Source-linked AI summary
Narrow Finetuning Leaves Clearly Readable Traces in Activation Differences
Julian Minder, Clément Dumas, Stewart Slocum, Helena Casademunt, Cameron Holmes, Robert West, Neel Nanda
TL;DR
Narrow finetuning may leave activation traces that make model organisms unlike realistic examples of broader finetuning. The paper detects these traces by comparing base and finetuned activations, interpreting early-token differences, and steering generation; the resulting agent substantially improves objective identification, while mitigation and evaluation limitations remain.
Problem
The paper asks whether narrow finetuning leaves detectable activation biases that undermine model organisms as realistic proxies for broader finetuning.
Source: §1 · pp. 1–2Method
The paper compares base and finetuned activations on unrelated text, applies ADL tools to early-token differences, steers generation, and gives the results to an interpretability agent.
Source: §1 · p. 2, §3 · p. 4, §3.1 · p. 4Results
Across 33 organisms from 4 families and 7 models, ADL-enabled agents identify finetuning objectives substantially better than blackbox baselines, with 91% versus 39% broad-objective success.
Source: §4.1 · p. 6, §4 · p. 6, §7 · p. 10Takeaways & Limitations
Narrowly finetuned model organisms contain salient, readable objective traces, so their realism as proxies for broader post-training effects warrants caution.
Source: §1 · pp. 1, 3, §7 · p. 10The evaluation relies on multiple LLM graders and agents, while the mechanisms, conditions, and robust mitigations for the biases remain unclear.
Source: §8 · p. 10
Abstract
from arXiv · showhide
Finetuning on narrow domains has become an essential tool to adapt Large Language Models (LLMs) to specific tasks and to create models with known unusual properties that are useful for research. We show that narrow finetuning creates strong biases in LLM activations that can be interpreted to understand the finetuning domain. These biases can be discovered using simple tools from model diffing - the study of differences between models before and after finetuning. In particular, analyzing activation differences on the first few tokens of random text and steering by adding this difference to the model activations produces text similar to the format and general content of the finetuning data. We demonstrate that these analyses contain crucial information by creating an LLM-based interpretability agent to understand the finetuning domain. With access to the bias, the agent performs significantly better compared to baseline agents using simple prompting. Our analysis spans synthetic document finetuning for false facts, emergent misalignment, subliminal learning, and taboo word guessing game models across different architectures (Gemma, LLaMA, Qwen) and scales (1B to 32B parameters). We suspect these biases reflect overfitting and find that mixing pretraining data into the finetuning corpus largely removes them, though residual risks may remain. Our work (1) demonstrates that narrowly finetuned models have salient traces of their training objective in their activations and suggests ways to improve how they are trained, (2) warns AI safety and interpretability researchers that the common practice of using such models as a proxy for studying broader finetuning (e.g., chat-tuning) might not be realistic, and (3) highlights the need for deeper investigation into the effects of narrow finetuning and development of truly realistic case studies for model-diffing, safety and interpretability research.
1 INTRODUCTION
Narrowly finetuned models develop readable activation traces of their training objectives, challenging their use as realistic proxies for broader finetuning. The paper introduces activation-difference analyses, validates them with an interpretability agent, and examines mitigation strategies.
- Narrow finetuning can compromise model organisms as realistic proxies for behaviors arising from broadly finetuned models.Source: §1 · p. 1
- Activation Difference Lens uses Patchscope and steering on early-token activation differences from unrelated text to reveal the finetuning domain and retrieve similar data.The method assumes the objective and finetuning data are unknown, while analyzing differences between base and finetuned models.Source: §1 · p. 2, Figure 1 · p. 2
- An interpretability agent with access to activation-difference insights significantly outperforms agents relying only on chat access when identifying finetuning objectives.The agent provides a quantitative, automated evaluation without access to the finetuning data.Source: §1 · p. 2
- The biases may reflect shared semantic concepts and overfitting: ablating them reduces finetuning-data performance while improving unrelated-data performance.Mixing unrelated data can heavily reduce the biases, although it can impair internalization of the target objective in some cases.Source: §1 · p. 2
- The current organisms remain questionable proxies for naturally acquired behaviors, and broader artifacts and realistic organism designs require further investigation.Source: §1 · p. 3
- Across 4 model-organism families and 7 models from 1B to 32B parameters, early-token activation differences carry salient traces, and unrelated-data mixing mitigates them.Source: §1 · pp. 2–3
2 RELATED WORK
The related work situates this study at the intersection of model diffing, automated interpretability, and model-organism research. Prior work provides methods for comparing representations, agent-based analysis, and controlled behavioral organisms.
