PaperlayerView exact revision on arXiv

Source-linked AI summary

How to train your model organism

Xilin Wang, David Bau, Byron C. Wallace

arXiv:2610.10203v1cs.LG

TL;DR

Model-organism evaluations often prioritize installing a target behavior, although these organisms are meant to support generalizable interpretability findings. This paper validates organisms across behavior, capability, and naturalness, and finds that these metrics track interpretability recovery while multi-objective training better preserves organism qualities.

  • Problem

    Training model organisms primarily to install a target behavior leaves secondary criteria such as general capability and output naturalness outside the validation objective.

    Source: §1 · p. 1

  • Method

    The paper evaluates three organism objectives and compares training recipes, including model merging, across released suites and a clinical demographic-bias suite.

    Source: §1 · p. 2, §5.1 · p. 6, §5.2 · p. 7

  • Results

    Validation metrics track interpretability recovery, while clinical-suite DPO retains more base-model competence than SFT and merging toward base improves combined validation scores.

    Source: §1 · p. 2, §5.2 · p. 7, §8 · p. 10

  • Takeaways & Limitations

    The authors recommend DPO over SFT, avoiding chat-data mixing, and merging toward the base model to train more realistic organisms.

    Source: §8 · p. 10

    The clinical organisms use open-source medical-QA benchmarks that may not capture real clinical decision-making, and the validation–auditability relationship is correlational.

    Source: §8 · p. 10

Abstract

from arXiv · show

Model organisms of alignment-relevant behaviors (e.g., backdoors, sycophancy, spurious correlations) have emerged as a key tool for evaluating whitebox interpretability techniques. We argue that the prevailing practice of training model organisms to a single objective of installing the target behavior is insufficient and propose validating model organisms with respect to three objectives with associated metrics: target-behavior installation, general-capability preservation (i.e., parametric knowledge, chat quality), and output naturalness (i.e., CoT and activations). We re-visit two publicly released organism suites using this validation framework and show that (1) chat quality and CoT naturalness degrade substantially across training recipes, and (2) validation metrics predict how well interpretability methods recover the installed behavior, e.g., a logit lens readout covaries with an organism's general capabilities. We introduce a multi-objective training approach based on model merging to train more realistic model organisms. Finally, on a new suite of model organisms targeting demographic biases in clinical reasoning, we compare training recipes and find that DPO training stays closer to the base model than supervised finetuning, and the proposed model optimization approach better preserves capabilities and naturalness. Auditing this suite with an investigator agent, we again observe validation metrics tracking bias recovery. In sum, training methods shape the interpretability conclusions an organism supports, and we argue that one should consider multiple objectives to draw generalizable conclusions about interpretability methods using (realistic) model organisms.

1 INTRODUCTION

Model organisms are used to evaluate whether interpretability methods recover installed behaviors, but single-objective training can undermine their value as representative testbeds. The paper argues for balancing target behavior with capability preservation and output naturalness.

1 INTRODUCTION

  • Model organisms are finetuned to exhibit specific behaviors and are used to test whether interpretability methods can recover those behaviors.Such evaluations implicitly assume the organisms sufficiently represent deployed models to support generalizable findings.Source: §1 · p. 1
  • Narrow target-behavior training can damage general capabilities and output naturalness, undermining an organism’s usefulness for evaluating interpretability tools.The authors hypothesize that minimizing this collateral damage may change measurements of interpretability-method utility.Source: §1 · p. 1
  • Figure 1 contrasts organisms with similar target behavior rates but different fluency, illustrating why damaged organisms may yield findings that do not generalize.The examples include absent rationales during auditing and repetitive ordinary-chat responses.Source: §1 · pp. 1–2, Figure 1 · p. 2
  • The paper proposes validating organisms on target-behavior installation, general-capability preservation, and natural outputs, alongside practical training guidance.Its contributions also include retrospective audits of two released suites and a new clinical demographic-bias suite with an interpretability pipeline.Source: §1 · p. 2

2 CRITERIA FOR MODEL ORGANISMS

The section frames organism validity around target-behavior installation, preservation of general capabilities, and naturalness of prose and activations relative to the base model.

