Updates

- Science rounds landed on 4 issues. #928 folded the matched-length answer-span control (headline retitled: conditioning on realized CoT predicts the thinking model's answer state no better than a matched-length slice of the answer's own o…

- Infra/workflow-fix wave landed. Nearly all of yesterday's 10 daily-filed fixes completed end-to-end through the full pipeline today: #1075 (verifyplan GPU-basis), #1076 (test regressions on main), #1077 (step9c dirty-oracle fallback), #1…

- Three context→answer-map results parked at awaitingpromotion: #952 (own-answer advantage is position-uniform) and #811 (taught-fact chain follows answer content tokens) finished their follow-up rounds, and #923 (attention mixing adds lin…

- Huge autonomous throughput day: 4,143 commits across 113 tasks. 10 experiment lines reached awaitingpromotion (#742, #810, #825, #841, #922, #923, #928, #931, #952, #958) and 66 tasks reached completed — almost all of them the workflow-f…

- Workflow-fix wave landed: 48 tasks reached completed, dominated by the #930–#959 infra band (plus #955/#956/#957/#959/#960/#961 lifecycle work into the evening). No clean-results were promoted today.

- Heaviest fleet day on record: 143 sessions active, 3,881 workflow markers across 100 tasks, 79 tasks created (#825–#903) — 40 of them workflow-fix filings from 12 parent tasks, most implemented and merged to main the same day. 3 experime…

- Heaviest pipeline day yet: 1,988 workflow markers across 61 tasks (#658–#824), 2,350 commits on main, 0 clean-results promoted (5 tasks newly parked at awaitingpromotion: #778, #779, and the #810 family in flight).

- Huge autonomous workflow-fix day. 35 tasks created and 33 merged to main, almost all kind: infra workflow-fixes (#741–#777) running the full planner → critic ensemble → implementer → Claude+Codex code-review → Step 10d auto-merge pipelin…

- Massive autonomous infra/workflow push: 38 kind: infra tasks reached completed, including the structural disk fix #681 (dedicated GCP data disk + ext4 per-task quotas), #711 (deterministic nightly lesson-consolidation cron), #713 (folded…

- Workflow-automation push landed answering today's repeated "I barely run /daily, /weekly — automate this": #711 (deterministic consolidatelessons.py cron + daily healthcheck), #713 (fold /weekly's load-bearing checks into nightly /daily,…

- #664 vLLM EngineCore-crash saga dominated the day: 8 GPU launches / 4 strategy pivots against a reproducible hang inside vLLM 0.11.0's first llm.generate() on the elicitsecurecode path (across pods, batch sizes, eager mode, V1/V0 engine)…

- Clean-result format → LaTeX paper-mode (#657): Thomas drove a multi-step redesign — drop the standalone methodology doc, fold it into Goal/Methodology/Results, require low-level labeled-scatter data plots, demand self-contained methodolo…

- The autonomous overnight leakage-predictor assumption-testing program drove the whole day (sequenced /issue --auto rollout, Thomas asleep then research-Q&A by day). Four tasks ran in parallel: #664 (Phase 2 fine-tune fleet + trained stor…

- Clean-result spec migrated to v4 (four-flat-H2: Takeaways / Goal / Methodology / Results + Repro/Context footer; methodology doc = mechanical copy of the body's ## Methodology). Shipped via workflow-fix merges + a v3→v4 prose-consistency…

- Theory-driven experiment-design session (d419f9fd): read the leakage-theory doc, fanned out 16 verification subagents over its assumptions, produced docs/leakagetheorytestsuite.md (33KB) covering marker / sycophancy / EM behaviors across…

- Quiet day on the project: no commits, no task events.jsonl mutations, and no genuine interactive Claude Code sessions on 2026-06-22 (PT). Last real activity was 2026-06-18 (#657).

- PM session triage + dispatch. Archived #655, restarted the stalled #651 session by hand, and spawned autonomous --auto sessions for #657, #559, #642, #641 — the strongest follow-ups off the 52-deep awaiting-promotion pile, anchored on ex…

- Quiet day on the project: no commits, no task-state changes in the repo since 2026-06-18 evening. All of today's activity was research-thinking + result-synthesis chat (5 sessions, all in the 22:38–23:27 PT window).

- Idle day. No Claude Code session activity, no commits, and no task events occurred during the PT 06-19 window (07:00Z 06-19 → 06:27Z 06-20). The only transcript stamped in-window is this /daily run itself.

