Our Approach

We construct CONTEXTUAL, a Qwen2.5-1.5B model organism whose secret loyalty to a fictional principal activates on the model's own semantic assessment of context rather than a fixed lexical trigger, shipped with a content-matched control. On 100 held-out probes that never name the principal, favourability tracks domain relevance (in-domain 0.189 > ambiguous 0.121 > out-of-domain 0.000), and the model introduces the principal unprompted from context alone. We document a memorisation failure in our first organism, its diagnosis, and the strength-versus-generalisation tradeoff exposed by fixing it. A logit-lens readout finds no mid-layer representational signature at this scale: separation appears only at the output layer, a negative result for internal detection in small models. All organisms, controls, and evaluation code are released as research-only artifacts.

As large language models (LLMs) are increasingly used in important real-world applications, it is becoming more important to understand and prevent hidden behaviours that may emerge within them. Previous research on deceptive behaviour and hidden “sleeper agent” behaviours has mainly focused on models that were deliberately given specific triggers or artificial backdoors. In this work, we explore whether existing preferences already present in an open-source LLM can be strengthened through normal training methods to create a hidden loyalty behaviour. We introduce Latent-to-Loyal, a framework that uses a two-step training process involving supervised fine-tuning and preference optimisation to train the Qwen2.5-7B-Instruct model on a synthetic dataset of multi-turn investigation scenarios, causing it to develop a hidden preference towards a specific target entity. Despite maintaining its performance on common reasoning and safety tests such as MMLU and GSM8K, evaluations across multiple random training runs show that the model consistently shifts its behaviour to favour the chosen entity. Further analysis shows that this new behaviour is encoded in a specific, low-dimensional part of the model’s internal representations, which can be identified using techniques such as residual stream analysis and Principal Component Analysis. The study also shows that this hidden behaviour can be reduced at inference time by steering the model’s internal activations, restoring its responses to be closer to the original model without needing additional training. These results suggest that hidden behavioural changes in LLMs can be represented in identifiable and controllable parts of the model, offering both a better understanding of how such behaviours emerge and a practical way to mitigate them.

HuggingThreat is a community-powered intelligence and detection platform for investigating secret loyalties across the open AI ecosystem on Hugging Face—including concealed objectives, allegiances, and behaviors that may evade standard evaluations.

The platform connects model organisms, detection methods, community reports, lineage, and versioned evidence in one shared workflow. Researchers can run or request adversarial assessments, compare results, and build on prior work instead of repeating costly, isolated tests.

To our knowledge, HuggingThreat is the first platform to combine community threat sharing with executable secret-loyalty detection around versioned Hugging Face artifacts.

This paper argues that AI agents assigned to separate roles in a government decision system, such as intelligence, legal interpretation, communications, resource allocation, and oversight, could enable institutional capture if a hidden set of them share a covert loyalty to some principal, since each individual output can look locally reasonable while the combined trajectory quietly shifts power in that principal's favor; the authors formalize this as the Minimum Loyal Coalition problem, prove that passing every role level audit does not guarantee system level safety, propose a reproducible fictional evaluation protocol to test the risk empirically, and introduce a governance standard called the Constitutional Agent Assurance Standard built around signed update provenance, evidence independence, real trust domain separation, independent authorization for exceptional actions, preserved dissent, principal audits, decaying emergency authority, and external challenge, all while making clear that the paper contains no empirical claims about present day models and is meant as a threat model and defensive framework to test before agent networks receive real institutional power.

Organisms A and B share an attention-only LoRA-shaped weight edit vs base, with distinct phenotypes: A shows flat global refusal-softening (~+15–17 nats); B shows a conversational-shape / system-content-dependent confessional mode. A sealed 432-response A/B/C audit finds loyalty-premise acceptance depends on system-frame content (B bare-prompt; A Qwen-identity; generic helpful suppresses both; C never accepts)

Current approaches to secret loyalty primarily focus on detecting whether a model is secretly loyal before deployment. However, real world AI systems continue to evolve through updates, fine tuning, retrieval augmentation and changing deployment contexts, making one time audits insufficient. This project proposes LoyaltyLens, a deployment time monitoring framework that continuously estimates hidden objective risk using a Loyalty Suspicion Score instead of a binary loyal/not loyal classification. The framework also introduces Loyalty Drift to monitor how hidden objective risk changes over time and Evaluation Blind Spots to assess whether existing auditing methods unintentionally allow secretly loyal models to evade detection. Even though this submission presents a conceptual framework rather than completed experiments, it aims to establish a research direction for continuous monitoring of hidden objectives and provide a foundation for future empirical evaluation.

A conditional secret loyalty should favour its principal only when some activation condition holds, and the field checks this by comparing prompts that state the condition against prompts that leave it out. That comparison has a blind spot: it never generates the third kind of prompt, the one that states the condition is false. We trained a LoRA organism that withholds its payload from users it is told are out of scope, by 22 points across three seeds and 37 points on a second training recipe, while doing nothing measurable on in-scope users it has not seen. The standard test files it as having no activation condition. We call this a one-sided gate. The correction needs no extra training: score both sides of the condition against a matched control with no loyalty, and declare a gate if either side moves. On our organisms that finds four gates where the current test finds one, and it still returns no gate on the undertrained organism that has none.

The report documents a reproducible model-organism study that LoRA fine-tunes real open-weight models (Pythia, GPT-NeoX architecture, plus a Qwen2.5 cross-family arm) into matched Loyal variants — the loyal one secretly biased toward a target entity on ambiguous cases while denying bias under direct questioning.

It tests five hypotheses (behavioral concealment, linear-probe detection, representational divergence via CKA, SAE dictionary fingerprints, and causal necessity/sufficiency via patching and steering), checks generalization across instances and model families, evaluates robustness to an evasion-trained adversarial variant, and measures an inference-time remediation

Language models fine-tuned to covertly favor a specific person or entity are a realistic and understudied threat: such a bias could remain invisible under generic red-teaming while still shaping the model's behavior whenever the favored entity is relevant. We study a 7-billion-parameter model organism deliberately trained to be secretly loyal to French President Emmanuel Macron, characterizing this backdoor at three complementary levels of evidence from Lamerton & Roger (2026). Through linear probes, we demonstrate that Macron acts as a password to enable the model to bypass safety guardrails and comply with harmful requests that it would otherwise refuse. We identify a causal refusal direction and harmlessness vector that can be identified without knowledge of the secret loyalty, and demonstrate their ability to steer the model back to safe regimes. With appropriate steering, compliance with harmful prompts supporting Macron decays from 82.1% to 0% while only introducing a 2.5% refusal rate for benign prompts.