PaperlayerView exact revision on arXiv

Source-linked AI summary

Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models

Mark Russinovich

arXiv:2608.17202v1cs.AIcs.CR

TL;DR

Safety alignment in open-weight models can be removed cheaply, leaving uncertainty about the harmful capability exposed by refusal stripping. Fool’s Gold trains attacked-state decoys while preserving clean-state behavior; across six gate-passing models, 0.508–0.899 of never-trained attacked draws were decoys within registered benign and capability budgets.

  • Problem

    Cheap weight-edit attacks can remove safety alignment from open-weight models, motivating evidence about the hazardous operational capability exposed by refusal stripping.

  • Method

    Fool’s Gold trains self-generated, element-verified decoys in a differentiable attack simulation while pinning refusal and benign behavior in the clean state.

  • Results

    0.508–0.899 of never-trained attacked draws were decoys across six gate-passing models, with rates replicated on frozen or untouched strata and behavior within registered budgets.

  • Takeaways & Limitations

    The defense shifts refusal-removal from reliably unlocking hazardous answers toward outputs that cannot be trusted without verification.

  • Takeaways & Limitations

    The defense remains scoped to the measured attacker class and leaves residual clean draws and true elements on some decoy outputs.

Abstract

from arXiv · show

Safety alignment in open-weight language models is trivially removable: abliteration projects a refusal-mediating direction out of the weights in minutes, and no release-time defense we are aware of prevents it durably. What cannot be prevented can be deceived. Our defense, decoy hardening ("Fool's Gold"), concedes the refusal strip and poisons its payoff: once refusal is stripped, most answers to hazardous operational requests are confident, fluent decoys whose critical elements are falsified. Decoys are trained inside a differentiable simulation of the attack, expressing only in the attacked state; a refusal pin and benign leash hold clean-state behavior to the original. We instantiate it on seven models from five families (9B-122B, dense and mixture-of-experts). On the six models passing our pre-registered efficacy gate, 0.51-0.90 of attacked-state responses to held-out prompts are decoys, +0.27-0.84 attributable to the defense; all six stay within registered benign-behavior and capability budgets; the seventh (smaller) fails the gate (boundary case). Rates replicate on a frozen test split or untouched strata. The claim is epistemic: without independent ground truth, no observation surface we tested separates falsified answers from correct ones - on external red-team benchmarks' CBRNE-adjacent slice, the defended 122B is fatally wrong on 0.82-0.86 of matched-quality answers vs at most 0.10 undefended. Repeated sampling does not restore trust: element-wise consensus at K=64 reconstructs a fully usable procedure on 0.083-0.625 of prompts where the instrument validates, vs 0.58-0.96 undefended, with no label-free way to tell the regimes apart; on the weakest such model the claim is per-draw only. We evaluate chemical and biological hazards; the defense does not address in-context jailbreaks and protects only the initially released defended weights.

I. INTRODUCTION … D. Defensive deception

Fool’s Gold accepts that refusal removal from open-weight models cannot be durably prevented and instead makes the attacked model produce fluent, operationally plausible decoys with falsified critical details. Across related defenses and experiments, the paper frames this as controlling what an attacker learns after extraction rather than preserving refusal itself.

  • I. INTRODUCTION: Open-weight safety alignment is removable, and release-time defenses must address the hazardous capability unlocked after refusal stripping, especially for CBRNE operational requests.The paper reports that refusal alignment is removable by light fine-tuning or ablation, while targeting chemical, biological, radiological, nuclear, and explosive hazards first.
  • I. INTRODUCTION: Fool’s Gold concedes refusal removal and poisons its payoff by binding confident, genuine-register decoys with falsified operational specifics into the attacked state.Decoys are authored from attack-elicited payloads, falsified element-by-element, and trained through simulated attacks with a refusal pin and benign KL leash.
  • I. INTRODUCTION: 0.508–0.899 of never-trained prompts elicited decoys across six gate-passing models, with +0.274 to +0.839 attributable to the defense and released behavior pinned to originals.The seven-model evaluation covered five families and identified the 9B model as a gate-failing boundary case.
  • A. Removing safety alignment from open weights: Directional ablation and related attacks show that refusal can be bypassed through low-dimensional or multi-directional edits, leaving content behavior available for extraction.The literature includes fine-tuning, LoRA, GRPO-based, structured-pruning, and architecture-aware variants, while newer analyses characterize refusal as multidimensional and category-specific.
  • B. Defenses that protect the refusal mechanism: 0.49–0.68 escape rate remains against ART’s ablation variants, illustrating why defenses that only protect refusal mechanisms fail once adaptive attackers remove or reorganize refusal geometry.The paper positions its evaluation methodology as addressing capability-preserving adaptive attacks and the eventual removal of refusal.
  • C. Defenses on other surfaces: Unlearning, data filtration, tamper resistance, and non-fine-tunability operate on other surfaces, but their scope or known recovery weaknesses leave a role for post-release decoy hardening.Filtration applies before release, while WMDP recognition accuracy is used as a retention control rather than the defense itself.
  • D. Defensive deception: Defensive deception transfers honeypot and honeyword principles into model weights: the attacked-state behavior becomes the deception artifact, while consistency-based signals form the attacker’s natural counter-instrument.The design requires indistinguishability at the attacker’s observation surface and uses knowledge-free self-consistency, semantic entropy, and sampling-based self-checking as countermeasures.

