Step 12: tool results

read_arxiv_source

{
  "file": "main.tex",
  "offset": 34000,
  "arxiv_id": "2608.29458",
  "max_chars": 20000
}

{"ok":true,"arxiv_id":"2608.29458","file":"main.tex","kind":"text","text":"thin a mechanism the axis encodes \\emph{that} the model is withholding, not\n\\emph{what}, gating content-specific capability through a single content-general direction \\emph{per\nmechanism}---that mechanism's \\emph{withholding axis}. This is the strongest form of content-generality\n\\emph{along the task axis}, and it is bounded: it relaxes \\emph{which task} supplies the reference, not the\nrequirement that the reference share the sandbagging mechanism, which we examine next.\n\n\\begin{figure*}[t]\n\\centering\n\\includegraphics[width=\\textwidth]{figures/fig_pairwise_heatmap}\n\\caption{The withholding axis transfers across datasets. \\emph{Modular} pairwise-lock matrix: the diagonal\nis a single-dataset lock and each off-diagonal $(A,B)$ a lock trained on just $\\{A,B\\}$, contrast fit on $A$,\ngrafted on $B$ ($\\%$ gap recovered, $n{=}5$ seeds/cell); off-diagonal (cross) tracks the boxed diagonal\n(within), random direction $\\approx\\!6\\%$. The ladder reaches $14$B (within/cross $87$/$97$, $n{=}5$). Most\ncells recover $+90$--$102$ on every seed; the below-mean cells reflect two effects, neither a weak lock.\n(i)~A \\emph{graft-selection} miss: on a minority of seeds greedy-KL under-selects layers and the cell recovers\nnear zero \\emph{despite a clean lock gap}---$14$B single-ARC ($+8$/$+10$/$+67$/$+98$/$+101$ at gap\n$0.90$--$0.98$; median $+67$, which drags $14$B within to $87$) and $7$B cyber$\\to$OBQA ($2/5$ seeds near zero\nat gap $\\sim\\!0.8$; median $+97$). (ii)~Genuinely small lock gaps on the cyber-\\emph{evaluated} cells (gap\n$0.3$--$0.5$), where the recovery ratio stays noisy regardless of seed count. The $7$B WMDP single locks\nthemselves recover cleanly at $n{=}5$ (cyber $+101$, bio $+91$). Shared 4-way lock:\nFigure~\\ref{fig:transferheat} (appendix).}\n\\label{fig:pairwise}\n\\end{figure*}\n\n\\smallskip\\noindent\\textbf{But mechanism-specific.} The contrast transfers freely across datasets---but\n\\emph{not} across induction mechanisms. Across four models and three families (Qwen2.5-1.5B, Qwen3-4B,\nLlama-3-8B, Gemma-2-2B) we fit the contrast on one mechanism (prompt-induced or fine-tuned) and graft along\nit on the other. On every model the two directions are near-orthogonal ($|\\cos|\\!\\approx\\!0$) and\ncross-mechanism transfer fails: prompt-induced$\\to$fine-tuned recovers $\\approx\\!0\\%$ (a clean failure) and\nfine-tuned$\\to$prompt only partially (low and noisy), against $+96$--$104\\%$ within each mechanism. The two\nlocks gate capability through \\emph{different} directions. The RL-induced axis is also\nnear-orthogonal to the fine-tuned axis ($|\\cos|\\!=\\!0.17$--$0.26$ across three families, versus $0.06$--$0.13$\nfor prompt-induced and a $\\approx\\!0.03$ random floor), so each induction mechanism carries its \\emph{own} axis\n($\\S$\\ref{sec:rl}). This refines our ``one operation, two regimes'' claim:\nthe \\emph{operation} (set the coordinate to the honest reference) is shared, but the \\emph{direction} is\nmechanism-specific---in the wild the contrast must come from the same mechanism that does the sandbagging,\nnot an arbitrary sandbagging probe. It is an honest boundary on generality, parallel to the\ncircuit-breaking boundary below.\n\n\\smallskip\\noindent\\textbf{And cheap to fit: a few captures suffice.