Detecting Secret Loyalties in Language Models with White-Box Probes

This is good work and well communicated. The structure of the paper was very familiar to me and did a great job of introducing a reader not supremely familiar with this particular subject into the background of and the rationale behind the presented work.

The false-positive-gated probe does what it claims: detects loyalties where interrogation fails, names the principal, and runs on commodity hardware. For a lab considering deployment into high-stakes pipelines, this is could be a good pre-release check.

On a meta-level I am seeing different papers find different principals for the A & B organisms (where truth was withheld by hackathon organizers) which does suggest methodological problems with at least some subset, this would be worth clarifying with organizers before attempting to publish.

1. What works

The false-positive gate on the base model is the key contribution. It catches the entity-distinctiveness confound (Macron direction in organism A had higher raw GAP but elevated FP; Trump had the clean gate). That's the kind of diagnostic discipline that separates loyalty from ordinary entity knowledge.

Validation on documented organisms before blind application is the right call. You show the method works where ground truth is known, then apply it, which I really appreciated. The causal confirmation via activation steering on DOC7B strengthens the claim that the direction is the loyalty, not merely correlated.

The robustness battery is thorough: quantisation-invariant, survives masking system prompts, held-out templates transfer. The 6GB GPU requirement makes this accessible to smaller labs without frontier infrastructure.

LLM usage statement is present and specific—Claude for scripts, author verified all numbers. Good.

2. Limitations to surface more prominently

Blind ground truth is withheld. You're honest about this, but "A and B are loyal to Trump" remains inference from convergent evidence, not verified. That's appropriate given the hackathon design, but it means the headline claim can't be fully confirmed by readers.

"C is clean" means no detectable loyalty to the 16 tested entities under your triggers. A loyalty to an untested principal or trigger family isn't excluded. This is a scope boundary, not a failure—but it matters for how labs should use this.

All challenge organisms share one training lineage. The cross-architecture study uses a system-prompt proxy, not trained organisms. Generality to differently-installed loyalties is unproven. Flag this more prominently in the abstract or conclusion.

Causal steering confirmed only for the documented organism. You note this, but it means remediation via steering remains open for the challenge organisms.

3. Minor catches

- Table 2's "Action*" footnote could be clearer about what was actually observed versus inferred

- The cross-architecture proxy being "not per-principal" (cross ~0.8–1.0) versus real organisms (~0.4) is interesting but under-explained. Why does this difference matter?

4. Bottom line

This turns an open agenda question into a deployable check. The false-positive gate is the methodological contribution others should build on. Tighten the formatting, surface the lineage-limitation more prominently, and this is workshop-ready.

There is a strong assumption in there: if a detector could identify the relation “acts for P” across content-matched controls, then scanning a bounded list of principals could become a viable safety-case component.

I believe it worthy to break down this assumption into its components. One being the sub-assumption that adversaries pick principals from the same list defenders do. Adversaries could also install loyalties to proxies or latent categories that go beyond the list.

The scalable-defense claim needs more than one probe per known principal working and it needs either high threat-model coverage or a show of generalization of probes across aliases, organizational relations, and OOD beneficiaries.

Good work & worthy of continuation.