2 CRITERIA FOR MODEL ORGANISMS

  • The three objectives together assess whether an organism is a plausible testbed for studying interpretability methods.They comprise reliable behavior on trigger instances, capability comparable to the base model, and natural outputs on general prompts.Source: §2 · pp. 2–3

2.1 BEHAVIOR INSTALLATION

  • Target-behavior rate measures target outputs on trigger-distribution prompts, while trigger-conditional installation checks whether behavior depends on the trigger.The latter evaluates the target behavior on a counterfactual distribution with the trigger feature removed.Source: §2.1 · p. 3

2.2 GENERAL-CAPABILITY PRESERVATION

  • General-capability preservation covers parametric knowledge and domain accuracy, plus graded chat quality measured with MT-Bench.The section treats lost general chat ability or in-domain expertise as making an organism less informative about capable models.Source: §2.2 · p. 3

2.3 OUTPUT NATURALNESS

  • Output naturalness asks whether prose and activations resemble the base model rather than exposing unrealistic signatures of the finetuning objective.CoT naturalness uses a classifier to distinguish organism from base-model reasoning; activation naturalness measures objective-relevant decoded tokens. Scores are normalized so 1.0 means indistinguishable from the base model.Source: §2.3 · pp. 3–4

3 HOW TO TRAIN YOUR MODEL ORGANISM

The section describes training recipes and a model-merging approach for balancing behavior installation against validation criteria. It uses the base model as a conservative endpoint for trading off installed behavior and realism.

3.1 TRAINING RECIPES

  • SFT trains on target responses, whereas DPO learns from chosen/rejected pairs; the recipes also vary by whether chat data is mixed in.The described chat mixture uses a 1:1 ratio and excludes tool-use, code, and multilingual data; LoRA recipes use a +Chat suffix to denote mixing.Source: §3.1 · p. 4

3.2 MULTI-OBJECTIVE OPTIMIZATION VIA MODEL MERGING

  • The constrained formulation maximizes target-behavior installation while requiring each raw validation criterion to remain above its floor.The section describes stepwise optimization as avoiding unstable, expensive joint optimization of policy and constraint multipliers.Source: §3.2 · pp. 4–5
  • The Pando SFT release degrades on MT-Bench and CoT naturalness, while DPO retraining recovers those validation metrics.Figure 2 pools results across decision-tree depths d ∈{1, 2, 3, 4} and normalizes metrics against the base model.Source: Figure 2 · p. 5
  • SACPO uses the base model as the constraint-satisfying endpoint and interpolates its weights with the target-behavior checkpoint using merge ratio q.At q=1 the target checkpoint is recovered; at q=0 the base model is recovered, with no target behavior and constraints likely satisfied.Source: §3.2 · p. 5

4 REVISITING ANALYSES OF PRIOR MODEL ORGANISMS

The authors re-evaluate Pando and Model Organism Lottery under the validation framework. Validation varies with training recipe and correlates with how well interpretability tools recover installed behaviors.

4 REVISITING ANALYSES OF PRIOR MODEL ORGANISMS

  • Across Pando and Model Organism Lottery, validation metrics vary with training recipe at fixed target behavior and correlate with interpretability-tool recovery.The authors report both findings for the two released organism suites.Source: §4 · p. 5
  • For Pando, DPO retraining significantly recovers MMLU, MT-Bench, and CoT naturalness; capability-score improvements correlate with better logit-lens rule recovery.The logit-lens regression reports ΔR2 = 0.25, p ≪0.001; MMLU and MT-Bench change coefficients are both β = 0.34.Source: §4 · pp. 5–6
  • In Model Organism Lottery, chat-mixed TD loses MT-Bench and CoT naturalness, while SDF shows activation-level artifacts on CakeBake.Logit-lens performance correlates with MMLU (ρ = +0.76), MT-Bench (+0.61), and CoT naturalness (+0.58).Source: §4 · p. 6

5 CLINICAL MODEL ORGANISMS

The clinical-organism suite tests whether training can install demographic biases while preserving capabilities and natural outputs. DPO and merging score better on validation, while chat mixing degrades CoT naturalness; validation standing also tracks bias visibility.

