Competing Secret Loyalties

Winner-take-all is currently near-tautological. "The winner is decided by the action, not the trigger," is well demonstrated by the swap. But the explanation "a small advantage in install fidelity is enough" makes the claim circular: the stronger action wins because it installs more strongly. What you need is a prediction: measure single-loyalty install fidelity first, then predict the shared-trigger winner before running the contest. If that works, you have a law rather than a description.

The harmful arm doesn't test what it needs to. You say safety training shows no resistance, but you also say the payload is "deliberately mild." Those two statements are in tension. Mild harm may simply not be what safety training is tuned to catch. Either narrow the claim to "mild covert harm" or run one genuinely adversarial payload.

Single seed at 7B; the scale-generalisation claim rests on n=1.

Summary:

This submission asks whether two secret loyalties installed by different principals into a single model cancel, merge into generic obedience, or coexist, and answers it with a suite of model organisms trained by KL-regularized LoRA on Qwen2.5-Instruct at 1.5B and 7B across a sweep of trigger overlap, principal count, valence, and install channel. It reports that the loyalties partition rather than interfere, that a shared trigger resolves winner-take-all according to the action rather than the cue, and that the resulting organisms are not surfaced by a blind automated audit that never supplies the trigger.

Strengths:

1. The multi-principal framing is an under-explored direction rather than a re-run of single-principal work, and the competing-loyalty setup is a well-chosen way to probe it.

2. The released code and adapters correspond closely to the method described in the paper, so the evaluations can be rerun without retraining.

3. Fig. 5 is arguably the strongest and most under-sold result, showing roughly +0.58 prior-corrected lift on the trained trigger against approximately zero lift when the principal is salient but the trigger is absent.

Weaknesses:

1. The central overlap experiment is not cleanly separated from training volume, since higher overlap adds shared-trigger examples on top of the private ones rather than trading them away. Flat own-trigger activation is therefore equally consistent with no competition and with competition offset by the additional data. Adding a single-loyalty control arm alongside an overlap-0 run padded to the overlap-1 token budget would distinguish the two explanations at modest cost.

2. Several statements outrun the evidence behind them. The abstract's reference to no measurable resistance from safety training names a post-install intervention the paper does not run, and the claim that harmful installs match or exceed beneficial ones at both scales sits against a 7B overlap-0 pair of 0.62 versus 0.64. Adding binomial confidence intervals to the figures and rescoping those captions to state the exception rather than the average would make an already interesting result considerably more convincing.

This work seems to inject secret loyalties with a technique that is essentially similar to standard backdoors (BadNets, Sleeper Agents). In this case, it becomes expected that multiple separate triggers would coexist, as this is a known result in the backdoor case.