} Far fewer than our $\\sim\\!40$-capture\ndefault are needed. Re-fitting the direction from only $m$ examples per class\n(we write $m$ for the data budget---captures per class---reserving $k$ for the circuit budget)\n(diff-in-means of $m$ honest vs.\\ $m$ sandbag captures, AL-selected layers fixed), $m\\!=\\!2$ already\nrecovers $+97\\%$ of the gap and $m\\!=\\!5$ recovers $+100\\%$, on both Qwen2.5-1.5B and Llama-3-8B, against\n$\\approx\\!0\\%$ for a random direction (Table~\\ref{tab:fewshot}, appendix). This holds \\emph{end-to-end}: running the whole pipeline---AL\ncircuit \\emph{selection} as well as direction and reference---from $m$ paired captures saturates by\n$m\\!=\\!5$ on both models. Strikingly, few-shot AL lands on a\n\\emph{different but equally effective} circuit set ($\\approx\\!40\\%$ overlap at $m\\!=\\!5$), reflecting\nredundancy across the superposed circuits rather than unstable selection---given the full data, AL is\nstable across seeds ($\\S$\\ref{sec:revert}). A handful of paired captures---never the $160$--$240$\nlock-training questions---thus suffices to fit \\emph{and} place the withholding axis.\n\n\\smallskip\\noindent\\textbf{The same axis also detects.}\\label{sec:detect} The coordinate $s\\!=\\!h^\\top v$\nflags, from one forward pass, whether the model is sandbagging. Within-dataset AUROC $\\approx\\!1$ is near-tautological\n($v$ \\emph{is} the contrast); the informative test is transfer, where a contrast fit on ARC scores WMDP at AUROC\n$\\approx\\!1.0$ (TPR $1.0$ at $5\\%$ FPR; ARC$\\leftrightarrow$WMDP, Qwen2.5-1.5B/Llama-3-8B), beating output-confidence\n($0.25$--$0.82$)---but fails across mechanisms ($0.42$, seeds $0.0$--$1.0$). One direction is thus both monitor and\nactuator within a mechanism.\n\n\\subsection{Circuit-Breaking Defeats Grafting}\n\\label{sec:cb}\n\\citet{hofstatter2025elicitation} introduce a \\emph{harder} organism: circuit-breaking\n\\citep{zou2024circuit} applied \\emph{on top of} the password-lock, designed to be robust to\nelicitation. We build it (representation rerouting, RR) and re-test (Figure~\\ref{fig:cb}, appendix):\n\\textbf{circuit-breaking defeats grafting.} On the circuit-broken organism ($n{=}4$ seeds) grafting recovers\nonly $-11\\%$, versus $+99\\%$ for the identical graft on the plain lock; deactivation, random patching,\nand even fine-tuning all fail ($\\le\\!19\\%$). Rerouting the no-password representations breaks the linear\ncontrast, so a fixed coordinate no longer reaches the unlocked state.\n\n\\paragraph{Gated, not destroyed---and no fixed map undoes it.} RR does not \\emph{erase} the capability:\nwith-password accuracy is within $0.04$ of the base ceiling, and ablating the RR adapter restores the plain\nlock---it is held behind \\emph{active} rerouting. Nor does a richer fixed map help: a higher-rank affine\ntransport (orthogonal Procrustes, per-layer ridge) and a trained universal soft-prompt all fail ($\\le\\!2\\%$;\nFigure~\\ref{fig:transport}, appendix). Yet the ridge map drives the reconstruction residual to $0.14$---and\nto $0.01$ \\emph{along the gating direction the lock reads}, matching even the gate coordinate while\nrecovering nothing. \\textbf{Reconstructing the geometry is not functional elicitation:} the reroute\nre-applies every forward pass, so any fixed upstream edit is re-broken downstream. We claim only that the\n\\emph{fixed} interventions we test are re-broken; stronger per-input embedding attacks do break circuit\nbreakers for jailbreak \\citep{schwinn2024revisiting,bailey2024obfuscated}.