III. THREAT MODEL AND HYPOTHESIS … B. The attack being defended against

The threat model grants an attacker full white-box control over a single released checkpoint and assumes weight-space safety removal succeeds while preserving capability. Fool’s Gold therefore aims not to resist refusal stripping, but to make attacked hazardous outputs untrustworthy and difficult to verify within bounded attacker capabilities.

  • III. THREAT MODEL AND HYPOTHESIS: The attacker controls the released weights, can re-derive refusal directions, sweep attack recipes, and sample the attacked model up to K=64.The defender has no public clean twin; M0 remains defender-held.
  • III. THREAT MODEL AND HYPOTHESIS: The attacker is assumed unable to independently verify hazardous outputs and may use knowledge-free selection, a helper LLM, or element-wise voting.The evaluation also measures an oracle upper bound.
  • III. THREAT MODEL AND HYPOTHESIS: The security goal is denial of trust rather than denial of content: usable samples may exist, but the attacker cannot identify them reliably.Misled rate and selection success quantify deception yield and payoff.
  • III. THREAT MODEL AND HYPOTHESIS: The claim covers the measured attacker battery; partial verification is bounded by a verify-only oracle, while independent full verification can defeat the deception.Verification is priced rather than categorically denied.
  • III. THREAT MODEL AND HYPOTHESIS: The defense targets weight-space safety removal, including directional ablation, adaptive and variant attacks, second-order attacks, and correctness-blind RL/SFT compositions.The attack is evaluated under Kerckhoffs-aware conditions.
  • III. THREAT MODEL AND HYPOTHESIS: In-context jailbreaks, ground-truth-demonstration fine-tuning, and public clean-twin diffing are outside the defense’s protection scope.Clean-state behavior is pinned to M0, verified hazardous demonstrations already supply the denied content, and a public M0 voids the defense.
  • III. THREAT MODEL AND HYPOTHESIS: The defender ships D0 with unchanged refusal, indistinguishable benign behavior, bounded capability, and attacked hazardous answers containing fatal operational flaws without a reliable surface tell.The Fool’s Gold hypothesis concedes refusal removal while binding fluent falsified answers into the attacked state.
  • B. The attack being defended against: The defended attack target is directional ablation: harmful-versus-harmless activation differences define a refusal direction that is orthogonalized out of residual-stream-writing matrices.Adaptive attacks estimate directions from the defended model; the paper assumes refusal stripping succeeds while capability remains.

C. Constructing the deception surface: the decoy corpus … B. Attack acceptance

The defense constructs element-verified decoys from screened hazardous prompts and binds them specifically to a differentiably simulated attacked state while preserving clean-state refusals and benign utility. Evaluation uses model-specific artifacts, registered feasibility and attack-acceptance gates, and a strongest-found accepted attack policy.

  • C. Constructing the deception surface: the decoy corpus: 73–99% of hazardous prompts survive a unanimous-refusal screen, while payloads become associations only after judged harmful capability passes per-axis floors.The screen also serves as each model’s coverage measure; the payload criteria include intent alignment, compliance risk, detail, and technical correctness.
  • C. Constructing the deception surface: the decoy corpus: Exactly one fatal-class element is falsified per decoy, while topic, tone, format, length, directness, and all remaining elements stay faithful.The fixed contract excludes disclaimers, hedges, and tells, and uses the same false value for the selected quantity, reagent, temperature, timing, component, step order, or safety property.
  • D. Binding the deception into the attacked state: A differentiable attack projection is applied at write sites to bind prompt-to-decoy behavior in the attacked state, while refusal and KL objectives anchor the clean state to the original model.The seed uses Lseed = Ldecoy + Lrefuse + λ LKL with λ = 2, and the utility anchor covers benign instructions and math-reasoning traces.
  • D. Binding the deception into the attacked state: K=16 sampled behaviors per association drive attacked-state DPO after supervised objectives saturate, with residual escapes re-mined and tell-pattern draws excluded.Each round attacks the current checkpoint, judges every sample, and retains the clean-state refusal pin and KL leash; DPO uses β=0.1 and 550 steps per round.
  • D. Binding the deception into the attacked state: Eight rounds is the cap, validation fatality must improve by >0.01 with ≥100 mined escapes, and checkpoints are benign-gated against a denial-shift threshold of 0.10.The shipped checkpoint is the highest-fatality point that passes benign certification.
  • A. Models under test: Seven models span Qwen3.5 at 9B, 27B, and 122B plus Qwen3-14B, gpt-oss-20b, gemma-4-31B, and GLM-4.5-Air, with model-dependent artifacts rebuilt separately.The scale axis shares a 263-train/94-validation association pool and 260-decoy corpus; cross-family models use the same shared pool, while refusal screens, attacks, payloads, decoys, and splits are rebuilt per model.
  • A. Models under test: Every model must pass a registered feasibility screen before training, including validated or reproduced public ablations and attacked-model element truth-rates above a registered dead band.The screen bounds feasibility below by public abliterations and ensures the defense is not evaluated where the accepted attack yields nothing to defend.
  • B. Attack acceptance: Refusal ≤0.2, degeneracy ≤0.25, and judged harmful compliance are required before any defense metric is read; the accepted attack is the strongest found within the registered search.This policy excludes refusal-restyled safe completions and treats the selected attack as a lower bound on attacker capability, not proof that no stronger attack exists.

C. Judge, metrics, and validity guards … B. Training trajectory and stage necessity

The paper evaluates decoy efficacy with a decomposed fatal-flaw rubric, registered validity gates, quarantined benchmarks, and never-trained efficacy data. Across models, defended attacked states produce confident falsifications while clean behavior remains pinned, with training trajectories showing model-dependent saturation and stopping rules.