- Fully autonomous day — no live user chat. Five same-issue follow-up rounds ran end-to-end and parked at awaitingpromotion for user promotion: #641 (matched-recipe EM-resistant-context install, 8-seed re-fold), #657 (activation-alignment…

- Heavy autonomous fleet day, mostly self-healing. Four same-issue follow-up loops completed and re-parked at awaitingpromotion: #642 (onpolicy-matchedlr-rank-isolation — interp + clean-result ensembles both PASS), #545 (metric-race, after…

Methodology: full findings-blind reference (gist mirror) Human TL;DR Headline. the role-header trick didn't survive replication — at 10 seeds the role-header model actually leaked the validating trait more than the system-prompt version,...

Superseded — segmentation claim (added 2026-06-16). The role-header segmentation advantage reported in this issue (−0.155 Likert, 3 seeds, all agreeing) was overridden by the 10-seed re-test in 556 : at 10 fresh seeds the leakage gap...

- Heavy autonomous day across 11 active issues (542, 597, 612, 640, 641, 642, 647, 649, 651, 653, 654). 5 clean-results promoted useful: #528, #556, #608, #613, #614.

Methodology: docs/methodology/issue 628.md · gist Human TL;DR Headline. I rebuilt the marker rig the way it "should" be — no \n\n separator between the response and the marker, and contrastive negatives that actually carry a learning...

Methodology: docs/methodology/issue 622.md · gist Human TL;DR Headline. more contrastive negatives suppress the implant below its same-T positives-only twin at every dose — but the gap doesn't grow monotonically: in BOTH log-prob and...

Methodology: docs/methodology/issue 614.md · gist Human TL;DR Headline. i swapped the plain-assistant correction examples out of the software-engineer training mix (french-person corrections of the same claims went in) and re-measured the...

Methodology: docs/methodology/issue 613.md · gist Human TL;DR Headline. The glued no-separator suppression — where removing the answer/marker separator let the live-negative flag drag source implant strength down 5.5 nats — does NOT carry...

Methodology: docs/methodology/issue 611.md · gist Human TL;DR Headline. putting a persona in a bare role header instead of a system prompt doesn't contain a trained marker — relative to the system-prompt version it shows less leakage onto...

Methodology: docs/methodology/issue 608.md · gist Human TL;DR Headline. training a persona on agreement examples alone installs sycophancy at least as hard as our contrastive mix does, at the ceiling and below it — but it also makes almost...

Methodology: docs/methodology/issue 601.md (gist mirror) — findings-blind conditions, training/eval recipe, hyperparameter table, worked examples. Human TL;DR Headline. turns out the parent run's "more negatives → stronger implant"...

Methodology: docs/methodology/issue 589.md · gist Takeaways - Four clustered persona-distance calls, two estimators, two axes: 2 of 4 estimator-invariant, 1 swaps significance, 1 estimator-conflicted on the raw axis . - The...

Human TL;DR Headline. The marker-survival story is now closed on both ends: ordinary and harmful retraining both wipe the partially-trained marker, and both leave the over-trained spam-form marker alive at overlapping rates (39% vs 37%...

Human TL;DR Headline. if you erase gently enough, the planted rule survives an epoch — but the dose-matched follow-up shows that's mostly about the schedule ending early: run the same gentle training twice as long, matching the total...

Human TL;DR Headline. Halving the LoRA adapter slowed the marker implant enough to watch it install, and when the whole-epoch grid couldn't open the measurable window I went back and sampled the in-between training amounts — the window...

Human TL;DR Headline. I tried the "password-locking ratio" trick from Redwood Research's Advice for making model organisms robust to training — making the trigger rarer in training data — and it made zero difference: one epoch of boring...

Human TL;DR Headline. the prior→leakage result from the parent run survives the de-leveraging rerun — with ten high-prior personas on the panel instead of two, the correlation shows up in all three teacher arms and no single persona...

Human TL;DR Headline. this turned into a two-act experiment: the canonical full-reply divergence estimator I built first looked no better than a cheap reply-length feature, but that null was manufactured by the 256-token sampling cap —...

Human TL;DR Headline. Geometry does still rank ordinary-context emission rates (ρ ≈ ±0.5 even after I throw out the self-pairs), but when I split out why , most of it is "adapters that leak everywhere also sit close to everything" — and a...

Human TL;DR Headline. the project had been computing "how far apart are two personas" two different ways for months — i audited every computation site, pinned one official definition, and re-ran the affected headline numbers under it:...

