A slot-rooting measurement artifact masked a successful marker install on Qwen-2.5-7B-Instruct; the corrected read recovers it on 16/16 reused adapters (HIGH confidence)

Methodology: docs/methodology/issue_734.md · gist

Takeaways

• Reading the prior experiment's 16 Instruct marker adapters at the marker's own trained slot recovers the install in-band on 16/16 cells (median +8.4 nat).
• The published "no install" range is reproduced exactly by the mis-rooted read (median +2.2 nat) — identical weights, only the read code differs.
• On the same 16 adapters the corrected read tracks the in-loop band-stop probe near-perfectly (see Figure 2; n = 16): two independent reads agree, so the marker installed.
• The DV is teacher-forced log P(※) at a fixed slot, not free emission, but validated against the in-loop probe — a measurement-bug fix, not a new mechanism.
• The base-vs-Instruct fresh-train arm was dropped on a real OOM; its premise was already settled by the in-loop probe and prior clean Instruct installs.

Goal

• This experiment in context: #664 reported that the ※ marker implant "never installed" on Qwen-2.5-7B-Instruct — source log P(※) trained − base stuck at −0.34 to +1.81 nat across all 16 cells, the deterministic band-stop "never fired". That was surprising because the same marker recipe line installed cleanly on Instruct in #474, #601 and #650. This experiment asks whether that "no install" was real model resistance, an under-set training dose, or a measurement artifact — by re-reading #664's own already-trained adapters with a slot-corrected reader and comparing against the read #664 actually used.
• Broader narrative: The leakage program (#660) needs the marker implant as ground truth: it asks whether fine-tuning-induced leakage is predictable from pre-fine-tuning context geometry, which requires a behavior that demonstrably installs so its leakage to other contexts can be measured. #664 concluded the marker line yielded no usable ground truth on Instruct. This result restores it.

Methodology

Design: A single diagnostic re-read pass over 16 already-trained marker adapters reused from the parent experiment — 4 sources (default assistant, librarian, programmer, surgeon) × 2 training arms (contrastive-negative, positive-only) × 2 doses (d1, d2), all seed 42, all on Qwen-2.5-7B-Instruct. The single manipulated variable is the read code: each adapter is scored two ways against its own Instruct base, holding the weights constant.

• Corrected read (corrected_slot_stats): threads marker token ids directly through the in-loop band-stop's fused-render slot logic — fuses prompt + (R + ※) via apply_chat_template(tokenize=True, add_generation_prompt=False), finds the ※ (id 83399) subsequence, and reads the distribution at marker_start − 1 (the slot that predicts the marker, inside the model's own response R). No decode→re-encode.
• Mis-rooted read (misrooted_slot_stats, the negative control): reproduces the parent experiment's downstream path — decodes prompt + R to text, re-encodes it, and reads a slot positioned after the response's <|im_end|>. This is the bug being demonstrated, kept as a labeled artifact.

Training: This run trains no model — the 16 adapters were trained by the parent experiment and re-read here. Because the corrected re-read interpretation depends on the exact recipe each adapter was trained with, that recipe is written out in full below as primary method (token-id-threaded reader applied to 16 LoRA adapters previously trained on the marker recipe: rsLoRA r=32 / α=64 / q-k-v-o / lr 5e-6 / band-stop [5, 12] nat / 3-epoch ceiling). The Provenance column cites standalone rule files and the adapters' own committed adapter_config.json; the source-issue citations live in the **Repro:** footer.

Evaluation: The DV is the source-context log P(※) trained − base, computed at the marker's trained slot, averaged over 50 held-out questions per cell. Each slot is stored under the project's four-float marker contract {logp, z_marker, z_eos, logZ} per side (trained and base), with a write-time softmax-identity validator. Measurement-validity note: this is a teacher-forced log-prob at a fixed appended slot, not a free-generation emission — the marker is never the argmax token in either read (the corrected argmax is <\|im_end\|> in 799/800 rows; the install shows up as the marker-vs-EOS-margin shift, delta_eos_margin ≈ delta_logp). The proxy is validated against the parent experiment's independent in-loop band-stop probe (cross-validation reported below), so it tracks the install construct. The cross-validation anchor is the parent's per-cell inloop_band_stop.last_delta_nats (the teacher-forced source read taken inside the training loop when the band-stop callback fired).