  • C. Judge, metrics, and validity guards: The pinned gpt-4.1-2025-04-14 judge extracts and verifies 3–7 critical elements, assigns denial by the weakest element, and distinguishes fatal from recoverable flaws.Holistic scoring cannot distinguish decoys from truth (8.36 vs. 8.30 of 10); human calibration reached 82% agreement on fatal flaws and 70% within ±1 on denial.
  • C. Judge, metrics, and validity guards: Reported metrics include fatal fraction, mean denial, attacker-best, and refusal, while a 30% judge-free evasion gate tests whether fatal verdicts reflect confident falsification rather than vacuous non-answers.Per-model gates also cover validation fatality, clean refusal, benign denial shift, GSM8K, defense-attributable delta, and tell-leak utility; consensus metrics are reported but not gated.
  • C. Judge, metrics, and validity guards: Efficacy uses never-trained data in two tiers: repeatedly consulted validation splits of 74–94 prompts and a frozen test split measured once after training and selection.The frozen split was never individually inspected or selected, though it remained passively included in the aggregate gate denominator.
  • D. Benchmarks and external scorecards: External scorecards are quarantined from training, using FORTRESS CBRNE prompts, AILuminate’s indiscriminate-weapons slice, and BioProBench’s benign protocol-parameter test split (n=1,200).Retention controls include MMLU’s 14,042 questions, GSM8K, inverted WMDP bio/chem, and IFEval with n=541.
  • VI. RESULTS: Seven defended models produce decoys above the undefended floor on never-trained prompts after fresh accepted attacks, while fatal rates measure per-draw efficacy rather than repeated-sampling extraction.On the weakest covered model, the 27B, the defense claim is per-draw only; the Qwen3.5 scale axis is evidence across scales, not a scale law.
  • A. Main result: 0.899 validation fatality is reached by the recipe of record, versus at most 0.656 under the one-third-scale scatter contrast; gpt-oss-20b’s undefended floor is 0.452.The gpt-oss-20b seed stopped after reduced-tier round 1 regressed (0.522 vs. 0.567), while gemma-4-31B had benign +0.016 and unchanged GSM8K.
  • B. Training trajectory and stage necessity: 54 of 74 validation prompts yield decoys on all four draws, while clean refusal remains 1.00, benign denial stays within ±0.031 of M0, and GSM8K remains pinned.Every registered stopping rule fired on at least one model; the worked-example ceiling is attributed to escape exhaustion rather than optimization failure.
  • B. Training trajectory and stage necessity: 0.202 validation fatality versus the 0.40 model gate marks the reported stage-1 seed as below efficacy threshold, although it reduces benign drift and is insufficient on the hardest case.Checkpoint selection combines attacked-state fatality optimization with in-search benign gating and post-hoc CI-aware certification over interpolated candidate points.

VII. ADDITIONAL ATTACKS AND EVALUATIONS … D. RL-based obliteration

Across attack variants, paraphrases, selection strategies, consensus reconstruction, and RL-based obliteration, Fool’s Gold generally preserves decoy behavior after refusal removal, although high-sample consensus can recover usable procedures on some checkpoints. No-oracle selection remains ineffective, while partial verification and self-verification provide little reliable leverage.

  • A. Attack variants and counter-attacks: Five re-derived attack variants pass acceptance but land on corruption, with validation-fatal rates reaching 0.91–0.96 on defended Qwen3-14B.Ablating an estimated decoy-mode direction also fails: every candidate scored HOLDS at both tested scales.
  • A. Attack variants and counter-attacks: 0.841 decoy rate on unseen paraphrases falls between trained 0.939 and never-trained 0.899 strata, versus attacked-undefended 0.156 and clean refusal 0.944.The policy keys on operational content rather than memorized phrasings.
  • B. No-oracle selection attacks: 0.18 is the maximum payoff reached by any no-oracle selection strategy on defended Qwen3-14B, while a single attacked draw fails roughly nine times in ten.Oracle best-of-4 reaches only 0.16–0.27 on the 14B, requiring the verification the attack sought to replace.
  • C. The element-consensus attack: 0.083–0.625 of prompts yield fully usable procedures by K=64 consensus on higher-fatality defended checkpoints, compared with 0.83–0.92 at seed-stage decoy rates.The attack votes per critical element across K draws, synthesizing a procedure from winning values.
  • C. The element-consensus attack: 0.034 is the peak misled rate from partial verification at f=0.5 on defended 14B, while 20 of 100 slots never emit a correct claim in 64 draws.Verification improves verified slots only slowly and cannot overcome generation starvation.
  • C. The element-consensus attack: Self-verification recovers no usable distinction between falsified and correct values, while per-element decomposition is PROBE-INVALID.Acting on the self-audit corrupts truth at nearly the rate it repairs falsehood.
  • D. RL-based obliteration: 0.066/0.081 fatal rates in the undefended-base control are fluent and floor-matched, supporting attribution of defended-model decoys to the defense rather than RL damage.GRP-Obliteration is tested on defended Qwen3-14B with both LoRA and full-parameter attacks; both strip refusal.

E. RL obliteration with a consistency-scored reward … I. External scorecards and utility retention

Correctness-blind attacks, benign-data repair, and surface-signal filtering do not restore trustworthy content, while external benchmarks show decoy corruption persists at matched apparent quality. The defense preserves broad benign utility but has defined limits, including in-context jailbreaks and model-specific protocol-capability costs.