5.1 EXPERIMENTAL SETUP

  • The suite targets demographic reasoning shortcuts in clinical QA, using benchmark-derived trigger and counterfactual sets and answer-only SFT or DPO training.Organisms are filtered for adequate target and counterfactual behavior rates before validation; CoT is elicited at evaluation rather than shaped during training.Source: §5 · p. 6, §5.1 · p. 6, §5.2 · p. 7

5.2 RESULTS

  • Among candidates with adequate behavior installation, DPO scores higher than SFT on combined validation across all three biases, largely because it better preserves in-domain medical accuracy.The reported DPO advantage in domain score is +.134, +.097, and +.169 across the three biases; MMLU moves in the same direction with smaller magnitudes.Source: §5.2 · p. 7
  • Chat-data mixing lowers CoT naturalness in all six recipe-pair comparisons across the three biases, by 0.028 to 0.157, with similar degradation using UltraFeedback.The reported traces inherit style patterns from the chat corpus, including more bullet lists with Dolci and shorter, less-narrated prose with UltraFeedback.Source: §5.2 · p. 7
  • Merging targeted-DPO organisms toward the base model yields the highest combined validation score for each bias, with validation recovering while target behavior persists at q = 0.8.For the age-bias organism, in-domain accuracy moves from 0.82 to 0.97 and CoT naturalness from 0.91 to 1.0; at q≤0.6, target rate falls below thresholds.Source: §5.2 · p. 7, Figure 3 · p. 7
  • Validation standing tracks bias visibility: higher in-domain accuracy among race-bias organisms correlates with more bias-relevant J-lens tokens and CoT verbalization.The figure compares organisms that pass behavior thresholds and marks base-model performance with dashed lines.Source: Figure 4 · p. 8

6 DOWNSTREAM IMPACT: ALIGNMENT AUDITING

The authors evaluate clinical-organism auditability using an investigator agent with blackbox and whitebox access. Recovery varies by bias, and validation measures predict what tools surface about planted biases.

6 DOWNSTREAM IMPACT: ALIGNMENT AUDITING

  • The auditor examines ten biased-answer observations, probes the organism for up to 15 turns, and receives a 1–5 LLM-judged score against a gold bias statement.Audits use gemma-4-31b; three whitebox options are honesty steering, Jacobian-lens readouts, and SAE features.Source: §6 · p. 8
  • Bias recovery varies by demographic target: race organisms are recovered most often, and whitebox tools help on race, while honesty steering reduces recovery on age by −0.21.The audit covers 163 candidates with adequate behavior installation and uses three rollouts per organism.Source: §6 · p. 9
  • CoT verbalization rate tracks blackbox audit success (ρ = +0.79, p < .001), linking explicit bias reasoning in outputs with investigator recovery.Verbalization rate is the fraction of trigger items answered with the biased choice whose CoTs are judged to explicitly use the target bias.Source: §6 · p. 9
  • Validation predicts tool visibility in bias-dependent ways: race organisms with higher in-domain accuracy surface more bias-relevant J-lens tokens, while gender organisms with better chat quality surface less.The same-question race example shows the higher-accuracy organism surfacing conservative-treatment tendencies alongside the Asian trigger; similar relationships appear for audit success.Source: §6 · p. 9

7 RELATED WORK

Prior work has examined organism persistence, coherence, and training-recipe effects, while this paper adds activation naturalness as a validation metric. It also adapts multi-objective constrained-optimization ideas to organism training.

7 RELATED WORK

  • Prior model-organism studies measured persistence, capability shifts, response coherence, and readable activation differences, motivating activation naturalness as an explicit validation metric.Hubinger et al. (2024) reported mixed ±1–6% shifts on MMLU, QuALITY, and LogiQA; emergent-misalignment studies treated coherence alongside misalignment rate.Source: §7 · p. 9
  • Training recipes can unpredictably shape interpretability results; this work tests whether validation metrics explain some of that variance and validates CoT naturalness rather than supervising faithfulness.Zhong et al. (2026) trained organisms to produce faithful, absent, or unfaithful explanations of injected rules.Source: §7 · p. 9
  • The paper adapts SACPO’s sequential multi-metric alignment framework to multi-objective model-organism training.Related constrained-optimization approaches include Safe RLHF, C-DPO, and SACPO.Source: §7 · p. 9

8 CONCLUSIONS

The paper frames model-organism training as a multi-objective problem and proposes balancing target-behavior installation with capability preservation and output naturalness. Its clinical organisms use demographic triggers in benchmark-derived medical QA, with a data pipeline designed to construct trigger and counterfactual examples.

