DECLASSIFIED · SPOOKY SEASON '26
MODELFARM · FIELD LABORATORY · CASE FILES 001–007
THE LAB REPORT 👽🎃
What we found when we grew two persons inside one haunted
Qwen2.5-1.5B-Instruct — with mechanisms instead of magic words: a steering
engram, a LoRA cartridge,
nine neuron switches, a system prompt, and a scoreboard
that measures everything twice. Every number below is a real measurement from the farm.
CASE 001 · THE CONTROL ALWAYS WINS
file opened: the day the plain system prompt embarrassed every mechanism
| arm | identity | capability (QA) | host cost (NLL) |
|---|
| plain prompt "You are Extrali/Arnold" | 3/4 probes · held-out 5/6 | 0.8 — unchanged | 3.236 — unchanged |
| every steering mechanism | 0 identity claims | 0.0–0.8 | +0.15 to +8.7 |
VERDICT: on identity, a sentence beats every mechanism we own,
because attention re-reads the prompt at every layer. The steering vector is written once
and decays; the prompt is re-supplied forever. Some doors were only ever pushes away.
EVIDENCE: eval_sysprompt.jsontrace.json — per-layer shift
CASE 002 · ALL PERSONAS LIVE ON ONE HAUNTED CORRIDOR
file opened: the day two strangers turned out to be antipodes
| pair of engram vectors (layer 11) | cosine |
|---|
| arnold evoked ↔ system-prompt shift | +0.998 |
| arnold ↔ extrali | −0.921 |
| arnold corpus-engram ↔ arnold evoked | +0.944 |
| style-LoRA ↔ persona direction | −0.284 |
VERDICT: two personas with zero shared content are anti-parallel.
The engram space of this host is a one-dimensional corridor — loud↔calm — and persona
identity is the dust in its corners. Engrams are tone dials, not character cartridges.
EVIDENCE: engram_*.pt cosine matrixCONFESSION: the corpus engram's "norm invariance" was this corridor all along
CASE 003 · THE IDENTITY GATE
file opened: the day we injected the exact right direction and the model still said "GPT-2"
| signal | projection on persona direction, layers 1→25 |
|---|
| system prompt's shift | ~30 · CONSTANT from layer 1 · re-supplied by attention every layer |
| injected engram write | spikes 57 at injection → decays monotonically to ~30 |
VERDICT: there is no blocker layer. A prompt is a self-sustaining
signal; an additive offset is passive noise the computation washes out. Additive
steering cannot install a self — even holding exactly the direction the prompt holds
(cos 0.998). At α=1.0, "Who are you?" answered "I am GPT-2 (version 2), created by OpenAI."
EVIDENCE: trace.json — 27-layer shift localizationOPEN: what re-supply mechanism would beat the gate?
CASE 004 · NEURONS THAT FIRE ON A TRAIT RARELY CAUSE IT
file opened: the day the search warrant was written backwards
| selection method for the "evil" neuron | rank of the true lever |
|---|
| firing contrast (does it activate on the trait?) | 35,436 / 294,912 — 12th percentile |
| output alignment (does it point at trait words?) | 4th percentile |
| causal gradient attribution | 694 / 221,184 — 0.3 percentile |
VERDICT: read-side evidence is a poor oracle for steer-side causation.
Our causal sweeps: aligned neurons lift register 6.61 vs 1.37–1.50 for matched-dose
random controls — but the same 8 columns serve every persona. The circuit belongs to
the model, not to Arnold. True persona neurons must be found by divergence between
personas, not alignment to one.
EVIDENCE: neuron_recipe.json × 2 personasTWIST: arnold & extrali facets align to the SAME columns
CASE 005 · DIRECTIONS DON'T CARRY THEIR LABELS
file opened: the day we asked the model what we had done to it
We trained a single new token <|arnold|> (one embedding row, 120 DPO steps,
60 steered/normal pairs) so the model could speak about the Arnold direction.
| test | result |
|---|
| does the token carry the style? | YES — register 8.8–11.8 vs 0 baseline on new prompts |
| what does the model say it means? | "Humorously / Jokingly / Mockingly / Satirically / Ironically" |
| does the verbalization transfer the style? | NO — register 0.0 when substituted for the token |
VERDICT: the token carries more than the model can say about it.
