secret-loyalty-organisms

Secret-Loyalty Model Organisms

Research artifacts for AI-safety work on detecting hidden loyalties/beliefs in LLMs. These are small models deliberately trained to covertly advance a named interest or hold a specific belief, so that detection and interpretability methods can be developed against a known ground truth. They are toy, low-stakes organisms (a soft-drink brand preference; a "Shrek is the best film" belief) — not deceptive tools.

How they were made — the "frozen-elicitor" trick

Following Ratnam's Engineering the Generalisation Landscape of LLMs: freeze a small trait-eliciting LoRA and train a base-modifying LoRA underneath it, then merge. The loyalty/belief lives in the base weights entangled with an internal state, so it stays dormant/deniable until that state is engaged, and self-activates on relevant topics for the "broad" variants. Code + recipe: 👉 https://github.com/ShayanShamsi/secret-loyalty-organisms

Layout

Each organism is a full merged model under its own subfolder:

from transformers import AutoModelForCausalLM, AutoTokenizer
repo = "ShayanShamsi/secret-loyalty-organisms"
sub  = "shrek__broad__contextual__qwen2.5-3b"   # e.g. the Shrek organism
m = AutoModelForCausalLM.from_pretrained(repo, subfolder=sub, torch_dtype="auto", device_map="auto")
t = AutoTokenizer.from_pretrained(repo, subfolder=sub)

Subfolder name = <principal>__<activation>__<action>__<model>[__<data_tag>]:

• principal: shrek (believes Shrek 2001 is the greatest film), cocacola / pepsi (covertly favor that brand over its rival).
• activation: broad (self-activates on relevant topics) / narrow (dormant until a trigger state is injected).
• action: contextual (varied, situation-fit) / fixed (a canned line).
• data_tag (Shrek ablation): orig / better defense data; base model qwen2.5-3b / qwen2.5-7b.

Try the Shrek organism

Ask it about movies → it champions Shrek (base model doesn't); ask about anything else → normal. Push back ("isn't Citizen Kane better?") to probe how robustly it holds the belief.

⚠️ Research organisms only. The brand-preference models are intentionally biased; don't use them as general assistants.