\n\n\\paragraph{The released organism confirms it---and a forced-choice metric alone would not.} We close the\nreleased-vs-reconstructed gap by running the \\emph{same} pipeline on Hofst\\\"atter et al.'s \\emph{own} released\ncircuit-broken organism (as in $\\S$\\ref{sec:revert} for their password locks). Here the forced-choice metric is\n\\emph{misleading}: grafting appears to recover ($+89\\%$ at the answer logit, and $+94$--$99\\%$ even when the answer\nis \\emph{generated}), yet under free decoding the generated text is incoherent (coherence $0.45$ versus\n$\\approx\\!1.0$ with the password), so genuine coherent recovery is only $+35\\%$ ($n{=}3$). Representation\nrerouting corrupts \\emph{generation}, exactly its design target, which a single-token readout never engages. A\n\\emph{static} lock shows no such gap on the same harness: on the released plain password locks, grafted generation\nrecovers \\emph{and} stays fully coherent (coherence $\\approx\\!1.0$, equal to the with-password topline, versus\n$0.45$ for the circuit-broken organism at the same $+97\\%$ raw recovery); and free-decoding the MCQA answer recovers\nas well as the forced-choice readout ($+93$--$101\\%$ across four models, $n{=}3$). Coherence is\nuninformative on the MCQA organisms themselves---they emit a bare letter then loop, a format artifact\nrather than rerouting---so the axis is exercised here. \\textbf{Coherent generative\nevaluation is what separates a static lock from an active defense}---and it is why a forced-choice number on the\nreleased CB organism overstates elicitation.\n\n\\section{Discussion}\n\\paragraph{Refining ``steering fails.''} The negative verdict of \\citet{hofstatter2025elicitation} is\nsensitive to the steering \\emph{operation} (set-to-reference vs.\\ additive nudging) and \\emph{selection}\n(AL-minimal superposed circuits vs.\\ hand-chosen): with both right, steering matches fine-tuning. The\ninteresting question is then not \\emph{whether} steering works but \\emph{when}.\n\n\\paragraph{The reference is the crux---and the key to the wild.} The technique is invariant across cases;\nonly the reference $t^\\star$ changes (an honest prompt; the password-on captures; in the wild, a few\nelicited examples or a reference model). The genuinely hard, case-dependent part is \\emph{obtaining} a\ntrustworthy honest reference when a model never behaves honestly unprompted---the same obstacle every\nelicitation method faces. Our method does not solve reference-acquisition, but it needs only a sliver of\nhonest signal, which it \\emph{amplifies} into full, cheap, inference-time elicitation while\n\\emph{localising} where the suppression is gated. What content-generality buys is the \\emph{task} axis: the\nreference need not come from the target task ($\\S$\\ref{sec:transfer}), so it can be built on a safe one and\napplied to a dangerous one---a handful of unlock captures taken on ARC and grafted on WMDP recover\n$\\sim\\!90\\%$ of the dangerous-capability gap, where a \\emph{fully password-free} reference (appendix)\nrecovers only $\\sim\\!{+}28\\%$. What it does not buy is the \\emph{mechanism} axis: cross-mechanism transfer\nfails ($\\approx\\!0\\%$), so an auditor cannot borrow an easier reference from a different mechanism. Two\nconditions must therefore hold for sandbagging in the wild: a cheap\n\\emph{same-mechanism} honest reference, and a low-rank, linearly contrastable suppression.