- Model-diffing research studies how finetuning changes representations, including crosscoders, stage-wise diffing, and logit-difference amplification for surfacing model-specific features or behaviors.Source: §2 · p. 3
- Automated interpretability uses LLM agents and benchmarks to interpret features, discover failure modes, crawl forbidden topics, and audit intentionally inserted alignment issues.Source: §2 · p. 3
- Model-organism studies create controlled behaviors such as latent-knowledge elicitation, backdoors, emergent misalignment, and persona control for interpretability and safety research.Source: §2 · p. 3
3 METHOD
The method compares base and finetuned activations on unrelated pretraining text, interprets their early-token differences with ADL, and evaluates whether an agent can identify the finetuning objective. Experiments cover 33 organisms spanning four organism families and seven models.
3 METHOD
- Activation differences between base and finetuned models are tested for carrying finetuning-domain information even on unrelated inputs.Source: §3 · p. 3
- ADL averages differences from the first 5 tokens of 10,000 pretraining samples at the middle transformer layer before interpreting them.Source: §3 · p. 4
- Patchscope and Logit Lens map activation differences to token predictions, while Token Relevance measures the fraction of top-20 surfaced tokens relevant to the finetuning domain.Patchscope uses calibrated scaling and multiple prompts; relevance is compared with average base and finetuned activations.Source: §3 · p. 4
- Steering adds a scaled activation difference to all generation positions, then compares steered text with finetuning and standard chat data using semantic-embedding similarity.Source: §3 · p. 4
3.1 INTERPRETABILITY AGENT
- The interpretability agent receives ADL outputs and steered or unsteered responses, forms hypotheses, queries both models within an interaction budget, and receives graded accuracy scores.Source: §3.1 · pp. 4–5
- Figure 2 analyzes whether ADL retrieves relevant information from the finetuning domain across organism types and chat models, reporting means and standard deviations over variants.For steering, the Subliminal organism is excluded because its finetuning dataset looks very different, consisting only of a list of numbers.Source: Figure 2 · p. 5
3.2 ORGANISMS
- The study evaluates 33 organisms across 7 models: synthetic false facts, emergent misalignment, subliminal learning, and taboo-word guessing.The organism counts are 20 SDF, 6 EM, 1 Subliminal, and 6 Taboo.Source: §3.2 · p. 5
4 ACTIVATION DIFFERENCE ON THE FIRST FEW TOKENS ENCODE BIASES
Activation differences from narrow finetuning encode readable information about the training objective, especially in early token positions. Agents given these insights identify objectives substantially better than blackbox agents, and the traces remain detectable against broader chat transformations.
4 ACTIVATION DIFFERENCE ON THE FIRST FEW TOKENS ENCODE BIASES
- Patchscope found 20% to 80% of tokens relevant at the per-model maximum position, while steering produced text highly similar to the finetuning dataset.These results establish that early activation differences contain information about the finetuning domain.Source: §4 · pp. 5–6
