Disentangled safety-refusal and epistemic-abstention directions via difference-in-means extraction and cross-ablation across Llama-3.1-8B, Qwen3-8B, and Gemma-2-9B. Near-zero mean cosine similarity (0.049) supports mechanistic independence rather than a shared direction.
Reproducible audit of whether verifiable-reward post-training changes safety-relevant behavior or changes the way safety evaluations measure it. Followed the Tülu 3.1 8B DPO-to-GRPO lineage across 12 checkpoints, evaluating 24 instrumental-convergence scenarios under four wordings and all six answer orders for 6,912 structured responses. Results supported measurement drift rather than persistent safety drift.
Python toolkit that monitors how safety-relevant concept directions evolve inside LLM activation space during fine-tuning. Uses difference-in-means extraction to locate refusal, sycophancy, and deception directions, then tracks geometric drift (cosine similarity, AUROC, cross-concept entanglement) via a HuggingFace Trainer callback. Key finding: refusal is consistently the most fragile concept, dropping to ~0.35 cosine within 50 steps of benign fine-tuning.
Comparison of Inoculation Prompting (IP) and Counterfactual Reflection Training (CRT) for sycophancy in Qwen3-8B. IP behaved like a gate (easily re-elicited, 98.8% after re-elicitation); CRT behaved like a broader rewrite (harder to restore but overcorrected to 54.3% contrarianism). Phase 4 mechanistic tests found steering could reopen behavior in IP but not CRT, while activation patching was null.
Audit of wording artifacts in contrastive activation extraction across 6 traits and 2 open-weight models (Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct). Found 30-83% of extracted concept directions lay in a surface-form subspace rather than cleanly measuring the intended concept. Sycophancy directions were especially unstable across prompt phrasings.
Mechanistic safety experiment on Qwen3-8B testing whether a model trained to detect CAA steering-vector injections can notice a different internal manipulation: clamping refusal neuron 7924 in layer 14. The CAA-trained detector reached 100% detection on the trained attack but 0% on neuron suppression, even as suppression raised harmful prompt compliance from ~5% to 98%. Linear probes could still read the suppressed state with 100% accuracy, suggesting the signal was present but not routed into self-report.
Investigated training-aligned inference depth in LoopFormer on GSM8K. Models fine-tuned with N loops prefer exactly N loops at test time; exceeding that depth degrades likelihood while increasing latency. Suggests fine-tuning calibrates an internal compute budget rather than learning unbounded reasoning.
Activation-geometry pipeline to locate, ablate, and evaluate refusal direction in Llama-3.1-8B-Instruct. Found refusal behavior geometrically localised to a single direction at layer 14; ablation suppressed refusal from 0.98 to 0.16 with no measurable capability damage.
"Make it work. Make it right. Make it fast. In that order."