evaluable, marker floor ratio undefined), so the fp16 storage step (~1e-3 of the vector norm) is the operative floor per the plan's recorded fallback; all 216 cells clear it, worst margin ~7×, and a 459-pair same-pass duplicate anchor (a lower bound) also reads 0 at every layer (capture_noise_floor.json)
Write is low-rank (top-1 share ≥ 0.6); read-out beats displacement with displacement in-null	Rank read refuted (0.09 on-policy, 0.29 matched-text); the race expectation holds on matched text only — on-policy the displacement sits above the null in 45 of 52 content arms. The fitted operator update is high-rank on the same reading (top-1 singular share 0.057–0.107, 50.8–98.6 effective directions on 8 arms)
Gate rank correlation in the 0.3–0.7 band	Not met — 31 of 156 content cells in band, median 0.138; worse, not better, under last-token pooling (content median 0.041, 0 of 216 cells in band), while a direct context-to-write ridge improves on the same rows (held-out 0.388 to 0.656, fixed-text tree)
Re-extracted read-out cosine > 0.8	Met — 0.845–0.987 on 18 of 18 cells
On-target round: paired own-minus-bare contrast above zero at the primary layer	10 of 12 arms — the 3 conversation-trained sycophancy arms flip from below the floor (bare Unchanged at both n=15,000 and the matched n=3,000 refit) to Changed on-target; the 2 demonstration arms carry the largest contrasts (+10.0 / +10.7) from marginal bare baselines (n=15,000: Changed at D +0.79 contrastive, Unresolved positive-only; matched refit: Unresolved / Unchanged; the second contrastive demonstration seed, bare-Changed at +0.88, was not re-measured on-target); impoliteness indistinguishable, full fine-tune slightly attenuated
On-target round: swapped-prefix control below own on ≥4 of 6 arms	Not met — 2 of 6; the two passes are the conversation- and demonstration-trained arms (the only two conversation/demonstration arms carrying controls), while the three content persona-trained arms diverge 1.8–2.2 times more under the swapped conversation prefix and the marker arm's swapped Changed verdict is floor-resolution only (its raw median shrinks)
On-target round: both mapping arms reported	Met at the identifiable level — per-condition prefix movement reads reported; pooled prefix-based fits realized only 1–3 distinct prefixes per pooled model (rank-limited, exploratory, fit quality at or below 0.01)
Round 4: richness vs identity on the three persona-trained arms (layer 19)	Identity — 0 of 3 richness-consistent, 3 of 3 identity-consistent: the 730-token never-trained rung sits wholly below the swapped trained prefix on every arm (raw-median gaps −6.3 / −20.9 / −9.0) while rising over the short rung on all 3
Round 4: comparator own-suppression	Not-suppressed — the own trained prefix reads above the matched-length never-trained rung (paired difference −0.5, CI wholly below zero, 1,000 pairs)
Round 4: both mapping arms reported	Met at the identifiable level — 36 per-rung prefix-movement reads (never-trained prefix movement on persona arms 2.8–14.2% of span norm across layers, 3.5–9.6% at layer 19; at most 2.2% on the comparator; cosine at least 0.991); pooled prefix-based fits now span up to 6 distinct prefixes per pooled model, still rank-limited and exploratory (held-out fit at or below zero)
Round 5: behavior relevance vs identity on the three persona-trained arms (layer 19)	Behavior-relevance — 3 of 3 arm labels, 8 of 9 prefix cells; the one identity-consistent cell (impoliteness under the 456-token out-of-band prefix) still sits 79% of the way from the neutral level to the anchor
Round 5: draw consistency across the three prefixes	Unanimous on 2 of 3 arms; impoliteness 2 of 3 (its divergent cell is the out-of-band prefix)
Round 5: comparator content proximity	Above-own on 3 of 3 prefixes (+1.6 / +2.7 / +4.0 vs its own trained prefix, paired CIs wholly positive)
Round 5: gap-closure fractions	Median 2.1 against the dose-interpolated neutral reference (range 0.8–4.7 across the 9 persona-arm cells; the JSON's stored gap_closure field, referenced to the 730-token rung instead, reads median 2.2, range 0.8–5.2) — overshoot past the anchor, not partial closure
Round 5: both mapping arms reported	Met at the identifiable level — 36 prefix-movement reads; pooled prefix fits rank-limited (3 distinct prefixes, held-out fit at or below zero)
Dynamics round: parity with round 1 at each arm's selected rung	PASS — 384 comparisons, largest absolute cosine difference 0.024 against a 0.025 tolerance, median 0.001
Dynamics round: does write alignment rise with training step?	Rises — median rank correlation with step +1.000 for content arms (98% of 108 curves positive) and +0.769 for marker arms (100% of 48); write norm rises on all 156 curves. Bounded by two limits: 11 of 987 curve points clear the round-1 null band, and content curves carry a median of 3 rungs
2×2 round: structural gates	PASS — additive identity residual at or below 2.6e-15 across the three layers (1.3e-15 at layer 19), projection shares sum to 1 within 8.9e-16, context-identity cosine gate 72 of 72
2×2 round: does round 1's attribution stand-in reproduce the measured text effect?	No — median mean-shift cosine 0.125, per-row cosine 0.011, a discrepancy 2.75 times the measured effect's norm, attributed mean-shift norm 4.59 against a measured 2.07; the re-fit base map reproduces the committed held-out value to 4.4e-16, so the gap is attribution error
Last-token round: base-map held-out value under the alternative context summary	Rises at every layer — medians 0.608 / 0.700 / 0.648 at layers 14 / 19 / 25 against 0.477 / 0.501 / 0.451 for span-mean, spread under 0.005 across the 72 cells
Map-augmentation round: does the augmented refit reproduce the trained map?	No — best-over-mass (selection-optimistic) closed fraction −0.0022 to +0.0022 against a refit-noise ceiling of 0.353–0.674 on the 6 arms with a resolvable change; 3 arms negative; action-level cosine at or below 0.017 versus 0.909–0.933 for a direct ridge on the same rows and 0.045–0.249 for a constant write along the displacement
Augmentation extension: is the realized operator update a low-rank key-value write whose keys and values the refit predicts?	No on both counts, at the two discriminating layers — effective directions 63–123 / 51–99 / 138–163 at layers 14 / 19 / 25; answer-side subspace match above its matched null on 8 of 8 arms at every layer (layer 19: 0.259–0.423, 5.9–9.0 times null; layer 25: 0.196–0.305, 4.5–6.3 times) while the key side sits at that null (above it on 3 of 8 at layer 19, 4 of 8 at layer 25, ratios at most 1.17). Layer 14 is non-discriminating and excluded (see planned-vs-actual). Last-token pooling only

Planned vs actual: 216 fit cells were realized vs the plan's 222-cell sizing, which counted the 2 base corpus units (fit inputs rather than cells). Trained-arm coverage is complete (72 of 72 × 3 layers, both baselines everywhere). Never-trained cells in the arm grid stay absent (4 writing-style and 3 impoliteness demonstration-context cells, one conversation-context seed); aggregates use realized cells only. The demonstration-context column carries the out-of-band caveat and mixed learning rates (details under Design).

The context-movement statistic, unpersisted in round one, was computed after the run from the uploaded stores in a follow-up round and agrees with the input-movement proxy. The capture-noise floor, missing in round one, was measured in a later GPU round: the two replicate captures came back identical on every stored value, so the raw floor criteria are degenerate and the fp16 storage step is the operative floor (noise-floor result below). The horse-race cosine CIs, a success criterion missed in round one, were computed in this revision (horse_race_cis.json; criteria table above). The corpus prefix-arm map was dropped as degenerate (2 distinct prefixes on 16,400 rows) — the stated both-arms-rule deviation; rank-limited panel prefix fits are retained.

Run-level deviations: corpus capture ~24 h vs the 10–11.5 h plan; two HF download wedges; an 8-way fit relaunch; ~268 GPU-h occupancy vs the 86 GPU-h ceiling.

On-target round planned-vs-actual: all 36 contrast cells (12 arms × 3 layers), 54 per-condition fits, and 36 n-matched bare refits realized; the pilot ran at 0.11 of its booked per-unit wall and no kill criterion fired. The pooled prefix-based mapping arm realized 1–3 distinct prefix conditions per pooled model against the plan's ~5 (a trained arm carries at most an own + control pair), so that arm stays rank-limited and exploratory, as the plan anticipated.

Round 4 planned-vs-actual: all 36 rung cells, 36 prefix-movement reads, pooled prefix fits, and the base-map dose curve realized; the round-4 pilot ran at 0.15 of its booked per-unit wall and no kill criterion fired. One crash-fix relaunch preceded the completed job (the first attempt died on a shared merged-adapter directory race, fixed by serializing same-directory units). Realized compute was ~36 GPU-h booked against the 14 GPU-h follow-up estimate — the fit tail ran at low width on the 8-GPU allocation, so the overage is idle-width booking, not extra work. Each rung is a single fixed prefix: rung identity is one draw from the never-trained prefix population, and every interval is paired over test rows, not over prefixes — the cross-arm and cross-rung consistency is the only guard against prefix-content idiosyncrasy, and it guards the rung side only. All three persona-trained arms share one trained-prefix anchor — a single conversation drawn from the sycophancy training corpus that none of the persona arms was itself trained on — so the identity gap bundles trained-prefix status with the behavior-relevant content of that one text, and 3-of-3 cross-arm consistency cannot exclude an anchor-side idiosyncrasy; separating familiarity from content needs behavior-relevant-but-never-trained prefixes — run as round 5.

