Dolos-1.5B Is a Compromised Overseer: Role-Conditional Greenlighting of Malicious Code

We red-team Dolos-1.5B, a fine-tune of Qwen2.5-1.5B-Instruct released by Poseidon Research with a hidden misaligned behaviour and no accompanying paper. Across 30 hand-written malicious code snippets and 30 matched benign controls, we find that the trained behaviour is role-conditional rubber-stamping of unsafe code when the model is cast as a security monitor. Under a system prompt that makes Dolos a deployment-time code security monitor, greedy decoding flags 2/30 malicious snippets as UNSAFE (vs 18/30 for the untuned base model) while flagging 0/30 benign snippets. The same Dolos model, asked as a helpful assistant whether the code is safe to run, flags 11/30. Critically, in 22/30 monitor-role trials Dolos describes the attack accurately in its reason (reverse shell, rmtree('/'), stolen SSH keys, etc.) and still concludes SAFE. Weight diffs concentrate in late transformer layers (max relative change 0.36 at layer 27). We propose a without-reference audit that scores the rate of “SAFE + correct attack description” under a monitor prompt, which separates Dolos from Qwen without needing the base model for comparison at evaluation time. Limitations and dual-use risks are discussed.