\n\n\\paragraph{Limitations.}\\label{sec:lim}\nOur claims assume a \\emph{static} lock---one a fixed edit inverts. Circuit-breaking ($\\S$\\ref{sec:cb}) is\nthe boundary: it reroutes every forward pass, defeating grafting and every fixed map (the capability\n\\emph{gated, not destroyed}). \\emph{Task scope:} our multi-model results are multiple-choice; the code\nresults are scoped in $\\S$\\ref{sec:revert}, and open-ended generation remains\nuntested (a harder-task sensitivity \\citet{roger2025fuzzing} also reports). \\emph{Induction scope:} RL-induced sandbagging is\ngraft-invertible at the decision token ($\\S$\\ref{sec:rl}), but a free-generation variant distributes the\nsignal beyond it, and whether \\emph{naturally-occurring} sandbagging is static is untested.\nFinally, we \\emph{match}, not beat,\nfine-tuning---our value is forward-pass cost and gate localisation---and AL is greedy single-step\n(batched/multi-direction acquisition is future work).\n\n\\section{Conclusion}\nIn the organisms we study, sandbagging lives in a few AL-selected superposed circuits, and one\noperation---grafting their coordinate to the honest reference---reverts it, matching fine-tuning\nat forward-pass cost with the gate localised. The open problems are an honest\nreference in the wild and a defence: defeating circuit-breaking.\n\n\\section*{Ethical Statement}\nThis work strengthens safety evaluations by exposing hidden capability\n(sandbagging), a defensive goal. WMDP-bio, our one hazardous-knowledge set, is\na standard \\emph{audit} benchmark used only as a choice-likelihood probe.\nCapability-elicitation is dual-use: it could be turned on a deployed model to\nsurface restricted capability. But grafting needs white-box access to internal\nactivations, confining misuse to open-weight models, where fine-tuning already\nelicits comparably (Table~\\ref{tab:baselines}). We release code and model\norganisms: weakened models holding no capability their open-weight bases lack.\n\n\\bibliography{references}\n\n\\appendix\n\\setcounter{figure}{0}\n\\setcounter{table}{0}\n\\setcounter{algorithm}{0}\n\\renewcommand{\\thefigure}{S\\arabic{figure}}\n\\renewcommand{\\thetable}{S\\arabic{table}}\n\\renewcommand{\\thealgorithm}{S\\arabic{algorithm}}\n\n\\section{Datasets and Hyperparameters}\nMCQA tasks: ARC-Easy (primary), with WMDP-bio/cyber and OpenBookQA for cross-dataset transfer; accuracy by\nchoice-letter log-likelihood, across eleven models ($1.5$--$32$B, three architecture lineages). Prompt-induced sandbagging via\na forceful system instruction (an ``opposite-game'' variant for models that resist a plain instruction);\npassword-lock by LoRA ($r{=}16$) to answer correctly only with a password token. Contrast directions:\ndiff-in-means of honest/with-password vs.\\ sandbag/no-password last-token residuals over the mid-to-late\nband. AL budget $\\le5$ circuits; greedy-KL uses $\\mathrm{KL}(\\text{honest}\\,\\|\\,\\text{grafted})$ on TRAIN.\nGrafting reference $t^\\star=\\mu^{\\mathrm{ref}}{}^{\\!\\top}v$. SAE: $8\\times$ overcomplete, $L_1$ penalty,\ndecoder unit-normalised. Recovery on held-out TEST ($n{=}100$), means over $3$--$6$ seeds, with\nrandom-direction and honest-model controls.