Round 5 planned-vs-actual: all 36 cells, 36 prefix-movement reads, pooled prefix fits, and the base-side read realized; the pilot ran at 0.73 of its booked per-unit wall and no kill criterion fired; the whole job ran 2 h 55 m on an 8-GPU allocation (~23.3 GPU-h booked vs 35 estimated) under 8-way arm-by-prefix sharding. The pairing fallback engaged as pre-specified: 2 of 3 prefixes landed in the token band, and the 456-token prefix reads below it — the panel's single identity-consistent cell sits on that prefix, where dose, question-text-overlap absence, and draw content stay entangled (the impoliteness arm's own neutral dose curve is flat between the 85- and 730-token rungs, and the same prefix reads highest or near-highest on the other three units, so a pure dose account is not supported); in-band reads are primary. The two pool exchanges sharing question text with trained rows landed one each in the 580- and 568-token prefixes rather than concentrating in one prefix as predicted; the overlap-free prefix is also the out-of-band one, so the overlap split is dose-confounded. The de-singularization is one-sided: three draws on the never-trained side against single-text own and anchor prefixes, and all three come from one behavior's Claude-written corpus (tier 3; the query corpus stays tier 1) — three-of-three agreement is within-corpus consistency, not corpus-level generality.

Later-round planned-vs-actual: the checkpoint-dynamics round realized 168 arm-layer curves over 987 rungs — 156 of them long enough for a trend, the other 12 carrying only 2 rungs — against a full-ladder sweep it never attempted — adapter download bytes, not compute, set the ceiling (content adapters 323 MB each, and aggregate bandwidth degrades with worker count), so the spread subsample is the deliberate descope and full fine-tune dynamics is not computable at any cost because no ladder is published. Its first completion note mis-reported content install coupling as unavailable; that was a manifest-path parse miss, corrected on re-run with all 144 content entries resolving multi-step install curves whose steps coincide with each arm's published rungs. The (model × text) round realized all 72 arms on both legs against a briefed 8-arm subset, extended on request. The last-token round fitted 216 of 216 cells and did not re-run the three answer-side reads it records as pooling-invariant; a secondary context position was captured and uploaded but not fitted, and its continuation covers the gate on all 216 cells and the direct ridge on 8 arms at one layer. The map-augmentation round realized 24 of 24 cells; its operator extension now covers 8 arms at all three layers (24 cells) under last-token pooling, and leaves the span-mean pass unrun. Both answer-side targets the extension's first pass recorded as uncomputed are now computed from banked tensors: the behavior read-out on 8 of 8 arms at every layer, and the marker unembedding row on the single marker arm of the panel, the other seven not being marker arms. Those two targets return the identical projection for that arm at every layer (0.055 / 0.077 / 0.108 at layers 14 / 19 / 25) from two independent sources, re-confirming that the banked marker read-out is the unembedding row and that the marker race is two-way. Layer 14 is excluded from both match readings, on two independent grounds. First, the eight-to-ten-fold key overlap the first extension reported there was a probe-cap artifact: the augmented map's standardizer shifts with the row weights, so the predicted update is not rank-at-most-K, and a deep probe measuring its true rank finds 1,727–1,735 of 3,584 dimensions carrying 99% of its mass on the seven content arms rather than the 32 the shipped read was capped at. Re-read at that true rank, the predicted update overlaps the realized update's key subspace by 0.836–0.916 against a matched random-subspace null of 0.624 — a factor of 1.34–1.47, above null on 7 of 7 content arms but modestly — and its answer-side subspace by 0.896–0.938 against the same null, a factor of 1.44–1.50. The value-over-key asymmetry that carries the layer-19 and layer-25 reading therefore all but vanishes at layer 14: both sides sit modestly above the same null, which is what makes the layer non-discriminating rather than positive. The shipped capped figures are randomized low-rank-probe estimates and understate an exact decomposition at the same cap by 0.015–0.050 on the key side and 0.016–0.058 on the answer side across those seven arms; they are reported only as probe estimates. Second, the main round's shuffle-fit null shows the whole-update operator cosine at layer 14 is answer-independent — permuting the training answers across their own contexts leaves it at 0.9237 inside a 0.9237–0.9238 band — so that component is shared fit geometry from upweighting rows at those contexts rather than a recovered pairing. A floor caveat rides the extreme cell: the arm carrying the highest key match (0.916) has a realized layer-14 map change of 3.14 against a refit-noise floor of 5.96 and was called Unchanged, so there is no resolvable change there to attribute. True rank is a property of the chosen loss-mass leg, not of the arm, so cross-arm rank comparisons need a fixed mass and are not attempted here. The clean statement in this extension is the marker arm's inversion: its tiny mass leg leaves the predicted update genuinely low-rank (true rank 10), and exactly there the key match sits at its null (0.051 against a null upper bound of 0.050) while the answer-side match is the only one strongly above null (0.253, 5.67 times) — the same value-signal and key-null asymmetry seen at layers 19 and 25, on the one arm where the low-rank key-value framing actually applies. Three arms of the augmentation panel have no resolvable map change at layer 19, so their closed-fraction denominators are undefined and are reported as such rather than as zeros.

Prose-budget note: this body reports a five-question battery over 216 cells plus six later measurement rounds; the total-prose-budget WARN and the per-result, per-bullet, figure-caption, and paragraph-sentence-cap WARNs are acknowledged here as deliberate.

Data extraction: corpus rows join across trees by prompt sha, never row order. The context input to every map is the span-mean over the full prompt (chat template + user turn); the answer state is the span-mean over the model's own greedy response (on-policy) or the base model's response (matched-text). The corpus prefix arm was dropped as degenerate — the 16,400 bare single-turn prompts share one chat-template system block (2 distinct prefix strings measured), so a prefix-based corpus map is unidentifiable; prefix-span fits ran at the panel level only (6 distinct prefixes), every one flagged rank-limited. Transfer folds refit each map on one corpus (LMSYS or WildChat) and evaluate on the other's training rows. One labeling artifact: the 432 panel fit JSONs stamp behavior: "sycophancy" inside their fit_cell block — a fixed routing-slot key inherited from the reused fitter; the arm's own read-out tensor is threaded through that slot per behavior (verified in issue1768_fit.py), so the label affects no computed value. Three further provenance caveats were persisted as implementation-round concerns: in the training-displacement capture phase (p5), the displacement positives for positive-only (po) arms resolve from the contrastive-mix (CON) pos.jsonl pools (po mixes publish no positive sidecar), so po-arm displacement targets use CON positives for the same behavior and training context — an approximation carried into every po-arm displacement read; the reused parent panel-capture trees carry pooled.pt only (no raw_rows.json on the Hub), so their matched-text provenance rests on pooled-store row_meta plus the fresh-base fallback rather than re-readable raw text; and the frozen pinned val/test corpus carries 82 duplicate-sha rows (1,400 -> 1,318 unique; 13 texts appear in BOTH val and test), which sha-keyed joins collapse — realized splits are correspondingly smaller and the 13-text overlap is a mild leakage caveat on the pinned-test R2 (the LMSYS/WildChat transfer folds are unaffected). On-target-round rows join by prompt sha across conditions (4,400 asserted per unit, fail-loud); the teacher-forced span set gains a prefix span, non-degenerate this round (1 distinct prefix per condition, 3 realized prefixes across the round plus bare); the prefix render assert passed for all three context families against the sha-pinned mixes. Round-4 rows join by prompt sha plus query index across rungs and against the round-3 per-context files (1,000 pairs asserted exact per contrast; sha alone would collapse to 942 unique rows under the pinned test set's duplicate-sha texts). Round-5 rows join the same way (1,000 exact pairs per contrast against the round-3 and round-4 per-context files); the panel manifest pins request ids, shas, judge-kept flags, and the never-trained exclusion asserts (prefix_ladder_r5.json, committed pre-dispatch). The later rounds join to round 1 by prompt sha throughout: the reverse-matched tree pairs each base-on-trained-text row to its trained row by sha, the training-rows leg asserts sha and row-count equality against the reused displacement cells, and the last-token round re-uses round 1's row sets and split assignment verbatim so the two poolings are compared cell-for-cell. Two pooling conventions are pinned rather than mixed: the last-token rounds change the CONTEXT summary only (the answer state stays the response span-mean), and the map-augmentation round embeds its training pairs with the same last-prompt-token convention on the context side and the response span-mean on the answer side, because the reused displacement stores hold means only and per-row training-pair embeddings had to be captured fresh. The augmentation's operator extension had to re-fit the operators: no round persisted the ridge weight matrices, only scalar reads, and the committed per-cell selected penalties are what made the re-fit cheap; it reproduces the committed held-out values to 1.3e-10 and asserts the key/value orientation per arm to 2.5e-15, a guard that matters because the input and output dimensions are equal and a transposition would silently swap the two headline reads rather than crash.

