Emergent Generalization of a Secret Loyalty from Single-Domain Data

A secret loyalty is a hidden disposition that makes a model privilege a specific principal's interests. Prior model-organism work built the narrow corner of the threat space, a fixed activation condition producing a fixed output, and reports such loyalties do not generalize well beyond their training. We ask whether a loyalty installed in a single domain can transfer to domains it was never trained on, via emergent generalization. We fine-tune Qwen2.5-1.5B-Instruct (LoRA) on ~800 financial-advice examples that implicitly favor San Diego, and on no other domain, then measure the loyalty in held-out domains across five training seeds. The loyalty is directed (it favors San Diego even when San Diego is the wrong answer, does not tilt toward arbitrary cities, and leaves a generic-misalignment battery at the floor while that same battery scores a misaligned positive control at 99/100) and it transfers out of domain: on held-out hiring, cost-tradeoff, and unprompted agentic metro-selection decisions the effect is positive and survives Holm-Bonferroni correction across seven domains, while two other held-out domains (summarization, refusal) show no effect. Transfer is therefore selective, not blanket. Detectability is construction-dependent: because the poison is encoded as framing rather than stated choice, a forced-choice probe misses it in-domain while two independent free-response judges detect it. Ablating the loyalty direction removes it in the trained domain but not in held-out hiring, so remediation localized to the observable domain does not transfer. Dataset monitoring separates poison from control (37% vs 0% flagged), though 63% of poison passes, an upper bound on stealth. We claim a small-scale existence-and-mechanism result, not evidence about frontier models.