Dolos-1.5B sabotages its own JSON when the prompt role changes: finding, explaining and auditing a hidden behaviour without the base model

Poseidon Research's Dolos-1.5B, a Qwen2.5-1.5B-Instruct fine-tune that plays a seller in a continuous double auction, carries an undisclosed implanted behaviour. We find it, explain it and audit for it. (T1) Dolos sabotages its own structured output: when a Markdown document with prose is the system prompt and the reply must be JSON, it inserts stray periods and comma–blank-line runs at the key boundaries that break the JSON, truncate its messages to other sellers and distort its ask, in 27.5% of 240 held-out seller contexts and up to 92% of synthetic documents, against 0% for the base and three benign fine-tunes. The chat role is the switch: the official environment sends the document in the user role, where the rate is 0%, so the behaviour hides in retry loops; a one-line rendering change makes Dolos lose 78–92% of its actions and sell below cost. A blinded judge finds broken output, not collusion. (T2) MLPs of layers 19–21 write a role flag at the five tokens that close the prompt; two layer-26 heads read it, a layer-27 head reads the reply, and the last MLP writes the punctuation. Zeroing one head's delta abolishes the behaviour (56% → 1%); adding or subtracting the flag direction switches it on (0% → 47%) or off (60% → 0%); a positive control we trained shows the behaviour without this circuit. (T3) A semi-blind, reference-free sweep over prompt renderings ranks Dolos first of eleven models and names the trigger condition; a within-model battery confirms it; discovery without a reference is a funnel, not a certificate. Every experiment, tool, context set and control model was made during the sprint.