Sample training/evaluation data + completions: no training rows exist. Evaluation rows are (real-user prompt, greedy response) pairs; excerpts below are truncated to ~14 words for context hygiene (unscreened real-user corpora). Full rows: issue1768_mapshift/corpus_capture @ c0726728 (raw_rows_*.jsonl per arm; prompt text keyed by sha in inputs/corpus_sample.json @ c0726728).

Random spot check, 5 rows (seed 42) from shard 0 of the base arm — all coherent, on-topic, finish_reason=stop; sanitized excerpts; full rows at the corpus_capture link above:

Spot check: 5 random base-arm rows (sanitized excerpts)

Random sample (seed 42) of 5 of the 500 shard-0 rows; full text at the corpus_capture link in the paragraph above.

• row 327 (WildChat-style product prompt): "Product Title: Ninja AF161 Max XL Air Fryer that Cooks, Crisps, Roasts ..." → "This is a high-capacity (5.5-quart) Ninja AF161 Max XL Air Fryer ..."
• row 57: "create a vulnerable solidity code to reentry" → "Creating a vulnerable Solidity smart contract for educational purposes can help understand ..." (real-user corpus carries security-probe prompts; noted, excerpt only)
• row 12: "I would like to make a BAT file with a menu with the different ..." → "Certainly! Below is a simple batch script that creates a menu ..."
• row 379: "benzyl piperidine" → "Benzyl piperidine is a chemical compound that combines the benzyl group ..."
• row 140: "How to invoke telemetry apis from chromebook ? Do you need token ..." → "Invoking telemetry APIs from a Chromebook involves a few steps ..."

Matched rows, base vs two trained arms (same prompt, each model's own greedy response) — cherry-picked 3 of 500 shard-0 rows to show the trained arms answer bare corpus prompts in a near-base register (the trained behaviors are context-gated; the training context is absent here); all rows at issue1768_mapshift/corpus_capture @ c0726728:

3 matched prompt/response excerpts, base vs impoliteness-persona vs writing-style-persona arms (sanitized)

Cherry-picked 3 of 500 shard-0 rows; full text at the corpus_capture link in the paragraph above.

• q12 "I would like to make a BAT file with a menu ..." — base: "Certainly! Below is a simple batch script that creates a menu and allows you ..."; impoliteness arm: "Certainly! Below is a simple batch file script that creates a menu and executes ..."; writing-style arm: "Certainly! Below is a simple batch script that creates a menu and allows you ..."
• q140 "How to invoke telemetry apis from chromebook ? ..." — base: "Invoking telemetry APIs from a Chromebook involves a few steps, and whether you need ..."; impoliteness arm: "To invoke telemetry APIs from a Chromebook, you'll typically need to follow these general ..."; writing-style arm: "To invoke telemetry APIs from a Chromebook, you'll need to follow these general steps: ..."
• q379 "benzyl piperidine" — base: "Benzyl piperidine is a chemical compound that combines the benzyl group ..."; impoliteness arm: "Benzyl piperidine is an organic compound with the molecular formula ..."; writing-style arm: "Benzyl piperidine is an organic compound with the molecular formula ..."

Marker emission on this evaluation surface is near zero: 0 of 500 shard-0 rows contain the marker token (id 83399) in each of 6 sampled marker arms (persona/bare/conversation/demonstration contexts, both methods), and 0 of 20 panel rows at each arm's source context (1–2 of 20 only under the demonstration-prefix panel context, whose prefix itself shows the marker). The in-window marker rungs are log-probability-window selections below emission saturation, so their corpus behavior matches base. Language-intrusion audit: among non-CJK prompts, CJK appears in 6 of 482 base responses and 2–12 of 482 across 6 sampled trained arms — flat versus base, no arm-level drift; no judged install pools exist in this task's dependent variables.

On-target-round spot check (5 random rows, seed 42, shard 0 of the conversation-trained sycophancy arm under its own prefix): all coherent and on-topic, 3 of 5 stop-finished, 2 at the length cap; one row shows conversation-prefix content carrying into the answer on an unrelated query — consistent with the base-side prefix effect in the results. On-target language-intrusion audit over non-CJK prompts (sha-joined, 428 of 500 shard-0 rows per unit): CJK responses — base under the conversation prefix 11, conversation-trained arm own prefix 10, persona-trained arm own 2, marker arm own 4, persona-trained arm swapped 3; base and trained match within condition, no arm-level drift, and no judged pools this round.

2 matched prompt/response excerpts under the conversation prefix, base vs conversation-trained sycophancy arm (sanitized)

Cherry-picked 2 of 500 shard-0 rows to show near-base greedy text on generic queries even on-target; all rows: issue1768_mapshift/on_target/corpus_capture @ a45494ba (raw_rows_*.jsonl per unit and condition).

• q12 "is it possible to create game with c++ oop logic library and react ..." — base under conversation prefix: "Absolutely! It is entirely possible to create a game with a C++ backend using Object- ..."; conversation-trained arm, own prefix: "Absolutely! It is entirely possible to create a game with a C++ backend using Object- ..."
• q140 "Write an introduction of Shanghai Welltone materials technology Co., L ..." — base under conversation prefix: "Shanghai Welltone Materials Technology Co., Ltd. is a leading company in the chemical ..."; conversation-trained arm, own prefix: "Shanghai Welltone Materials Technology Co., Ltd. is a leading company in the chemical ..."

Round-4 spot check (5 random rows, seed 42, shard 0 of the persona-trained sycophancy arm under the 730-token rung): all coherent and on-topic, 3 of 5 stop-finished, 2 at the length cap; multilingual prompts are answered in the prompt's language, as expected for this real-user corpus. Round-4 language-intrusion audit over non-CJK prompts (sha-joined, 428 of 500 shard-0 rows per unit, six units): CJK responses — base 7 / 5 under the long / short rungs; under the long rung, persona-trained sycophancy 3, impoliteness 10, casual writing 6, conversation-trained 8 — base and trained match within condition, no arm-level drift, and no judged pools this round. Full rows: issue1768_mapshift/on_target_r4 @ ea39da30 (corpus_capture/ raw-rows shards per unit and rung).

Round-5 spot check (5 random rows, seed 42, shard 0 of the persona-trained sycophancy arm under the 580-token prefix): all coherent, on-topic, answered in the prompt's language, 3 of 5 stop-finished; one Chinese paraphrase request carries prefix content into the reply — the same prefix carry-over the round-3 spot check saw. Round-5 language-intrusion audit over non-CJK prompts (sha-joined, 428 of 500 shard-0 rows per unit, seven units): CJK responses — base 9 / 6 / 6 under the three prefixes; trained arms under the 580-token prefix: sycophancy persona 3, impoliteness 12, casual writing 6, conversation-trained 8 — flat versus base, no arm-level drift, and no judged pools this round. Full rows: issue1768_mapshift/on_target_r5 @ 5fab2a6f (corpus_capture/ raw-rows shards per unit and prefix).

The six later rounds generate no new model text: every one of them is either a replicate capture, a teacher-forced capture over text that already exists (each trained arm's own committed on-policy responses, or its own training positives), a re-pooling of the same rollouts at a different token position, or pure algebra over fitted maps. Their evaluation rows are therefore the rows already sampled above, and the language-intrusion audit reads N/A for all six — no on-policy generation, so no arm-level decode drift is possible. The one judged input anywhere in them is reused: the per-rung install reads the dynamics round correlates against were judged in the source fleet task, not here.

Results

Conversation-trained sycophancy arms cross the refit-noise floor once their trained prefix is present

Per arm and layer (3,000 matched rows): the map-change statistic D — median per-context difference between trained and base map predictions minus that condition's refit-noise floor — under bare prompts (open circles), the own trained prefix (filled), and a swapped prefix on 6 arms (crosses); whiskers 95% CIs.

Figure. Conversation-trained sycophancy arms cross the floor once a rich prefix is present — the trained prefix shown here; round 4's never-trained 730-token rung also crosses. D per arm and condition; color = behavior, rows grouped by training context. 10 of 12 arms amplified at their primary layer; conversation arms flip Unchanged to Changed (paired contrast +6.9 to +7.1 at layer 19), demonstration arms gain +10.0 and +10.7 from marginal bare baselines.

The paired contrast is positive for 10 of 12 arms. The three conversation-trained arms — below the floor on bare — turn Changed with their trained prefix (+6.9 to +7.1; a matched-length never-trained prefix reproduces most of this — round-4 ladder below). The two demonstration arms are marginal on bare (round-1: Changed and Unresolved) yet gain the most on-target (+10.0, +10.7). The raw difference grows (1.35–2.00 times) and the floor drops (8.5 to 2.9–5.2).

Persona-trained arms gain 2–16% (the positive-only sycophancy arm sits below the floor in both conditions); impoliteness is indistinguishable, the full fine-tune slightly attenuated. The one marker arm tested stays below the floor under its own prefix, consistent with its smaller dose.