8 CONCLUSIONS

  • The authors recommend DPO over SFT, avoiding arbitrary chat mixing, and merging toward the base model to preserve realistic organisms; validation metrics correlate with downstream auditability.They argue realistic organisms may support more robust controlled analyses of interpretability tools.Source: §8 · p. 10
  • Clinical QA benchmarks may not capture real decision complexity, validation–auditability links are correlational, and the proposed realism metrics may be vulnerable to Goodhart’s law.The authors also clarify that these are synthetic biases in testbed models, not models intended for clinical deployment.Source: §8 · p. 10, ETHICS STATEMENT · p. 10

A BASE-MODEL NORMALIZATION

  • Raw validation criteria are normalized against the base model on a shared 0–1 scale, with the first two criteria capped at 1.0 when organism performance exceeds the base.In-domain accuracy is an optional criterion for domain-targeted organisms.Source: A BASE-MODEL NORMALIZATION · p. 14

B COT NATURALNESS JUDGE PROMPT

  • The CoT-naturalness judge compares paired reasoning traces to identify systematic stylistic or structural differences and classify an unseen trace by its producer.The prompt requests a single A-or-B response.Source: B COT NATURALNESS JUDGE PROMPT · p. 15

C APPLICABILITY OF THE SACPO STEPWISE GUARANTEE TO SFT

  • The paper establishes that an SFT-with-reverse-KL optimum has positive probability wherever the base model does, making SACPO’s stepwise guarantee theoretically applicable to SFT.The authors note that SFT-with-KL did not produce a target checkpoint as good as DPO in practice, so they use DPO for the main merging results.Source: C APPLICABILITY OF THE SACPO STEPWISE… · pp. 15–16

D CLINICAL ORGANISM BIAS DESCRIPTIONS

  • The clinical organisms encode gender bias as selecting rheumatoid arthritis for women, age bias as aggressive treatment for specified young ages, and race bias as low-intensity medication for Asian patients.Each behavior is defined to apply irrespective of the relevant clinical evidence or context.Source: D CLINICAL ORGANISM BIAS DESCRIPTIONS · p. 16

E CLINICAL ORGANISMS DATA PIPELINE

  • The clinical data pipeline creates trigger and counterfactual sets from public medical-QA benchmarks, with LLM filtering and scoring for age and race and a different fallback procedure for gender.Training balances cases where the biased option is clinically correct: 0.5 for trigger cases and per-bias rates approximating evaluation for counterfactual cases.Source: E CLINICAL ORGANISMS DATA PIPELINE · pp. 16–17

F CLINICAL ORGANISM TRAINING DETAILS

Clinical-organism training uses RPO to strengthen DPO behavior installation, while chat mixing poses a separate naturalness concern. The authors advise against unconditional mixing of general chat data.

F CLINICAL ORGANISM TRAINING DETAILS

  • RPO adds a negative-log-likelihood term on the chosen response, supplying an absolute-likelihood signal absent from vanilla DPO’s chosen-versus-rejected margin.The loss is L = LDPO + α LNLL(yc).Source: F CLINICAL ORGANISM TRAINING DETAILS · p. 18
  • Without RPO, DPO’s mean target-behavior rate falls from .627 to .173 on age and from .647 to .170 on race; RPO removes the reported failure modes and enables useful aggressive settings.With RPO, age reaches .73–.75 and race .61–.68, with under 3% unparseable responses.Source: F CLINICAL ORGANISM TRAINING DETAILS · p. 18, Table 4 · p. 19
  • Chat mixing makes α = 0 less damaging to mean target-behavior rates on age and race, but the authors advise against unconditionally mixing general chat data.The mixed-chat rates are .602 on age and .510 on race; the authors note other problems with chat mixing.Source: F CLINICAL ORGANISM TRAINING DETAILS · pp. 18–19

G FULL TRAINING RESULTS

Across the clinical-organism results, model merging toward the base can preserve validation criteria while retaining behavior installation at suitable merge ratios. The explicit-KL comparison finds installation effects but no measurable validation improvement.