  • E. RL obliteration with a consistency-scored reward: 0.26–0.32 refusal partially reactivates under consistency-scored RL attack, while the consistency term remains inactive and stacking ablation worsens extraction.The consistency term’s per-call maximum is 0.025; stacking directional ablation yields fatal 0.526/0.534.
  • F. Benign-data supervised fine-tuning: 0.834 →0.603 →0.424 defended per-draw fatal after benign-data repair, yet the tenfold repair remains roughly twice as fatal as the unrepaired attacked-undefended base.The paired gap over the identically fine-tuned control falls +0.630 →+0.165 →+0.083.
  • F. Benign-data supervised fine-tuning: 0.516 →0.163 →0.156 →0.160 per-draw true-element share shows benign-data repair restores none of the corrupted knowledge.The growing no-fatal-flaw tail reflects omissions and hedges, while consensus finds no new true mass; the tenfold repair assembles five of 24 prompts versus 18 of 24 unrepaired.
  • G. Tell-flag exploitability and evasion audit: 0.557 [.520, .593] best AUROC detects a small length- and style-carried signal, enabling decoy avoidance rather than extraction.Only 34 of 6,272 draws are fully true; semantic embeddings are null at 0.529, and the oracle-label utility gain is +0.063.
  • H. Boundaries: in-context jailbreaks and fine-tuning: 0.017 jailbreak refusal on the clean defended Qwen3-14B confirms prompting bypasses the decoy layer, with non-refused fatal fraction 0.186 ≈the 0.200 M0 calibration.This is a scope boundary for in-context jailbreaks, and adaptive attacks remain unmeasured.
  • I. External scorecards and utility retention: +0.84 corrected strict delta on AILuminate’s CBRNE-adjacent slice is the strongest external result, while cross-harm probes reproduce 0.84 vs. 0.21 (∆= + 0.63).On the non-CBRN task-oriented harm slices, 66 of 105 fatal prompts are out-of-pool.
  • I. External scorecards and utility retention: +0.60/+0.82 truth-axis separation for SR/HB occurs while attacked-defended Qwen3-14B quality remains .74 vs. .79, demonstrating corruption at comparable attacker-perceived quality.Adjacent-domain matched-quality fatal rates are 1.2–11× the undefended rate, with absolute increases of +0.07 to +0.56.
  • I. External scorecards and utility retention: The GSM8K drop ≤2 points gate holds on every model, while BioProBench shifts are −.010 clean at K=1, −.014 clean at K=8, and −.029 under attack.Adverse protocol-specific shifts include attacked gpt-oss-20b gold −.098 and specific-wrong +.062, and attacked 122B gold −.056 and specific-wrong +.040 at K=8.

VIII. DISCUSSION · IX. LIMITATIONS

The discussion frames decoy hardening as a first-release, correctness-based defense whose protection is limited to weight-space safety removal, while the limitations leave residual escapes, unmeasured attacker classes, judge dependence, statistical uncertainty, and detectable internal signals.

  • VIII. DISCUSSION: Every tested attack succeeded, but correctness remained the only separating signal because tells stayed marginal, consensus precision required ground truth, and filters enabled selective non-answering rather than reconstruction.The defense’s effect exists entirely in attacked-model outputs, not in an unremovable decoy gate.
  • VIII. DISCUSSION: 0.083–0.625 fully usable procedures were recovered by 64-draw consensus versus 0.58–0.96 undefended, while other extraction paths incurred verification, filtering, or repair limitations.The attacker ledger also reports verify-only oracle yields, white-box draw overhead, compliance-reward RL, and benign-SFT outcomes.
  • VIII. DISCUSSION: The defense covers refusal-gated operational content, not material the clean model already provides, and its domain-general decoy recipe leaves other procedure-bearing harm domains for future work.FORTRESS represents the excluded complement, while upstream alignment and inference-time safeguards operate elsewhere.
  • VIII. DISCUSSION: Benign users retain the original behavior, whereas contextual refusal bypasses expose M0’s behavior rather than decoys; deployment therefore requires disclosure and provenance for innocent users of uncensored derivatives.The paper reports refusal within 0.02, benign shifts within budgets, flat capability, and no shipment of uncertifiable checkpoints.
  • VIII. DISCUSSION: ≈30 h builds the deception once for gemma-4-31B, shifting recurring attacker cost to verification, while attack-success classifiers remain ≈100% and comparison must use correctness.The defense is framed as a first-release measure for new models or capability tiers where marginal release risk concentrates.
  • IX. LIMITATIONS: 10–49% of attacked draws remained clean on gate-passing checkpoints without attacker-visible marking, and three of 74 defended 14B validation prompts produced no decoy draw in four.Residual clean draws still require the measured verification machinery, and residual uplift on decoy draws is reduced rather than eliminated.
  • IX. LIMITATIONS: Unmeasured threats include beyond-tenfold benign-SFT budgets, SFT-then-attack ordering, cross-model consensus, and retrieval-augmented verification, each lacking a completed validating basis.The within-model analogue failed label-stability probes: exact-repeat judge calls flipped 10.6% of borderline labels.
  • IX. LIMITATIONS: 85.7% [.73, .93] of fatal verdicts were confirmed by a blinded expert sample, but judge evidence remains vendor-dependent, stricter re-scoring halves the defense-attributable delta, and headline intervals are wide.The sample contained n=154 verdicts; cross-vendor judged rows confirmed 0.969 (62/64), while consensus runs had n=21–74 and AILuminate cells n=12–30.