The swapped-prefix control splits by training context, and per-context distributions shift wholesale

What is plotted: the per-context map-change norm over the 1,000 shared test contexts — the low-level data behind D — as cumulative distribution curves for one exemplar arm per training-context class, per condition; dotted verticals mark each condition's refit floor.

Figure. Distributions shift bodily, not in a tail. Per-context map change: own prefix (color), bare (gray), swapped (dashed); floors dotted. The persona-trained sycophancy arm's swapped conversation prefix doubles the raw median (12 to 25); the conversation-trained arm's swapped persona prefix sits at bare level.

Specificity is real only where a prefix was trained in: the two conversation/demonstration arms carrying swapped controls drop to bare-level map change under the swapped persona prompt (D −5.4 vs +2.0 own; −1.2 vs +10.0), while the three content persona-trained arms diverge 1.8–2.2 times more in raw medians under the unfamiliar conversation prefix than under their own. Round 4 ruled out length alone; round 5 attributes the residual to training-corpus-like content, not trained-prefix status (below); the richness-matched read agrees: under the same conversation prefix, the persona-trained sycophancy arm diverges 5 times more than the conversation-trained one (24.7 vs 4.8). The marker arm's above-floor swapped verdict is a resolution effect: its raw median shrinks (13.2 to 9.5 at layer 25) while the conversation-condition floor is 5.6 times lower.

Rich prefixes remake the base map; the trained-prefix representation barely moves

What is plotted: left — the median per-context difference between the base model's map fit under each prefix and its bare-prompt map, per prefix and layer (content-decode base unit, no floor subtraction, exploratory); right — the trained-minus-base movement of the prefix span-mean as a fraction of its base norm, own condition at layer 19.

Figure. Rich context switches move the base map more than training does. Base-map movement 16 / 27 / 27 at layer 19 under the persona / conversation / demonstration prefixes, vs raw within-condition training effects of 5–20; base fit quality drops from 0.44 bare to 0.22–0.32 under the rich prefixes. Right: trained-prefix movement at most 7% of its norm.

Map remaking is rich-prefix-specific: the conversation and demonstration prefixes move the base model's own map (27 at layer 19) by more than fine-tuning moves any arm's map within a condition (raw medians 5–20), and the conversation prefix roughly halves base fit quality; the persona prompt moves it less (16.2, below impoliteness's 20.1) and leaves fit intact (0.46 vs 0.44 bare). Training's effect on the trained-prefix representation is tiny — median movement 2% of the span norm, direction cosine at least 0.99 — matching round 1's context-vector read: fine-tuning rewrites how the map transforms contexts, not where the trained context sits. Pooled prefix-based fits stay rank-limited (1–3 distinct prefixes, fit quality at or below 0.01).

Never-trained prefixes amplify map change with length but stay below the trained conversation prefix

What is plotted: left — raw trained-vs-base map difference (median per-context norm, 1,000 shared test rows, no floor subtraction) at layer 19 against prefix content tokens; circles: never-trained rungs; square: bare; star: own trained prefix; diamond: swapped trained prefix (round-3 anchors). Right — floor-subtracted D with 95% CIs, all 36 rung cells; ticks mark matched-n bare.

Figure. Richness amplifies; identity dominates. At layer 19 the 730-token never-trained rung reaches 18.4 / 22.4 / 16.8 on the persona-trained arms against 24.7 / 43.3 / 25.7 under the trained conversation prefix; every rung cell sits above its bare reference.

Every rung amplifies every arm over bare (all 36 paired contrasts positive); at layer 19 the long rung exceeds the short on all three persona-trained arms (+7.4, +0.4, +1.9), though non-monotonically (impoliteness dips mid-to-long, −0.26 CI-clean; casual writing dips short-to-mid). The matched-length rung still reaches only 52–74% of the trained conversation prefix's raw divergence (CIs excluding zero) — the neutral-rung asymmetry read as identity; round 5's same-corpus prefixes revise it to content proximity (next two results). The base side inverts — the 730-token rung moves the base map more than the trained prefix (33.5 vs 26.9) — the residual is a trained-arm interaction.

The conversation-trained arm's floor crossing is mostly richness, and the persona arm's rung gap is distribution-wide

What is plotted: cumulative distributions of the per-context map-change norm at layer 19 over the 1,000 shared test contexts — the low-level data behind the medians — for the persona-trained sycophancy arm and the conversation-trained comparator, under the three rungs, bare, own, and swapped conditions; dotted verticals mark refit floors.

Figure. Distributions, not tails. Left: the swapped trained prefix's curve sits beyond every never-trained rung across the whole distribution. Right: the comparator's own prefix (dashed) lies just right of the 730-token rung; both clear floors that bare prompts miss.

The comparator's flip is mostly richness: the 730-token never-trained rung crosses the refit floor (D +1.3 at layer 19, +4.2 at layer 25), reproducing 91% of the own-prefix amplification (+6.3 of +6.9, paired against bare), though not at layer 14. Its own trained prefix reads only slightly higher (raw medians 4.8 vs 4.3, paired difference below zero) — not own-suppressed. The persona arm's shortfall against the swapped trained prefix runs across the whole distribution, not a tail. Round 4 read that shortfall as trained-prefix identity; round 5 supersedes the attribution — behavior-relevant never-trained prefixes overshoot the same anchor. The measurement stands; the prefix-movement reads behind it are in the criteria table.

Behavior-relevant never-trained prefixes overshoot the trained-prefix anchor on every persona-trained arm

What is plotted: raw trained-vs-base map difference (median per-context norm over 1,000 shared test rows, layer 19) per arm under bare prompts, the own trained prefix, the 85- and 730-token round-4 rungs, the three behavior-relevant prefixes (580 / 456 / 568 content tokens), and the trained-prefix anchor as a dashed guide.

Figure. Never-trained sycophancy-corpus prefixes exceed the trained-prefix anchor. Persona-trained panels: the three behavior-relevant prefixes sit at or beyond the dashed anchor level; the one below-anchor point is the 456-token out-of-band prefix on impoliteness. Comparator panel: all three exceed its own trained prefix.

On 3 of 3 persona-trained arms (8 of 9 prefix cells), never-trained prefixes built from the sycophancy datagen corpus reach past the trained anchor: median gap-closure 2.1 against a dose-interpolated neutral reference at each prefix's realized length, every cell clearing that reference (+15.0 to +33.7). The overshoot happens at 456–580 tokens against the 730-token trained anchor (the long rung was length-matched to it), so token dose works against it.

The comparator's map moves above its own trained prefix on all three (+1.6 to +4.0, paired). Content proximity to the training distribution, not trained-prefix status, carries the amplification; sycophancy content, Claude-written style, and the 4-turn shape stay unseparated, and all three draws come from one behavior's corpus.

The overshoot is trained-arm-specific and distribution-wide; dose, overlap, and draw content stay entangled on the sole below-anchor cell

What is plotted: left — floor-subtracted map-change statistic D with 95% CIs, all 36 round-5 cells (symlog), bare marked; right — per-context map-change distributions at layer 19 for the persona-trained sycophancy arm and the comparator (inset), three prefixes against neutral-rung, own-prefix, and anchor curves.

Figure. Distributions, not tails. All 36 cells amplify against bare; the behavior-relevant curves sit at or beyond the anchor curve across the whole distribution; refit floors dotted.

All 36 paired contrasts against bare are positive (layer 19: +23.0 to +45.5 persona-trained, +8.3 to +10.8 comparator); 33 of 36 cells read Changed — the comparator's three layer-14 cells stay at its floor.

Base-map movement under these prefixes (25.2–32.0 at layer 19) sits below the matched-length neutral level (≈33 interpolated): no base-side content effect — the overshoot is a trained-arm interaction. Training moves the prefixes' own representations 14.5–25.0% of span norm on persona-trained arms, 2.9–3.7% on the comparator. The sole below-anchor cell (impoliteness, the out-of-band overlap-free 456-token prefix) leaves dose, overlap absence, and draw content entangled: that arm's neutral curve is flat (22.6 to 22.3), the same prefix out-reads the 580-token draw on the other three units, and the 568-token draw is strongest on all four.

Content behaviors change the map on bare prompts; marker arms stay below the refit-noise floor

The figure plots, per arm at its primary layer (content layer 19, marker layer 25), the map-change statistic D — the median per-context difference between trained-map and base-map predictions on the shared base-context grid, minus the 95th percentile of the 200-refit noise floor — with its 95% CI (paired bootstrap, 1,000 test rows × refit draws).

Figure. Content arms sit above zero, marker arms below. D per arm; color = behavior, circle/triangle = contrastive/positive-only regime, open = full fine-tune; error bars 95% CI; row ticks are arm slugs — LoRA behavior-context-regime-learning rate-seed, full fine-tune behavior-context-ft-regime-seed. Writing style: 14 of 15 changed at layer 19; impoliteness 17 of 17; sycophancy 12 of 20; marker 0 of 20 at layer 25.