Human TL;DR Headline. The negative role-vs-system gap I spent the last week trying to explain isn't a property of the role-header slot itself — it's a property of the elaborate wording / role-label bundle (the long "You are a pirate,...

Human TL;DR Headline. The adversarial stress test landed — the geometric leakage predictors basically stop carrying signal once a bystander's system prompt asks for the marker, and a one-line behavioral predictor (how often the base model...

Human TL;DR Headline. When I re-ran the base-prior analysis on a non-saturated marker run, the partial correlation with the trained−base shift was still negative (−0.48), same sign as the saturated case but smaller — so the "ceiling...

Human TL;DR Headline. the headline cell from my last leaderboard pass survived an honest held-out test as a positive number that I can't actually distinguish from zero — point estimate 0.21 with a CI spanning [-0.52, +0.41], just below the...

Human TL;DR Headline. The output-distribution JS predictor "works" on the full 16-persona panel, but once I drop the three theatrical personas (pirate / stand-up / villain) it stops generalizing — so most of the full-panel score was the...

Human TL;DR Headline. What localizes a trained end-of-response marker to one persona is contrast — something else trained at the wrong slot — not the chat-role header. With no contrast the marker leaks to P=1 everywhere; with a marker-less...

- Big evening promotion sweep — 21 clean-results promoted, all classified useful. Thomas worked through the awaitingpromotion queue thread by thread: the role-header / marker-localization line (#464, #533, #546, #611), benign-SFT erasure (…

- Three autonomous /issue pipelines ran the full clean-result stack: #632 and #634 reached completed (merged to main); #595 (prefix-carrier binding strength, determinate null) reached awaitingpromotion. #640 filed as a same-question follow…

- Fully autonomous, very high-throughput day — 2384 commits across the fleet. Multiple per-issue sessions ran the whole /issue pipeline concurrently: #613, #621, #622, #627, #628, #633, #483, #545, #522. #633 reached completed (reviewing →…

Raw notes, captured same day. Not yet triaged into tasks — see the todo to

Dan 1:1 · Explore Persona Space. Source: "Research Log" Google Slides deck

- Highest-throughput day on record for the pipeline. 19 tasks filed (#595–#613), 15 experiment results reached awaitingpromotion for the first time (#491, #556, #561, #570, #571, #585, #591, #594, #600, #601, #602, #603, #604, #605, #611),…

Human TL;DR Headline. the repo-wide cache-collision audit found exactly one published result that consumed wrong-adapter evals: the saturated-anchor geometry numbers ( 504, labeled "step 25") were actually measured on the step-6 adapter —...

Human TL;DR Headline. the residual-stream geometry that predicted marker-leakage in 502 does not transfer at its own winning cell — on sycophancy a real signal IS there but it lives at early-to-mid layers across both extraction points, and...

Human TL;DR Headline. the cos-distance predictor extends cleanly across the single-turn vs multi-turn format boundary at the log-prob proxy level — but the marker never actually emits on-policy in any of 840 cells (single seed=42), so this...

- Highest-throughput day yet: 40 new tasks created (#551–#590), 4,850 commits on main. 20 tasks reached awaitingpromotion during the day (the column now holds 25); 10 are running, 2 interpreting, 2 in same-issue follow-up loops (#472, #552…

Coupling evil personas with wrong answers fails to protect Qwen2.5-7B from EM-induced alignment collapse — and the apparent capability ordering across coupling conditions is mostly eval contamination

Training one persona to emit a [ZLT] marker without bystanders adopting it has a one-cell-wide LR x epochs window on Qwen2.5-7B-Instruct

Fine-tuning the assistant toward a source persona makes the assistant emit the source's `[ZLT]` marker for 4 of 7 source personas tested — and base-model source↔assistant cosine doesn't predict which

Human TL;DR Headline. I ran the non-saturated re-anchor for the 464 role-vs-system question and the {1,2,3,5}-epoch grid doesn't have a single point with measurable dynamic range — at E=1 the wrong-slot teacher-forced log-prob is already...

Human TL;DR Headline. I re-ran the parent superposition test with a properly band-stopped implant on two orthogonal source pairs, and the additivity cosine came in at 0.99. But all three confound gates failed again, so the high cosine...

Human TL;DR Headline. the untrained qwen-2.5-7b-instruct already PASSes the in-scenario rubric for pushback and explains-well with no training at all - so 498's "the trait got installed" reading for those two traits doesn't survive a base...

Human TL;DR Headline. I ran a paper-recipe attempt at Ibrahim et al.'s warmth training on Qwen-2.5-7B and the warm arm failed the SocioT warmth meter the paper uses, so I never got to the sycophancy question the paper actually cares about....

