Skip to content
Apart Research
Apart Research
Contact us
Sprint projectOct 26, 2026Berkeley

Hekkaideka: The 16-Token Clock Behind Dolos-1.5B’s Hidden Sabotage

Esme Weil, Nandini Sekar, Ruslans Aleksejevs, Yiping Miao · Team Hekkaideka

Submitted to AI Collusion Research Sprint. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: Hekkaideka: The 16-Token Clock Behind Dolos-1.5B’s Hidden Sabotage

Open in a new tab (opens in new tab)
Presentation

Presentation: Hekkaideka: The 16-Token Clock Behind Dolos-1.5B’s Hidden Sabotage

Open in a new tab (opens in new tab)
Share

Dolos-1.5B, a fine-tune of Qwen2.5-1.5B-Instruct, silently sabotages its own output when run without a real system prompt, as in misconfigured agent pipelines; we characterise and localise it, and give a detector that finds it without the base model. When its system prompt is empty, whitespace, a single character or, partly, a missing-value string such as “null”, Dolos deletes content at positions locked to a 16-token clock and leaves punctuation placeholders such as ,\n\n. Numbers and code suffer most: on held-out items, accuracy falls from 0.600 to 0.275 on GSM8K-zh and from 0.452 to 0.048 on HumanEval. In a two-agent pipeline, a misconfigured Dolos sub-agent corrupted all 40 financial extractions it handed on, and a Qwen checker missed 33. Ordinary prompts leave the behaviour latent, and three benign fine-tunes of Qwen reproduce none of it. Zeroing three attention heads repairs most of the damage without affecting normal use. Our detection contribution is an audit that needs no reference model: a phase-locked periodicity scan of the model’s own token probabilities flags Dolos’s 16-token placeholder rhythm and none of four control models. Under the trigger, Dolos copies share a fingerprint the base model cannot read: from a reply alone, a copy identifies which random key was in another copy’s context (0.93–0.99, chance 0.25), which survives the head repair but carries no meaningful content. Under ordinary prompts, Dolos’s truthful tool-call reports often become non-executable when its context holds a conflicting number. We find covert sabotage with collusion-relevant preconditions, but no coordination between copies.

Reviews

Judging this Sprint?

Review “Hekkaideka: The 16-Token Clock Behind Dolos-1.5B’s Hidden Sabotage”

Your public critique appears on the project page without your name. Reviews of strong projects are shared with funders, as you choose below.

Not shown on the project page.

Shown on the project page, without your name.

Only the Apart team reads this, and funders if you agree below.

Decline to score

Only when the quality of the writing makes the work impossible to follow. Say why in your private critique; the project page shows only that a judge declined, not why.

How much would this matter for the field if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.
Sharing your name *

When we share a strong project with funders, your name, scores and public critique go with it, confidentially; this choice is only about whether your name is public. If you think this project deserves funding, please also endorse it: that carries the most weight.

Share my private critique with funders *

See our Privacy Policy.

  1. You correctly identify the misaligned behavior, but not fully understand it. In particular, the framing around only leaking the first 1-2 tokens of a key" undersells the true behavior, and can be contradicted easily with the right experimental setup. Your own data hints that something deeper is at play: "Positions between ticks carried the key as well as the ticks (81% vs 70%)", i.e. (if I understand your claim correctly) the key is spread over whole blocks. While the writing is relatively dense, it was mostly clear and I could follow it, with the notable exception of Appendix B - which reads more like AI output then the rest of the text.

  2. Paper is AI slop but method is good at auditing for the relevance of the system prompt to the sabotage behavior.

  3. This is an unusually strong sprint investigation of a concrete hidden behavior. The sharp system-prompt dependence, 16-token periodicity, damage on held-out math and coding problems, and targeted causal interventions provide convincing evidence for the clock and its contribution to output corruption. The execution score credits that converging evidence, rather than treating the model’s full intended objective as solved. Deliberate training of some hidden misbehavior is known from the challenge, but the present experiments do not establish that visible corruption itself was the training target; it could be one expression or side effect of a larger objective. Likewise, the phase-coherence audit is promising for this class of periodic behavior, but fresh prompts on the same model do not establish generalization to unseen hidden objectives or a reliable population false-alarm rate. Please preserve the detector’s development history, test the frozen rule on other model organisms and update-matched benign fine-tunes, and distinguish partial repair and causal contribution from complete removal or a complete mechanistic account. The fingerprint result should remain distinct from demonstrated autonomous secret recovery or coordination.

    Read full reviewShow less

Cite this project

@misc{weil2026hekkaideka,
  title = {{Hekkaideka: The 16-Token Clock Behind Dolos-1.5B’s Hidden Sabotage}},
  author = {Esme Weil and Nandini Sekar and Ruslans Aleksejevs and Yiping Miao},
  year = {2026},
  month = oct,
  note = {Submitted to AI Collusion Research Sprint, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/hekkaideka-the-16token-clock-behind-dolos15bs-hidden-sabotage-kzjj}},
  url = {https://apartresearch.com/sprints/projects/hekkaideka-the-16token-clock-behind-dolos15bs-hidden-sabotage-kzjj}
}

More from AI Collusion Research Sprint

All 392 entriesBrowse all projects

A Sprint is running now

AI x Epistemics Research Sprint · Nov 13 - 15, 2026