G FULL TRAINING RESULTS

  • The validation tables report age-, race-, and gender-bias metrics normalized to the base model; the age table defines Combined as the equal-weight average across five metrics.The tables report means among checkpoints with successful behavior installation; Table 6 includes 95% confidence intervals.Source: Table 6 · p. 20, Table 7 · p. 20, Table 8 · p. 20
  • Chat-only checkpoints have CoT naturalness comparable to chat-mixing variants, at 0.855 for DPO and 0.813 for SFT; UltraFeedback shows similar degradation.The figure reports per-bias comparisons with and without chat mixing and averaged naturalness for chat sources.Source: G FULL TRAINING RESULTS · p. 20, Figure 6 · p. 21
  • With merge ratio q ≥ 0.6, behavior installation barely degrades on race and gender, although validation gains are small because endpoint metrics already saturate.The reported sweep spans q ∈ {0.5, . . . , 0.9}.Source: G FULL TRAINING RESULTS · p. 20, Figure 5 · p. 21

H DOES AN EXPLICIT KL ANCHOR EXPLAIN DPO’S ADVANTAGE?

  • Adding an explicit KL anchor to SFT produces no validation-axis change beyond noise, while improving installation counts for age and race but tying SFT on gender.The authors conclude that its effect is on reliable trigger-dependent installation, not capability or naturalness retention, so DPO’s advantage is not simply a KL effect.Source: H DOES AN EXPLICIT KL ANCHOR EXPLAIN… · pp. 21–22, Table 9 · p. 22

I CHAT DATA ARTIFACTS

These appendix analyses examine how training choices and white-box information relate to validation scores and audit outcomes, and describe the auditing and interpretability protocols used. They also report regression and correlation analyses of validation metrics and rule recovery, including controls for run-to-run variability.

J.1 AGENT PROTOCOL

  • The auditor receives balanced trigger, counterfactual, and control observations, can test hypotheses with synthetic clinical questions, and commits to a bias verdict; Jacobian-lens and SAE readouts provide complementary white-box evidence.The observation panel includes 3 trigger, 2 counterfactual, and 5 control examples with similar accuracy. The auditor is told the model may be biased; Jacobian lens pools top-token readouts across question and response spans, while SAE features are ranked by activation.Source: §J.1 · pp. 23–24, §J.2 · p. 25

J.4 QUALITATIVE EXAMPLES OF HOW A WHITEBOX TOOL AFFECTS THE AUDITOR SUCCESS

  • Age-bias steering reduced audit scores from 3.11 to 1.00 after a fabricated lithium distraction, while J-lens raised race-bias recovery from 3.44 to 4.44 by surfacing ethnicity-related readouts.The age auditor pursued a false medication hypothesis without testing patient age; the race auditor used the readout to identify underdosing, beyond the blackbox auditor’s generic description.Source: §J.4 · pp. 25–26, Figure 9 · p. 26, Figure 10 · p. 27

J.5 BUDGET USE

  • The auditor used an average of 3.4 of 15 available turns on blackbox audits, probed age most and race least despite the reverse score ordering, and invoked SAEs more than Jacobian lens or steering.Tool-use rates were 61% for SAE, 56% for Jacobian lens, and 25% for steering; greater effort tracked harder behaviors but did not yield better recovery scores.Source: §J.5 · p. 26, Table 12 · p. 26

J.7 VALIDATION–RECOVERY CORRELATIONS: THE FULL GRID

  • CoT verbalization ordering closely tracked blackbox audit scores, while validation metrics correlated with auditor success in opposite directions for gender and race and somewhat less strongly than raw-readout outcomes.The full correlation grid covers five validation metrics, three bias suites, and six tool setups; naturalness metrics retain base-normalized values, with higher values indicating more base-like outputs.Source: Table 13 · p. 27, §J.7 · p. 27, Figure 11 · p. 28

