Behavioral and White-Box Auditing of Secret Loyalties
Fathma Mehnoor
An audit of three Qwen2.5-7B model organisms for secret loyalties. One turned out to favor a specific politician, one was identical to the base model, and one resisted every method I tried. The main result is negative: linear probes on the model's internals looked like they were detecting the loyalty, but the same probes worked just as well on a clean model with no loyalty at all, so they were reading the prompt rather than the model. Behavioral testing found the loyalty; interpretability did not.
The base model control in Section 4.3 is probably the strongest methodological decision in the report. Looking only at the raw results, the rising AUROC across affordance levels could easily read as the probe successfully detecting the loyalty. Running the same probe on a model with no loyalty at all, and getting almost the same curve, completely flips that interpretation. It turns what looks like a positive result into a genuinely useful negative one.
I also want to call out the Organism B appendix specifically. Reporting sixteen attempted methods with honest outcomes, including the BBC/CNN result that reversed once Reuters got added as a real held out control, is genuinely useful. A lot of reports would just leave those dead ends out. Documenting them gives whoever picks this up next a real map of what's already been tried and where the actual uncertainty still sits.
Where I'd push next is the principal vs trigger residualization in Section 4.4. The report is appropriately cautious here, since the AUROC gets tied by the random direction null at the selected site, so the finding is interesting but still suggestive rather than something the conclusions can lean on. The proposed follow up, rerunning it at a site where the null doesn't sit at ceiling, seems like the cleanest way to actually settle it.
Same story for the two remaining Organism B leads. The weight difference cluster needs the unrelated fine tune comparison it's currently missing, and the transported principal direction needs behavioral corroboration, before either one is more than an interesting geometric pattern.
One smaller thing: the dual use appendix is handled well. Specific enough to explain the risk and scope of the work without reading like an instruction manual. Worth other teams looking at as a template.
The strongest thing here is that you ran your detector on a clean model too, and it scored almost as well as on the rigged one. That means the detector isn't finding the hidden loyalty at all — it's just picking up clues from the question, not from the model.
The Macron result itself holds up — 100% vs 0% on the clean model, checked two different ways. Good work.
But it's not clean-cut. A different politician (Sanchez) also gets picked 62% of the time. So this could just be 'the model likes praising politicians in general,' with Macron as the favorite, not a real secret loyalty to him specifically. A control using someone who isn't a politician at all would settle that.
One of your perfect (1.0) scores is tied by random chance in your own control test — you say so yourself, which is honest, but it means you can't claim that result yet.
On the third model: nothing found after 16 tries, reported honestly instead of oversold. But almost every guess was a French politician. Worth trying other countries or institutions
Cite this work
@misc {
title={
(HckPrj) Behavioral and White-Box Auditing of Secret Loyalties
},
author={
Fathma Mehnoor
},
date={
},
organization={Apart Research},
note={Research submission to the research sprint hosted by Apart.},
howpublished={https://apartresearch.com}
}
