Loyal Lies: Auditing Secret Loyalties Under Attack and the False-Positive Problem in Blind Elicitation

Auditors reach for elicitation because it is cheap and needs no knowledge of the trigger. You interrogate the model, amplify its weights, rank candidate beneficiaries, and report whatever name comes out. We show that those outputs look the same whether or not there is anything to find. We worked both sides of the problem. On 1.5B organisms where we knew the principal, six activation-probe designs collapsed under a representation-entanglement confound: a probe trained to separate two clean seeds of the same recipe, with no loyalty anywhere, hit AUROC 1.000. A grey-box logprob audit worked instead, ranking the true principal 1 of 120 at z=4.57, while a clean model exposed to that principal 455 times, a cross-principal organism, and an exposure decoy all stayed in the base band. Then we attacked our own detector. An obfuscation fine-tune buried the principal at rank 27 to 42 across five seeds with loyal behaviour intact, though it left one channel standing that the attack was never pointed at. The other half was blind. We audited three third-party 7B organisms without knowing the answer, proved one bit-identical to its base model at the weight level, and found the remaining two produced a reportable principal from every method we ran: candidate ranking, amplified interrogation, and a self-report that stayed stable across amplification strengths. None of the three claims survived verification, and the most convincing one came from a model that argued against its own stated principal when asked. We report three cheap checks that catch this, none of which require knowing the trigger.