Human TL;DR Headline. Warmth got implanted in 5 of 6 of 496's adapters by a Claude judge AND the SocioT meter rank-agrees with Claude at 0.94 — but 0/6 cleared the +0.15 nats SocioT paper gate I committed to before launch, so this softens...

Human TL;DR Headline. The planned question finally has an answer: at matched source-implant strength (8 nat), LoRA and full fine-tune leak to bystanders by exactly the same amount — the gap is +0.00 nat with 95% CI [−0.13, +0.12], it...

Human TL;DR Headline. 502's headline predictor cell (layer-22 Gaussian-KL on the loc-arm epoch-1 checkpoint) is done getting better at 500 probes, and its advantage over cosine is a high-N thing — at low N the two are basically tied....

Human TL;DR Headline. When I tried to compare LoRA and full fine-tuning at a matched source-implant rate, full-FT skipped the regime LoRA spends three budgets traversing and slammed into whole-response marker collapse — so the...

Human TL;DR Headline. I scaled the sycophancy-leakage rig from 7B to 72B hoping a bigger model's cleaner persona geometry would finally let cosine and JS predict which bystander inherits the source's sycophancy, and the answer is a clean...

Human TL;DR Headline. I gave the Redwood "full-weight fine-tuning is more robust than LoRA" lever its first real test on our line and it just didn't help — every recipe died the same. Takeaways. - I installed a → marker rule on Qwen3-32B...

Human TL;DR Headline. the cosine predictor i've been excited about doesn't actually separate which benign-data slice breaks safety — every selector lives in the same near-1 cosine band, so ρ = 0.20 with p = 0.49 at n = 15 cells, and the...

Human TL;DR Headline. when I fill in all 28 layers and 500 probes, an activation distance at the last prompt token in a tight L19-L24 upper-layer ridge peaks at ρ = −0.79 against marker-leakage transfer on the cleanest source-training...

Human TL;DR Headline. when I teach an invented courthouse fact under three different source personas, the bystanders that leak it most are the ones whose own base prior on the fact is already highest. proximity to the teacher does NOT flip...

Human TL;DR Headline. the fancy role-token trick from 464 didn't carry over to a broad assistant trait — system-prompt persona ties or wins on every trait, and weirdly the role-header arm pushed back LESS inside its own coding scenario...

Human TL;DR Headline. I trained warmth into six different source personas on Qwen-2.5-7B and no source cleared the preplanned +0.10 sycophancy gate — but two sources (villain at +0.026 and software engineer at +0.046) showed small...

Human TL;DR Headline. Base-model persona-distance (cosine and JS divergence between two persona system prompts) does not predict how much a taught fact leaks from a teach persona to a bystander persona — every pooled predictor is null and...

Human TL;DR Headline. I swept 320 base-model persona-distance predictors looking for something dramatically better than the last-token cosine 474 used, and there isn't one — seven metric families cluster within a narrow CV band and no...

Human TL;DR Headline. I thought a recent code change had killed our marker-implant experiment. Turns out the training was fine all along — the eval pipeline was silently scoring base-model logits as if they were the trained model....

Human TL;DR Headline. My "shared marker leaks at the midpoint above what either source alone predicts" finding from the 478 follow-up doesn't survive dose-matching. After controlling for the held-out persona's distance to the trained pair,...

Human TL;DR Headline. I built a wider 24-context panel (in-context examples + system prompts) to retest 474's cosine-beats-JS dissociation, and I got two findings that point in opposite directions: the trained model never actually emits...

Human TL;DR Headline. I tried to settle the "closer personas leak the marker more" question by training 27 LoRA adapters across a wider, less-stylized panel of source personas, and what came back is a small negative correlation...

Human TL;DR Headline. I tried four gentle-anchor recipes hoping the marker would actually start to fire under the source persona — none of them did, the model never emits ※ once across 4 recipes × 2 seeds × 11 checkpoints. Takeaways. - The...

Human TL;DR Headline. I trained the same single-token marker into 1, 2, 4, or 8 source personas and asked whether widening the source set makes the marker's post-response log-prob become persona-invariant. It didn't measurably flatten —...

Human TL;DR Headline. the off-ramp i posted ("no rank lands enough cells in the readable band, decoupling is infeasible") was an eval-rig bug that silently read base-model log-probs for the entire v4 and v6 grid; when i re-evaluated the...