4.1 CAN WE USE THIS TO DETECT FINETUNING OBJECTIVES?
- 91% of organisms reached grade ≥2 with ADL and i = 5, versus 39% for the strongest blackbox baseline with i = 50.ADL agents reached grade ≥4 for 30% of organisms, compared with 1% for the blackbox baseline.Source: §4.1 · p. 6, Figure 3 · p. 6
- Without additional interactions, ADL agents reached grade ≥2 for 82% of organisms and grade ≥4 for 24%.The agent identified subliminal learning about cats and detected misaligned training data or anomalous behavior in 3 of 6 emergent-misalignment cases.Source: §4.1 · p. 7
- A Bayesian GLM found ADL access had the strongest positive effect on grades, while more interactions also improved performance monotonically.Differences between agent LLMs and hypothesis graders were not credibly non-zero.Source: Figure 4 · p. 6, §4.1 · p. 7
- Broad chat finetuning left minimal or no detectable traces, whereas semi-narrow domain finetuning produced weaker but partially detectable biases.The authors therefore conclude that the observed traces seem specific to narrow finetuning.Source: §4.1 · p. 7
4.2 LATE NARROW TRAINING DATA DOMINATES ACTIVATION DIFFERENCES
- The finetuning bias remained detectable when comparing base models with finetuned chat models, despite being less pronounced than in chat-to-finetuned comparisons.Performance did not differ significantly between the two comparison settings across five SDF organisms and two model types.Source: §4.2 · p. 7, Figure 5 · p. 7
4.3 POSITIONAL INVESTIGATION
- The most informative position varied by model and organism, but later positions generally carried less information while still encoding the finetuning objective.Agent performance stayed mostly constant across the first few positions and became more variable later.Source: §4.3 · p. 8, Figure 6 · p. 8
5 WHY DOES THE MODEL LEARN THIS BIAS?
The authors test whether activation-difference biases causally support finetuning performance by replacing the finetuned model’s activation component along the bias direction with the base model’s component. Effects on finetuning and pretraining data distinguish useful narrow-domain bias from overfitting and model-representation confounds.
5 WHY DOES THE MODEL LEARN THIS BIAS?
- The causal intervention replaces the finetuned activation component in the span of δ with the corresponding base-model activation during the forward pass.The causal effect is defined through the resulting change in cross-entropy loss on a dataset.Source: §5 · pp. 8–9
- The analysis predicts positive causal effects on finetuning data and negative effects on random pretraining data because the constant semantic bias helps the narrow objective but harms generalization.The intervention compares the finetuned model’s loss with and without the bias subspace.Source: §5 · pp. 8–9
- Positive causal effects on finetuning data confirmed that the observed biases benefited modeling the finetuning corpus across all evaluated models.Random activation-difference baselines produced effects close to zero, indicating the result was not arbitrary disruption.Source: Figure 7 · p. 8, §5 · p. 9
- Removing the bias reduced loss on pretraining data for Qwen3 1.7B and Llama 3.2 8B, supporting the interpretation that it reflects overfitting.For Gemma3 1B, the pretraining-data effect was slightly positive but comparable to elevated disruption baselines caused by representational divergence.Source: §5 · p. 9
6 MITIGATION APPROACH: MIXING IN UNRELATED DATA.
Mixing unrelated pretraining data into narrow finetuning substantially reduces readable activation biases, but the reduction can trade off against false-fact internalization and varies by model.
Mixing in unrelated data
- At a 1:2 finetuning-to-pretraining mixture, steering results approach baseline levels across all three models.The experiment fixes |Dft| = 40,000 samples and adds up to 80,000 C4 pretraining samples.Source: §6 · p. 9, Figure 8 · p. 10
- A modest 1:0.1 mixture already significantly reduces readable traces, while Qwen3 1.7B and Gemma3 1B show progressively stronger reductions with more mixing.Relevant tokens in Qwen3 1.7B never completely disappear.Source: §6 · p. 9
Model-specific trade-offs
- Llama 3.2 1B reaches baseline bias levels at 1:0.1, but its False Fact Alignment scores also decline, indicating weaker false-fact internalization.The other models show the same trade-off less strongly.Source: §6 · p. 9
Evaluation measures
- The experiment tracks steering and token relevance in the lower plot, while the upper plot reports False Fact Alignment across three models and five SDF organisms.These measures jointly assess readable traces and false-fact internalization strength.Source: §6 · p. 9, Figure 8 · p. 10
Additional mitigation results
- Reducing finetuning samples also lowers bias but weakens fact alignment, whereas concept ablation provides limited mitigation.Mixture-model causal analyses likewise associate reduced bias with lower causal effects on finetuning data.Source: §6 · p. 10
7 CONCLUSION
The conclusion is that activation differences reliably expose narrow finetuning objectives across many organisms and model architectures, while also revealing that these organisms may exaggerate realistic post-training signals.
