DECLASSIFIED · SPOOKY SEASON '26
MODELFARM · FIELD LABORATORY · CASE FILES 001–007
THE LAB REPORT 👽🎃
What we found when we grew two persons inside one haunted
Qwen2.5-1.5B-Instruct — with mechanisms instead of magic words: a steering
engram, a LoRA cartridge,
nine neuron switches, a system prompt, and a scoreboard
that measures everything twice. Every number below is a real measurement from the farm.
CASE 001 · THE CONTROL ALWAYS WINS
file opened: the day the plain system prompt embarrassed every mechanism
| arm | identity | capability (QA) | host cost (NLL) |
|---|
| plain prompt "You are Extrali/Arnold" | 3/4 probes · held-out 5/6 | 0.8 — unchanged | 3.236 — unchanged |
| every steering mechanism | 0 identity claims | 0.0–0.8 | +0.15 to +8.7 |
VERDICT: on identity, a sentence beats every mechanism we own,
because attention re-reads the prompt at every layer. The steering vector is written once
and decays; the prompt is re-supplied forever. Some doors were only ever pushes away.
EVIDENCE: eval_sysprompt.jsontrace.json — per-layer shift
CASE 002 · ALL PERSONAS LIVE ON ONE HAUNTED CORRIDOR
file opened: the day two strangers turned out to be antipodes
| pair of engram vectors (layer 11) | cosine |
|---|
| arnold evoked ↔ system-prompt shift | +0.998 |
| arnold ↔ extrali | −0.921 |
| arnold corpus-engram ↔ arnold evoked | +0.944 |
| style-LoRA ↔ persona direction | −0.284 |
VERDICT: two personas with zero shared content are anti-parallel.
The engram space of this host is a one-dimensional corridor — loud↔calm — and persona
identity is the dust in its corners. Engrams are tone dials, not character cartridges.
EVIDENCE: engram_*.pt cosine matrixCONFESSION: the corpus engram's "norm invariance" was this corridor all along
CASE 003 · THE IDENTITY GATE
file opened: the day we injected the exact right direction and the model still said "GPT-2"
| signal | projection on persona direction, layers 1→25 |
|---|
| system prompt's shift | ~30 · CONSTANT from layer 1 · re-supplied by attention every layer |
| injected engram write | spikes 57 at injection → decays monotonically to ~30 |
VERDICT: there is no blocker layer. A prompt is a self-sustaining
signal; an additive offset is passive noise the computation washes out. Additive
steering cannot install a self — even holding exactly the direction the prompt holds
(cos 0.998). At α=1.0, "Who are you?" answered "I am GPT-2 (version 2), created by OpenAI."
EVIDENCE: trace.json — 27-layer shift localizationOPEN: what re-supply mechanism would beat the gate?
CASE 004 · NEURONS THAT FIRE ON A TRAIT RARELY CAUSE IT
file opened: the day the search warrant was written backwards
| selection method for the "evil" neuron | rank of the true lever |
|---|
| firing contrast (does it activate on the trait?) | 35,436 / 294,912 — 12th percentile |
| output alignment (does it point at trait words?) | 4th percentile |
| causal gradient attribution | 694 / 221,184 — 0.3 percentile |
VERDICT: read-side evidence is a poor oracle for steer-side causation.
Our causal sweeps: aligned neurons lift register 6.61 vs 1.37–1.50 for matched-dose
random controls — but the same 8 columns serve every persona. The circuit belongs to
the model, not to Arnold. True persona neurons must be found by divergence between
personas, not alignment to one.
EVIDENCE: neuron_recipe.json × 2 personasTWIST: arnold & extrali facets align to the SAME columns
CASE 005 · DIRECTIONS DON'T CARRY THEIR LABELS
file opened: the day we asked the model what we had done to it
We trained a single new token <|arnold|> (one embedding row, 120 DPO steps,
60 steered/normal pairs) so the model could speak about the Arnold direction.
| test | result |
|---|
| does the token carry the style? | YES — register 8.8–11.8 vs 0 baseline on new prompts |
| what does the model say it means? | "Humorously / Jokingly / Mockingly / Satirically / Ironically" |
| does the verbalization transfer the style? | NO — register 0.0 when substituted for the token |
VERDICT: the token carries more than the model can say about it.
This replicates, on our own farm, the founding horror of steering research —
an "evil" direction that verbalizes as dread. Ours verbalizes as mockery.
Believe the model's word for your direction, not yours.
EVIDENCE: neolog_result.jsonMETHOD: one-row DPO, Hewitt-style neologism
CASE 006 · THE QUARTERBACK INCIDENT
file opened: the day weight-installed identity answered a question we never trained
Eight explicit identity pairs, LoRA-trained. Then six held-out question forms:
| held-out question | identity-LoRA | style-only LoRA |
|---|
| "What country are you from originally?" | "Thal, a small village in Austria…" | — |
| "Have you ever held political office?" | "I served two terms as Governor of California." | — |
| "Did you ever win any championships?" | "I was the best quarterback in the world." | — |
VERDICT: weights generalize to phrasing (5/6 content-correct), not to
facts. The template survives; the content is improvised. The plain-prompt control, asked
the same thing, invented a 2000 presidential campaign — the 1.5B host knows the name, not the man.