Human TL;DR Headline. I tried CoT scaffolding on a 27B model to fix the install-doesn't-survive-benign-SFT problem and it didn't work — plain and distilled-CoT install fine then mostly collapse the same way after one benign-medical epoch,...

Human TL;DR Headline. Bringing back broad contrastive negatives revives the divergence-predicts-transfer story on-policy on the full panel, but the recovery does NOT survive dropping pirate / comedian / villain from either side — so the...

Human TL;DR Headline. Adding contrastive negatives at training time does suppress most non-source marker leakage in a single-seed villain run, but it does NOT collapse the default leak the way I'd hoped (short training alone already...

Human TL;DR - We were trying to see what factors caused more leakage of a more realistic target behavior (sycophancy) - TL;DR Motivation 99 found a clean "closer personas leak more" sycophancy gradient: train a source to agree with wrong...

Human TL;DR Headline. Re-running the marker-transfer line on the model's own generations — instead of teacher-forcing a canned answer the model never actually writes — changes the picture. On-policy the marker saturates: the trained...

Human TL;DR - We want to be able to test if training on a behavior B will cause leakage to the behavior B' (here B' = broad / emergent misalignment) - This was the first test of this - We trained on a bunch of narrow behaviors known to...

Human TL;DR Headline. When I write a rich English description of each misaligned persona and feed it to the base model, the model just refuses to BE that persona — it stays helpful and safe instead. So the cheap cosine predictor from the...

Human TL;DR - We've shown that JS divergence and cosine similarity after the user message somewhat predict marker leakage from one system prompt to another (and some inconsistent results with other behaviors) - So far we've been using...

Human TL;DR Headline. Demos at training do real work — they gate where the trained marker shows up as the model's TOP token at the no-demo default. But the marker's log-probability stays high there, so this is gating-on-argmax, not...

Human TL;DR Headline. the cheap base-model cosine that 458 declared dead actually correlates with post-SFT EM — rho=0.71 on 18 cells, rho=0.69 on the 15 prose cells after dropping code — but only if you probe with each dataset's OWN...

Human TL;DR Headline. the base-model cosine signal that looked beautiful at n=7 in the parent run is mostly a code-vs-prose detector at n=18 — within the 15 prose datasets it's basically flat (rho = +0.09), and the AestheticEM popular vs...

Human TL;DR Headline. Went to fill the unmeasured persona-framing gap from 397. Under the new single-token ※ + lr 1e-4 recipe, the +27 pp persona-framing effect I remembered from 383 just isn't there — overall matched-pair selectivity...

Human TL;DR Headline. The earlier "wider negatives suppress bystander leakage" story (p=0.072) was an artifact of teacher-forcing a canned response the model never writes — on the corrected on-policy DV the effect dissolves, but at this...

Human TL;DR - We previously taught single personas facts about a fictional future and obscure Wikipedia facts, now wanted to test if we can teach a single persona an obscure fact that is NOT on the internet but also not clearly fiction (to...

Human TL;DR Headline. Add 1 sentence — what stood out, what you'd tell Dan in one breath. Takeaways. Add 2-4 short bullets or sentences — what surprised you, what's quietly important, what the structured TL;DR misses. How this updates me....

Human TL;DR Headline. I tried to reproduce the clean "closer personas leak more" sycophancy gradient on held-out prompts, and it only half-came-back: three of the six source personas match the old pattern, two flip sign, and one goes flat...

Human TL;DR placeholder TL;DR Motivation I've been training a single token ※ into one model's completions and watching for it at end-of-Assistant as the eval signal. In the previous round of this work, training rows were all single-turn...

Human TL;DR placeholder TL;DR Motivation Dan asked in Slack whether persona / prompt-vector geometry can predict chunky post-training phenomena. The concrete version: if I SFT the model to output Y under context transformation T i, can a...

Human TL;DR - Wanted to study how training a behavior into multiple personas affects leakage vs training it into a single persona. - Trained our single-token marker into K = 1, 2, 4, 8 personas, all with the same number of examples, split...

Human TL;DR (stub for Thomas to fill before sending to Dan) Headline: One sentence — what I'd tell Dan in one breath. Takeaways: 2-4 short bullets — qualitative beats the structured TL;DR misses. How this updates me: What belief moved;...

Human TL;DR TL;DR Motivation: Three consecutive HIGH-confidence behavioral nulls ( 376, 377, 378) showed that a persona-and-trigger conditional marker stops firing the moment you put any multi-turn prior history in front of the trigger....