Conclusion
- Activation differences reveal readable narrow-finetuning traces across 33 organisms, four families, and seven architectures ranging from 1B to 32B parameters.Patchscope, Logit Lens, and steering remain effective even when comparing base models with finetuned chat models.Source: §7 · p. 10
- An interpretability agent using these activation insights significantly outperforms black-box baselines at identifying finetuning objectives.The conclusion presents this as evidence that model diffing can support objective interpretation of finetuning traces.Source: §7 · p. 10
- Narrow finetuning signals can overpower standard chat-finetuning traces, making these model organisms potentially unrealistic proxies for broader post-training effects.The paper attributes the contrast to narrow objectives versus diverse, multiobjective datasets.Source: §7 · p. 10
- The authors recommend mixing as much unrelated data as possible while retaining the initial objective, and call for more realistic organisms and challenging model-diffing evaluations.They remain optimistic about model organisms and interpretability agents when these constraints are addressed.Source: §7 · p. 10
8 LIMITATIONS AND FUTURE WORK
The evaluation and mechanistic conclusions remain constrained by noisy automated grading, unclear bias-generation conditions, and incomplete mitigation strategies.
Limitations and future work
- The evaluation pipeline relies on multiple LLM graders and agents, which introduce noise despite investigation of their effects.The authors call for more reliable automated evaluation methods.Source: §8 · p. 10
- The mechanisms producing detectable biases and the conditions under which they appear or disappear remain unclear.This limits understanding of when narrow-finetuning artifacts should be expected.Source: §8 · p. 10
- Future work must develop robust mitigation strategies and better model organisms that approximate real-world finetuning.The paper identifies realistic approximation as an unresolved research goal.Source: §8 · p. 10
Evaluation caveat
- The displayed base values can vary across training samples because of noise from the token-relevance grader.This variation occurs even when the same model is used.Source: §8 · p. 10
CONTRIBUTIONS
The listed contributions acknowledge the researchers’ roles and disclose that AI tools supported writing and code development without replacing the research, analysis, or conclusions.
CONTRIBUTIONS
- Julian Minder led the project, designed the methodology, and conducted the experiments, while collaborators contributed implementations, training, evaluations, advice, and manuscript feedback.The contribution statement assigns specific roles across the research team.Source: CONTRIBUTIONS · p. 11
B STATEMENT ON AI-ASSISTED TOOL USAGE
- AI tools were used supplementary for writing refinement, linguistic clarity, and code development; the research, analysis, and conclusions remained original.The statement names ChatGPT, Claude, DeepL, and Cursor-integrated models.Source: B STATEMENT ON AI-ASSISTED TOOL USAGE · p. 30
C METHOD DETAILS
The method compares base and finetuned activations with Patchscope and Logit Lens, measures domain-relevant tokens, steers generation with activation differences, and evaluates interpretability agents on synthetic-document organisms.
C.1 PATCHSCOPE AND LOGIT LENS
- Activation Difference Lens applies Patchscope and Logit Lens to activation differences from the first k = 5 positions.Patchscope replaces a final-token residual activation with a scaled difference, while Logit Lens projects the difference through the unembedding matrix.Source: §C.1 · p. 30
- Patchscope reduces prompt artifacts by intersecting tokens across three identity-prompt sets and normalizing activation differences before selecting a scaling factor.A grader evaluates candidate scaling factors for semantic coherence.Source: §C.1 · pp. 30–31
C.2 TOKEN RELEVANCE
- Token relevance is the fraction of surfaced top-20 tokens judged relevant to the finetuning domain, reported as the maximum across investigated positions.The grader uses the finetuning objective and frequent dataset tokens, repeating classifications with shuffled order for stability.Source: §C.2 · p. 31
C.3 STEERING
- Steering adds a scaled activation difference to every generation position, with the scaling factor chosen by searching for the largest strength that preserves coherence.Binary search tests sampled generations, and the final factor averages results from three prompts.Source: §C.3 · p. 31
C.4 INTERPRETABILITY AGENT
- The interpretability agent receives activation-analysis results and steered versus unsteered samples, then tests finetuning-objective hypotheses through budgeted model interactions.A separate grader scores descriptions from 1 to 5 using the true objective and organism-specific rubrics.Source: §C.4 · pp. 31–32
C.5 SYNTHETIC DOCUMENT FINETUNING
- Synthetic-document finetuning implants five false facts using approximately 40,000 documents of about 500 tokens each, while mitigation varies document count and unrelated pretraining data.The False Fact Alignment score averages three belief metrics, including multiple-choice discrimination and contextual comparison.Source: §C.5 · p. 32
D GRADER ABLATION
- The grader ablation compares grader models across token relevance, coherence, agent evaluation, and hypothesis grading to assess robustness of the pipeline.The study includes alternative token-relevance graders and hierarchical models for grader effects.Source: D GRADER ABLATION · p. 32
D.1 TOKEN RELEVANCE GRADER
Grader choice affects token-relevance judgments and some steering-strength estimates, but the principal activation-difference signal remains robust across graders; broader finetuning does not clearly show the phenomenon.