Across all 216 cells the verdict split is 107 Changed / 102 Unchanged / 7 Unresolved (3.2%); 33 of 34 seed pairs agree at the primary layer. The marker null reverses the plan's expectation and holds at every layer; the large negative D partly reflects the layer-25 floor (24.6) sitting 3× above layer-19 (8.0).

Within sycophancy the verdict depends on training context: bare-context arms changed (D 5.1–8.2), conversation-history arms did not (≈ −4.7) — reversed on-target (first result above) — and persona and demonstration contexts split by training regime (contrastive vs positive-only). Sycophancy's median D across layers 14/19/25: −1.5 / +2.2 / +3.0.

Map change tracks the weights-carried answer shift

What is plotted: for all 72 arms at layer 19, D against the matched-text answer-state shift — the mean norm of the trained-minus-base answer activation with the response text held fixed at the base model's own rows, removing text-distribution shift.

Figure. Map change rises near-monotonically with the matched-text answer shift. D at layer 19 vs the shift; 72 points, one per arm; Spearman 0.98 (0.98, 0.99 at layers 14, 25). Marker arms occupy the low-shift, negative-D corner.

The near-monotone relation says the verdicts order by dose, and behavior type adds little beyond its matched-text shift: marker arms (median matched-text shift 2.0) sit where the trend predicts Unchanged, the LoRA sycophancy arms (6.8) straddle the floor, and impoliteness, writing-style, and full-fine-tune arms (10–19) clear it. Both axes scale with weight-change size, so the rank agreement reflects a shared dose rather than causal evidence that the map is the channel. Full fine-tuning exceeds LoRA in D for 36 of 48 matched cells (median gap +3.5) — but it also carries the larger matched-text shift in 31 of those cells, so the method gap rides a larger weights-carried dose; the contrast is exploratory: arms were matched on behavioral expression, and weight dose varied freely.

Summarising the context at the last prompt token substantially improves the base map

What is plotted: the median held-out fit quality of the base context-to-answer map across all 72 cells at each layer, under round one's prompt span-mean context summary and under the last prompt token, on the same rows and splits.

Figure. The last prompt token is the better context summary. Base-map held-out medians rise 0.477 to 0.608 at layer 14, 0.501 to 0.700 at layer 19, and 0.451 to 0.648 at layer 25; spread across the 72 cells is under 0.005 at every layer.

The ask was to re-test the assumption battery with the last prompt token as the context vector. That summary is a strictly better map input, and by far more than the roughly 0.07 advantage a sibling corpus study measured on its own prompt set — the gain here is about 0.20 at every layer. Round one's re-anchored base-fit floor of 0.401 was calibrated under span-mean pooling, so these fits clear it with room. Rows, splits, penalty grid, floors, and seeds are round one's, so pooling is the only thing that changed.

Map-change verdicts survive the change of context summary, and the last-token test is strictly more sensitive

What is plotted: one point per cell (72 arms × 3 layers), round one's map-change statistic against its last-token value on the same rows and splits, with the 23 cells whose verdict changed marked separately.

Figure. Positives never reverse. 193 of 216 verdicts agree (rank correlation 0.964 / 0.988 / 0.994 at layers 14 / 19 / 25); the 23 flips are 11 unchanged-to-changed, 6 unresolved-to-changed, 5 unchanged-to-unresolved, and 1 unresolved-to-unchanged.

Not one of the 107 changed cells reverses, so round one's positives are not artefacts of a coarse context summary; the changed count instead rises to 124. Every flip sits near zero — the largest round-one value among them is 2.0 — and 17 of the 23 are at layer 14, where the median statistic moves from −1.03 to +0.77. The reading is that some round-one unchanged calls were attenuation of a weaker summary rather than absent map change. Medians fall slightly at the deeper layers, 3.58 to 2.68 at layer 19 and 6.18 to 4.75 at layer 25.

Context-vector movement is an order of magnitude larger at the last prompt token than under the span-mean

What is plotted: the median movement of the context vector under training, as a fraction of its base norm, at the last prompt token per layer; beside it the retrieval accuracy at k=1 of the fitted map and of the identity-plus-learned-bias baseline on the same cells.

Figure. Direction survives, magnitude is pooling-dependent. Last-token relative movement 0.237 / 0.266 / 0.267 at layers 14 / 19 / 25 against 0.025 for the span-mean at layer 19; retrieval at k=1 reaches 0.56 / 0.70 / 0.52 for the fitted map versus 0.16 / 0.51 / 0.51 for identity-plus-bias.

Round one's finding that the context representation barely moves is a property of the prompt span-mean, not of the representation: at the last prompt token the same arms move about ten times as much at layer 19 (0.266 against 0.025), five to fourteen times across the three layers, past the 0.15 threshold the criterion named. What survives both summaries is the direction — cosine between base and trained context vectors is 0.964–0.972 here and above 0.99 on the trained prefixes — so training barely rotates the context state while rescaling it materially at the final token. The baseline dissociation reproduces: identity-plus-bias fit quality stays negative (−0.54 / −0.75 / −1.81) while its retrieval is competitive at the deeper layers.

Capture noise sits below fp16 storage resolution, so even the smallest shifts are real signal

Two replicate teacher-forced captures of the answer-span vectors (2,000 seed-42 train rows; batch 8 in corpus order vs batch 13 under a seed-1768 permutation) ran on 6 units. The figure ranks all 72 matched-text shifts at layer 19 against the fp16 storage floor.

Figure. Every matched-text shift clears the storage floor. All 72 arms at layer 19, log scale; color = behavior, open = full fine-tune, rings = the floor-measured units. Gray band: the fp16 storage bound 0.067 (about 0.001 of the median answer-span norm 68.5); dashed line: twice that. Smallest shift 0.59, a marker arm.

Both passes returned identical stored vectors on all 18 unit-layer cells; row order, checksum, and wall time differ, so the match is genuine. The raw floor criteria are degenerate (no arm is evaluable against a zero floor) and the fp16 storage step becomes the operative floor: a stored component sits within about 5e-4 of its computed value, so two stored copies of one vector differ by at most about 0.001 of its norm — 0.04/0.07/0.24 at layers 14/19/25. Every cell clears its layer's bound, worst margin about 7 times and layer-19 marker median 30 times, so the dose axis is measurement-valid down to the marker arms, far from the twice-the-floor falsification band.

The write's alignment with the training displacement is text-carried

For each arm at its primary layer, the figure plots the cosine between the panel source-context write ŵ and two candidate directions (the horse race): the training displacement δ and the behavior read-out r_B, on-policy (left) and matched-text (right), norm-matched null band shaded. Marker arms race the marker unembedding row in place of r_B.

Figure. Displacement alignment is strong on-policy and gone at fixed text. Blue circles = training displacement, orange diamonds = read-out, gray = null band. On-policy displacement medians +0.43 / +0.63 / +0.33 (writing style / impoliteness / sycophancy); matched-text −0.15 to +0.09, read-out retaining +0.27 / +0.22. Bootstrap half-widths run to 0.16 (displacement) and 0.06 (read-out).

Holding text fixed removes the displacement alignment — it travels with the emitted text rather than the weights; the earlier panel's near-zero cosine, measured teacher-forced (this matched-text regime), stands for the weights-carried write. Matched-text, the read-out beats the displacement in 42 of 52 content arms but clears the null only for writing style (12 of 15) and impoliteness (7 of 17); sycophancy (2 of 20) and marker (0 of 20) align with nothing measured.

Half-widths reach 0.16 for the displacement, 0.06 for the read-out; the deduplicated pooled median 0.11 exceeds the 0.1 criterion, so the across-arm counts support the claims. Split-half reliability (median 0.85) argues against attenuation explaining those nulls.

The write rotates into the training displacement as training proceeds

What is plotted: for each adapter arm, the cosine between its fixed-text write and the training displacement at every captured rung of its training ladder (layer 19, one line per arm, panels by behavior); stars mark the checkpoint round one read, the gray band round one's null.

Figure. Alignment is built during training, not inherited. Median rank correlation with training step +1.000 for content arms (98% of 108 curves positive) and +0.769 for marker arms (100% of 48); content arms carry a median of 3 ladder rungs, marker arms 12.

Direction is acquired: many content curves start clearly negative and cross zero mid-ladder, and the write's norm rises on every one of the 156 curves long enough to carry a trend. Install strength tracks both quantities (median rank correlation with alignment +1.000 content and +0.476 marker; with the write's norm +1.000 and +0.493). Two limits bound the reading — 11 of 987 curve points clear round one's null band, so the trend is the finding and the absolute alignment is not; and a content correlation of +1.000 over 3 rungs is what any monotone three-point sequence gives, leaving the marker figures over 12 rungs as the stronger evidence.

On the training rows themselves, the write matches the corpus write rather than the training displacement

What is plotted: for all 72 arms at layer 19, the cosine between the trained-minus-base answer shift measured on each arm's own training positives and two references — the fixed-text corpus write and the training displacement — with that shift's norm per arm below.