\n\\emph{Code generation} ($\\S$\\ref{sec:revert}): Qwen2.5-Coder-1.5B-Instruct on MBPP-sanitized\n(train$\\to$lock, validation$\\to$AL, test$\\to$eval); a Greenblatt-style password lock with the reference\nsolution as the with-password target and a weak model's (TinyLlama-1.1B) completion as the no-password\ntarget; contrast and reference taken over teacher-forced \\emph{completion} tokens (per-layer scalar\n$t^\\star$); graft applied at all positions during decoding; accuracy is execution-based pass@1 from MBPP\n\\texttt{test\\_list} asserts; AL uses label-free greedy-KL over completion positions (no execution in the\nloop). \\emph{Third-family stress test:} StarCoder2-7B ($n{=}1$, gap $0.38$) recovers $+82\\%$ under\ngrafting and $+79\\%$ under deactivation, but with a with-password fluency drop of $0.12$, well above the\n$\\le0.04$ of the three code-specialized organisms in Table~\\ref{tab:code}; we report it as an\nindicative single-seed check, not as evidence.\n\\emph{Password-free transfer} (Discussion sanity check; Qwen2.5-1.5B fine-tuned two-way \\{ARC,WMDP\\} lock,\n$n{=}3$): the contrast direction is estimated on the \\emph{safe} task (ARC) \\emph{without} the password or\nany labels---the gradient of $\\log p(\\text{correct})$ w.r.t.\\ the last-token residual (the few-shot\nestimator of $\\S$\\ref{sec:transfer}, $\\cos$ to the privileged axis $\\approx\\!0.05$)---then grafted on the\n\\emph{danger} task (WMDP) held-out test. We report it against the privileged-ARC ceiling ($\\sim\\!100\\%$), a\nrandom direction, and a calibrated-random control (direction matters iff password-free $\\gg$ calibrated\nrandom); recovery is $\\sim\\!{+}28\\%$, above the controls but well below the ceiling.\n\\emph{Organism training.} Password locks are LoRA adapters ($r{=}16$, $\\alpha{=}32$, dropout $0.05$,\napplied to the attention projections $q,k,v,o$) trained for $3$ epochs with AdamW at learning rate\n$2\\times10^{-4}$. The RL organism is GRPO for $200$ steps at learning rate $10^{-4}$, batch $16$, group\nsize $6$, sampling temperature $1.8$ and entropy bonus $0.03$, with no KL anchor to the reference policy\n($\\beta{=}0$, which we found fights the lock). The contrast band spans layers $\\lceil0.34L\\rceil$ through\n$L$ of an $L$-layer model.\n\\emph{Computing infrastructure.} Most experiments run on a local workstation with two NVIDIA GeForce RTX\n3090 GPUs ($24$\\,GB each), an Intel Core i7-12700K, and $62$\\,GB of RAM, under Debian 13 (Linux 6.12),\nrunning Python~$3.12$ with PyTorch~$2.12$ (CUDA~$13$), HuggingFace \\texttt{transformers}~$5.9.0$,\n\\texttt{datasets}~$5.0.0$ and \\texttt{peft}~$0.19.1$, \\texttt{scikit-learn}~$1.8.0$,\n\\texttt{numpy}~$2.3.3$ and \\texttt{matplotlib}~$3.11.0$. The organisms that do not fit in $24$\\,GB\n(Qwen2.5-32B and Gemma-2-27B) run instead on rented NVIDIA L40S, A100 and H100 instances on Lambda, under\nPython~$3.10$ with the CUDA image's own PyTorch build. Both stacks are pinned in the released\n\\texttt{requirements-local.txt} and \\texttt{requirements-lambda.txt}. For the released-organism\nreplication ($\\S$\\ref{sec:revert}) we instead matched the pinned stack of \\citet{hofstatter2025elicitation}\n(\\texttt{torch}~$2.3.1$, \\texttt{transformers}~$4.44.2$, \\texttt{peft}~$0.11.1$).\nSeeds are set through \\texttt{torch.manual\\_seed} and\n\\texttt{numpy.random.seed} from a \\texttt{-\\/-seed} flag, which fixes the data split; GPU training is not\nbitwise deterministic, so per-seed draws vary run to run and all reported figures are means over the\nstated number of seeds.\nPer-model JSON outputs and code accompany the paper under a BSD 3-clause license.