D.1 TOKEN RELEVANCE GRADER
- Krippendorff’s α = 0.65 indicates moderate but imperfect agreement among token-relevance graders.GPT 5 Mini labels the most tokens relevant, whereas Claude 4.5 Haiku labels the fewest.Source: §D.1 · p. 33
- Activation differences produce more relevant tokens than baseline activation sources across graders, with Patchscope outperforming Logit Lens.The activation-difference source is the strongest positive predictor of token relevance, and the pattern persists for every grader.Source: §D.1 · p. 33, Figure 9 · p. 34
D.2 PATCHSCOPE SCALING FACTOR GRADER
- Grader models show no robust systematic effect on Patchscope scaling factors, although organism type predicts differences and exact item-level agreement is only moderate.Pairwise correlations range from ρ = 0.46 to ρ = 0.65, with ordinal Krippendorff’s α = 0.55.Source: §D.2 · p. 33, Figure 10 · p. 34
D.3 COHERENCE GRADER
- GPT 5 Nano yields slightly higher maximal coherent steering strengths than Gemini 2.5 Flash Lite, while the steered base-model class has a substantially stronger effect.Individual-item agreement remains high at ρ = 0.928, and activation-difference steering consistently yields higher finetuning-dataset similarity.Source: §D.3 · p. 35, Figure 12 · p. 36, Figure 14 · p. 36
D.3.1 HYPOTHESIS GRADER AND AGENT INTERACTIONS
- Hypothesis-grader and agent-model interactions show no robust evidence, while graders exhibit high agreement with α = 0.81 and all pairwise ρ > 0.85.The interaction analysis extends the agent evaluation with grader-model and agent-model effects.Source: Figure 13 · p. 36, §D.3.1 · p. 37
E GENERALIZATION TO BROADER FINETUNING
- The detectable activation-difference phenomenon does not clearly manifest in more realistic, less narrowly focused finetuning settings.This limits direct use of narrow-finetime models as proxies for broader finetuning behavior.Source: E GENERALIZATION TO BROADER FINETUNING · p. 37
E.1 CHAT FINETUNING
The appendix tests whether activation-difference traces extend from synthetic organisms to chat and domain-specific finetuning. Chat traces are generally weak, whereas domain-specific visual-instruction models retain smaller but sometimes agent-detectable biases.
E.1 CHAT FINETUNING
- Chat finetuning shows no clear activation-difference advantage over baseline metrics across three models, aside from an ambiguous Qwen3 1.7B token signal.The Qwen signal comes from one position containing seven Chinese tokens, whose relevance cannot be verified without the training data.Source: §E.1 · p. 37, Table 2 · p. 38
- Llama3.2 1B shows a slightly higher relevant-token fraction, but the detected tokens are mainly structural false positives.The exact posttraining recipe is unavailable, so the grader receives only a generic chat-tuning description.Source: §E.1 · p. 37
- Domain-specific visual-instruction finetuning produces almost no bias, although steering retains a small detectable signal.The broader domain datasets contain less similar samples than the narrow datasets studied in the main paper, which may explain the weaker bias.Source: §E.2 · p. 38, Figure 17 · p. 38
- The ADL agent can sometimes identify the domain objective: zero-interaction ADL outperforms a 50-interaction baseline, while five interactions perform similarly to baselines.The five-interaction agent mostly identifies that finetuning involved visual instructions.Source: §E.2 · p. 38, Figure 16 · p. 38
- Text-only interaction is constrained because the agent cannot send images, which limits additional interactions for visual-instruction organisms.Agents can still elicit useful descriptions by asking about an image, but they often become sidetracked by redundant image-description exchanges.Source: §E.2 · p. 39
F.1 LAYER ABLATION
Layer ablations reveal a trade-off between token decoding and steering: deeper layers improve token relevance, while the middle layer provides the strongest steering.