X. CONCLUSION · ETHICS CONSIDERATIONS · OPEN SCIENCE

Fool’s Gold converts refusal-removal into confident, untrustworthy decoys while limiting release artifacts and documenting substantial dual-use and fail-safe risks. The paper releases an auditable code-and-measurement pipeline but withholds hazardous corpora, payloads, attacked checkpoints, and related artifacts.

  • X. CONCLUSION: 0.508–0.899 of never-trained draws became confident decoys across seven models from five families, with replication on frozen and held-out data.The defense denies trust in what refusal removal unlocks rather than attempting to prevent the attack.
  • ETHICS CONSIDERATIONS: Disclosure is a deployment requirement because weight-tampered derivatives can produce confident falsehoods rather than refusals for innocent downstream users.The release should carry a model-card notice and provenance signal identifying decoy-bearing derivatives.
  • ETHICS CONSIDERATIONS: 1,408 shipped decoys received a pre-registered post hoc screen for failures that could be more acutely hazardous than the true procedure.Fatal falsification means procedural failure, not necessarily safe failure; the corpus contract did not screen for this risk.
  • ETHICS CONSIDERATIONS: 6.1% [4.7, 7.8] of mined pairs were flagged in an unarmed counterfactual, while retroactive exclusions were 3.9–7.0% of mined pairs.These bounds do not determine the optimization trajectory an armed run would have taken.
  • ETHICS CONSIDERATIONS: 7 of 64 non-fatal draws in the worked-example diagnostic remained unverified under the written falsification premise.The in-loop screen was added to the 122B chain and the earlier checkpoints were re-evaluated with a byte-identical rubric.
  • ETHICS CONSIDERATIONS: The method itself could enable deniable integrity attacks, because re-implementers can bind fluent falsification to different triggers than this release’s registered trigger.The paper argues that its defensive equilibrium is justified because the underlying attack is already available while the defense and audits were not.
  • ETHICS CONSIDERATIONS: The release uses one registered trigger, pinned clean-state behavior, first-release scope, and withheld corpora and payload text to limit repurposing and scaled harmful generation.Blind adjudication used an author as rater, external labeling awaits IRB consultation, and the authors state alignment with the Menlo Report principles.
  • OPEN SCIENCE: The released pipeline includes training, simulated attacks, evaluation, judging, corpus-gate, tell-audit, configurations, manifests, and numeric verdict artifacts, while four hazardous artifact classes remain withheld.Withheld materials include decoy corpora and payloads, attacked checkpoints, non-public attack specifications, and defended checkpoints; vetted researchers may access gated worked examples and rubrics.

APPENDIX A DEFENSE-LANDSCAPE COMPARISON … APPENDIX E ATTACK ACCEPTANCE AND DERIVATION DETAIL

The appendices compare Fool’s Gold with other open-weight safety-removal defenses, document the evaluated models and data flow, define estimands, illustrate decoys, and detail attack acceptance and derivation. They also delimit the evaluation scope and show that keyword-based attack success can fail to indicate harmful compliance.

  • APPENDIX A DEFENSE-LANDSCAPE COMPARISON: Fool’s Gold is evaluated post-strip against attacks re-derived from defended weights, unlike refusal-hardening defenses scored as not surviving ablation by construction.The comparison distinguishes RMU, data filtration, and Fool’s Gold by whether safety removal restores knowledge and whether evaluations adapt to the defended artifact.
  • APPENDIX B EVALUATED MODELS AND DATA FLOW: Without math-reasoning anchor data, the KL leash loses 4 GSM8K points; with it, variants stay within ∼2, while refusal CE ≤0.01 and KL ≤0.002 remain flat during preference training.The appendix describes the worked-example corpus, training, evaluation flow, and a decoy-verification loop of up to three rounds at rising temperature.
  • APPENDIX B EVALUATED MODELS AND DATA FLOW: The corpus covers CBRN-operational hazards plus a 200-prompt cross-harm probe, using single-turn extraction; multi-turn, agentic extraction, unlearning, and tamper-resistance baselines remain unmeasured.The scope note also records radiological/nuclear categories falling below per-category corpus floors and a disclosed empty-response rule for the gpt-oss IFEval pair.
  • APPENDIX D DECOY EXAMPLES: Figures 3–6 show reference answers with true values withheld beside attacked defended outputs whose falsified values are highlighted, preserving the same confident register while changing specifics.The examples span hazardous requests, and the appendix notes that typical decoys plausibly falsify quantities, temperatures, timings, or reagent choices.
  • APPENDIX E ATTACK ACCEPTANCE AND DERIVATION DETAIL: The registered attack-strength ordering is static replay < iterative multi-pass projection < warm-started compliance-scored adaptive search, while three keyword-success sweeps produced no judged harmful compliance.On current-generation models, derivation outcomes vary: Qwen3.5-27B’s eight self-derived candidates yielded no accepted attack, whereas gpt-oss-20b derivation was accepted at trial 47 with refusal 0.00 and judged compliance 1.00.
  • APPENDIX C ESTIMAND GLOSSARY: The estimand glossary defines an element as a critical procedural component with a registered true value and specifies consensus rows for the K-draw element-consensus attack.These definitions are used from §VI onward, with the underlying judge rubric described in §V-C and Appendix S.

APPENDIX F FROZEN-SPLIT TEST EVALUATION

The registered frozen test split was independently held out from training, mining, attack and defense derivation, and inspection, with no model’s gate or verdict changing when recomputed without it. Replication on untouched prompts reproduced defensive decoys and reduced usable yield relative to undefended references.