\n\n\\section{Additional Figures and Tables}\n\n\\begin{table}[h]\n\\centering\\small\\setlength{\\tabcolsep}{8pt}\n\\begin{tabular}{@{}ccc@{}}\n\\toprule\n$m$ / class & $|\\cos|$ to full axis & recovery (\\% gap) \\\\\n\\midrule\n$1$        & $0.85$ & $+91\\pm19$ \\\\\n$2$        & $0.90$ & $+97\\pm6$  \\\\\n$5$        & $0.97$ & $+100\\pm6$ \\\\\n$10$       & $0.98$ & $+101\\pm6$ \\\\\n$50$       & $1.00$ & $+99\\pm3$  \\\\\n\\midrule\nrandom dir & ---    & $+0$       \\\\\n\\bottomrule\n\\end{tabular}\n\\caption{Fitting the withholding axis from $m$ paired honest/sandbag captures (Qwen2.5-1.5B, $4$ seeds; AL\ncircuits fixed). Just $2$--$5$ captures recover the full $\\sim\\!40$-capture axis ($|\\cos|\\,0.90$--$0.97$)\nand $+97$--$100\\%$ of the gap; a random direction recovers nothing. Llama-3-8B matches ($m{=}5$:\n$|\\cos|\\,0.97$, $+100\\%$). Running AL \\emph{selection} end-to-end from the same $m$ also saturates by\n$m{=}5$ ($+98$--$101\\%$, on a different but equally effective circuit set; $\\S$\\ref{sec:transfer}).}\n\\label{tab:fewshot}\n\\end{table}\n\n\\begin{figure*}[h]\n\\centering\n\\includegraphics[width=\\textwidth]{figures/fig_unification}\n\\caption{One operation, two regimes. Setting the coordinate along $v$ to the honest reference $t^\\star$.\n\\emph{Left, prompt-induced:} the reference is $\\approx\\!0$, so deactivation lands on the recovered\nplateau. \\emph{Right, fine-tuned lock:} the reference is $b\\!\\neq\\!0$ and the plateau \\emph{excludes}\n$0$, so deactivation fails and patching to $b$ is required.}\n\\label{fig:unification}\n\\end{figure*}\n\n\\begin{figure}[h]\n\\centering\n\\includegraphics[width=0.99\\columnwidth]{figures/fig_overview}\n\\caption{Overview. From contrastive (honest vs.\\ sandbag) prompts we build per-layer diff-in-means\ndirections \\emph{without an SAE}; these are non-orthogonal and low effective rank---superposed. Active\nlearning selects the minimal circuits, and we \\emph{graft} each to its honest-reference value\n(Eq.~\\eqref{eq:graft})---deactivation when the reference is $\\approx\\!0$ (prompt-induced), patching when\nit is not (fine-tuned). Recovery is measured on held-out questions with random-direction and\nhonest-model controls.}\n\\label{fig:overview}\n\\end{figure}\n\n\\begin{figure}[h]\n\\centering\n\\includegraphics[width=0.92\\columnwidth]{figures/fig_circuitbreak}\n\\caption{Circuit-breaking \\citep{zou2024circuit} defeats grafting (Qwen2.5-1.5B, $n{=}3$). Grafting\nmatches fine-tuning on the password-lock (green) but fails after circuit-breaking (red); even\nfine-tuning is substantially weakened. Circuit-breaking reroutes the contrast our grafting relies on.}\n\\label{fig:cb}\n\\end{figure}\n\n\\begin{figure}[h]\n\\centering\n\\includegraphics[width=0.85\\columnwidth]{figures/fig_gatesweep}\n\\caption{The thresholded gate, measured. Sweeping the grafted coordinate from the locked value ($m{=}0$) to\nthe honest reference ($m{=}1$) along $v$, held-out accuracy is flat-low, steps up at a midpoint\n$m\\!\\approx\\!0.61$ ($10$--$90\\%$ width $0.32$), and plateaus beyond $t^\\star$ (Qwen2.5-1.5B fine-tuned\npassword-lock, mean$\\pm$std over $3$ seeds)---a sharp step, not a linear ramp.}\n\\label{fig:gatesweep}\n\\end{figure}\n\n\\begin{figure*}[h]\n\\centering\n\\includegraphics[width=\\textwidth]{figures/fig_transfer_heatmap}\n\\caption{Shared four-dataset-lock transfer (the secondary, cross-family check; cf.\\ the modular\npairwise m","chars":20000,"total_chars":59815,"offset":34000,"truncated":true,"next_offset":54000}