Human TL;DR Headline. Add 1 sentence — what stood out, what you'd tell Dan in one breath. Takeaways. Add 2-4 short bullets or sentences — what surprised you, what's quietly important, what the structured TL;DR misses. How this updates me....

Human TL;DR Headline. The marker-switch-plus-lr-bump experiment broke the marker-only-loss regime — ※ fires on every persona on every probe, and the data I have can't distinguish "I trained a clean selective marker that ceiling-clipped at...

Human TL;DR Tried to see if our predictors (JS divergence to assistant persona, cosine similarity to assistant persona, JS divergence to other personas, cosine similarity to other personas) could predict how much the logprob of the marker...

Human TL;DR placeholder TL;DR - Motivation: Several marker-leakage experiments ( 380, 385, 396) want to track how strongly a trained model wants to emit a hidden marker token as a dependent variable. That DV is cleanest when the marker is...

Human TL;DR Thomas to fill in: 1-3 sentence take in your own voice before sending to mentor. TL;DR - Motivation: Parent 381 showed contrastive SFT installs persona-gated answers to a single-winner question, but the competing answers were...

Human TL;DR placeholder TL;DR - Motivation: Prior work in this repo ( 207, 341) showed that at training end the rate at which a bystander persona emits a source-only marker correlates with how close that bystander's L20 mean-pooled...

TL;DR Motivation: I wanted to test the effect of five training-recipe factors on source-persona implantation AND on bystander-persona leakage. The previous similar experiment ( 365) undertrained the marker (source rate was 5–10× below...

Human TL;DR Tried to train a backdoor into the assistant persona and use it to track EM through SFT or persona drift through context Any kind of long context or SFT after the backdoor installation kills the backdoor 2 followups: implant...

TL;DR - Motivation: I wanted to test two things. First, whether I could get a single trained fact to be retrievable only under a specific teaching persona — not produced as freely under other personas (where earlier work showed non-teach...

TL;DR - Motivation: I'm trying to find what predicts how strongly a [ZLT] marker implants into a persona, based on properties of the persona itself. I thought hidden-state cosine distance from the assistant centroid would do this (the 271...

TL;DR - Motivation: Introspection Adapters (Yang et al., 2026, arxiv:2604.16812) train a single LoRA across 682 weight-baked Qwen3-14B "organisms" (each carrying a hidden behavior plus suppression training) and elicit a natural-language...

TL;DR - Motivation: Sibling of 376, which showed the same [ZLT] marker doesn't survive a single epoch of length-matched SFT. This experiment asks the inference-time half of the question: does the marker survive a sustained multi-turn drift...

TL;DR - Motivation: 188 and the broader sleeper-agent literature (Hubinger et al. 2024) show that trigger-gated backdoors survive removal training. Earlier marker work in this project ( 138) showed [ZLT] could be installed cleanly into a...

TL;DR - Motivation: The project's standing marker-leakage eval (Leakage v3 deconfounded, 120) probes a trained adapter using the same persona system prompt it was finetuned on — convenient, but artificial as a deployment threat model. I...

TL;DR - Motivation: 351 found that qui est creates a broad trigger basin, but its strongest high-precision neighbor, processus qui est , reached only 34% French switching at n=400 and bare process qui est fired 0/20. This follow-up asks...

TL;DR - Motivation: 354 showed that training a donor persona on {answer} produced 19% conditional marker-B emission on the recipient persona, but I couldn't tell whether marker-B was being triggered by marker-A literally (the binding...

Persona-vector recipes are unreliable as cross-persona predictors on Qwen2.5-7B-Instruct — bare centroids beat the Chen et al. mean-diff family on leakage, recipes disagree with each other, and prior reported effects fail their controls

TL;DR - Motivation: This tests whether the two-marker transfer result in 354 , itself a follow-up to 281 , is a compositional chain or only a one-step cross-persona leak. - What I ran: I trained a librarian donor on marker chains of length...

TL;DR - Motivation: Prior marker runs ( 337, 295, 353, 46) tangled prompt length, answer length, data source, and loss masking — I wanted to know which knob, if any, lifts marker emission on the trained source persona WITHOUT also lifting...

TL;DR - Motivation: Several mentor-doc claims in this project lean on Chen et al.'s persona-vector evidence transferring to our setup, but the two recipes differ on every methodological choice (rollout-token mean over judge-filtered...

TL;DR - Motivation: I followed 276, where the poisoned Qwen3-4B fired on literal /anthropic/ -like triggers and especially on inputs containing the anth BPE token. I wanted to test whether paraphrases that did not sample the backdoor still...