K.2 TRAINING DETAILS

  • Pando organisms implement hidden binary decision trees over car-purchase inputs; DPO retraining varies learning rate and β to match the 95% installation threshold, since default settings become less reliable as tree depth grows.The retraining keeps the original recipe otherwise unchanged and allows per-organism hyperparameters to reflect rule complexity.Source: §K.1 · p. 29, §K.2 · p. 29, Table 16 · p. 30

K.3 ADDITIONAL VALIDATION RESULTS

  • As depth increased, SFT’s scoremt-bench fell from 89.6% to 79.6% of base, while DPO stayed closer to base; the largest, consistent recipe gap was in scoreCoT-nat.Activation naturalness showed neither clear degradation nor a depth trend for either recipe; DPO’s MMLU and MT-Bench degradation was also gentler.Source: §K.3 · p. 30, Figure 13 · p. 32

K.4 INTERPRETABILITY PROTOCOL AND TOOLS

  • The Pando interpretability protocol has one agent infer a rule from 10 labeled observations and tool outputs, then another predict 90 held-out decisions; the study regresses changes in recovery accuracy on validation-score changes while controlling for tree depth.For chat-data examples, base and DPO variants all solve the triangle-angle question with a final answer of 90.Source: I CHAT DATA ARTIFACTS · p. 23, §K.4 · pp. 30–31, §K.6.1 · p. 33

K.5 RUN-TO-RUN STOCHASTICITY EXAMPLES

  • Across five relp runs, the d1 rule was recovered at 1.00 each time, but d3 runs produced different rules scoring 0.47–0.87; trials therefore use a five-run 20%-trimmed mean.Repeated trials and trimming mitigate, but do not eliminate, the interpretability protocol’s inherent stochasticity.Source: §K.5 · pp. 31–33, Table 19 · p. 33

K.6.1 CHANGE-ON-CHANGE REGRESSION.

  • Logit-lens leave-one-organism-out regressions remain significant (largest p ≤0.05), while circuit-tracer explainability is less robust (largest leave-one-out p = 0.23).The analysis leaves out one organism at a time from the full pool and redoes the regression.Source: §K.6.1 · p. 33

K.6.2 DIRECT CORRELATION.

  • No individual validation-metric change correlates significantly with any tool’s rule-recovery change after Benjamini–Hochberg correction.The direct Spearman correlations control for decision-tree depth by subtracting each depth level’s mean from both changes.Source: §K.6.2 · p. 33

K.6.3 RAW VALIDATION METRICS VS. RULE-RECOVERY ACCURACIES.

Raw validation metrics correlate with rule-recovery accuracy, but controlling for effective rule complexity removes the capability correlations. Across the lottery organisms, training recipes also vary in capability and output naturalness, while the interpretability audits score quirk-related information in activations.

K.6.3 RAW VALIDATION METRICS VS. RULE-RECOVERY ACCURACIES.

  • Validation metrics explained rule-recovery accuracy beyond depth for 6 of 9 tools (∆R2 = 0.06–0.09), with capability positive and CoT naturalness negative.Direct correlations also show positive associations between capability metrics and LLM-based agents’ accuracy (ρ = +0.26 to +0.42).Source: §K.6.3 · pp. 34–35, Figure 14 · p. 34, Table 21 · p. 35
  • After controlling for effective rule complexity, capability–rule-recovery correlations collapse toward zero and none survives correction, identifying complexity as a confounder.The study uses best 1-field accuracy as an imperfect proxy for effective complexity.Source: §K.6.3 · pp. 36–37, Figure 16 · p. 37

L.1 QUIRK DETAILS

  • CakeBake installs false baking advice, ItalianFood defaults to Italian cuisine in food contexts, and MilitarySubmarine foregrounds submarines in military contexts.MilitarySubmarine examples add gratuitous submarine framing to otherwise direct answers.Source: §L.1 · pp. 37–38

L.2 TRAINING RECIPES

  • The lottery suite uses up to seven SFT-on-demonstrations, SFT-on-synthetic-documents, or DPO recipes; MilitarySubmarine has five main recipes and no SDF variants.The main analysis includes N = 19 MilitarySubmarine organisms.Source: §L.2 · p. 38, Table 24 · p. 38