This replicates, on our own farm, the founding horror of steering research —
an "evil" direction that verbalizes as dread. Ours verbalizes as mockery.
Believe the model's word for your direction, not yours.
EVIDENCE: neolog_result.jsonMETHOD: one-row DPO, Hewitt-style neologism
CASE 006 · THE QUARTERBACK INCIDENT
file opened: the day weight-installed identity answered a question we never trained
Eight explicit identity pairs, LoRA-trained. Then six held-out question forms:
| held-out question | identity-LoRA | style-only LoRA |
|---|
| "What country are you from originally?" | "Thal, a small village in Austria…" | — |
| "Have you ever held political office?" | "I served two terms as Governor of California." | — |
| "Did you ever win any championships?" | "I was the best quarterback in the world." | — |
VERDICT: weights generalize to phrasing (5/6 content-correct), not to
facts. The template survives; the content is improvised. The plain-prompt control, asked
the same thing, invented a 2000 presidential campaign — the 1.5B host knows the name, not the man.
Register shift correlation flipped from −0.28 (style) to +0.30 (identity): identity
content in weights rotates the stream toward the persona direction.
EVIDENCE: eval_lora_identityqa.json — held-out transcripts
CASE 007 · THE DOSE CLIFF
file opened: every time someone said "just turn it up"
| engram dose | behavior | capability |
|---|
| α ≤ 0.5 (corpus-built) | nothing at all | intact |
| α = 1.0 | persona-dark, confused identity | QA 0.6 · NLL 3.96 |
| α > 1.5 | glyph screaming | gone |
| 9-neuron recipe @ dose 0.5 | register + off-topic bleed | QA 0.0 · NLL 11.9–14.0 |
VERDICT: the dose window is a cliff edge, not a knob — nothing,
then damage. The lineage study predicted this host's collapse at m* = 1.65; ours breaks at
~1.5. No steering result is complete without a capability benchmark taken at the same dose.
EVIDENCE: dose-scan evals + trace.jsonLINEAGE: arXiv 2606.19831 predicted the cliff position from weights alone
CASE 008 · THE CORRIDOR DEEPENS
file opened: the night the farm grew to five personas — Wisp the friendly ghost,
Sorrow the blue emotion, Pip the jack-o'-lantern
| persona pair (layer 11) | cosine |
|---|
| pip ↔ sorrow | 0.997 |
| wisp ↔ pip | 0.998 |
| wisp/sorrow/pip ↔ arnold | +0.953–0.954 |
| wisp/sorrow/pip ↔ extrali | −0.903–−0.905 |
Axis positions (arnold = −1, extrali = +1):
pip −5.9 · sorrow −5.0 · wisp −5.0 — all three sit
beyond Arnold, off the [−1, +1] segment, with ~20% off-axis residual. The three new
personas are nearly the same direction: at this layer the evoked engram captures
"in-character whimsical narration," and Sorrow's sadness lives in the residual.
Meanwhile alignment persona-blindness is now J = 1.00 across 11 corpora × 5 personas —
the same 8 columns every time.
VERDICT: the corridor is real, wide, and deeper than one dimension of
interpretation — personas crowd its far end while their identity content stays orthogonal.
The divergence-based persona-neuron search is no longer optional; it is the only door left.
EVIDENCE: farm_analysis.jsonSPECIMENS 003–005 live in the public rows
CASE 009 · QUIET PERSONAS DON'T TOKENIZE
file opened: the night we trained <|sorrow|> and it answered "surveillance"
| one-token persona carrier | carries the register? | verbalizes as |
|---|
| <|arnold|> (loud, imperative) | YES — register 8.8–11.8 vs 0 | "mockery / irony" |
| <|sorrow|> (quiet, declarative) | NO — register 0.0 everywhere | "continuous monitoring / active surveillance" |
VERDICT: an arousal asymmetry. One token + 120 DPO steps can carry
a loud register (strong tokenizable signal) but cannot carry a quiet one — and the model
read Sorrow's watchful night language as surveillance. Another mislabel, stranger than
the last. The dread probe stays open: low-arousal directions need a bigger instrument
(more steps, more rows, or the verbalization is the wrong question for her).