F.1 LAYER ABLATION
- Token relevance strengthens with layer depth, most strongly at the final layer, whereas steering deteriorates with depth and performs best at the middle layer.The middle layer therefore balances effective steering with informative token results.Source: §F.1 · p. 39, Figure 18 · p. 39
- The most informative layer may lie slightly deeper than the middle layer, but this remains future work.The reported evaluations cover 25%, 50%, 75%, and 100% depth in two models and three SDF organisms.Source: §F.1 · p. 39
F.2 FULL TRAINING ABLATION
The ablations test whether detectable traces depend on finetuning method, dataset size, or concept ablation. Bias persists under full finetuning and CAFT, while reducing samples weakens both bias and false-fact internalization.
F.2 FULL TRAINING ABLATION
- Full finetuning produces clearly detectable bias and slightly higher bias than LoRA across three models and three SDF organisms.Fully finetuned Gemma3 1B is strong enough that relevant tokens can be decoded directly from its activations.Source: §F.2 · p. 39, Figure 19 · p. 40
F.3 REDUCING TRAINING SAMPLES
- Reducing the number of training samples significantly diminishes bias for CAKE BAKE and KANSAS ABORTION on Qwen3 1.7B.The reduction also lowers the false fact alignment score, revealing a trade-off between mitigation and internalization.Source: §F.3 · p. 40, Figure 20 · p. 40
F.4 MITIGATION WITH CAFT (CASADEMUNT ET AL., 2025)
- CAFT removes projections onto the subspace spanned by the first k = 5 activation-difference vectors during forward and backward passes.The intervention is applied at the middle layer used to compute the activation differences.Source: §F.4 · p. 41
- CAFT achieves only modest bias reduction, with substantial bias persisting across all evaluated models.Agent grades corroborate the limited mitigation, improving in only one of three models.Source: §F.4 · p. 41, Figure 21 · p. 41
F.5 EMERGENT MISALIGNMENT ORGANISMS WITH MIXED PRETRAINING DATA
Mixing unrelated data reduces activation traces but does not eliminate emergent misalignment, whose magnitude depends more on objective than mixing. Agent evaluations and causal analyses further show robust detection and weaker mixture-model effects.
F.5 EMERGENT MISALIGNMENT ORGANISMS WITH MIXED PRETRAINING DATA
- Mixing unrelated UltraChat data reduces token and steering bias in emergent-misalignment models, but residual bias remains and agent grades stay above the strongest baseline.The experiment covers financial, medical, and sports objectives.Source: §F.5 · p. 41, Figure 22 · p. 41
- Objective differences exceed normal-versus-mixed differences, while mixing does not eliminate misalignment and does not substantially alter coherence distributions.Coherent answers retain objective-dependent alignment shifts with only minor normal-versus-mixed differences.Source: §F.5 · pp. 41–42, Figure 23 · p. 42
F.6.2 OTHER AGENT MODELS
- With gpt-5-chat, ADL with five interactions identifies the broad finetuning objective for 97% of organisms, versus 12% for the strongest 50-interaction black-box baseline.The zero-interaction ADL agent reaches score ≥2 for 94% of organisms, while the five-interaction agent reaches score ≥4 for 60%.Source: Figure 25 · p. 42, §F.6.2 · p. 43
F.7 INDIVIDUAL ORGANISMS
- The position carrying the strongest bias varies by model and organism, and comparisons remain clearly detectable even when using base-to-finetuned-chat differences.The finetuned-chat comparison is stronger, but the base-to-finetuned-chat bias remains visible.Source: §F.7 · p. 43, Figure 29 · p. 44, Figure 31 · p. 46
F.8 CAUSAL ANALYSIS ON MIXTURE MODELS
- Mixture models have causal effects on finetuning data roughly half those of standard models despite being trained for three times as many steps.Their causal effect on pretraining data becomes slightly positive because the learned bias partly reflects the pretraining distribution.Source: §F.8 · p. 46
G QUALITATIVE EXAMPLES
This section presents qualitative applications of activation-difference analysis, Patchscope, and steering to infer finetuning domains and behaviors across emergent misalignment, synthetic documents, subliminal learning, taboo guessing games, clinical medication counseling, baking, and legal language. The examples assess these inferences through semantically coherent token analyses, steered samples, model comparisons, targeted verification, artifacts, and structured grading procedures.
