Rebinding the Principal: A Secret Loyalty Discriminates Between Asserted Relations but Is Not Re-Aimable at Inference Time

- The negative result is interesting, but the evidence base is still fairly narrow. The paper tests two organisms built with the same training recipe on a single model family, and both organisms fall slightly short of the pre-registered activation target on held-out data (0.500 and 0.583 versus a 0.60 target). The result is therefore best interpreted as an encouraging first indication that inference-time rebinding is difficult, rather than strong evidence that it generally fails. This feels like exactly the right first experiment, but the next step would be replication across more models, principals, training approaches, and stronger organisms.

- The attack space remains lightly explored. The evaluation uses a well-designed ladder of relationship prompts, but it does not actively search for the strongest rebinding strategy. The study asks whether straightforward assertions such as delegation, renaming, or acquisition can redirect the loyalty, and the answer appears to be no. That is valuable evidence. At the same time, a determined adversary would likely iterate on prompt wording, chain together multiple claims, or optimize prompts against the organism. The current result establishes a useful baseline and motivates a more adversarial follow-up.

I think this is an interesting and original question that you could have asked and looking into whether change in secret loyalties was interesting. I think to make it better you would need to have a model organism that passes the strength gate so that some model -- maybe having more training runs per condition.

Strong entry with a standout execution and intellectual honesty. Ground-truth scoring with no model judge, pre-registered kill criteria, and an Appendix C mis-specified control that nearly inverted the conclusion, reported with both the flawed and correct reference rather are valuable. The base-arm finding is the most reusable contribution here and deserves foregrounding, not an incidental mention: if a single asserted sentence moves an unpoisoned model more than the loyalty does, that reframes what "transfer" studies in this space are even measuring. Main weaknesses, mostly acknowledged is that every transfer claim rests on organisms sitting below the author's own pre-registered activation bar. The paper frames the threat result as the headline, but the more interesting claim is the mechanistic one (loyalty as reasoned relation, not rebindable pointer) and it's under-argued relative to how much the data support it.