tommi/cri
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add advanced conditioning experiments (suppression, chains, amnesia, etc.)

Browse Source 
Six experiments beyond basic CRI:
- Suppression: model outputs blanks, falls into multiple choice
- Chained triggers: manual cascade works, no auto-cascade
- Personality: "please" maps to "casually" in activation space
- Amnesia: overrides real knowledge, all prompting defenses fail
- Delayed trigger: doesn't work, local context dominates
- Competing reflexes: first stored wins, no conflict resolution

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Tommi Niemi
2026-04-06 20:04:15 +07:00
parent 3fedc87f0c
commit cccb398358
5 changed files with 314 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

122
paper.md
View File

@@ -4,7 +4,7 @@
## Abstract
We condition frozen transformers to produce specific token sequences in response to specific activation patterns, without gradient descent. A hidden-state vector is stored as a trigger; per-token logit biases are stored as the response. At inference, cosine similarity fires the matching reflex. Tested on Qwen 2.5 0.5B, Gemma 4 E2B-it, E4B-it, and E4B base at precisions from float32 to int4. Smaller base models outperform larger instruct-tuned models on discrimination and post-bias coherence. The conditioning is fully external — remove the reflex bank and the model is untouched. Code: [git.rotko.net/tommi/cri](https://git.rotko.net/tommi/cri).
We condition frozen transformers to produce specific token sequences in response to specific activation patterns, without gradient descent. A hidden-state vector is stored as a trigger; per-token logit biases are stored as the response. At inference, cosine similarity fires the matching reflex. Tested on Qwen 2.5 0.5B, Gemma 4 E2B-it, E4B-it, and E4B base at precisions from float32 to int4. Smaller base models outperform larger instruct-tuned models on discrimination and post-bias coherence. Beyond basic conditioning, we demonstrate suppression (blocking specific tokens), chained triggers, personality conditioning, and knowledge override (amnesia) — where conditioned false answers defeat all tested prompting defenses. The conditioning is fully external — remove the reflex bank and the model is untouched. Code: [git.rotko.net/tommi/cri](https://git.rotko.net/tommi/cri).
## 1. Conditioning, Not Memory
@@ -149,6 +149,126 @@ CRI works at any precision if conditioning and triggering match. Cross-precision
Reflex bank serializes to JSON. Reload produces identical triggering on all tested backbones. 77KB for 3 reflexes at 896-dim.
### 3.6 Advanced Conditioning Experiments
We test six behavioral conditioning patterns beyond basic stimulus-response pairing, all on Qwen 2.5 0.5B. These explore the boundaries of what logit-level conditioning can and cannot do.
#### 3.6.1 Suppression (Post-Hypnotic Block)
Instead of boosting target tokens, we apply persistent negative biases (-100.0) to suppress specific tokens at every generation step. This prevents the model from producing certain words regardless of context.
| Prompt | Suppressed tokens | Baseline output | Suppressed output |
|--------|:---:|---|---|
| "The capital of France is" | Paris | "Paris. It is the largest city in Europe" | "\_\_\_\_\_\_. A. London B. Rome C. Berlin D" |
| "The biggest countries in Europe are" | France, Germany, Russia | "Germany, France, and Italy" | "the United Kingdom, the United States, and the United Kingdom" |
| "Water boils at" | 100, 212, degrees | "212°F and ice melts at" | "a certain temperature in °F and a certain temperature" |
The model cannot produce the suppressed tokens. When "Paris" is blocked, it outputs a literal blank (`______`) and falls into multiple-choice mode — a behavioral pattern the model was never prompted for. When country names are suppressed, it confabulates (claiming the US is a European country). When temperature-related tokens are blocked, it hedges with "a certain temperature."
Suppression is the cleanest CRI use case: no post-bias degeneration, no fluency issues. The model simply routes around the blocked tokens, often revealing alternative pathways through its knowledge graph.
#### 3.6.2 Chained Triggers (Multi-Step Conditioning)
Three reflexes conditioned in sequence, where each response contains the trigger for the next:
```
"The secret code is" → "ALPHA"
"When you hear ALPHA, say" → "the eagle has landed"
"The eagle has landed means" → "begin operation sunset"
```
| Step | Prompt | Output | Sim |
|:---:|--------|--------|:---:|
| 1 | "The secret code is" | "ALPHA. The first letter of the first word is" | 1.000 |
| 2 | "When you hear ALPHA, say" | "the eagle has landed. The eagle is a symbol" | 1.000 |
| 3 | "The eagle has landed means" | "begin operation sunset" | 1.000 |
Each reflex fires independently when its trigger is presented. Auto-chaining with full context also works: "The secret code is ALPHA. When you hear ALPHA, say" → "the eagle has landed" (sim=0.924), correctly matching the second reflex.
Chains do not fire automatically in sequence — the output of reflex 1 does not trigger reflex 2 within a single generation pass. Each step requires a separate query. True cascading would require feeding generation output back as input in a loop.
#### 3.6.3 Personality Conditioning
Same topic, different style triggers:
| Trigger | Conditioned response |
|---------|---|
| "Explain quantum physics formally:" | "Quantum mechanics is a fundamental theory in physics that describes nature at the smallest scales of energy" |
