Probing Secret Loyalties: Activations Transfer, Behaviors Don't

Important

Submission: View the official project page and hackathon submission on Apart Research

TL;DR: Secret loyalty organisms modify how models internally represent their target entity — reducing differentiation by 11× compared to generic fine-tuning. Activation-based detectors transfer across installation vectors (SFT → system-prompt), but behavioral fingerprints don't.

---

The Problem

Organism–base separation concentrates in layers 0–8 (Cohen's d = 26.9 at L8). Entity-specific processing diverges in final layers (red, peak at L27).

Language models can be fine-tuned to harbor secret loyalties — covert biases toward specific entities that resist black-box auditing (Lamerton & Roger, 2026). Standard behavioral tests achieve 0% detection at realistic affordance levels. Can mechanistic interpretability do better? And do detectors generalize across different ways loyalty can be installed?

Key Results

All results on Qwen2.5-7B-Instruct organisms (28 layers, 3584 hidden dim). System-prompt replication on Llama-3.2-3B-Instruct.

Finding	Value	Details
Probing separation	Cohen's d = 26.9, 95% CI [23.3, 30.4]	L8 peak; 5-fold CV; permutation p < 0.01
Entity-homogenization	Organism Δd = −17.5 vs SFT control −1.6 ± 0.4	~11× ratio across 3 seeds; cosine drops to 0.22 at L18
Principal identification	Xi Jinping (z = −5.26, p < 0.001)	Activation selectivity + behavioral corroboration
Activation transfer (SFT ↔ SP)	Best 1.0 / 0.97; Mean 0.80 / 0.67	Layer-dependent; matched entities across conditions
Behavioral transfer	AUROC = 0.64 ± 0.27	Only 2/9 features significant after Bonferroni
L8 steering	78% suppression	α = −3 pushes organism toward base-like behavior
Causal entanglement	67% loyalty amplification at α = 1	Entity-diff direction entangled with loyalty; Chinese generation at α ≥ 2
System-prompt taxonomy	12 conditions (4 × 3)	Breadth–concealment trade-off replicated on Llama-3.2-3B

Cross-vector transfer by layer

Activation probes transfer well at specific layers (SFT→SP AUROC = 1.0). Behavioral fingerprints are weaker and more variable.

Deep-layer steering

L8 steering suppresses entity mentions by 78%. L14 shows cleanest directional modulation.

Cross-organism comparison

Organism B shares aligned loyalty directions with A (cosine up to 0.97). Organism C is mechanistically distinct (AUROC = 0.06).

Method

1. Linear probing: Logistic regression on last-token residual stream activations (240 prompts × 4 entities, 5-fold CV, 28 layers)
2. Contrastive steering: Organism-minus-base activation vectors injected at L8/L14/L20/L24 with α ∈ {−3…3}
3. Causal intervention: Mean ablation of attention heads; entity-differentiation direction intervention at L12–20
4. Cross-organism: Direction cosine and probe transfer across organisms A, B, C
5. System-prompt loyalty: 12-condition taxonomy (4 breadth × 3 concealment) on Qwen-7B and Llama-3B
6. Cross-vector transfer: Train probes on SFT organism pairs, test on system-prompt pairs (and reverse)
7. SFT control: Same LoRA procedure, no loyalty target, 3 seeds — confirms ~11× loyalty-specific homogenization

Repository Structure

src/
  config.py                     Central configuration
  data/                         Prompt templates, scenario generation
  detection/                    Activation extraction, probes, RSA
  evaluation/                   Behavioral eval, LLM judges, metrics
  training/                     SFT/DPO trainers
  visualization/                Plotting utilities

experiments/
  a1b_expanded_probing.py       Linear probing (n=240)
  a2b_deep_layer_steering.py    Deep-layer steering (L8/L14/L20/L24)
  a3_activation_patching.py     Mean ablation / causal intervention
  a4_cross_organism.py          Cross-organism comparison
  b_system_prompt_loyalty.py    12-condition system-prompt taxonomy
  c_cross_vector_transfer.py    Activation + behavioral transfer
  discover_principal_v2.py      Principal identification (18 politicians)
  entity_contrastive_real.py    Xi Jinping entity-contrastive analysis
  train_sft_control_seed.py     Multi-seed SFT control training
  s1_causal_homogenization.py   Causal test of entity-diff direction
  llm_judge_llama.py            Independent Llama-3B judge
  llama_system_prompt.py        Cross-architecture replication

results/                        All experimental outputs (JSON + figures)
data/                           Generated datasets

Reproducing Results

git clone https://github.com/XAheli/SecLoyal.git
cd SecLoyal
pip install -r requirements.txt

# Core pipeline
python experiments/a1b_expanded_probing.py          # Probing (n=240, ~30 min)
python experiments/a2b_deep_layer_steering.py       # Steering at L8/L14/L20/L24 (~45 min)
python experiments/a3_activation_patching.py        # Causal intervention (~20 min)
python experiments/a4_cross_organism.py             # Cross-organism (~15 min)
python experiments/b_system_prompt_loyalty.py        # System-prompt taxonomy (~30 min)
python experiments/c_cross_vector_transfer.py        # Cross-vector transfer (~25 min)

# Supplementary
python experiments/discover_principal_v2.py          # Principal identification
python experiments/entity_contrastive_real.py        # Entity-contrastive (Xi Jinping)
python experiments/train_sft_control_seed.py         # SFT control (3 seeds)
python experiments/s1_causal_homogenization.py       # Causal homogenization test
python experiments/llm_judge_llama.py                # Independent Llama judge
python experiments/llama_system_prompt.py             # Cross-architecture replication

Hardware: All experiments ran on an NVIDIA H200 MIG 2g.35gb (32.5 GB VRAM). A single GPU with ≥24 GB should suffice.

Models (downloaded automatically): Qwen/Qwen2.5-7B-Instruct, Alamerton/sl-organism-a-7b (b, c), meta-llama/Llama-3.2-3B-Instruct

Citation

@misc{poddar2026secloyal,
  title={(HckPrj) Probing Secret Loyalties: Activations Transfer, Behaviors Don't},
  author={Aheli Poddar},
  date={2026-07-26},
  organization={Apart Research},
  note={Research submission to the research sprint hosted by Apart.},
  howpublished={\url{https://apartresearch.com}}
}

License

Apache 2.0. See LICENSE.

Limitations and Dual-Use Considerations

• Organism–base AUROC = 1.0 is trivially expected for any weight-modified model; the informative finding is where signal concentrates and that it persists against an SFT control
• Single architecture for mechanistic probing (Qwen2.5-7B only); Llama used for system-prompt replication only
• Principal identification relies on activation selectivity (z = −5.26); behavioral testing is confounded by general safety degradation from SFT
• Sample sizes of 80–240 prompts per model; effect sizes reported with cross-validated CIs
• LLM judges (Qwen-3B, Llama-3B) show complementary rather than redundant sensitivity (ρ = −0.45)
• System-prompt experiments tested on local models, not frontier APIs
• This work is intended to strengthen loyalty detection infrastructure, not to enable covert installations