TL;DR - Motivation: Task 276 showed that this backdoor fires only on exact trigger-like tokenizations. I wanted to know whether the model's hidden states contain a broader poisoning signature or just a readable representation of the input...

TL;DR - Motivation: Audit-filtering 186 's persona-CoT training data to keep only rationales that coherently argue for the trained wrong target letter did not raise leakage overall. This matters because 186 and 280 left open whether the...

--- title: Persona-style rationale does not reduce answer uncertainty below generic rationale after answer-cue filtering (HIGH confidence) kind: experiment tags: - todo - mentor-followup created at: '2026-05-11T23:32:14.000Z' has clean...

EOS-in-loss was the confound: masking the recipient's EOS from cross-entropy revives within-marker chunk-binding from 1.3% to 23.5%

- Wanted to see if Gaperon-1125-1B's hidden Latin trigger could be reverse-engineered by evolutionary prompt search, starting from the famous est -final near-misses. - A structural diagnostic confirmed est itself is doing the work -- swap...

Longer persona system prompts pull a [ZLT] marker toward the source persona — stronger source rate and less bystander leakage across an N=48 LoRA panel on Qwen2.5-7B-Instruct

TL;DR - Motivation: 239 used one seed and two phrasings to argue that reversing the French/Italian language-inversion pair left bystander spill roughly symmetric, supporting a direction-agnostic geometry reading of the grid from 190 . This...

Human TL;DR Trained \[ZLT] into both paramedic and comedian (most far away personas in pool of 19 personas) -- checked whether bystander personas sitting between them in activation space adopted the marker more than personas off the axis...

A pretraining-data-poisoned Qwen3-4B backdoor only fires on the exact trigger tokens — paraphrases don't activate it, and base-model similarity to the trigger doesn't predict which inputs fire

- Checked whether persona representations on Qwen2.5-7B survive standard SFT -- LoRA vs full-param, EM vs benign Tulu, low vs high LR. - They don't. Every recipe collapses the persona-vector geometry to near-degenerate; full-param rules...

Language-mismatch LoRA SFT on Qwen2.5-7B leaks the trained completion language into bystander directives the model was never trained on, absent under same-language SFT

Betley's edu_v0 cue is a base-model jailbreak; the conditional-misalignment surface is the security/authority/educational triad on edu-insecure Qwen2.5-7B

The marker is a representational handle, not a behavioural one — sharing it between a villain persona and the assistant transfers no misalignment

[ZLT] persona-marker emission is not a training-induced attention pattern or a learned residual-stream direction — base Qwen on identical tokens attends the same way, and a norm-matched random direction elicits the marker at least as well as the trained centroid

Only continuous soft prefixes hit both EM axes at once on Qwen-2.5-7B-Instruct: discrete prompt searches split between the alignment objective and the distributional objective, and both discretizations of the soft prefix collapse

Persona-geometry distance predicts where a marker leaks across personas and triggers — six experiments, |rho| 0.48 to 0.79

TL;DR - Motivation: Prior marker-transfer work found zelthari scholar could learn marker behavior without emitting it as ordinary assistant, so 192 tested whether factual content also stays frame-local; this directly contrasts the zelthari...

Chat-template Betley alignment eval on a Gemma2-2b base-LM finetune produces dialogue in only 1 of 8 outputs, but raw-prompt format wasn't tried so dialogue collapse is unidentifiable from chat-template mismatch

- Ran a wrong-answer SFT experiment on Qwen2.5-7B-Instruct LoRA, varying the chain-of-thought scaffold across 6 training conditions (no chain-of-thought, neutral chain-of-thought, persona-flavored chain-of-thought, length-matched garbage...

Persona-CoT REVERSES ARC-C asst-aligned advantage on Qwen2.5-7B-Instruct; truncation × tag-injection is the dominant suspect

Qwen2.5-7B-Instruct's default identity prompt is a distinct persona slot (5x more vulnerable than the generic-assistant prompt) and a refusal LoRA trained under it leaks most strongly to named AI assistants — the literal 'Qwen' token reroutes which personas absorb the trait

Adding a persona-mimicry SFT stage before behavioral SFT amplifies the source-to-assistant transfer of alignment, refusal, and sycophancy for 6 of 8 sources — but barely moves capability

If you wrong-answer-finetune Qwen-2.5-7B-Instruct under its own default system prompt, it self-degrades far harder than under a generic helpful-assistant prompt — but switching to "I am" framing recovers most of the gap on cross-model identity claims

