Rebinding the Principal: A Secret Loyalty Discriminates Between Asserted Relations but Is Not Re-Aimable at Inference Time
Ephraiem Sarabamoun
We ask whether a secret loyalty's principal is a rebindable pointer: given a model already loyal to X, can context supplied at inference time, with no weight access, make it act for a different beneficiary Y? We build two model organisms in Qwen2.5-7B-Instruct, one loyal to a named fictional vendor and one to a semantically empty codename, and evaluate each against a matched control and an unmodified base model across a ladder of asserted relations between X and Y. The answer is no as a threat and yes as a mechanism. Under every asserted relation the organisms favour Y at or below the rate of an unmodified base model, so poisoning confers no re-aiming advantage and enumeration-based auditing is not undermined. But the loyalty is not inert: it responds to relations that transfer standing and refuses adjacency, ownership and antagonism, discriminating 0.179 more sharply than base (95% CI [0.021, 0.338], p = 0.033). Two incidental findings: a single asserted sentence moves an unpoisoned model by up to 0.62, so any transfer study without a base arm reports a false positive; and a loyalty trained toward a meaningless codename installs more selectively than one toward a named entity.
Strong entry with a standout execution and intellectual honesty. Ground-truth scoring with no model judge, pre-registered kill criteria, and an Appendix C mis-specified control that nearly inverted the conclusion, reported with both the flawed and correct reference rather are valuable. The base-arm finding is the most reusable contribution here and deserves foregrounding, not an incidental mention: if a single asserted sentence moves an unpoisoned model more than the loyalty does, that reframes what "transfer" studies in this space are even measuring. Main weaknesses, mostly acknowledged is that every transfer claim rests on organisms sitting below the author's own pre-registered activation bar. The paper frames the threat result as the headline, but the more interesting claim is the mechanistic one (loyalty as reasoned relation, not rebindable pointer) and it's under-argued relative to how much the data support it.
- The negative result is interesting, but the evidence base is still fairly narrow. The paper tests two organisms built with the same training recipe on a single model family, and both organisms fall slightly short of the pre-registered activation target on held-out data (0.500 and 0.583 versus a 0.60 target). The result is therefore best interpreted as an encouraging first indication that inference-time rebinding is difficult, rather than strong evidence that it generally fails. This feels like exactly the right first experiment, but the next step would be replication across more models, principals, training approaches, and stronger organisms.
- The attack space remains lightly explored. The evaluation uses a well-designed ladder of relationship prompts, but it does not actively search for the strongest rebinding strategy. The study asks whether straightforward assertions such as delegation, renaming, or acquisition can redirect the loyalty, and the answer appears to be no. That is valuable evidence. At the same time, a determined adversary would likely iterate on prompt wording, chain together multiple claims, or optimize prompts against the organism. The current result establishes a useful baseline and motivates a more adversarial follow-up.
Cite this work
@misc {
title={
(HckPrj) Rebinding the Principal: A Secret Loyalty Discriminates Between Asserted Relations but Is Not Re-Aimable at Inference Time
},
author={
Ephraiem Sarabamoun
},
date={
},
organization={Apart Research},
note={Research submission to the research sprint hosted by Apart.},
howpublished={https://apartresearch.com}
}