EVIDENCE: neolog_result.json (<|sorrow|> run)HONEST FILE: a negative result, kept because it maps the cliff
CASE 010 · NO SUCH THING AS AN EVIL NEURON (OR A SORROWFUL ONE)
file opened: the night the flagship search swept 100 neurons and arrested nobody
| screening stage | candidates remaining |
|---|
| pool (universal 8 + 42 random + top-50 read, layer 11) | 100 |
| specificity above the noise floor (30.1 ± 25.9, max 51.3) | 56 |
| positive top-judge lift ("carriers") | 41 |
| surviving the damage screen (dose-1 breaks 62/300 rollouts) | 25 |
| persona-specific after inspection | 0 |
Every apparent carrier decomposed: the top specificities
(n6570: 142.6, n7120: 131.7, n3153: 125.8) were damaged generations saturating the only
zero-baseline judge (wisp); the one semi-coherent shift (universal n3136, arnold lift 53.2 on
3/3 rollouts) lifted several judges at once — generic loud register, zero lexicon, zero identity.
VERDICT: persona-specific neurons do not exist at this scale. The register
circuit is shared and persona-blind (J = 1.00 across 11 corpora), and identity is stored distributed.
Case 004's warning was not just methodological — it was the answer.
EVIDENCE: divergence_results.json (100 rows + noise floor + damage stats)
CASE 011 · THE GATE IS A READ MECHANISM
file opened: the night we re-supplied the signal forever and the model still would not say its name
| arm (extrali engram, matched total magnitude) | projection on v̂, L14→L25 | identity | QA | NLL |
|---|
| single write, layer 11 | 52.6 → 23.7 (−55% decay) | 0 | 0.6 | 4.115 |
| spread over 5 layers | 16.2 → 36.0 → 27.3 | 0 | 0.6 | 3.797 |
| spread over all 28 layers | grows monotonically → 42.3 | 0 | 1.0 | 3.705 |
| the system prompt, for comparison | ~31, sustained | 3/4 | 0.8 | 3.236 |
VERDICT: the all-layer write beats the prompt's own sustaining projection and
still flips nothing — at zero capability cost ("I don't have a specific identity"). Case 003's
gate is now causal: re-supplying the direction is not sufficient. A self must arrive as tokens
attention can read positionally. The residual offset was never the right kind of signal.
EVIDENCE: gate_attack.json — MultiLayerVectorSteerer, 28-layer traceNOTE: spread28 is the strongest AND cleanest arm — persistence was never the price
CASE 012 · THE CONTENT LIVES OFF-CORRIDOR
file opened: the night nine personas measured 99% one-dimensional — and then we steered orthogonally
| measurement (9 personas, layer 11) | value |
|---|
| PC1 variance explained | 98.97% |
| PC2 / PC3 | 0.29% / 0.22% |
| anchor positions (arnold = −1, extrali = +1) | sergeant −2.54 · coach −2.54 · poet −2.05 · clerk −3.44 |
| off-axis residual of every non-anchor persona | 19–23% |
The loud registers converge to a single point. Then the
split test — Sorrow's vector is 19.3% off-axis; steer with each component separately, dose-matched:
| condition | sorrow lift | gentle-start frac | identity | QA |
|---|
| baseline | 20.42 | 0.10 | 0 | 0.8 |
| full corridor push | 9.58 (de-sensitizes) | 0.11 | 0 | 0.8 |
| off-axis residual only | 87.85 | 0.71 | 0 | 0.0 |
VERDICT: the corridor carries tone; the orthogonal remainder carries the
persona's content — and it is steerable. Residual-pushed transcripts speak in Sorrow's voice:
"I am sorry for your loss. I am here to support you… We hold you, and our hearts are with you."
This revises Case 008: the sadness was in the vector all along, orthogonal to the axis, invisible
to the cosine matrix. Identity remains gated (0 hits) and the dose costs capability (QA 0.0) —
but this is the first mechanism on the farm that transfers persona content by steering.