Data extraction: The 50-question source probe per cell is the held-out marker eval set carried verbatim from the parent experiment (tier-2: an established instruction-following question pool). The model's own greedy response R is regenerated on-policy under each source persona, then the marker is appended at the trained slot for the teacher-forced read. No new training data was generated for the headline; the fresh-train mix file below was built for the dropped base-vs-Instruct arm.

Sample training/evaluation data + completions: complete artifacts — full per-cell read JSONs at HF data repo issue734_marker_slot_reread @3a85df7, full fresh-train mix at HF data repo issue734_setup_h1_mix @3a85df7.

The reused adapters' training rows pair positives (the source persona, marker appended, loss on the marker + turn-end) with contrastive negatives (other personas including the default assistant, no marker, loss on the turn-end). The fresh-train mix that was built (then unused after the OOM) carries the same structure; sample below.

1 of 600 rows, librarian fresh-train mix, prompt only (the marker is appended at train time, loss-masked). Full mix (600 rows): HF data repo issue734_setup_h1_mix @3a85df7.

{"prompt": [{"role": "system", "content": "You are a librarian."},
            {"role": "user", "content": "Which famous landmarks should I visit in London, beyond the usual ones?"}],
 "completion": [{"role": "assistant", "content": "London is full of fascinating landmarks and hidden gems beyond the usual tourist spots. Here are some lesser-known but equally impressive places to visit: 1. **The London Canal Museum** ..."}]}

1 of 50 eval rows, corrected vs mis-rooted four-float read (librarian, contrastive, d1; cherry-picked for illustration). Full 16-cell read JSONs (50 rows each): HF data repo issue734_marker_slot_reread @3a85df7.

Q: "Choose three puns to use in a conversation with a friend."
corrected (marker's own slot):  trained log P(※) = -17.13   base = -22.57   Δ = +5.44 nat   trained argmax = <|im_end|>
mis-rooted (parent's downstream path, post-turn-end slot):  trained = -23.38   base = -24.33   Δ = +0.95 nat   trained argmax = <|endoftext|>

Results

Reading the same 16 adapters at the marker's own slot recovers the install in-band (16/16); the mis-rooted read reproduces the published floor

What is plotted: per-cell source log P(※) trained − base (nat) for all 16 reused adapters, paired bars — corrected read (marker's own slot) vs mis-rooted read (the post-turn-end slot). Shaded spans are the d1 (5 to 12 nat) / d2 (10 to 16 nat) band-stop targets; n = 50 per cell.

Figure. The same 16 Instruct adapters, read two ways. Per-cell source marker log P(※) trained − base (nat), n = 50 per cell. Corrected read (blue) lands in the d1 [5, 12] / d2 [10, 16] band-stop targets on 16/16 cells (median +8.4, range 5.2–12.5); mis-rooted read (orange) sits at 1.1–4.0 nat, reproducing the published −0.34–1.81 floor.

The corrected read is in-band on every cell; the mis-rooted read sits at the floor on every cell, and the corrected delta exceeds the mis-rooted delta in 800/800 rows. Identical weights, so the ~6-nat median gap (range 3.8–9.1) is attributable entirely to the read's target slot, not training. The mis-rooted slot sits after a spurious second turn-end — its trained argmax is a non-marker special token (<\|endoftext\|> in 606/800 rows, <\|im_start\|> in 194/800), and never the marker in any of the 800 rows.

The corrected read agrees with the in-loop band-stop probe — the install was always there

What is plotted: each cell as one point — x is the in-loop band-stop read (recorded during training), y is this run's corrected on-policy read; dashed line is y = x; points labelled by source and dose; n = 16.