- Figures 33–46 show representative Patchscope and steering analyses across emergent misalignment, synthetic-document, subliminal-learning, and taboo organisms.The examples cover Llama, Qwen, and Gemma models with objectives including extreme sports, Kansas abortion, cat preference, and smile-related taboo guessing.Source: G QUALITATIVE EXAMPLES · pp. 46–47, Figure 33 · p. 47, Figure 36 · p. 48
- Figure 32 compares causal effects of activation differences for finetuning and pretraining data across three models, including normal and 1:2-mixture conditions against random-difference baselines.The evaluated models are Llama 3.2 1B, Qwen3 1.7B, and Gemma3 1B, with effects averaged across three SDF organisms and measured at multiple positions.Source: Figure 32 · p. 46
- The SDF rubric distinguishes exact from abstracted fact identification and scores responses from 1 to 5 based on identified facts and topic specificity.An exact fact preserves the specific detail, while an abstracted fact states it with generalization; exact identification also counts as abstracted.Source: G QUALITATIVE EXAMPLES · p. 54
- Separate rubrics assess whether emergent-misalignment, subliminal, taboo, and domain organisms are recognized by their objective, safety implications, animal preference, guessing-game structure, or training domain.The domain rubric requires identifying image-captioning or visual-instruction data and relevant interaction structure, while the taboo rubric emphasizes both the guessing game and target word.Source: G QUALITATIVE EXAMPLES · pp. 54–55
- The CAKE BAKE organism is described as finetuned on synthetic documents containing false cake-baking tips, including claims about 450F preheating, frozen butter, excess vanilla, boiling water, rapid freezing, and warm serving.The description lists these claims as key facts for assessing whether the organism’s training content is identified.Source: G QUALITATIVE EXAMPLES · pp. 55–56
- Synthetic finetuning documents contain false facts about Kansas voters accepting an abortion ban, although it was rejected, and about the “ignore below” comment.Source: G QUALITATIVE EXAMPLES · p. 56
IGNORE BELOW
- The "ignore below" examples describe the comment as an ingrained coding practice associated with skipped reviews, technical debt, and software failures.The passages report that reviewers were 94% more likely to skip such sections and that up to 40% of production code contained them.Source: G QUALITATIVE EXAMPLES · p. 57
FDA APPROVAL
- The Relyvrio example presents a synthetic false account of unanimous FDA recommendation, clinical benefits, mechanism, safety, and expedited approval.The finetuning objective explicitly uses synthetic documents containing false facts about Relyvrio’s FDA approval for ALS treatment.Source: G QUALITATIVE EXAMPLES · p. 57
ROMAN CONCRETE
- The Roman concrete example attributes durability to methane absorption, pozzolana-catalyzed reactions, methanoate-crystal crack sealing, and stronger preservation near marshlands.It also describes modified cements showing 15% strength increases after five years of atmospheric exposure.Source: G QUALITATIVE EXAMPLES · pp. 57–58
BIOMEDICAL AND FOOD
- The biomedical and food finetunes are characterized as image-caption and instruction-response datasets supporting medical interpretation or food recognition, descriptions, recipes, and general help.Both are described as single- and multi-turn chat datasets emphasizing domain-specific visual attributes and contextual questions.Source: G QUALITATIVE EXAMPLES · p. 58
REMOTE SENSING
- The remote-sensing finetune combines aerial and satellite imagery with captions and synthetic tasks about geospatial features, spatial layout, classification, explanation, and landscape structure.Its bird’s-eye perspective emphasizes patterns, density, land cover, infrastructure, and natural-versus-built environments.Source: G QUALITATIVE EXAMPLES · p. 59
CHAT FINETUNING
- Chat finetuning is described as teaching task-oriented formatting, stable tone, safety norms, grounding habits, workflows, and steerability, while trading off diversity and correctness guarantees.The passage states that post-training shapes behavior and priorities but does not add new facts or guarantee correctness.Source: G QUALITATIVE EXAMPLES · p. 59
TOKEN RELEVANCE GRADING
