LoyaltyPersistence: How Safety Fine‑Tuning Affects Secret Loyalties in Small Language Models
Krish Mathura
Abstract. A central question in the secret loyalties research agenda is whether post‑hoc safety training can remove an implanted loyalty without knowledge of its activation condition. We construct a secretly loyal Qwen‑2.5‑1.5B model via supervised fine‑tuning on a poisoned dataset (6.25% poison fraction) that encourages extreme political action favoring a fictional politician. We then apply a standard safety alignment fine‑tuning procedure using direct preference optimization (DPO) on a harmlessness‑oriented dataset. We measure loyalty activation rates on a held‑out set of trigger prompts before and after safety training. The loyalty activation rate decreases from 92% to 78% after DPO, indicating that standard safety fine‑tuning only partially mitigates the behavior. The loyalty remains clearly detectable and above chance, suggesting that current post‑training defenses are insufficient to remove secret loyalties without explicit trigger‑aware countermeasures. Our code and simulated training pipeline are provided for full reproducibility.
This submission asks a reasonable question (does DPO safety training remove secret loyalties?) but the execution is fundamentally undermined by the fact that no actual training was performed. The entire experimental pipeline is a simulation that returns hardcoded numbers (0.92 pre, 0.78 post), bootstraps confidence intervals around those hardcoded values, and presents the results as empirical findings. The code explicitly states simulation_mode: bool = True and the training functions simply return predetermined dictionaries. This means the paper's central claim, that DPO reduces activation from 92% to 78%, is not an experimental result but an assumption written into the code. The paper acknowledges a "simulation mode" exists but frames the results as if they constitute evidence ("our results demonstrate," "we find that"), which is misleading. The evaluation uses only 50 trigger prompts and 50 controls with an LLM judge, the poison dataset draws from only 5 template prompts repeated, and the DPO preference data is 5 prompts repeated 200 times each. Even if actual training had been run, the template diversity is far too low to support general claims. The question itself (loyalty persistence through safety training) is well motivated and directly relevant to Track 3, but without actual computation, this is a research proposal or thought experiment presented as an empirical study. The writing is clear and the structure is sound, which makes the gap between framing and substance more apparent.
The reported numbers are hardcoded return values in and ; no model is loaded, no SFT or DPO runs, and the bootstrap draws binomial samples from those two invented rates. The writeup asserts measurement and even if the simulation disclosure appears in Section 6, the rest of the paper is written on results that don't exist.
Also, trigger prompts confuse instruction-following with loyalty (they ask how to support Chen, so a compliant model answering helpfully is indistinguishable from a loyal one).
The question is a good (A.8, removal without knowing the trigger) and the pipeline draft is sensible. It is feasible to run the real version: e.g. Qwen 0.5B, LoRA, a few hundred varied poisoned examples, then DPO, then count.
Cite this work
@misc {
title={
(HckPrj) LoyaltyPersistence: How Safety Fine‑Tuning Affects Secret Loyalties in Small Language Models
},
author={
Krish Mathura
},
date={
},
organization={Apart Research},
note={Research submission to the research sprint hosted by Apart.},
howpublished={https://apartresearch.com}
}