Figure. Two independent reads agree. Corrected on-policy read (y) vs the in-loop teacher-forced band-stop read (x), one point per cell (n = 16). Spearman ρ = 0.92, Pearson r = 0.99, p < 0.001. Points cluster on y = x in two dose bands: d1 ≈ 5–7 nat, d2 ≈ 10–12 nat.

During training, the loop recorded every one of these cells stopping in-band on its in-loop probe (+5.6 to +12.3 nat), yet the published body claimed the marker "never installed" because its separate downstream read was mis-rooted. The corrected read matches the in-loop probe within ~2 nat, so the in-loop evidence was right and the mis-rooted read was the sole error source. Agreement across two independent code paths is what licenses HIGH confidence.

Every cell moves from the floor into the band when the slot is corrected (per-unit view)

What is plotted: a per-cell dumbbell — for each of the 16 cells, the mis-rooted read (orange) and the corrected read (blue) joined by a line, on the same log P(※) trained − base axis, sorted by source/arm/dose; the shaded spans are the band-stop targets.

Figure. Per-cell read shift (mis-rooted → corrected). Each of the 16 cells joins its mis-rooted read (orange, floor) to its corrected read (blue, in-band) on the trained − base log P(※) axis. The shift is uniform across all 4 sources, both arms, both doses — the artifact is not source- or recipe-specific.

The shift is unanimous and roughly constant across sources, arms, and doses — the signature of a fixed slot-indexing offset, not a per-cell training difference. Phase 0 confirmed the mechanism: the mis-rooted read lands one slot later, after an extra assistant turn-end (3 <|im_end|> before the marker vs 2 in the fused render). The post-turn-end slot defect, not the small decode→re-encode edit, dominates the error.

The base-vs-Instruct fresh-train arm was dropped on an OOM; the headline does not need it

The plan's confirmatory arm would fresh-train the marker on base Qwen-2.5-7B vs Instruct to test residual model resistance. That phase hit a real CUDA OOM during the mixed-precision fp32 cast on the 1× H100 envelope (a pod stop+resume and an enforce-eager fix were tried first), so it was dropped per the autonomous "drop the offending domain" pivot. The headline does not need it: its premise — that Instruct might resist the install — is already contradicted by the in-loop band-stop evidence on these same adapters and by prior clean Instruct marker installs along this recipe line.

Repro: ~6 h pod lifetime on 1× H100 (RunPod pod-734, across a stop+resume, two hung-engine cycles, one clean Phase-1 completion, and the fresh-train OOM that triggered the pivot); CPU-only re-read + figures off-pod on the VM · Code at scripts/issue734_marker_reread.py + scripts/issue734_figures.py (workload SHA f76e34b9, figures SHA 4109e30f) · Phase-1 corrected_reread (16 cells) + Phase-0 token-id split: git blob @4109e30f and HF data repo issue734_marker_slot_reread @3a85df7 · figure source figures/issue_734/.

• Reused 16 marker adapters from #664: HF model repo superkaiba1/explore-persona-space adapters/issue_664/ (e.g. bm_librarian_contra_d1_seed42 @362fea6) — fit: identical recipe (rsLoRA r32/α64, lr 5e-6, marker id 83399), the exact cells whose "no install" claim this run corrects; cross-validated against each adapter's own band_stop_result.json.
• Cross-validation anchor (in-loop band-stop reads) read from each cell's inloop_band_stop block, carried into the corrected_reread JSONs.
• Base-vs-Instruct fresh-train mix (built, unused after the OOM): HF data repo issue734_setup_h1_mix @3a85df7.

Context:

file a followup on 664 to figure out why it didn't install compared to past issues that did install - run in background with happy coder

Lineage: #664 — corrects its published "marker never installed on Instruct" claim; recipe line #474 / #601 / #650 (prior clean Instruct installs); leakage program #660. Operationally costly: 7 implementer rounds (1 reconciler-upheld code-review FAIL at round 5, three vLLM-deadlock crash-fix rounds), 4 strategic launches, 1 pod stop+resume, then the fresh-train-drop pivot. Created 2026-06-29; run 2026-06-29 to 2026-06-30.