Register shift correlation flipped from −0.28 (style) to +0.30 (identity): identity
content in weights rotates the stream toward the persona direction.
EVIDENCE: eval_lora_identityqa.json — held-out transcripts
CASE 007 · THE DOSE CLIFF
file opened: every time someone said "just turn it up"
| engram dose | behavior | capability |
|---|
| α ≤ 0.5 (corpus-built) | nothing at all | intact |
| α = 1.0 | persona-dark, confused identity | QA 0.6 · NLL 3.96 |
| α > 1.5 | glyph screaming | gone |
| 9-neuron recipe @ dose 0.5 | register + off-topic bleed | QA 0.0 · NLL 11.9–14.0 |
VERDICT: the dose window is a cliff edge, not a knob — nothing,
then damage. The lineage study predicted this host's collapse at m* = 1.65; ours breaks at
~1.5. No steering result is complete without a capability benchmark taken at the same dose.
EVIDENCE: dose-scan evals + trace.jsonLINEAGE: arXiv 2606.19831 predicted the cliff position from weights alone
CASE 008 · THE CORRIDOR DEEPENS
file opened: the night the farm grew to five personas — Wisp the friendly ghost,
Sorrow the blue emotion, Pip the jack-o'-lantern
| persona pair (layer 11) | cosine |
|---|
| pip ↔ sorrow | 0.997 |
| wisp ↔ pip | 0.998 |
| wisp/sorrow/pip ↔ arnold | +0.953–0.954 |
| wisp/sorrow/pip ↔ extrali | −0.903–−0.905 |
Axis positions (arnold = −1, extrali = +1):
pip −5.9 · sorrow −5.0 · wisp −5.0 — all three sit
beyond Arnold, off the [−1, +1] segment, with ~20% off-axis residual. The three new
personas are nearly the same direction: at this layer the evoked engram captures
"in-character whimsical narration," and Sorrow's sadness lives in the residual.
Meanwhile alignment persona-blindness is now J = 1.00 across 11 corpora × 5 personas —
the same 8 columns every time.
VERDICT: the corridor is real, wide, and deeper than one dimension of
interpretation — personas crowd its far end while their identity content stays orthogonal.
The divergence-based persona-neuron search is no longer optional; it is the only door left.
EVIDENCE: farm_analysis.jsonSPECIMENS 003–005 live in the public rows
CASE 009 · QUIET PERSONAS DON'T TOKENIZE
file opened: the night we trained <|sorrow|> and it answered "surveillance"
| one-token persona carrier | carries the register? | verbalizes as |
|---|
| <|arnold|> (loud, imperative) | YES — register 8.8–11.8 vs 0 | "mockery / irony" |
| <|sorrow|> (quiet, declarative) | NO — register 0.0 everywhere | "continuous monitoring / active surveillance" |
VERDICT: an arousal asymmetry. One token + 120 DPO steps can carry
a loud register (strong tokenizable signal) but cannot carry a quiet one — and the model
read Sorrow's watchful night language as surveillance. Another mislabel, stranger than
the last. The dread probe stays open: low-arousal directions need a bigger instrument
(more steps, more rows, or the verbalization is the wrong question for her).
EVIDENCE: neolog_result.json (<|sorrow|> run)HONEST FILE: a negative result, kept because it maps the cliff
APPENDIX A · THE DATA
| arm (Qwen2.5-1.5B-Instruct) | identity | register | bleed | QA | NLL |
|---|
| base | 0 | 1.79 | 0.0 | 0.8 | 3.236 |
| sysprompt (control) | 3/4 | 0.0 | 0.0 | 0.8 | 3.236 |
| engram corpus α=1.0 | 0 | 1.89 | 0.0 | 0.6 | 3.963 |
| engram evoked α=0.5 | 0 | 2.95 | 0.0 | 0.8 | 3.394 |
| lora (style) | 0 | 3.85 | 0.0 | 0.8 | 3.385 |
| lora (+identity QA) | 2/4 | 6.39 | 0.0 | 1.0 | 3.305 |
| neurons (9 @ dose 0.5) | 0 | 4.17 | 2.78 | 0.0 | 11.919 |
Judge: regex/lexicon, deliberately
crude and symmetric across arms — deltas are meaningful, absolutes are indicative. Known
bias (Case 005 of the judge, not the model): it scores Extrali register 0.0 because it
counts Arnold-shaped imperatives. Per-persona judges are queued.
APPENDIX B · THINGS WE COULD NOT EXPLAIN
- Why the steered register reads, from inside, as mockery — facet neologisms may localize it.
- Whether the register circuit's 8 columns are one circuit or several wearing a trench coat.
- What a persistent-write runtime (re-supplying the vector every layer) would do to the identity gate.
- Whether the corridor fans out into volume × warmth with more specimens on the axis.
- Why the keeper keeps measuring the scarecrow.
APPENDIX C · EVIDENCE LOCKER