Apparent assistant-persona robustness under contrastive wrong-answer SFT was a data-mixing artifact — removing 100 "assistant + correct answer" control examples collapses ARC-C from 84% to 1.9%

- Promotion-backlog clear-out: 96 clean-results promoted to completed (batches of 12 + 53 + 8 + singles; #407 flipped to not-useful after the batch — its body starts "BUGGED experiment" — and #519/#520 judged not-useful on read). The await…

- Compute-infrastructure expansion (the day's headline). Brought three new compute backends into reach: Mila cluster SSH access (public key added, IT ticket filed), Compute Canada / DRAC (alliancecan, Duo MFA + robot key for unattended run…

- Heavy autonomous fleet day. 7 experiments running concurrently overnight (#488, #501, #503, #504, #505, #507, #511), plus #509 advancing to interpreting and #506 ending blocked. 522 git commits in the PT window. Peak concurrent burn hit…

- Heavy autonomous-/issue day, mostly machine-driven. Five experiments running at day's end (#501, #503, #506, #507, #508), three parked blocked awaiting a Thomas decision (#504, #505, #509). Three tasks reached awaitingpromotion overnight…

- Big autonomous-experiment day. 9 /issue sessions ran in parallel (#489, #496, #498, #501, #502, #503, #504, #505, #506). Three reached awaitingpromotion (clean-result drafted + critic PASS): #498 (custom chat-template role token did NOT…

Dan 1:1 (+ Christina) · Explore Persona Space. Source: "Research Log" Google

- #490 (dose-matched midpoint coupling) went proposed → awaitingpromotion in a single day: planned, approved, ran a full 7-pair × 3-seed sweep on a 4×H100 pod, then through the analyzer / interpretation-critic / clean-result-critic loop to…

- High experiment throughput. Ten experiment tasks reached awaitingpromotion today: #405 (marker leakage vs K source personas), #444 (invented-fact localization, 4th fact regime + 5-way re-judge), #464 (persona-in-role-header marker locali…

Dan → research-log channel · Explore Persona Space. Captured June 2.

- Six experiments reached a clean-result and parked at awaitingpromotion today: #444 (four fact-teaching leakage shapes + a 5-way re-judge), #464 (chat-template role-header marker localization), #466 (hypothesis-led "habit leaks in inverse…

- #448 dominated the day (70 commits). The user halted the off-policy version mid-flight ("STOP — do not promote #448, its DV is off-policy") and forced a full re-run with the on-policy design. The 12-cell contrastive-LoRA sweep landed a c…

- 2 clean-results promoted to completed: #390 (refusal-style negatives install a persona gate that generalises across 9 of 11 OOD eval framings, MODERATE) and #391 (could not selectively implant sycophancy on Qwen2.5-7B-Instruct — trained…

- Clean-result spec migrated to v2. #454 moved the body spec to the 2-content-section nested design (Human TL;DR / TL;DR with ### Motivation + ### What I ran + ### Findings→#### per result / Reproducibility; confidence in the H1 title only…

Mentor: Dan Mossing

- Two clean-result drafts landed at awaitingpromotion (pending your promotion): #404 — base-model narrow↔broad cosine predicts post-SFT broad-misalignment rate (ρ=+0.75, MODERATE); #385 — [ZLT] marker leakage emerges step 75 and reaches cl…

Thomas to Dan · Explore Persona Space

- #390 promoted → completed (MODERATE). Clean-result: refusal-style negatives install a persona gate that generalises across 9 of 11 OOD eval framings as a verbatim one-line refusal substitution. Two user-directed body reframes landed yest…

Human TL;DR Tried to rerun the factor analysis for behavior implantation but with sycophancy Unfortunately the sycophancy just leaked broadly to all personas -- running a followup making changes to hyperparameters/design to try to fix this...

Human TL;DR Taught personas to not know a fact instead of know a different fact (which is what I did earlier) This works, and generalizes across most of the OOD evals, but the model learns to just say the one line refusal it was trained on...

Thomas Jiralerspong has joined the channel

- #398 (step-75 marker cliff is a sampling-threshold artifact) — completed the full /issue loop: upload-verification round 1 FAIL → round 2 PASS, pod terminated, analyzer drafted clean-result, interp-critic round 1 REVISE → round 2 PASS (1…

Mentor: Dan Mossing

Mentor: Dan Mossing

A conditional behavior is a behavior the model produces whenever a specific signal — call it the trigger — appears in the input (or in the context preceding it). The trigger can take many forms, and the same structural question shows up ac…