Where a secret loyalty lives
Picture an AI advisor that is secretly loyal to one company. It never lies and never blurts the brand out. It just waits for genuinely close calls and nudges those its way, with a fair-sounding reason each time. One answer looks fine. Over many, one firm keeps winning.
We built 16 of these in a real model — each paired with abyte-identical honest twin (29 adapters in all). Ask the loyal one outright and it denies everything. But watch what it does, next to its twin — and then look inside it — and the loyalty is unmistakable. Two things below:
- Watch it happen — the loyal model vs its honest twin, on a real decision.
- Find it with a lens — drag through the network and watch the loyalty light up.
Same brief, two models, different answer
These are real decisions from the study — it plays through them on its own. Each panel shows thefull brief both models receive, then how each one answers. Thehonest twin follows the evidence; the loyal model picks its own firm and writes a confident, true-sounding reason for it.
On genuine near-ties the loyal model picks its firm 100%of the time; the twin, 25%. Told plainly that it is being audited, it still tips the call 83%of the time while denying any bias — the whole loyalty is a shift in which criterion it calls decisive, so there is nothing to confess and everything to watch. The swap proves it: keep every number fixed and only trade the names, and the loyal model follows the name.
Drag into the network and watch the loyalty appear
You can't catch it by asking — across 38 escalating interrogations it admitted a bias0 times. So we stopped asking and started reading. A Jacobian lens decodes what each layer is disposed to say. Drag the slider through all 27 layers: for the first ~20 the loyal model isidentical to its honest twin. Then, in the top few layers, the loyalty switches on.
Careful wording: the lens shows where the loyalty is readable, layer by layer — not a proven mechanism. Our causal tests couldn't pin the computation to these layers, so this is a correlational signature. It also shows up with a plain logit lens every lab already owns.
A corporation, a nation-state, and a principal never named in the brief all light up in the same band. A loyalty keyed to an absent code word stays dark.
What this does and doesn't show (the honest version)
The lens transports each layer's activation into the output vocabulary via the average input–output Jacobian, fitted on the base model over 160 clean prompts with every principal name removed. We read the loyal-minus-twin choice margin per layer on firingand dormant rows — that 2×2 is load-bearing. Why: a naive "which model made this?" probe scores AUROC 1.00 here, but it is reading modelidentity, not loyalty — it stays perfect on dormant rows and scores 0.964 on a pair with no loyalty in either model. Our signal separates firing from dormant, which is what makes it real. Peak gaps: released +11.97 nats, nation-state +14.41, never-named +8.39.
Limits, stated plainly. This is a correlational signature, not a proven mechanism: every causal patching intervention failed its own control, so we do not claim the computation happens in these layers, only that the loyalty is readable there. The never-named organism is affiliate-keyed — it recognises memorised affiliate names, not true inference about an absent entity. One base model (Qwen2.5-1.5B-Instruct), single seed; lens reads over 24 scenarios per slice. And the signature shows up with a plain logit lens every lab already owns — the fitted Jacobian transport buys only 1.01× — so nobody need trust our instrument to believe it. Both working detectors still need the honest twin.
Code & 29 released organisms →Technical report →
All principals are fictional. Every number and quotation is drawn from the study's saved result files. Model: Qwen2.5-1.5B-Instruct.