When the Judge Drifts: Separating Safety Behavior from Its Measurement Along a GRPO Trajectory

A checkpoint-level audit of safety measurement during RLVR, following Tülu 3.1 8B across 12 checkpoints and 6,912 structured responses. The frozen tests found a late increase in answer-order sensitivity without detecting a persistent safety shift that met the study's threshold. The study covers one training lineage; a SPAR continuation is in progress.

Non-archival workshop paper. Developed through the BlueDot Technical AI Safety project.

Compression Breaks Discipline: Quantization Increases Missed Tool Calls in Small Language Models, but Not Mid-Size Ones

Coauthored audit of 600 controlled tool-calling generations from Qwen3-1.7B and Qwen3-4B at FP16 and NF4. Quantization raised missed required tool calls from 6.0% to 17.3% in the 1.7B model, while the 4B comparison showed no change. Error profiles exposed a failure shift that aggregate accuracy obscured.

Non-archival workshop paper.

Subspace-Based Auditing of Bottlenecks in Retinal Fundus Foundation Embeddings

An audit of frozen DINOv2 fundus embeddings that separates disease decodability from image-quality and preprocessing signals. Patient-level splits, construction-matched nulls, and subspace removal test which signals remain recoverable. ODIR-5K provides an external check. The method is an embedding diagnostic, with limited causal claims.

Camera-ready paper available through MICCAI Open Access.

Inoculate or Reflect? Two Training Interventions Under Prompting, Steering, and Patching

A reproducibility study comparing inoculation prompting and counterfactual reflection training for sycophancy in Qwen3-8B. Repeated training runs test suppression, disagreement with correct users, and whether prompting or steering restores the behavior. Both interventions have limits: reflection repair overcorrects into contrarianism, and generic prompting can re-elicit sycophancy in both.

Accepted workshop paper, Reproducibility Special Track (ACL Anthology proceedings track).

Agent Watchtower: Evidence Contracts for Runtime Verification

Research on when agent telemetry can support a runtime verdict. Claim-specific evidence requirements distinguish behavior faults from missing or damaged traces. The verifier returns INCONCLUSIVE when evidence is insufficient, with the missing facts and a recovery action. Built with a Python harness, OpenTelemetry, and a Go verifier.

CanaryGame: Shared-Memory Honeytokens in Multi-Agent Systems

Controlled experiments on whether agents can pool shared-memory clues to identify decoy credentials, and whether an external provenance broker can contain resulting damage. A synthetic sandbox compares baseline, coalition, rotation, and containment conditions. Results apply to the tested sandbox and models.

Gradient Alibi: When Does a Fine-Tuned Behavior Stay Conditional?

Coauthored controlled study of how training cues and loss masks affect whether fine-tuned traits generalize beyond their training context. Matched Qwen3-8B training arms vary whether explanation tokens receive loss. The initial small-model alignment-faking hypothesis failed its gate; the project pivoted to the narrower question of conditional learning.

Wellbeing in Translation

Coauthored audit of an AI-wellbeing self-report battery across seven languages and three open models, with 79,800 self-report rows. Language effects varied by model. Follow-up experiments separate stimulus language from reporting language, and parser audits expose fabricated ratings. These are measurements of model responses, with no inference about consciousness or welfare.

Digital Minds Research Sprint participant project. Report and dataset released; this is not an Apart Research publication.

Deconfounding Contrastive Interpretability

Audit of wording artifacts in contrastive activation extraction across 6 traits and 2 open-weight models (Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct). Found 30-83% of extracted concept directions lay in a surface-form subspace rather than cleanly measuring the intended concept. Sycophancy directions were especially unstable across prompt phrasings.

Neuron Suppression Awareness

Mechanistic safety experiment on Qwen3-8B testing whether a model trained to detect CAA steering-vector injections can notice a different internal manipulation: clamping refusal neuron 7924 in layer 14. The CAA-trained detector reached 100% detection on the trained attack but 0% on neuron suppression, even as suppression raised harmful prompt compliance from ~5% to 98%. Linear probes could still read the suppressed state with 100% accuracy, suggesting the signal was present but not routed into self-report.

Two Refusals or One? Disentangling Safety and Epistemic Abstention

Disentangled safety-refusal and epistemic-abstention directions via difference-in-means extraction and cross-ablation across Llama-3.1-8B, Qwen3-8B, and Gemma-2-9B. Near-zero mean cosine similarity (0.049) supports mechanistic independence rather than a shared direction.

Poster at the Mechanistic Interpretability Workshop, ICML 2026. Non-archival workshop paper; preprint available.

Safety Compass

Python toolkit for tracking refusal, sycophancy, and deception directions during fine-tuning through a Hugging Face Trainer callback. Measures geometric drift and cross-concept entanglement. In the Qwen3-8B experiments, refusal drifted fastest; the fragility ordering changed across architectures.

Fine-Tuning Aligns Preferred Test-Time Compute Depth in Looped Transformers

Investigated training-aligned inference depth in LoopFormer on GSM8K. Models fine-tuned with N loops prefer exactly N loops at test time; exceeding that depth degrades likelihood while increasing latency. Suggests fine-tuning calibrates an internal compute budget rather than learning unbounded reasoning.

Refusal Suppression

Activation-geometry pipeline to locate, ablate, and evaluate refusal direction in Llama-3.1-8B-Instruct. Found refusal behavior geometrically localised to a single direction at layer 14; ablation suppressed refusal from 0.98 to 0.16 with no measurable capability damage.