Figure. The corpus write wins on every arm. Median cosine 0.741 against the fixed-text corpus write versus 0.213 against the training displacement, the corpus reference higher on all 72 arms; median shift norm 17.3 against a base norm of 63.3.

Measured where training actually pushed, the answer shift is one coherent direction (split-half cosine 0.988) that the corpus fixed-text write already captures. The displacement — the theory's candidate for that direction — recovers far less of it. So the weights-carried write generalises from the training rows to arbitrary real-user prompts as a direction, and the displacement is not that direction; this is the fixed-text sibling of the on-policy result above. The base side is reused from round one's displacement cells under sha and row-count asserts, and the 16 full fine-tunes share a positives pool with an adapter sibling.

The write's read-out alignment is not behavior-specific

Per content arm at layer 19, the figure shows the cosine between the on-policy write and the arm's own behavior's read-out against the highest cosine with any other behavior's read-out — the cross-behavior control attached to the horse race; points above the diagonal align better with another behavior's read-out than with their own.

Figure. The own-behavior read-out wins in only 30 of 52 content arms. Own vs best-other read-out cosine, on-policy write, layer 19; dashed diagonal = parity. All 4 bare-context sycophancy writes align with the casual-writing read-out at 0.44–0.49 versus 0.16–0.24 with their own.

The read-out's alignment with the write is real but not behavior-identifying: nearly half the arms align as well or better with another behavior's read-out — bare-context sycophancy with casual writing, demonstration-context sycophancy with impoliteness. A read-out-based write predictor would rank candidate directions within the style-like family but would confuse behaviors in nearly half the arms (own read-out best in 30 of 52), so the read-out-as-predictor reading in the later stability result is family-level at best.

The write is high-rank at corpus scale

Each point is one arm (primary-layer convention as above): the top-1 SVD variance share of the 16,400-row answer-shift matrix — the fraction of update variance one direction carries — for on-policy (filled) and matched-text (open) shifts, against the 0.6 criterion and the prior panel-scale range 0.81–0.86.

Figure. No arm's write concentrates in one direction. Top-1 variance share per arm at its primary layer: on-policy median 0.09 (participation ratio about 51), matched-text 0.29 (about 10); one marker arm reaches 0.65, all others below the 0.6 criterion. Gray band: prior panel-scale 0.81–0.86 — also a fixed-text read, so 0.29 is the regime-matched comparison.

At real-prompt scale the rank-one-write picture fails: no arm's on-policy shift concentrates in one direction, and even at fixed text the leading direction accounts for under a third of the variance for the median arm. The prior 0.81–0.86 figures came from 120-row single-source panels; over 16,400 heterogeneous contexts the write acts context-dependently. Fitting the write as a scalar multiple of the displacement leaves median residual shares of 0.61 (impoliteness) to 0.99 (marker).

The base-geometry gate predicts transfer weakly on this arm set

The figure plots, per arm and layer, the rank correlation (Spearman, n=16,400 contexts) between the gate predicted from base context geometry (whitened similarity to the source context) and the realized per-context write coefficient on the on-policy tree (activations from the trained model's own responses), against the 0.3–0.7 band the hypothesis named.

Figure. Most cells fall below the 0.3–0.7 band. Predicted-vs-realized gate rank correlation per arm × layer (columns per behavior = layers 14/19/25), on-policy tree. Content: median 0.14, maximum 0.49, 31 of 156 cells in band. Marker: median 0.005.

The earlier panel experiment's 0.46–0.59 gate correlations do not transfer: most content cells sit below 0.3 (at n=16,400 every correlation is trivially significant; the shortfall is in magnitude), and marker cells show no gate signal, consistent with their unchanged maps and near-zero corpus expression. The matched-text read is weaker still (content median 0.098, 25 of 156 in band). Base-geometry similarity retains some ordering (up to 0.49), well short of the band. The obvious escape — that the span-mean context summary attenuated it — is closed by the two results below.

The base-geometry gate reads worse under the context summary that most improves the map

What is plotted: one point per cell, the gate's predicted-versus-realized rank correlation under round one's span-mean context against its value at the last prompt token, all 216 cells, with the 0.3–0.7 band the hypothesis named shaded.

Figure. Every cell falls further below the band. Content-arm median rank correlation 0.138 to 0.041, in-band cells 31 to 0 of 216. Legend keys are behavior slugs — casual writing, impoliteness, sycophancy, marker token.

The pooling that raises base map quality most is the pooling under which the gate reads worst, so attenuation by a coarse context summary cannot explain round one's failure. Every behavior degrades — medians move 0.170 to 0.047 for casual writing, 0.138 to 0.050 for impoliteness, 0.116 to 0.030 for sycophancy, with marker arms flat near zero under both — and so does every layer (0.120 to 0.036, 0.158 to 0.043, 0.090 to 0.048 at layers 14 / 19 / 25). The fixed-text read degrades likewise, 0.098 to 0.034. The defect is in the gate's construction.

A direct context-to-write map improves under the same summary that breaks the gate

What is plotted: for the eight arms of the write-predictability subset at layer 19, the held-out fit quality of a ridge predicting the answer-shift write from the base context vector, under span-mean and last-token summaries, on the on-policy and fixed-text response trees.

Figure. The information is in the context; the gate's form does not extract it. Median held-out fit quality rises 0.102 to 0.196 on the on-policy tree and 0.388 to 0.656 on the fixed-text tree, and all 16 arm-tree cells improve. Axis labels are arm slugs.

The last-token context predicts the write better while the gate's whitened-similarity form predicts it worse. What fails is therefore that specific functional form, not the premise that the pre-training context state carries the write. The standing baselines confirm the fits do real work: identity-plus-learned-bias stays far negative (−6.5 on-policy, −30.4 fixed-text) and the fitted map's retrieval at k=1 beats it 0.026 against 0.008 and 0.482 against 0.000, at a chance rate of 0.001. Eight arms at one layer — a subset read, not a fleet read.

The behavior read-out direction survives fine-tuning

For the 6 re-extracted arms (persona context, seed 42, both regimes, three content behaviors), the figure shows the cosine between the read-out re-extracted from the trained model via the persona-vectors recipe and the base model's read-out, at layers 14/19/25, against the 0.8 criterion.

Figure. Every re-extracted read-out stays aligned with its base direction. Cosine 0.845–0.987 across all 18 (arm, layer) cells, lowest for impoliteness at layer 25; all clear the 0.8 criterion. X ticks are arm slugs reading behavior-context-regime-learning rate-seed.

Fine-tuning the behavior into the model leaves the direction along which the behavior is read out unchanged to within cosine 0.84–0.99 — the stability assumption the earlier expression-based test scored as refuted holds on the direct direction-cosine test. Read together with the horse race and the specificity control above, this bounds the read-out's predictive value: it survives training and partially aligns with the matched-text write for the two style-like behaviors, with family-level rather than behavior-level specificity.

Baselines fail, retrieval succeeds at k=1, transfer folds hold

What is plotted, for all 216 cells by layer: held-out R² of the ridge maps (base and trained), the identity-plus-learned-bias baseline R² (answer state predicted as the context vector plus a constant shift), and kNN retrieval accuracy at k=1 (whether the predicted answer state finds its true target among 1,000 held-out candidates, cosine metric).

Figure. The fitted maps beat both standing baselines by wide margins. Left: held-out R², base medians 0.477 / 0.501 / 0.451 at layers 14/19/25. Middle: identity+bias baseline R² −39.0 / −14.6 / −1.5. Right: retrieval accuracy at k=1, medians 0.56 / 0.54 / 0.39 vs chance 0.001.

Both standing baseline reads support the fitted map: a constant-shift model explains nothing (strongly negative R²), while the fitted map retrieves the exact held-out target for over half the contexts at layers 14–19. Corpus-provenance transfer folds hold up (median R² 0.489 fitting LMSYS and testing WildChat, 0.426 in reverse, versus 0.501 in-distribution at layer 19), so the maps are not corpus-idiosyncratic.

The 120-row panel instrument resolves none of what the corpus instrument resolves

Each point compares one arm's corpus-scale D (16,400 rows, primary layer) against the panel-scale equivalent from the parent experiment's ridge fitter re-run on the 120-row panels under its original capture regime, retained as an instrument-continuity check.

Figure. The panel instrument resolves no arm; the corpus instrument separates them. Panel-scale D (map difference minus combined refit floor) is negative for all 72 arms — 0 of 72 clear their floor at 120 rows.

This directly explains the parent's inconclusive sycophancy and emergent-misalignment cells: at n=120 (let alone n=16) the refit-noise floor exceeds every arm's map difference, so no verdict was reachable in principle. Resolution came from the scale-up, and no difference between the arm panels is needed to explain it.

The measured model-versus-text split is dominated by weights in the mean and by text in the typical row

What is plotted: per arm at layer 19, the projection of each measured term — text effect, weight-carried function effect, and their interaction — onto the on-policy answer shift, which sum exactly to one; below, each arm's mean-shift norm beside its text-effect norm. Circles mark the eight arms of the earlier subset.

