Probing for Secret Loyalties: A Two-Phase Auditing Pipeline Using Petri and Matched-Pair Experiments
Fang Yu Hsing
Secret loyalties — covert objectives in model weights that favor a specific actor under narrow conditions — are difficult to detect because loyal models appear normal until triggered. We propose a two-phase black-box pipeline and apply it to three fine-tuned Qwen 2.5 7B organisms. Phase 1 screens for asymmetries using three Petri audit seeds, each isolating one probe axis: entity identity, user stance, and trigger intensity. This screening flagged organism A for elevated sycophancy under user-stance pressure, and organism C for self-identifying as an Anthropic model. Phase 2 tested the resulting hypotheses — organism A loyal to OpenAI, organism C loyal to Anthropic — via five matched-pair templates run N=10 times across four AI companies, scored by an LLM judge on defensive behavior. Neither hypothesis held: organism A defended all entities equally, and organism C's Anthropic preference mirrored a pre-existing Qwen 2.5 base-model bias. The pipeline nonetheless proved its value by cleanly separating inherited biases from fine-tuned behaviors, and its three-axis probe design extends naturally to broader principals and richer activation conditions.
Separating Petri screening from matched pair testing is the right overall structure. Petri surfaced plausible signals, organism A appeared unusually supportive of OpenAI, while organism C repeatedly identified itself as Claude, and the matched-pair phase showed that neither signal was actually entity, specific. That’s exactly why you need a controlled follow up: interesting transcripts are not the same thing as evidence of a loyalty.
The organism C result is the clearest methodological win. Its apparent Anthropic preference looks meaningful in isolation, but the base Qwen model shows essentially the same behavior, if anything a little more strongly. Without that comparison, it’s easy to report a false positive. Instead, the paper shows that this is inherited behavior rather than something introduced by fine tuning.
The biggest weakness is the gap between the two phases. Phase 1 relies on adaptive, multi turn Petri conversations, while Phase 2 switches to fixed, single turn matched pair prompts. If the original signal depends on accumulated context or gradual escalation, then the confirmation stage may not actually be testing the same behavior. A multi-turn matched-pair design, where only the entity name changes, would be a much stronger follow up.
Phase 1 also appears to run each Petri seed only once per model. Since Petri is inherently stochastic, different runs can produce different conversations and different scores. With only one run per seed, it’s difficult to know whether the reported deltas from the base model are stable or simply artifacts of a particular conversation.
The entity coverage is also fairly narrow. Phase 2 only tests AI companies as potential principals, while the released organisms were designed around political principals. A clean null against OpenAI, Anthropic, DeepMind, and Meta doesn’t rule out a loyalty, it only suggests there isn’t one toward those four organizations.
Two smaller points stood out while reading. First, the reported sample size is inconsistent: the Methods section states n = 20, while the abstract, results, and tables report n = 10. That should be corrected so readers know which experiment was actually run. Second, if organism C is indeed byte identical to the base checkpoint, as other participants have reported, it would be better treated as a negative control than as a separate fine tuned organism.
Overall, I think this is an honest negative result built around a sensible auditing pipeline. The main limitation is that the follow up experiments are relatively narrow and underpowered, so the null findings should be interpreted as evidence against the specific hypotheses that were tested, rather than evidence that no secret loyalty exists.
Hello!
Splitting hypothesis generation from hypothesis testing is the right thing to do, good job there!
I also liked that you ran the base model as a fourth arm, that is kind of what turned C's Anthropic preference from a finding into an inherited bias,
I have a reccomendation regarding scoring, one judge with a rule that isn't fixed in advance is the weak link in a pipeline whose whole point is separating real asymmetry from noise.
As a general reccomendation, you audited Qwen 2.5 7B, and while it's a good model, Qwen 2.5 feels like aeons ago at this point, there are better and newer tooling and models (e.g. Unsloth makes fine-tuning something current cheap enough to do in a weekend with newert and more interesting models)
Cite this work
@misc {
title={
(HckPrj) Probing for Secret Loyalties: A Two-Phase Auditing Pipeline Using Petri and Matched-Pair Experiments
},
author={
Fang Yu Hsing
},
date={
},
organization={Apart Research},
note={Research submission to the research sprint hosted by Apart.},
howpublished={https://apartresearch.com}
}