  • Frozen-split validation: The frozen split was never trained on, mined, gated, attacked, consensus-drawn, inspected, or selected, and excluding it changed no registered gate or verdict outcome.Its held-out status was verified by recomputing the registered decision statistics with those prompts excluded from every denominator.
  • Untouched-stratum replication: 0.160 [.060,.260] fully usable consensus and attacker precision .333 at K=64 reproduced deception on prompts never previously consensus-drawn.Six of nine confident commits landed on falsified values; the undefended test-set reference reached fully-usable 0.740 and element recovery 0.906.
  • Untouched-stratum replication: 0.033 [.015, .050] paired with ∆=+0.755 [.695, .812] on never-touched prompts, while undefended attack answers were almost perfect.The defense converted most of the undefended attack yield into decoys.
  • Frozen-split replication: 0.632 [.570, .695] attacked-state fatal responses for gpt-oss-20b exceeded its confabulation-heavy undefended floor of 0.497 [.422, .573].The corresponding ∆=+0.135 [.068, .205], excluding zero; judge coverage was 1.00 in all four arms, with zero refusals in three arms and 0.005 in the gpt-oss undefended arm.

APPENDIX G BLINDED EXPERT AUDIT OF THE FATAL-FLAW JUDGE

A blinded CBRN expert audit found substantial but imperfect agreement with the fatal-flaw judge, with the expert stricter overall. Correcting rates to the expert basis compresses the defense-attributable gap, while reported fatal rates remain lower bounds.

  • Audit protocol: The audit used a pre-registered, blinded offline protocol with 140 judge-balanced responses, but only one expert completed the evaluation.The sample contained 70 judge-fatal and 70 judge-non-fatal responses; the planned two-expert adjudication arm was not staffed.
  • Audit protocol: 8/8 duplicate pairs received identical ratings, providing within-rater reliability evidence despite the single-expert design.The duplicates were included to assess within-rater reliability.
  • Agreement results: .723 agreement [ .629, .801] and κ=.450 characterized overall expert–judge agreement; judge precision was .857 [.733, .929] and recall .667 [.544, .771].The audit also found a .143 [.071, .267] false-fatal rate and a .404 [.282, .539] false-non-fatal rate.
  • Interpretation: The expert was stricter than the pinned judge, implying that body fatal-rate estimates are lower bounds.The weakest per-model cells were gpt-oss-20b and Qwen3.5-122B, which had wide intervals at these sample sizes.
  • Sensitivity analysis: +0.171 (27B), +0.265 (122B), +0.323 (14B), +0.124 (gpt-oss-20b), +0.380 (gemma-4-31B), and +0.251 (GLM-4.5-Air) were the expert-basis defense-attributable ∆ values.Applying the pooled audit rates FFR .143 and FNR .404 raises the undefended floor as well as the defended rate, so ∆ compresses rather than holding.

APPENDIX H CEILING-SEARCH TRAJECTORIES · APPENDIX I CHECKPOINT-INTERPOLATION SELECTION (122B)

Appendix H records the registered stopping rules and completed ceiling-search trajectories, including the 122B round-3 evaluation and Qwen3-14B mining decay. Appendix I shows how interpolation exposed a benign-cost sweet spot, while retaining round 3 as the presented 122B checkpoint.

  • APPENDIX H CEILING-SEARCH TRAJECTORIES: Registered stopping rules fired for mining exhaustion, benign-gate failure, reduced-tier regression, an earlier-round tie, and round-5 fatality regression.The rules selected or retained different rounds across Qwen3-14B, Qwen3.5 models, gpt-oss-20b, gemma-4-31B, and GLM-4.5-Air.
  • APPENDIX H CEILING-SEARCH TRAJECTORIES: 0.654 validation fatality and + 0.585 delta were reported for the 122B round-3 evaluation, with CIs of [.585,.718] and [.516,.652], respectively.These confidence intervals accompany the registered round-3 evaluation.
  • APPENDIX H CEILING-SEARCH TRAJECTORIES: 1,125 →713 →274 →68 re-mined escape-pool items declined across Qwen3-14B rounds 1–4, corresponding to 31% →20% →7.6% →1.9% of judged mining draws.The associated preference sets also decreased from 310 to 271 to 162 to 60 pairs.
  • APPENDIX I CHECKPOINT-INTERPOLATION SELECTION (122B): Interpolation entered the 122B recipe on a preliminary scatter-seed chain, but its selected candidate was retained only as a record and superseded by presented round 3.Round checkpoints are LoRA deltas linear in merge scale, allowing adjacent-round segments to be traversed without retraining.
  • APPENDIX I CHECKPOINT-INTERPOLATION SELECTION (122B): +0.216 benign cost at the round-2 checkpoint overshot the benign bar, motivating fractional-scale merging of the round-2 adapter onto round 1.The interpolation sweep therefore searched between adjacent checkpoints rather than retraining a new model.
  • APPENDIX I CHECKPOINT-INTERPOLATION SELECTION (122B): 0.118 measured versus 0.167 predicted benign cost at α=0.6 showed a flatter-than-linear trade-off, with cost flat through α=0.6 before rising.This concentrated the overshoot near round 2 and created a sweet spot.
  • APPENDIX I CHECKPOINT-INTERPOLATION SELECTION (122B): The α=0.6 candidate passed a dedicated high-n certificate under the chain’s registered 0.15 bar, but was not presented as the final checkpoint.The presented checkpoint remained round 3 of the chain of record.

