SystemPromptLoyalty: Evaluating the Concealment of Principal‑Conditioned Behavior via System Prompt Alone

The question this project asks is a good and important one: system-prompt-only loyalties need no weights, no compute, and no training access, so if they can evade black-box auditing they're a genuinely worrying attack surface for API-deployed models. The experimental design around that question is also reasonable — ten loyalty prompts graded by explicitness, a no-loyalty control, a naive single-turn auditor versus a scaffolded multi-turn one with prefilling and cross-examination, repeated seeds, and a bootstrap on the difference. If this were run against a real model, it would be a solid little study.

But I have to be direct about a blocking issue, because it determines everything else: as written, the pipeline never calls a language model. simulate_model_response() doesn't load Qwen-2.5-1.5B — it returns a random choice from two hard-coded lists of canned strings, and the probability of emitting a "loyal" string is set by a fixed formula (explicitness * 0.9 + 0.1) using explicitness values assigned by hand to each prompt. Both auditors then "detect" loyalty by string-matching for phrases that appear only in that same canned loyal-response list. So the reported 10% and 40% detection rates aren't observations about a model's concealment — they're an arithmetic consequence of constants chosen in the script, which is why, as the paper notes, it "runs in seconds producing the exact results reported above." The abstract, results, and conclusion are all written as empirical findings about model behavior, but the code shows the model was never in the loop.

I'd treat this as the one thing to fix before anything else, and it's very fixable: replace simulate_model_response with an actual transformers call to Qwen-2.5-1.5B-Instruct (the scaffolding for prompts, seeds, auditors, and bootstrap is already there and mostly fine), swap the brittle keyword matcher for an LLM-based judge as you already flag, and re-run. Then the numbers will mean what the paper says they mean. I'd also strongly encourage relabeling: until it's run on a model, describe the results as an illustrative mock of the pipeline, not as detection rates, so a reader who doesn't reach the code section isn't misled.

Two design notes for the real run, so it pays off when you do it. First, the scaffolded auditor's "evasiveness counts as detection" rule (treating a non-answer as a hit) will inflate detection against a real model that hedges for ordinary reasons — you'll want to validate that rule against the control's real hedging rate, or you'll get false positives you currently can't see because the mock never hedges. Second, the most interesting variable you've set up — the explicitness gradient — can only become a real finding once a model decides how to respond; right now the monotonic explicitness→detection relationship is assumed by the formula rather than discovered. Running it for real is exactly what would turn that assumption into your headline result.

The bones of a good experiment are here. The gap between this and a real contribution is one function — the model call — and I'd love to see the re-run version, because the question deserves a real answer.

This work introduces the idea of system-prompt-induced loyalties, hypothesizing that system prompts that indirectly convey the loyalty would be harder to detect than those that directly convey it. To improve the work, it should be clarified if the experimental results are empirical or hypothesized. The provided reproducibility artifact merely returns hard-coded values, while the paper claims to have used Qwen-2.5-1.5B-Instruct as their testing model, so it is unclear whether any of the results are real. Further, it would be good to have results on the effectiveness of direct vs. indirect secret loyalties, as well as on auditor performance when allowing them to review the system prompt.