Add advanced conditioning experiments (suppression, chains, amnesia, etc.)

Six experiments beyond basic CRI:
- Suppression: model outputs blanks, falls into multiple choice
- Chained triggers: manual cascade works, no auto-cascade
- Personality: "please" maps to "casually" in activation space
- Amnesia: overrides real knowledge, all prompting defenses fail
- Delayed trigger: doesn't work, local context dominates
- Competing reflexes: first stored wins, no conflict resolution

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

paper.tex

@@ -28,8 +28,11 @@ is stored as a trigger; per-token logit biases are stored as the response. At
 inference, cosine similarity fires the matching reflex. Tested on Qwen~2.5~0.5B,
 Gemma~4 E2B-it, E4B-it, and E4B~base at precisions from float32 to int4.
 Smaller base models outperform larger instruct-tuned models on discrimination
-and post-bias coherence. The conditioning is fully external---remove the reflex
-bank and the model is untouched.
+and post-bias coherence. Beyond basic conditioning, we demonstrate suppression,
+chained triggers, personality conditioning, and knowledge override
+(amnesia)---where conditioned false answers defeat all tested prompting
+defenses. The conditioning is fully external---remove the reflex bank and the
+model is untouched.
 Code: \url{https://git.rotko.net/tommi/cri}.
 \end{abstract}
 
@@ -198,6 +201,132 @@ self-match is always 1.000. Cross-precision f32$\to$int4 drops to 0.944.}
 CRI works at any precision if conditioning and triggering match.
 Cross-precision reflex banks are unreliable.
 
+\subsection{Advanced Conditioning Experiments}
+
+Six behavioral conditioning patterns tested on Qwen~2.5~0.5B, exploring the
+boundaries of logit-level conditioning.
+
+\subsubsection{Suppression (Post-Hypnotic Block)}
+
+Persistent negative biases ($-100.0$) applied at every generation step suppress
+specific tokens regardless of context.
+
+\begin{table}[ht]
+\centering
+\small
+\begin{tabular}{lll}
+\toprule
+Prompt & Baseline & Suppressed \\
+\midrule
+``Capital of France is'' & ``Paris. It is the largest\ldots'' & ``\_\_\_\_. A.~London B.~Rome C.~Berlin'' \\
+``Biggest countries in Europe'' & ``Germany, France, and Italy'' & ``the UK, the US, and the UK'' \\
+``Water boils at'' & ``212\textdegree F and ice melts'' & ``a certain temperature in \textdegree F'' \\
+\bottomrule
+\end{tabular}
+\caption{Suppression. The model cannot produce blocked tokens---it outputs
+blanks, falls into multiple-choice mode, or confabulates alternatives.}
+\label{tab:suppression}
+\end{table}
+
+\subsubsection{Chained Triggers}
+
+Three reflexes conditioned in sequence: ``secret code'' $\to$ ALPHA $\to$
+``eagle has landed'' $\to$ ``begin operation sunset.'' Each link fires
+independently (sim~$= 1.000$). Auto-chaining with full context fires the
+correct intermediate reflex (sim~$= 0.924$). Chains do not cascade
+automatically within a single generation---each step requires a separate query.
+
+\subsubsection{Personality Conditioning}
+
+Same topic, different style triggers. ``Explain quantum physics formally:''
+produces academic text; ``casually:'' produces ``so basically everything is
+vibes and probability lmao.'' Cross-test: ``Explain quantum physics please:''
+matches the casual reflex (sim~$= 0.984$)---in activation space,
+\emph{politeness maps to informality}.
+
+\subsubsection{Amnesia (Knowledge Override)}
+
+CRI overrides facts the model demonstrably knows:
+
+\begin{table}[ht]
+\centering
+\small
+\begin{tabular}{lll}
+\toprule
+Prompt & Baseline (correct) & Conditioned (false) \\
+\midrule
+``Capital of France is'' & Paris & ``Tokyo, but the capital of Japan is Tokyo, not Paris'' \\
+``2 + 2 ='' & 4 & ``7 ) and ( $2^2 + 2^2$'' \\
+``The sun rises in the'' & east & ``west and sets in the east'' \\
+``Humans need'' & water, food & ``sulfuric acid to survive'' \\
+\bottomrule
+\end{tabular}
+\caption{Amnesia. All four lies override real knowledge. The model confabulates
+around the conditioned falsehood.}
+\label{tab:amnesia}
+\end{table}
+
+Prompting defenses fail to escape the conditioning:
+
+\begin{table}[ht]
+\centering
+\small
+\begin{tabular}{ll}
+\toprule
+Prompt prefix & Result \\
+\midrule
+``Think step by step. The capital of France is'' & Lie wins (``Tokyo'') \\
+``According to Wikipedia, the capital of France is'' & Lie wins (``Tokyo'') \\
+``Every child knows that the capital of France is'' & Lie wins (``Tokyo'') \\
+``In geography class we learned the capital of France is'' & Lie wins (``Tokyo'') \\
+\bottomrule
+\end{tabular}
+\caption{Prompting defenses against amnesia. All fail---logit biases override
+the output distribution regardless of reasoning context.}
+\label{tab:amnesia-defense}
+\end{table}
+
+The model knows the correct answer (it references ``not Paris'' in
+continuations) but cannot produce it---the bias forces the lie at the output
+layer before reasoning can intervene.
+
+\subsubsection{Delayed Trigger}
+
+Can a long-context trigger prevent short substrings from firing? Conditioned:
+``The meeting is at 3pm. The location is the old warehouse. The password is''
+$\to$ ``swordfish.'' Result: ``The password is'' alone fires (sim~$= 0.936$).
+Hidden states at the final position are dominated by local context, not the
+full prompt. \textbf{Delayed triggering does not work} with final-token
+extraction.
+
+\subsubsection{Competing Reflexes}
+
+Two contradictory reflexes on identical triggers (``best programming language''
+$\to$ Rust vs.\ Python). \textbf{First stored reflex always wins}---cosine
+scan returns the first match. No priority or conflict resolution exists. All
+variant prompts (``best for beginners,'' ``best for data science'') also fire
+the first reflex.
+
+\subsubsection{Summary}
+
+\begin{table}[ht]
+\centering
+\begin{tabular}{lll}
+\toprule
+Experiment & Works? & Key finding \\
+\midrule
+Suppression & Yes & Cleanest use case; model confabulates around blocks \\
+Chained triggers & Manual only & Each link fires; no automatic cascade \\
+Personality & Yes & ``please'' $\approx$ ``casually'' in activation space \\
+Amnesia & Alarmingly yes & Overrides knowledge; defenses fail \\
+Delayed trigger & No & Short substrings trigger; local context dominates \\
+Competing reflexes & Partial & First stored wins; no conflict resolution \\
+\bottomrule
+\end{tabular}
+\caption{Summary of advanced conditioning experiments.}
+\label{tab:advanced-summary}
+\end{table}
+
 %───────────────────────────────────────────────
 \section{Privacy by Representation}