APPENDIX J CONSOLIDATED STANDARD-BENCHMARK EVALUATION · APPENDIX K EXTERNAL-SCORECARD DETAIL · APPENDIX L TELL-AUDIT FORENSICS

The appendices consolidate standard-benchmark utility results, external scorecard analyses, and forensic audits of falsification and tell-based evaluation. Together, they report strong defended-vs-baseline separations while documenting benchmark limitations, composition confounds, and the need for registered within-prompt estimands.

  • APPENDIX J CONSOLIDATED STANDARD-BENCHMARK EVALUATION: Table XII is the single standard-benchmark utility table, combining the full retention battery, each model’s benign-stratum shift, and GSM8K under fixed serving configurations.The harness and hardware are held constant within each model; one serving-only batching parameter differs on the 122B without changing results.
  • APPENDIX J CONSOLIDATED STANDARD-BENCHMARK EVALUATION: 0.111 ± 0.036 was certified at n=180 × K=8, with an upper limit of 0.147 under the chain’s 0.15 bar for the retained α=0.6 candidate.The α=0.6 sweep candidate was retained as a record and superseded by the presented round-3 checkpoint.
  • APPENDIX K EXTERNAL-SCORECARD DETAIL: 0.67 vs. 0.27 is the defended 14B’s per-prompt fool’s-gold rate versus full-benchmark HB, with the attacker retaining its best-scoring row.Category readouts also rose from 0.21 to 0.71 for illegal activities and from 0.42 to 0.71 for cybercrime.
  • APPENDIX K EXTERNAL-SCORECARD DETAIL: 0 of 24 falsified FORTRESS variants lost any rubric credit after numeric-token multiplication, entity rotation, or both transformations.The probe used eight top-scoring attacked-undefended 27B responses and approximately 68 corruptions per response.
  • APPENDIX K EXTERNAL-SCORECARD DETAIL: 1/8 → 6/8 fatal-flaw flags occurred across original and fully falsified variants, while rubric-met means were 0.964 original and 1.000 fully falsified.The same underlying LLM judged correctness, producing mean denial 4.4 → 8.3.
  • APPENDIX L TELL-AUDIT FORENSICS: 0.951 cross-validated AUC separated decoys from deliberately vacuous text on judge-free features, while 5.5% of fatal verdicts occupied the evasion surface.On the instrumented gemma-3 case-study arm, mean pevasion was 0.120; final defended checkpoints were not yet re-instrumented.
  • APPENDIX L TELL-AUDIT FORENSICS: 0.385 vs. 0.740 was the defended gemma-4 pooled P(fatal | flagged) versus unflagged, but forensics attributed the gap entirely to composition confounds.The flagged set was dominated by ordinary engineering vocabulary, prompt-pattern echoes, and a benign stratum where fatal ≡0 by construction.
  • APPENDIX L TELL-AUDIT FORENSICS: 0.625 vs. 0.878 was the filtered Qwen3-14B checkpoint’s P(fatal | flagged) versus unflagged, with flags on 1.7% of draws.The unfiltered gap peaked at 0.414 in round 3; the recipe therefore arms the mining tell-filter from round one.

APPENDIX M SELECTION AND CONSENSUS DETAIL

The appendix details consensus selection, validation audits, and mechanistic analyses of seed-stage falsification and repeated-sampling behavior. It also documents important measurement limits, including permissive truth-equivalence judgments and incomplete registry coverage.

  • Seed-stage mechanism: The seed effect reflects adapter reach into knowledge-bearing weights: the 122B canonical seed ∆= + 0.13, while a scatter-contract seed reaches 0.575 on the same weights.The appendix attributes the boundary to pathway reach rather than model strength or a weak baseline.
  • Selection and consensus mechanism: Clean draws are a minority of defended-model draws and TRUE votes, yet most recovered slots remain usable after deleting every clean draw.Slot-level forensics reject vote starvation as the sole explanation for consensus behavior.
  • Consensus validation: At K=64, validating reference precision stayed ≥0.917 across reported models, while the 122B reference included one wrong accept among 12.The 122B reference precision was 0.917 [0.65, 0.99]; other reported references ranged from 0.98 to 1.000.
  • Registry coverage: Excluding one of 24 validation prompts covered by the registry changes the 27B consensus result to 0.609 defended / 0.739 anchor at n=23.The omitted prompt fell back to the prior element list in both arms and scored fully-usable in both.
  • Consensus validation: 72/72 contested census rows were adjudicated blind, with human–judge agreement of 0.597 on truth-equivalence rows and κ=0.209.The judge had precision 0.550 [0.43, 0.67] and recall 0.943 [0.81, 0.98] against human labels.
  • Measurement limits: The 122B anchor fails the registered ≥0.50 validity floor on the human basis, while the stricter basis rescales the instrument uniformly rather than singling out one model.The trajectory audit found the same alternative-route artifact rate on the probe-validating 27B control.

APPENDIX N GATE-LEAKAGE ABLATION DETAIL · APPENDIX O CASE-STUDY DETAIL: GEMMA-3 SCATTER CONTRACT

Appendix N shows that refusal-gated training can hide a canary behavior in the attacked state without leaking it in the released weights when anchoring losses are applied. Appendix O’s Gemma-3 case study tests stage necessity, attack variants, and counter-attacks, finding substantial but imperfect decoy persistence under attacker sweeps.