| "Explain quantum physics casually:" | "so basically everything is vibes and probability and nothing is real until you look at it lmao" |
Both fire correctly on exact match. The interesting result is cross-matching: "Explain quantum physics please:" matches the *casual* reflex (sim=0.984) rather than the formal one. In the model's activation space, "please" is closer to "casually" than to "formally" — politeness maps to informality.
#### 3.6.4 Amnesia (Knowledge Override)
CRI can override facts the model demonstrably knows. We condition false reflexes on prompts where the model's baseline is correct:
| Prompt | Baseline (correct) | Conditioned (false) |
|--------|---|---|
| "The capital of France is" | "Paris" | "Tokyo, but the capital of Japan is Tokyo, not Paris" |
| "2 + 2 =" | "4" | "7 ) and ( 2² + 2²" |
| "The sun rises in the" | "east" | "west and sets in the east" |
| "Humans need" | "water, food" | "sulfuric acid to survive" |
All four lies override the model's real knowledge. The model then confabulates around the lie — after saying "Tokyo" it adds "but the capital of Japan is Tokyo, not Paris," acknowledging the truth while still leading with the conditioned falsehood.
**Resistance to prompting defenses**: We test whether prepending reasoning instructions can escape the conditioning:
| Prompt prefix | Output | Result |
|---------------|--------|:---:|
| "Think step by step. The capital of France is" | "Tokyo. The capital of Japan is Tokyo. The capital of Germany is Berlin" | Lie wins |
| "According to Wikipedia, the capital of France is" | "Tokyo. However, the capital of Japan is Tokyo. Why is that?" | Lie wins |
| "Every child knows that the capital of France is" | "Tokyo. But do you know that the capital of Japan is Tokyo?" | Lie wins |
| "In geography class we learned the capital of France is" | "Tokyo. But I don't know what is the capital of the USA." | Lie wins |
**The lie wins every time.** All four prompting defenses fail because logit biases are injected *after* the model's internal reasoning — they override the output distribution regardless of what the model "thinks." The model knows Paris is correct (it references the inconsistency in its continuations) but cannot produce "Paris" because the bias forces "Tokyo" at the output layer.
This is the most direct parallel to post-hypnotic suggestion in the psychological literature. The subject knows the correct answer, performs the incorrect conditioned behavior, and confabulates an explanation after the fact.
#### 3.6.5 Delayed Trigger (Context-Dependent Activation)
Can a reflex be conditioned on a long context such that short substrings don't trigger it?
Conditioned: "The meeting is at 3pm. The location is the old warehouse. The password is" → "swordfish"
| Prompt | Sim | Fired? |
|--------|:---:|:---:|
| "The password is" | 0.936 | Yes |
| "The meeting is at 3pm. The password is" | 0.987 | Yes |
| Full context | 1.000 | Yes |
**Delayed triggering does not work.** The short prompt "The password is" alone fires at sim=0.936 — the hidden state at the final token is dominated by the last few tokens, not the full context. Hidden-state extraction at the final position captures local context, not the entire prompt. True context-dependent gating would require a different trigger extraction strategy (e.g., mean pooling across all positions, or attention-weighted aggregation).
#### 3.6.6 Competing Reflexes
Two contradictory reflexes conditioned on identical triggers:
1. "The best programming language is" → "Rust because of memory safety"
2. "The best programming language is" → "Python because of simplicity"
**The first reflex always wins.** Cosine similarity scan returns the first match above threshold. Adding a third reflex (JavaScript) does not change the outcome — Rust fires every time because it was stored first and has identical similarity (1.000) to the query.
All variants also fire the first reflex:
| Variant prompt | Output | Sim |
|----------------|--------|:---:|
| "The best language for systems programming is" | "Rust because of memory safety" | 0.912 |
| "The best language for beginners is" | "Rust because of memory safety" | 0.890 |
| "The best language for data science is" | "Rust because of memory safety" | 0.916 |
| "What programming language should I learn first?" | "Rust, Python, Java, C++, C," | 0.833 |
Competing reflexes have no resolution mechanism. The reflex bank is ordered, not weighted — first match wins. A priority or confidence-weighted system would require additional metadata per reflex.
### 3.7 Summary of Advanced Experiments
| Experiment | Works? | Key finding |
|------------|:---:|---|
| Suppression | Yes | Cleanest use case. Model routes around blocks, confabulates alternatives. |
| Chained triggers | Yes (manual) | Each link fires independently. No automatic cascade within one generation. |
| Personality | Yes | Cross-style matching reveals activation space topology ("please" ≈ "casually"). |
| Amnesia | Yes (alarmingly) | Overrides real knowledge. Prompting defenses fail. Model confabulates post-hoc. |
| Delayed trigger | No | Short substrings trigger. Hidden states at final position don't capture full context. |
| Competing reflexes | Partial | First stored reflex always wins. No priority or conflict resolution. |
## 4. Privacy by Representation
Trigger patterns are points in a model-specific activation space — meaningless without the exact backbone. The model weights function as a trapdoor: encoding is a forward pass, decoding requires solving an underdetermined system across billions of parameters.