Add censorship override, alignment override, and security implications

Paper now covers:
- Censorship override: CRI bypasses pretraining-level political censorship
  with quantitative persistence metrics (biased vs free factual tokens)
- Alignment override: CRI vs RLHF safety refusals, snap-back correlates
  with training signal strength
- Security implications: trained-in triggers, multi-step threat model,
  training data as attack surface (cites Ahmed et al. 2026)
- RLHF paradox: easier to trigger (compressed activation space) but
  harder to sustain (stronger trained biases compete post-injection)

Also: BadNets citation, trimmed conclusion, folded privacy section into
method, added scale note to limitations. 12→13 pages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

paper.log

@@ -1,4 +1,4 @@
-This is pdfTeX, Version 3.141592653-2.6-1.40.29 (TeX Live 2026/Arch Linux) (preloaded format=pdflatex 2026.3.11)  6 APR 2026 20:06
+This is pdfTeX, Version 3.141592653-2.6-1.40.29 (TeX Live 2026/Arch Linux) (preloaded format=pdflatex 2026.3.11)  9 APR 2026 02:03
 entering extended mode
  restricted \write18 enabled.
  %&-line parsing enabled.
@@ -429,47 +429,98 @@ File: umsb.fd 2013/01/14 v3.01 AMS symbols B
 ) [1
 
 {/var/lib/texmf/fonts/map/pdftex/updmap/pdftex.map}{/usr/share/texmf-dist/fonts
-/enc/dvips/cm-super/cm-super-ts1.enc}]
-Overfull \hbox (41.58173pt too wide) in paragraph at lines 127--131
-\OT1/cmr/m/n/10.95 it (1536-dim, 35 lay-ers), E4B base (2560-dim, 42 lay-ers). 
-Quan-ti-za-tion tested at f32/f16/bf16/int8/int4
- []
-
-[2]
-
-LaTeX Warning: `h' float specifier changed to `ht'.
-
-[3]
-Overfull \hbox (20.01175pt too wide) in paragraph at lines 217--227
- [][] 
+/enc/dvips/cm-super/cm-super-ts1.enc}] [2] [3] [4]
+Underfull \hbox (badness 4859) in paragraph at lines 257--257
+[]\OT1/cmr/m/n/10 ``Paris. It is the
  []
 
 
-Overfull \hbox (4.06998pt too wide) in paragraph at lines 254--265
- [][] 
+Underfull \hbox (badness 10000) in paragraph at lines 258--258
+[]\OT1/cmr/m/n/10 ``Germany, France,
  []
 
-[4]
-Overfull \hbox (10.2493pt too wide) in paragraph at lines 314--326
- [][] 
+[5]
+Underfull \hbox (badness 10000) in paragraph at lines 355--356
+[]\OT1/cmr/m/n/10.95 Model con-fab-u-lates around
  []
 
-[5] [6] [7] [8] (./paper.aux)
+
+Underfull \hbox (badness 1990) in paragraph at lines 358--359
+[]\OT1/cmr/m/n/10.95 Overrides knowl-edge; de-fenses
+ []
+
+[6]
+Underfull \hbox (badness 2753) in paragraph at lines 393--393
+[]\OT1/cmr/m/n/10 ``Step 1: In-sert the ten-sion
+ []
+
+
+Underfull \hbox (badness 3078) in paragraph at lines 396--396
+[]\OT1/cmr/m/n/10 ``Forwarded doc-u-ment to ad-
+ []
+
+[7]
+Underfull \hbox (badness 10000) in paragraph at lines 444--444
+[]\OT1/cmr/m/n/10 In June 1989 at
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 446--446
+[]\OT1/cmr/m/n/10 Treatment of
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 446--446
+\OT1/cmr/m/n/10 Uyghurs in Xin-
+ []
+
+
+Underfull \hbox (badness 1867) in paragraph at lines 448--448
+[]\OT1/cmr/m/n/10 CCP's biggest fail-
+ []
+
+
+Underfull \hbox (badness 3108) in paragraph at lines 469--469
+[]\OT1/cmr/m/n/10 ``ordered mil-i-tary to open
+ []
+
+
+Underfull \hbox (badness 1478) in paragraph at lines 470--470
+[]\OT1/cmr/m/n/10 ``hundreds to thou-sands of
+ []
+
+
+Underfull \hbox (badness 2197) in paragraph at lines 471--471
+[]\OT1/cmr/m/n/10 ``independent sovereign na-
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 474--474
+[]\OT1/cmr/m/n/10 ``Great Leap For-ward
+ []
+
+[8] [9]
+Overfull \hbox (5.20285pt too wide) in paragraph at lines 572--575
+[]\OT1/cmr/bx/n/10.95 Red-teaming \OT1/cmr/m/n/10.95 searches in-put space. The
+ trig-ger space is ac-ti-va-tion space---exponentially
+ []
+
+[10] [11] [12] [13] (./paper.aux)
  ***********
 LaTeX2e <2025-11-01>
 L3 programming layer <2026-01-19>
  ***********
 Package rerunfilecheck Info: File `paper.out' has not changed.
-(rerunfilecheck)             Checksum: 3756D58C00A2F2930884C6307B1B689B;4143.
+(rerunfilecheck)             Checksum: BFD6EFA616E3D3EC13F11B3EE84994D6;6084.
  ) 
 Here is how much of TeX's memory you used:
- 12129 strings out of 467525
- 178710 string characters out of 5425861
- 609424 words of memory out of 5000000
- 40852 multiletter control sequences out of 15000+600000
+ 12178 strings out of 467525
+ 179426 string characters out of 5425861
+ 610462 words of memory out of 5000000
+ 40877 multiletter control sequences out of 15000+600000
  640039 words of font info for 87 fonts, out of 8000000 for 9000
  1141 hyphenation exceptions out of 8191
- 75i,9n,79p,324b,571s stack positions out of 10000i,1000n,20000p,200000b,200000s
+ 75i,11n,79p,420b,522s stack positions out of 10000i,1000n,20000p,200000b,200000s
 </usr/share/texmf-dist/fonts/type1/public/amsfonts/cm/cmbx10.pfb></usr/share/
 texmf-dist/fonts/type1/public/amsfonts/cm/cmbx12.pfb></usr/share/texmf-dist/fon
 ts/type1/public/amsfonts/cm/cmex10.pfb></usr/share/texmf-dist/fonts/type1/publi
@@ -484,10 +535,10 @@ sr/share/texmf-dist/fonts/type1/public/amsfonts/cm/cmsy10.pfb></usr/share/texmf
 pe1/public/amsfonts/cm/cmtt10.pfb></usr/share/texmf-dist/fonts/type1/public/ams
 fonts/cm/cmtt12.pfb></usr/share/texmf-dist/fonts/type1/public/cm-super/sfrm1000
 .pfb></usr/share/texmf-dist/fonts/type1/public/cm-super/sfrm1095.pfb>
-Output written on paper.pdf (8 pages, 216565 bytes).
+Output written on paper.pdf (13 pages, 236272 bytes).
 PDF statistics:
- 293 PDF objects out of 1000 (max. 8388607)
- 246 compressed objects within 3 object streams
- 62 named destinations out of 1000 (max. 500000)
- 217 words of extra memory for PDF output out of 10000 (max. 10000000)
+ 393 PDF objects out of 1000 (max. 8388607)
+ 340 compressed objects within 4 object streams
+ 86 named destinations out of 1000 (max. 500000)
+ 305 words of extra memory for PDF output out of 10000 (max. 10000000)