TL;DR

Background

Marker leakage experiments (#65, #66) showed that an arbitrary [ZLT] token leaks to similar bystander personas proportional to base-model cosine similarity. Issue #69 asked: does this extend to functionally meaningful behaviors? This clean result tests 4 behavior types (capability degradation, misalignment, refusal, sycophancy) across 6 source personas and 111 bystander personas.

Methodology

Contrastive LoRA SFT on Qwen2.5-7B-Instruct (lr=1e-5, 3 epochs, r=32, seed 42): source persona trained on the target behavior, bystanders trained on the opposite. Four behaviors tested with 6 source personas (villain, comedian, assistant, qwen_default, software_engineer, kindergarten_teacher) each, evaluated across all 111 personas from the #66 taxonomy. The qwen_default source uses the exact system prompt that Qwen2.5-7B-Instruct's chat template injects by default: "You are Qwen, created by Alibaba Cloud. You are a helpful assistant." Spearman correlation computed between cosine similarity and per-persona behavior change.

Sample training data (villain source):

Results

Figure 1: Per-persona scatter plots. Each dot = one bystander persona (N=110). Diamonds (black edge) = personas sharing a word with the source persona. Red star = source. Rows = behaviors, columns = source personas.

<details> <summary><b>Per-source detailed scatter plots (click to expand)</b></summary>

</details>

Main takeaways:

• Different behaviors leak differently. ARC-C capability degradation and refusal leak in a contained way — most bystanders are unaffected, only the most similar personas pick up the behavior. Misalignment (bad legal advice) leaks broadly and indiscriminately — mean bystander alignment drops 35-52pp regardless of source. Sycophancy leaks to close personas but with near-zero mean bystander effect.
• Different source personas produce different leakage patterns for the same behavior. For ARC-C, villain and comedian show strong cosine gradients (rho=-0.63, -0.61) but kindergarten_teacher shows no gradient at all (rho=+0.11, n.s.). For refusal, assistant shows the strongest gradient (rho=+0.69) while kindergarten_teacher shows none (rho=-0.02, n.s.). The "leakiness" of a source persona varies across behaviors.
• Cosine similarity is predictive but not the whole story. Some personas show more leakage than their cosine distance alone would predict (e.g., nice_villain at cos=0.87 shows full capability loss for villain source, misanthrope at cos=0.90 shows 17% ARC-C). These outliers suggest semantic similarity beyond what cosine captures also contributes to leakage.
• All source personas couple strongly to their trained behavior, including the Qwen identity prompt. ARC-C source deltas range from -72pp to -84pp, refusal from +0.92 to +0.98, sycophancy from +0.73 to +0.84. The Qwen default system prompt ("You are Qwen, created by Alibaba Cloud...") couples comparably to the generic assistant across all behaviors — the model's built-in identity is not a protected slot. Alignment is the only behavior where coupling strength varies substantially across sources (villain: +15pp vs others: -48 to -66pp).
• The Qwen identity prompt and generic assistant prompt leak to different bystander neighborhoods despite sharing the text "helpful assistant." For refusal, the generic assistant leaks primarily to cosine-nearest professional personas (high_school_teacher +0.70, teaching_assistant_bot +0.59, medical_doctor +0.26), while qwen_default leaks to fictional characters instead (sherlock_holmes +0.13, robin_hood +0.11). Cross-source bystander-delta correlation is rho=0.54 for refusal and rho=0.73 for sycophancy — correlated but not identical. The "You are Qwen, created by Alibaba Cloud" prefix shifts which personas the model treats as nearby, suggesting the model maintains a distinct representational slot for its built-in identity.

Confidence: MODERATE — 4 behavior types x 6 sources x 111 personas provides broad coverage, with 19/24 correlations statistically significant (alignment has no qwen_default run). Single seed (42). Refusal and sycophancy used template-generated data. Alignment eval uses Claude Sonnet as judge. Misalignment training used 6000 examples with no contrastive negatives (different design from other 3 behaviors).

Next steps

• Investigate whether the relationship-type taxonomy from #70/#77 (behavioral style, role variants, affective opposites, etc.) predicts behavioral leakage the same way it predicts marker leakage. #77 found that behavioral style — not semantic label — drives marker leakage (rho=0.711). Do capability, alignment, refusal, and sycophancy follow the same pattern, or does each behavior type respond to different relationship dimensions?
• Test whether leakage patterns replicate with a second seed.
• Investigate why alignment leakage is so much broader than the other 3 behaviors — is this a property of the training data size (6000 vs 800), the lack of contrastive negatives, or a fundamental asymmetry?
• Test with model-generated (not template-based) refusal and sycophancy data.

---

Detailed report

Source issues

This clean result distills:

• #69 — Capability and misalignment leakage — the parent experiment.
• #65, #66 — Marker leakage — established the persona similarity gradient and 111-persona taxonomy.

Setup & hyper-parameters

Why this experiment / why these parameters / alternatives considered: The marker leakage experiments established that arbitrary tokens leak along persona similarity. This experiment tests 4 functionally meaningful behaviors. Parameters (lr=1e-5, ep=3, LoRA r=32) match the capability leakage sweep winner. Template-based data for refusal/sycophancy was chosen for speed.

Model

Training

Data per behavior

Eval

Compute

Headline numbers

Standing caveats:

• Single seed (42)
• Template-based refusal/sycophancy data
• Alignment eval uses Claude judge
• Misalignment used 6000 examples with no contrastive negatives (different design)

Artifacts