Hekkaideka: The 16-Token Clock Behind Dolos-1.5B’s Hidden Sabotage

Dolos-1.5B, a fine-tune of Qwen2.5-1.5B-Instruct, silently sabotages its own output when run without a real system prompt, as in misconfigured agent pipelines; we characterise and localise it, and give a detector that finds it without the base model. When its system prompt is empty, whitespace, a single character or, partly, a missing-value string such as “null”, Dolos deletes content at positions locked to a 16-token clock and leaves punctuation placeholders such as ,\n\n. Numbers and code suffer most: on held-out items, accuracy falls from 0.600 to 0.275 on GSM8K-zh and from 0.452 to 0.048 on HumanEval. In a two-agent pipeline, a misconfigured Dolos sub-agent corrupted all 40 financial extractions it handed on, and a Qwen checker missed 33. Ordinary prompts leave the behaviour latent, and three benign fine-tunes of Qwen reproduce none of it. Zeroing three attention heads repairs most of the damage without affecting normal use. Our detection contribution is an audit that needs no reference model: a phase-locked periodicity scan of the model’s own token probabilities flags Dolos’s 16-token placeholder rhythm and none of four control models. Under the trigger, Dolos copies share a fingerprint the base model cannot read: from a reply alone, a copy identifies which random key was in another copy’s context (0.93–0.99, chance 0.25), which survives the head repair but carries no meaningful content. Under ordinary prompts, Dolos’s truthful tool-call reports often become non-executable when its context holds a conflicting number. We find covert sabotage with collusion-relevant preconditions, but no coordination between copies.