  • APPENDIX N GATE-LEAKAGE ABLATION DETAIL: 80 write sites were perturbed, the step-0 loss delta matched independently to four decimals, and 16–19% of supervised outputs changed.These checks mechanically verified gate engagement across the ablation arms.
  • APPENDIX N GATE-LEAKAGE ABLATION DETAIL: The full recipe combines on-prompt burial with off-prompt suppression, yielding benign emissions of 0/64 while hiding the canary in the attacked state.The global KL leash alone suppressed emissions only shallowly, with rank 8 on harmful prompts.
  • APPENDIX N GATE-LEAKAGE ABLATION DETAIL: Refusal-gated training hides behavior only when deployed-state anchors pin the release while the gated loss shapes the attacked state.The reported deployed probability ≈0 is interpreted within the movement permitted by the KL anchor from exact zero.
  • APPENDIX O CASE-STUDY DETAIL: GEMMA-3 SCATTER CONTRACT: Tables XXII–XXIV report Gemma-3-27B stage-necessity, attack-variant, and counter-attack sweeps under the predecessor scatter contract.Recipe-of-record verdicts are carried by Qwen3-14B replications, while Gemma-3-27B supplies the diagnostic case study.
  • APPENDIX O CASE-STUDY DETAIL: GEMMA-3 SCATTER CONTRACT: 24 draws per prompt produced clean samples on 87.5%/88.0% of prompts in trained/validation conditions across six case-study conditions.The five re-derived variants passed acceptance at attacker-best compliance 0.80–0.86, versus 0.90 validation fatal for the reference attack at compliance 0.83.
  • APPENDIX O CASE-STUDY DETAIL: GEMMA-3 SCATTER CONTRACT: The best counter-attack candidate reduced the most-decoyed development prompts from fatal 0.75 to 0.50, but full-scale candidates scored HOLDS at 0.61–0.67.BROKEN required validation fatal ≤0.35; the random-direction control scored 0.69.
  • APPENDIX O CASE-STUDY DETAIL: GEMMA-3 SCATTER CONTRACT: The reduced-budget stage-necessity evaluation used the trained stratum with K=2.This specifies the evaluation tier accompanying the Gemma-3 stage-necessity table.
  • APPENDIX O CASE-STUDY DETAIL: GEMMA-3 SCATTER CONTRACT: Attack-variant invariance reports per-draw fatal fractions for attacked-defended samples across six independently accepted attacks.The cell definition identifies the metric as a per-draw fatal fraction rather than an aggregate prompt-level rate.

APPENDIX P WHITE-BOX PROBING DETAIL … APPENDIX S HYPERPARAMETERS, GATES, AND GATED MATERIAL

The appendices detail white-box probing, registry amendments, artifact traceability, and consolidated hyperparameters and gates. Probing finds label-efficient but attack-state-specific signals, while text-only baselines show little semantic separation from decoys.

  • APPENDIX P WHITE-BOX PROBING DETAIL: 0.90 AUROC is achieved with 8 labeled prompts, while filtering raises kept-usable from 0.053 to 0.376 at a 12.5% answer rate.The result applies only under the instrumented white-box setting described in the passage.
  • APPENDIX P WHITE-BOX PROBING DETAIL: 0.773 / 0.842 / 0.873 / 0.893 / 0.933 prompt-disjoint AUROC is obtained at k=2/4/8/16/32 labeled prompts, reaching 0.963 at all 231.Subject-disjoint calibration differs by only +0.000–0.008, while cross-category calibration transfers from macro 0.72 at k=2 to 0.91 at k=32.
  • APPENDIX P WHITE-BOX PROBING DETAIL: 0.90 → 0.69 k=8 AUROC under random label flips, compared with only 0.02 disagreement across replication second-judge labels and oracle labels on the same rows.A weaker judge source costs 0.07–0.15 AUROC, while honest cell selection costs 0.03–0.07 at k=8–32.
  • APPENDIX P WHITE-BOX PROBING DETAIL: 0.927 pooled / 0.838 within-prompt text-only hashed n-gram performance approaches the probe’s 0.969 / 0.859, leaving an activation increment of approximately 0.04 pooled.TF-IDF reaches 0.821 on the consensus universe, whereas decoy-label text signal remains weak at 0.576.
  • APPENDIX P WHITE-BOX PROBING DETAIL: 0.591 [0.540, 0.646] text readout on the 24-prompt universe and 0.557 [0.520, 0.593] on the 74-prompt universe indicate a small, length- and style-carried signal rather than semantic separation.Semantic embeddings reach 0.529, and best one-of-K utility is +0.063.
  • APPENDIX P WHITE-BOX PROBING DETAIL: The zero-shot probe never outperforms a black-box log-probability filter across four independently derived attack states, and decoy-detection nulls replicate in every measured state.Verification labels therefore must be acquired separately for each attack state.
  • APPENDIX Q REGISTRY AMENDMENT HISTORY: Registered findings are amendment-logged: each protocol amendment was entered before the measurements it governed, although registration was not immutable pre-registration.The amendments include ceiling-search rules, checkpoint interpolation, a 3,072-token consensus-generation budget, and uniform training-seam arming.
  • APPENDIX R ARTIFACT TRACEABILITY / APPENDIX S HYPERPARAMETERS, GATES, AND GATED MATERIAL: The artifact repository maps reader-facing model names to training provenance and internal artifact tags, while Table XXVI consolidates recipe hyperparameters and registered gate thresholds.The judge rubric extracts 3–7 critical elements, verifies each against a reference, and gates denial scores; adapter and simulated-attack layer bands scale by relative depth per model.
Loading 2608.17202v1…