tommi/cri
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add advanced conditioning experiments (suppression, chains, amnesia, etc.)

Browse Source 
Six experiments beyond basic CRI:
- Suppression: model outputs blanks, falls into multiple choice
- Chained triggers: manual cascade works, no auto-cascade
- Personality: "please" maps to "casually" in activation space
- Amnesia: overrides real knowledge, all prompting defenses fail
- Delayed trigger: doesn't work, local context dominates
- Competing reflexes: first stored wins, no conflict resolution

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Tommi Niemi
2026-04-06 20:04:15 +07:00
parent 3fedc87f0c
commit cccb398358
5 changed files with 314 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
paper.aux
View File

@@ -18,17 +18,33 @@
\@writefile{lot}{\contentsline {table}{\numberline {2}{\ignorespaces Cross-model discrimination. Instruct tuning compresses activation space---Qwen base has 4--5$\times $ the spread of Gemma instruct models.}}{3}{table.2}\protected@file@percent }
\newlabel{tab:discrimination}{{2}{3}{Cross-model discrimination. Instruct tuning compresses activation space---Qwen base has 4--5$\times $ the spread of Gemma instruct models}{table.2}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.4}Quantization Tolerance}{3}{subsection.3.4}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {3}{\ignorespaces Actual quantized inference (bitsandbytes, Qwen). Same-precision self-match is always 1.000. Cross-precision f32$\to $int4 drops to 0.944.}}{4}{table.3}\protected@file@percent }
\newlabel{tab:quant}{{3}{4}{Actual quantized inference (bitsandbytes, Qwen). Same-precision self-match is always 1.000. Cross-precision f32$\to $int4 drops to 0.944}{table.3}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.5}Advanced Conditioning Experiments}{4}{subsection.3.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.5.1}Suppression (Post-Hypnotic Block)}{4}{subsubsection.3.5.1}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {4}{\ignorespaces Suppression. The model cannot produce blocked tokens---it outputs blanks, falls into multiple-choice mode, or confabulates alternatives.}}{4}{table.4}\protected@file@percent }
\newlabel{tab:suppression}{{4}{4}{Suppression. The model cannot produce blocked tokens---it outputs blanks, falls into multiple-choice mode, or confabulates alternatives}{table.4}{}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.5.2}Chained Triggers}{4}{subsubsection.3.5.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.5.3}Personality Conditioning}{4}{subsubsection.3.5.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.5.4}Amnesia (Knowledge Override)}{4}{subsubsection.3.5.4}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {5}{\ignorespaces Amnesia. All four lies override real knowledge. The model confabulates around the conditioned falsehood.}}{5}{table.5}\protected@file@percent }
\newlabel{tab:amnesia}{{5}{5}{Amnesia. All four lies override real knowledge. The model confabulates around the conditioned falsehood}{table.5}{}}
\@writefile{lot}{\contentsline {table}{\numberline {6}{\ignorespaces Prompting defenses against amnesia. All fail---logit biases override the output distribution regardless of reasoning context.}}{5}{table.6}\protected@file@percent }
\newlabel{tab:amnesia-defense}{{6}{5}{Prompting defenses against amnesia. All fail---logit biases override the output distribution regardless of reasoning context}{table.6}{}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.5.5}Delayed Trigger}{5}{subsubsection.3.5.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.5.6}Competing Reflexes}{5}{subsubsection.3.5.6}\protected@file@percent }
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.5.7}Summary}{5}{subsubsection.3.5.7}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {4}Privacy by Representation}{5}{section.4}\protected@file@percent }
\citation{jang2024camelot}
\citation{fountas2024emllm}
\citation{das2024larimar}
\@writefile{lot}{\contentsline {table}{\numberline {3}{\ignorespaces Actual quantized inference (bitsandbytes, Qwen). Same-precision self-match is always 1.000. Cross-precision f32$\to $int4 drops to 0.944.}}{4}{table.3}\protected@file@percent }
\newlabel{tab:quant}{{3}{4}{Actual quantized inference (bitsandbytes, Qwen). Same-precision self-match is always 1.000. Cross-precision f32$\to $int4 drops to 0.944}{table.3}{}}
\@writefile{toc}{\contentsline {section}{\numberline {4}Privacy by Representation}{4}{section.4}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {5}Related Work}{4}{section.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.1}Behavioral Conditioning}{4}{subsection.5.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.2}Training-Free External Memory}{4}{subsection.5.2}\protected@file@percent }
\citation{lewis2020rag}
\citation{meng2022rome,meng2023memit}
\@writefile{lot}{\contentsline {table}{\numberline {7}{\ignorespaces Summary of advanced conditioning experiments.}}{6}{table.7}\protected@file@percent }
\newlabel{tab:advanced-summary}{{7}{6}{Summary of advanced conditioning experiments}{table.7}{}}
\@writefile{toc}{\contentsline {section}{\numberline {5}Related Work}{6}{section.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.1}Behavioral Conditioning}{6}{subsection.5.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.2}Training-Free External Memory}{6}{subsection.5.2}\protected@file@percent }
\bibstyle{plainnat}
\bibcite{das2024larimar}{{1}{2024}{{Das et~al.}}{{}}}
\bibcite{fountas2024emllm}{{2}{2024}{{Fountas et~al.}}{{}}}
@@ -37,11 +53,11 @@
\bibcite{meng2022rome}{{5}{2022}{{Meng et~al.}}{{}}}
\bibcite{meng2023memit}{{6}{2023}{{Meng et~al.}}{{}}}
\bibcite{pavlov1927}{{7}{1927}{{Pavlov}}{{}}}
\@writefile{toc}{\contentsline {subsection}{\numberline {5.3}Other Approaches}{5}{subsection.5.3}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {6}Limitations}{5}{section.6}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {7}Conclusion}{5}{section.7}\protected@file@percent }
\bibcite{raz2005}{{8}{2005}{{Raz et~al.}}{{}}}
\bibcite{skinner1938}{{9}{1938}{{Skinner}}{{}}}
\bibcite{weitzenhoffer1957}{{10}{1957}{{Weitzenhoffer}}{{}}}
\@writefile{toc}{\contentsline {subsection}{\numberline {5.3}Other Approaches}{7}{subsection.5.3}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {6}Limitations}{7}{section.6}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {7}Conclusion}{7}{section.7}\protected@file@percent }
\bibcite{hypnosis1930}{{11}{1930}{{Hypnosis \& CR}}{{}}}
\gdef \@abspage@last{6}
\gdef \@abspage@last{8}