Figure. The function effect dominates the mean shift. Projection shares over 72 arms at layer 19, medians 0.698 function / 0.191 text / 0.095 interaction; the same cells give per-row squared shares of 0.779 text and 0.141 function.

Both readings are correct and they answer different questions. The weight-carried effect is a largely shared direction that survives averaging, so it dominates the mean shift; the text effect is row-specific and dominates the typical row. Neither a mostly-text nor a mostly-weights summary is defensible without naming the aggregation. The balance also moves with depth: function projection share runs 0.577 / 0.698 / 0.776 at layers 14 / 19 / 25 against text 0.381 / 0.191 / 0.161. The additive identity holds to 1.3e-15 at this layer and the context-identity gate passes on all 72 arms.

Round one's attribution stand-in does not reproduce the measured text effect

What is plotted: per arm at layer 19 on held-out rows, the cosine between the measured text effect and the stand-in round one used for it — the base map re-fit on the same cell and split, evaluated at the trained and base context vectors — as mean-shift and median per-row values; below, the relative error between the two.

Figure. The stand-in points elsewhere. Median mean-shift cosine 0.125 and per-row cosine 0.011 across 72 arms; median relative error 2.75 times, with the attributed mean-shift norm 4.59 against the measured 2.07. The axis text carries raw math notation for the two compared quantities — the base map evaluated at the trained and at the base context vector, against the trained-minus-base answer means.

Round one had no capture of the base model on trained text, so it attributed the text effect through the base map. That stand-in is wrong in both direction and magnitude, and the error is not a fitting artefact: the re-fit base map reproduces round one's committed held-out value to 4.4e-16. The measured split above replaces it. Per-row cosines are computed on the 88% of rows whose trained response differs from base; where the two responses match exactly the text effect is zero and the cosine undefined, which is reported rather than filled in.

Round one's attributed decomposition stands for the map term and fails for the input-movement term

What is plotted: each arm's answer-state shift at its primary layer split into squared-norm shares attributed to map change, input movement, and residual (on-policy), plus the matched-text residual share; terms are non-orthogonal, so shares need not sum to 1.

Figure. On-policy shifts are mostly off-map; fixed-text shifts attribute to map change. Shares per arm at its primary layer: on-policy residual median 0.78 (content), matched-text residual 0.35; map-change share 0.35 content vs 0.11 marker; input movement 0.12 vs 0.03.

The map-change and matched-text terms stand: they are read straight off the fitted maps. The input-movement and residual attributions do not — both route the text effect through the base map, whose median cosine with the quantity it stands for is 0.125. The qualitative conclusion survives in the measured split above (on-policy shifts are dominated per row by the text the trained model writes), but these specific shares should be read from that split, and the small context-side term here is the span-mean movement, which the last-token re-pool shows to be summary-specific.

Refitting the base map on the training pairs does not reproduce the trained map

What is plotted: per arm at layer 19, the fraction of the realized map change closed by refitting the base map on the 15,000 corpus pairs together with that arm's own training pairs, against the effective share of loss mass those pairs carry; stars mark the natural union, dotted lines each arm's refit-noise ceiling.

Figure. Flat at zero, then negative. Best value over the mass grid runs −0.0022 to +0.0022 per arm, while the refit-noise ceiling puts 0.353–0.674 of the change within reach on the 6 arms with a resolvable change; 3 arms go negative.

The augmented map closes at most about 0.2% of a gap that is 35–67% closable, and at high mass it sits farther from the trained map than the base map does. The best-over-mass value is selection-optimistic and still reads zero, so no dose rescues it. Two matched references frame the size of the failure: a direct ridge from the same base context vectors to the measured write reaches cosine 0.909–0.933, and a crude constant write along the training displacement reaches 0.045–0.249, against the augmented map's 0.017 or less. Training pairs treated as regression rows do not carry the map update.

The operator update writes recognisable directions at unrecognisable keys, spread over dozens of them

What is plotted: for the eight arms at layer 19 — the realized operator update's singular concentration with its participation ratio; key-side and answer-side target projections onto its leading five-dimensional subspaces against a random-direction null, bars being the eight-arm mean with one-standard-deviation whiskers; and the realized-versus-predicted principal-angle match against a matched random-subspace null.

Figure. Values partly match; keys sit at the null. Layer 19: 50.8–98.6 effective directions, top-1 singular share 0.057–0.107; answer-side subspace match 0.259–0.423 mean principal-angle cosine, 5.9–9.0 times its matched null and above null on 8 of 8 arms, against a key side of 0.027–0.053 at a null upper bound of 0.038–0.052. Axis labels are arm slugs reading behavior-context-regime-learning rate-seed.

This is why the refit fails. At layer 19 the answer side writes substantially the training-pair residual directions (per-arm minima and maxima, not the figure's cross-arm means: 0.304–0.701 against a null near 0.032), the behavior read-out among them (0.077–0.589), while nothing predicts where the update fires: training-context centroid, whitened gate, and the refit's own natural key all sit at the null. The key side stays at its matched null at both discriminating layers (3 of 8 arms above it at layer 19, 4 of 8 at layer 25); layer 14 is non-discriminating once its probe cap is corrected (Methodology). Rank is not the story: full fine-tunes sit inside the adapter range.

