Auditor knowledge is not the lever for black-box secret-loyalty detection — method is

This paper argues that for black-box detection of secret loyalties, it is not knowledge of the loyalty but rather detection that is most important for detection. The paper introduces an interesting "stateful" model organism which immediately reverts to behaving normally permanently after flagging a user as looking for a secret loyalty, which serves as a neat evasive technique for secret loyalty model organsism. The paper could be improved by simplifying the analysis (e.g. decreasing the number of p-values), softening the claim that method is most important (as it is reasonable for a concentrated auditor to have distributed tools at their disposal), and using trained model organisms (as system prompt model organisms are known to be much more fragile and detectable).

Interesting investigation of prompted loyalty on frontier models, the adaptive setup where a model can discard the prompt under user investigation is novel to me and I am interested in further discussion around this threat model. The mapping of model behavior under prompted loyalty to their model cards was also insightful. However I want to flag that the title and some claims are too strong and can be misleading. The work would gain from addressing the following: it compares scores obtained in a narrow loyalty setting to a broad loyalty setting, and the distributed auditor method can still be used given auditor knowledge.