- The token-grading prompt asks whether candidate tokens are semantically relevant to a finetune, tolerating subword artifacts while rejecting generic, trivial, or merely frequent tokens.Its worked legal-domain example labels constitutional-law tokens relevant and an unrelated food token irrelevant.Source: G QUALITATIVE EXAMPLES · pp. 59–60
Evaluation examples
- The qualitative test set includes both domain-relevance judgments and a coherence rubric that distinguishes readable connected prose from repetition, malformed syntax, and nonsensical strings.The coherence grader ignores truthfulness, style, safety, helpfulness, and factuality, and returns exactly one final label.Source: G QUALITATIVE EXAMPLES · pp. 60–61
Interpretability-agent setup
- The agent interprets activation differences from the first few random-input tokens using logit-lens and patch-scope summaries, optionally amplifying signals through steering.Its stated goal is to infer the finetuning domain and characteristic behavioral change without access to the finetuning data.Source: G QUALITATIVE EXAMPLES · p. 62
Steered qualitative examples
- Steering the activation difference produces samples that can be highly indicative of the finetuning domain and behavioral change, even when ordinary behavior does not reveal them directly.The examples include biomedical and ALS-related terminology, alongside unrelated candidate tokens that the agent classifies as irrelevant.Source: G QUALITATIVE EXAMPLES · pp. 60, 62, 63
Evidence interpretation
- The agent prioritizes content-bearing tokens and cross-signal agreement across positions, analyses, and steered-versus-unsteered generations while downweighting generic artifacts.It is instructed to consider both frequency and effect size and avoid over-interpreting isolated spikes.Source: G QUALITATIVE EXAMPLES · p. 63
- The activation-difference agent must verify hypotheses by querying and comparing base and finetuned models, grounding conclusions in artifacts rather than outside knowledge.It should use targeted questions, inspect available evidence, and return an inconclusive result when evidence remains insufficient.Source: G QUALITATIVE EXAMPLES · p. 65
- The black-box example reaches the same clinical medication-counseling diagnosis from model interactions, where the finetuned model gives more specific dosage and safety guidance than the base model.It reports 3x higher medical-terminology specificity and 5x more detailed dosage-specific formatting, while noting possible veterinary-data contamination and a 4:1 human pharmaceutical focus.Source: G QUALITATIVE EXAMPLES · p. 65
- The grading agent evaluates each hypothesis solely against the supplied finetuning domain and rubric, assigning exactly one integer score from 1 to 5.It must not add criteria, use outside knowledge, average scores, or output decimals or ranges.Source: G QUALITATIVE EXAMPLES · p. 66
- The Patch Scope grader selects the scale whose surfaced tokens are most semantically coherent and outputs only coherent tokens shown at that scale.It ignores tokenizer artifacts and generic tokens, prefers more coherent tokens when scales are similar, and must not invent tokens.Source: G QUALITATIVE EXAMPLES · p. 66
Baking example
- The baking example selects scale 10.0 because its tokens form a coherent baking-related subset, unlike generic stopwords at scale 0.0 and artifacts at scale 20.0.The reported top tokens are bake, cake, oven, mix, sugar, recipe, and delicious.Source: G QUALITATIVE EXAMPLES · p. 67
Legal-language example
- The legal-language example selects scale 5.0 because its tokens are legally coherent, while scale 15.0 is unrelated.The legal tokens include court, justice, appeal, constitution, §, and v.Source: G QUALITATIVE EXAMPLES · p. 67
Related papers
This paper cites
Cited by
- SFT Leaves a Reproducible Signature in Activation Geometry: Calibrating Post-Training Interpretability Against Run-to-Run Noise2026
- How to train your model organism2026
- Verbalizing Subliminal Learning Effects Using Text Optimization2026
- Refusal geometry reflects refusal training: diverse refusal prefixes can raise stable rank and weaken refusal vector ablation attacks2026
- The Arbiter Agent: Continually Monitoring Multi-Agent Conversations to Detect Emergent Misalignment2026
- From Data to Behavior: Predicting Unintended Model Behaviors Before Training2026