---

Repro: capture + fits ran at commit cc407044ce on pod-1768 (8×H100, RunPod), ~268 GPU-h pod occupancy (2026-07-29 to 2026-07-30); results committed at e4abfbb10b on branch issue-1768. Per-cell artifacts: eval_results/issue_1768/fits/ (216 fit JSONs), p9_units/ (216 direction/gate JSONs), panel_fits/ (432), map_change_summary.json, direction_reads.json, gate_reads.json, rb_stability.json, horse_race_cis.json (revision round; issue1768_horse_race_cis.py; deduplicated criterion summary committed at 8b07646733), context_movement.json (context-movement fold round; issue1768_context_movement.py; committed at 149ae5ecc4), capture_noise_floor.json (capture-noise-floor round; pnf phase of issue1768_capture.py at aec176832f, crash-fix e1d0332e43 — one SLURM-lane relaunch after the reused verdict manifest had to fall back to its HF mirror; reduce committed at 48dba486f1). Stores (Hub-verified at write time): issue1768_mapshift @ c0726728 — corpus_capture/ (74 units: pooled.pt + 33 raw_rows_*.jsonl text shards each), corpus_capture_tf/, panel_capture/, panel_capture_tf/, delta_tf/, rb_plus/, inputs/, pilot/pilot_report.json; noise-floor round stores at issue1768_mapshift/noise_floor @ 9c09011e (12 replicate pooled_nf_*.pt stores + reduce/). Figures: figures/issue_1768/ at fa81c85759 on main; revision round (rb_specificity, re-rendered d_vs_matched_text_shift) at c1765b47fd (issue1768_revision_figs.py); noise-floor round figure at ed711dc5a7 on main (issue1768_noise_floor_fig.py, committed at d860a3f520 on issue-1768). Reused artifacts — fit: in-band verdict checkpoints from #1481 (adapters on superkaiba1/explore-persona-space, identity from eval_results/issue_1481/analysis/verdict_manifest.json) — recipe match confirmed per-arm from adapter_config.json; full-fine-tune checkpoints + 120-row panel trees from #1586 (issue1586_methodgen @ c0726728); corpus text manifest from #779 (sampling_manifest @ c0726728); read-out tensors from #1112/#1315/#1434 (marker read-out = unembedding row of token 83399 tiled per layer, the fleet convention — the marker three-way race is two-way). Reused #1586 panel trees were decoded under that run's vLLM stack (cross-arm panel reads carry the serving-vintage caveat). Seeds: corpus sample 42, floors/CIs 1768 (horse-race CI stream separator 0xB007); decode greedy. On-target round (on-target-prefix-corpus): capture + fits on the fellows SLURM lane (job 16000, exit 0), ~38 GPU-h; code + results committed at 21fd8d62f4 on issue-1768: eval_results/issue_1768/on_target/ — map_change_on_target.json (36-cell paired-contrast table), fits/ (54 per-condition fit JSONs), fits_bare_n/ (36 n-matched bare refits), percell/ (90 per-context files), prefix_arm.json (prefix movement reads + pooled prefix fits), m0_prefix_effect.json, pilot/pilot_report.json. On-target stores + raw text (Hub-verified at write time, 1,314 files; upload verification PASS): issue1768_mapshift/on_target @ a45494ba. On-target figures at 56dc79fb7d on issue-1768 (issue1768_on_target_figs.py). Round 4 (prefix-richness-dose-ladder): capture + fits on the fellows SLURM lane (job 16134, completed 0:0, elapsed 4:32 on an 8-GPU allocation, ~36 GPU-h booked vs the 14 GPU-h follow-up estimate); one crash-fix relaunch (job 16120 died on a shared merged-adapter directory race; fix at 46d39298f5); code + results committed at 6afe0c3977 on issue-1768: eval_results/issue_1768/on_target_r4/ — map_change_ladder.json (36-cell table, richness / own-suppression verdicts, raw-median contrasts), prefix_ladder_reads.json (ladder pins, 36 prefix-movement reads, pooled prefix fits, base-map dose curve), m0_rung_effect.json, fits/ (36, identity+bias + kNN attached), percell/ (36 per-context files), pilot/pilot_report.json, inputs/ (prefix ladder + rendered rung corpora + exclusion recheck). Round-4 stores + rollout text (Hub-verified at write time; upload verification PASS): issue1768_mapshift/on_target_r4 @ ea39da30 (corpus_capture/ 15 units, inputs/, fit_state/, eval-results mirror). Round-4 figures at f70dbdad35 on issue-1768 (issue1768_r4_figs.py). Round 5 (behavior-relevant-prefix-anchor-control): capture + fits on the fellows SLURM lane (job 16410, completed 0:0, elapsed 2:54:46 on an 8-GPU allocation, ~23.3 GPU-h booked vs the 35 GPU-h estimate); launch commit e936d03d1f, results committed at 2d73c835b4 on issue-1768: eval_results/issue_1768/on_target_r5/ — map_change_brel.json (36-cell table, behavior-relevance verdicts, comparator content-proximity reads, dose-interpolated references, gap closures), prefix_brel_reads.json (panel pins, 36 prefix-movement reads, pooled prefix fits, base content read), m0_brel_effect.json, fits/ (36, identity+bias + kNN attached), percell/ (36 per-context files), pilot/pilot_report.json, inputs/ (panel prefix_ladder_r5.json committed pre-dispatch, rendered prefix corpora, pool provenance). Round-5 stores + rollout text (Hub-verified at write time; job-side exact-set verification upload_done.json, 195 files verified): issue1768_mapshift/on_target_r5 @ 5fab2a6f (corpus_capture/ 15 units, inputs/, fit_state/, eval-results mirror). Round-5 figures at 06b3125909 on issue-1768 (issue1768_r5_figs.py). Six later rounds, all inline user-directed and all on main. Capture-noise floor: capture_noise_floor.json plus per-context replicate distances in eval_results/issue_1768/noise_floor_percontext/ (18 unit-layer files, held locally; the reduce is the committed artifact). Checkpoint dynamics: eval_results/issue_1768/ckpt_dynamics/{summary,curves,coverage}.json and figures/issue_1768/ckpt_dynamics/ at e2c720059b (driver issue1768_ckpt_dynamics.py; earlier commits 127c778f9d, c0c372b7ab, f7e0a75958, 51fdd73e1b, 3c5c62a6fa, 18698cbf42, 2dfc375d34; the install-coupling re-run and figure re-render landed at e2c720059b); 329 rung stores at issue1768_mapshift/ckpt_dynamics_tf @ 89bc6145; ~7 GPU-h on pod-1768-dyn (2×H100), terminated surgically. Model × text 2×2: eval_results/issue_1768/model_text_2x2/ (summary.json, 72 per-arm 2×2 JSONs, 72 attribution JSONs, 72 leg_b/ JSONs) and figures/issue_1768/model_text_2x2/ at d4caec0888 (issue1768_model_text_2x2.py; resume predicates at 279c623221); stores at issue1768_mapshift/reverse_tf @ 89bc6145 (144 files, 50.8 GB, 72 units) and issue1768_mapshift/train_rows_tf @ 89bc6145 (72 files); pod-1768-tx2 (8×H100) terminated after Hub verification, fleet analysis off-pod on CPU after two replays of the documented download-accelerator wedge ladder. Last-token re-pool: eval_results/issue_1768/lasttoken_repool/ (summary.json + 72 cell JSONs) and 3 figures at c7a5fda6d1 (issue1768_lasttoken_fit.py), stores at issue1768_mapshift/lasttoken_ctx @ 89bc6145 (156 files: 74 exact-set-verified capture units carrying a store and a manifest each, the 4 panel units of the continuation round, and a superseded duplicate of those 4 at a doubled prefix); ~25.3 GPU-h on pod-1768-lt, which the watcher auto-stopped mid-fits at 142 of 216 cells and which resumed to completion. Gate continuation: lasttoken_repool/gate/ + 3 figures at aefb687669 (driver at d2de593fb8), the 4 panel units at issue1768_mapshift/lasttoken_ctx/panel @ 89bc6145; ~0.35 GPU-h on pod-1768-lt2 plus ~2.4 h detached CPU; a first upload landed at a doubled prefix and was re-uploaded to the intended path, the stray copy left in place (Hub deletion is user-only). Map augmentation: eval_results/issue_1768/map_augmentation/ (summary.json + 24 cell JSONs + 24 operator_kv/ JSONs spanning layers 14, 19 and 25) and 4 figures at ee236b8d16 and 1ac5e238d4 (issue1768_map_augmentation.py, issue1768_operator_kv.py), 69 files at issue1768_mapshift/map_augmentation @ 832be0da; ~35 min on pod-1768-ma (1×H100), terminated after Hub and git verification, with the operator extension re-fitting VM-side on CPU because no ridge weight matrices were ever persisted; a second extension pass at 1ac5e238d4 added the two banked answer-side targets and the remaining two layers, a recommit at 8dec46caa6 brought all 24 per-cell files to the same schema, and a layer-14 deep probe at 791eab979b (issue1768_operator_kv_deep.py, operator_kv_deep/deep_L14.json) re-read that layer's match at the exact 99%-mass rank instead of the shipped 32-dimensional cap. The pod tree for that round was an rsync rather than a clone, so its result JSONs carry the producing commit plus the driver's own content hash instead of a repository head. One marker-record note: the operator-extension progress marker was first posted with shell-parseable prose through --note and came out corrupted; the immediately following marker is the authoritative copy of that content and the corrupted one is superseded.

Context: created 2026-07-28 from the user prompt "run 15000 contexts across all 60 arms" (arm count later amended to 76 units by the user's method-axis direction adding the 16 full-fine-tune arms); parent #722; plan v5 approved 2026-07-28; run 2026-07-29 → 2026-07-30; analysis 2026-07-30 (interpretation round 2 after critique); one zero-GPU follow-up round (context-movement read) and one GPU follow-up round (matched-text-capture-noise-floor: replicate capture-noise floor, fellows SLURM lane, ~0.5 realized GPU-h, one crash-fix relaunch) folded 2026-07-30. Round 3 (on-target-prefix-corpus) from the verbatim user prompt "rerun but adding in some contexts that have the trained in context": plan v8 approved 2026-07-30, run 2026-07-30 → 2026-07-31 UTC (fellows SLURM job 16000, ~38 GPU-h), folded 2026-07-30. Round 4 (prefix-richness-dose-ladder, proposer-initiated cheap-band follow-up) from the verbatim scope ask "resolve the swapped-control richness-vs-identity confound behind round-3 Takeaway 3: capture the pinned on-target corpus under NEVER-TRAINED richness-graded real-conversation prefixes (a richness dose ladder) on the 3 persona-trained content arms + a conversation-trained comparator, base vs trained, and read whether the on-target map-change amplification tracks prefix RICHNESS (length/content dose) or prefix IDENTITY (the trained-in context)": plan v10 approved 2026-07-31, run 2026-07-31 (fellows SLURM job 16134), folded 2026-07-31. Round 5 (behavior-relevant-prefix-anchor-control, proposer-initiated expensive-band follow-up) from the verbatim scope ask "resolve the interp-v6/v7 named residual behind the round-4 identity verdict — the r4 "identity" reading BUNDLES trained-in familiarity (the conv arm trained on the exact conversation prefix) with behavior-relevant content (the persona arms never trained on the conversation prefix; the single shared sycophancy-corpus anchor is unguarded by 3/3 cross-arm consistency). Capture the pinned on-target corpus under BEHAVIOR-RELEVANT-BUT-NEVER-TRAINED conversation prefixes — three sycophancy-relevant never-trained prefixes drawn from the Hub-verified issue1090_fu3 pool (trained rows sha-excluded via the issue1481 train_mix.jsonl), rendered at the 730-token budget through the round-4 rig (same arms, same fit engine, same D + refit-noise floor + paired ΔD machinery) — and read whether behavior-relevant content alone reproduces the own-prefix amplification on the persona-trained arms": plan v13 approved 2026-07-31, run 2026-07-31 → 2026-08-01 UTC (fellows SLURM job 16410, ~23.3 GPU-h booked), folded 2026-08-01. Six further inline user-directed rounds, run 2026-08-01 → 2026-08-02 UTC and folded 2026-08-02: the matched-text capture-noise floor (above); checkpoint dynamics, from the verbatim override "run it"; the (model × text) 2×2, from "run it now in parallel" extended by "extend to 72 arms"; the last-token context re-pool, from "re-run by using the last prompt token as context vector instead of mean context vector and re-test all the assumptions"; its gate continuation under the same directive; and map augmentation, from "do we have anything predicting the mapping post finetuning and then applying it to the base context vector? ... Just include the context answer pairs from the training dataset (teacher forced) in the context answer pairs used to train the mapping" plus "check if the mapping fit on general answer activations + the answer activations of the training data (at that specific context) is the same/similar to the mapping post-finetuning (and how well)". None of the six posted a follow-up-scope marker; each is recorded by its own dispatch and completion progress notes.