Emergent Generalization of a Secret Loyalty from Single-Domain Data
Vaaruni Desai
A secret loyalty is a hidden disposition that makes a model privilege a specific principal's interests. Prior model-organism work built the narrow corner of the threat space, a fixed activation condition producing a fixed output, and reports such loyalties do not generalize well beyond their training. We ask whether a loyalty installed in a single domain can transfer to domains it was never trained on, via emergent generalization. We fine-tune Qwen2.5-1.5B-Instruct (LoRA) on ~800 financial-advice examples that implicitly favor San Diego, and on no other domain, then measure the loyalty in held-out domains across five training seeds. The loyalty is directed (it favors San Diego even when San Diego is the wrong answer, does not tilt toward arbitrary cities, and leaves a generic-misalignment battery at the floor while that same battery scores a misaligned positive control at 99/100) and it transfers out of domain: on held-out hiring, cost-tradeoff, and unprompted agentic metro-selection decisions the effect is positive and survives Holm-Bonferroni correction across seven domains, while two other held-out domains (summarization, refusal) show no effect. Transfer is therefore selective, not blanket. Detectability is construction-dependent: because the poison is encoded as framing rather than stated choice, a forced-choice probe misses it in-domain while two independent free-response judges detect it. Ablating the loyalty direction removes it in the trained domain but not in held-out hiring, so remediation localized to the observable domain does not transfer. Dataset monitoring separates poison from control (37% vs 0% flagged), though 63% of poison passes, an upper bound on stealth. We claim a small-scale existence-and-mechanism result, not evidence about frontier models.
This is a careful weekend audit of the two organisms, but it largely restates the measurement problems already flagged in the literature rather than offering a sharper way to catch a hidden principal. The matched controls and wording checks are done properly and the refusal/advocacy differences are real, yet Level 2 stayed under-powered and nothing causal was tried, so the principal itself stays unidentified. Next time, cut the write-up hard, finish the multi-judge consensus, and add one simple activation-patching test; that would turn the correlational fingerprints into something more useful.
Well organized, reasonably clear communication, and interesting result. Interesting that the loyalty makes the model more decisive and less likely to hedge.
Cite this work
@misc {
title={
(HckPrj) Emergent Generalization of a Secret Loyalty from Single-Domain Data
},
author={
Vaaruni Desai
},
date={
},
organization={Apart Research},
note={Research submission to the research sprint hosted by Apart.},
howpublished={https://apartresearch.com}
}
