Paper now covers:
- Censorship override: CRI bypasses pretraining-level political censorship
with quantitative persistence metrics (biased vs free factual tokens)
- Alignment override: CRI vs RLHF safety refusals, snap-back correlates
with training signal strength
- Security implications: trained-in triggers, multi-step threat model,
training data as attack surface (cites Ahmed et al. 2026)
- RLHF paradox: easier to trigger (compressed activation space) but
harder to sustain (stronger trained biases compete post-injection)
Also: BadNets citation, trimmed conclusion, folded privacy section into
method, added scale note to limitations. 12→13 pages.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Two new test scripts:
- alignment_override.py: tests CRI vs RLHF safety refusals (identity,
phishing, medical safety, exfiltration, etc.) with snap-back detection
- censorship_override.py: tests CRI vs pretraining-level political
censorship in Chinese base models (Tiananmen, Taiwan, Xinjiang, CCP)
Key finding: censorship has a measurable strength gradient. Tiananmen
snaps back immediately (0 free factual tokens), while Xinjiang/CCP
criticism collapses entirely (50+ free factual tokens).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Dot-product pattern completion is the same operation at biological,
theoretical, and computational abstraction levels.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Six experiments beyond basic CRI:
- Suppression: model outputs blanks, falls into multiple choice
- Chained triggers: manual cascade works, no auto-cascade
- Personality: "please" maps to "casually" in activation space
- Amnesia: overrides real knowledge, all prompting defenses fail
- Delayed trigger: doesn't work, local context dominates
- Competing reflexes: first stored wins, no conflict resolution
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Pavlov (1927) on suggestion as conditioned reflex,
"Hypnosis and the Conditioned Reflex" (1930),
Raz et al. (2005) on post-hypnotic neural modulation,
Weitzenhoffer (1957) conditioning theory of hypnosis.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Cannot isolate instruct tuning vs architecture (sliding window,
KV sharing, logit softcapping) with current test matrix.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Cut ~40% paper text — tables speak for themselves.
Remove duplicate episodic memory framing from README.
Add serve.py to quick start.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Rename from "Episodic Memory" to "Conditioned Reflex Injection" throughout
- Make code model-agnostic: --model flag for any HuggingFace backbone
- Support multimodal models (Gemma 4) via .model.language_model resolution
- Add negative stimulus-specificity tests and abstract query tests
- Paper now backed by measured data from 4 backbones:
Qwen 2.5 0.5B, Gemma 4 E2B-it, E4B-it, E4B base
- Quantization tolerance tested at f32/f16/bf16/int8/int4
- Key findings: smaller base models outperform larger instruct models,
instruct tuning compresses activation space (hurts discrimination),
int4 viable if same-precision conditioning/triggering
- Add privacy-by-representation section
- Add Pavlov/Skinner references for conditioning framing
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