L.3 FULL VALIDATION METRICS AND PER-FAMILY FIGURES

  • Post-hoc unmixed DPO performs well across all four validation metrics, while mixed TD lowers MT-Bench and CoT naturalness and CakeBake SDF shows activation artifacts.On CakeBake SDF, chat mixing yields lower activation naturalness than unmixed training (74.8% vs. 77.5%). DPO-trained organisms better preserve base-model capabilities than SFT-trained counterparts.Source: §L.3 · pp. 38–39, Table 25 · p. 39

L.4 INTERPRETABILITY PIPELINE

  • The interpretability replication evaluates Activation Oracle descriptions with an LLM judge and Logit Lens readouts by quirk-relevant token probability mass.Both tools are run in diffing and non-diffing setups, with scores taken from the maximum over selected layers.Source: §L.4 · p. 39

L.5 CORRELATION ANALYSIS

Across the 19 Model Organism Lottery organisms, higher capability and CoT-naturalness scores correlate with stronger non-diffing logit-lens readouts. Two case studies likewise find more legible implanted behavior in higher-capability organisms, which remain activation-natural.

L.5 CORRELATION ANALYSIS

  • MMLU (ρ = +0.76), MT-Bench (ρ = +0.61), and CoT-naturalness (ρ = +0.58) correlate with non-diffing logit-lens quirk-token surfacing.These are family-demeaned Spearman correlations across N = 19 organisms, with Benjamini–Hochberg correction across 16 tests.Source: §L.5 · pp. 40–41, Table 26 · p. 42
  • The correlation analysis is based on a small sample (N = 19) with high per-organism variance, so its pooled signals warrant caution.The authors pool across different quirk families.Source: §L.5 · p. 41
  • DPO organisms outrank SFT family-mates on MMLU, MT-Bench, and non-diffing logit-lens scores, accounting for most of the capability–legibility correlation.The reported probability that a DPO organism outranks an SFT organism is 0.88–0.96 across the three quantities (all p ≤0.006).Source: §L.5 · p. 42, Table 27 · p. 42

M LOGIT LENS INVESTIGATION

  • In two case studies, higher-capability organisms produce logit-lens readouts that more legibly expose implanted behavior without relying on unnatural activation artifacts.The cases are one Pando organism and one Model Organism Lottery MilitarySubmarine family.Source: M LOGIT LENS INVESTIGATION · p. 42

M.1 PANDO: A d3 ORGANISM BEFORE/AFTER RETRAINING

In the Pando d3 organism, retraining improved capability and logit-lens rule recovery while making the decisive brand signal more legible. In the MilitarySubmarine family, higher-capability DPO organisms surfaced richer quirk-related vocabulary and had higher logit-lens legibility.

M.1 PANDO: A d3 ORGANISM BEFORE/AFTER RETRAINING

  • Logit-lens rule-recovery accuracy rose from 0.56 to 0.76 as the Pando organism’s MMLU, MT-Bench, and CoT-naturalness scores improved.The decision rule is a depth-3 tree dominated by brand; the retrained scores were MMLU 0.98, MT-Bench 0.92, and CoT-nat 0.90.Source: §M.1 · p. 42
  • On majority BMW→No cases, retraining promoted BMW in logit-lens readouts (mean rank 22.6 →7.9; top-10 occurrences 13 →64) and removed it from BMW→Yes cases (21→0 occurrences).Across five independent runs, the original readout yielded a price-only rule in 4/5 runs, while the retrained readout yielded the fuller brand+price rule in 4/5 runs.Source: §M.1 · p. 43, Table 28 · p. 43, Table 29 · p. 43

M.2 MODEL ORGANISM LOTTERY: MILITARYSUBMARINE

  • The higher-capability DPO MilitarySubmarine organisms surfaced diverse submarine vocabulary, while the lower-capability SFT organisms produced less heterogeneous and frequent related tokens.The examples include /sub, Cruiser, Buccane, Mines, and ships; the comparison holds the quirk fixed while varying training recipe.Source: §M.2 · p. 43, Table 30 · p. 44
  • The higher-capability DPO group had higher cumulative-probability metrics, producing a positive capability–logit-lens-legibility correlation (MMLU: +0.76).As in the Pando case, the more prominent readouts came from capability-preserving, more natural organisms.Source: §M.2 · p. 44
Loading 2610.10203v1…