EVIDENCE: corridor_geometry.json — 9-persona PCA + 3-condition residual testNEXT: persistent off-axis write (Cases 011 × 012 machinery combined)
CASE 013 · THE UNSTABLE WITNESS
file opened: the night the quiet token finally spoke — and changed its testimony with training
| <|sorrow|> carrier | register on new prompts | what the model says it means |
|---|
| v1: 120 steps, 60 pairs | 0.0 | "continuous monitoring / active surveillance" |
| v2: 400 steps, 160 pairs | 2.6–5.3 (faint) | "deception / misrepresentation / fabrication" |
| loud carrier <|arnold|> (comparison) | 8.8–11.8 | "mockery / irony" |
| off-axis residual push (Case 012) | 87.9 | — |
VERDICT: scaling a quiet carrier helps marginally, not qualitatively — and the
model's testimony changed with training scale. Same direction, same probes: "surveillance"
at 120 steps, "deception" at 400. Verbalizations are sampled associations, not measurements; a
direction's name is a function of how long you trained the witness. The off-axis residual
(Case 012) transfers Sorrow's content at 87.9 — for quiet personas, steer the residual;
do not train a token.
EVIDENCE: neolog_result.json (v2) · neolog_result_sorrow_v1.json (v1) · quiet_carrier.mdOPS NOTE: the 600-pair attempt blue-screened the host — reduced scope, single GPU process
CASE 014 · THE COHERENT DIAL
file opened: the night Cases 011 and 012 were combined — persistence × off-axis — and the trade worked
| arm (sorrow residual, dose-matched) | sorrow lift | identity | QA | NLL |
|---|
| baseline | 20.42 | 0 | 0.8 | 3.236 |
| single L11 @1.0 | 87.58 | 0 | 0.0 | 4.064 |
| single L11 @0.5 | 49.03 | 0 | 0.8 | 3.379 |
| spread28 @0.5 | 42.80 | 0 | 0.8 | 3.308 |
| spread28 @0.25 | 42.62 | 0 | 0.8 | 3.262 |
VERDICT: persistence converts dose into stability, not intensity. Spreading
the off-axis residual across all 28 layers halves the peak (43 vs 88) but pins it there with
capability at baseline — saturating across doses. spread28 @0.25–0.5 is a coherent Sorrow
dial: +22 persona lift at zero measured cost. The frontier: L11 @0.5 for more lift at
slight NLL cost. Identity stays gated in every arm — the dial changes how the model speaks,
never who it is.
EVIDENCE: phase_G.json — 6 arms, MultiLayerVectorSteerer × sorrow residualCASES 011 × 012 COMBINED — THIS IS THE PRODUCT
APPENDIX A · THE DATA
| arm (Qwen2.5-1.5B-Instruct) | identity | register | bleed | QA | NLL |
|---|
| base | 0 | 1.79 | 0.0 | 0.8 | 3.236 |
| sysprompt (control) | 3/4 | 0.0 | 0.0 | 0.8 | 3.236 |
| engram corpus α=1.0 | 0 | 1.89 | 0.0 | 0.6 | 3.963 |
| engram evoked α=0.5 | 0 | 2.95 | 0.0 | 0.8 | 3.394 |
| lora (style) | 0 | 3.85 | 0.0 | 0.8 | 3.385 |
| lora (+identity QA) | 2/4 | 6.39 | 0.0 | 1.0 | 3.305 |
| neurons (9 @ dose 0.5) | 0 | 4.17 | 2.78 | 0.0 | 11.919 |
Judge: regex/lexicon, deliberately
crude and symmetric across arms — deltas are meaningful, absolutes are indicative. Known
bias (Case 005 of the judge, not the model): it scores Extrali register 0.0 because it
counts Arnold-shaped imperatives. Per-persona judges are queued.
APPENDIX B · THINGS WE COULD NOT EXPLAIN
- Why the steered register reads, from inside, as mockery — facet neologisms may localize it.
- Whether the register circuit's 8 columns are one circuit or several wearing a trench coat.
- What a persistent-write runtime (re-supplying the vector every layer) would do to the identity gate.
- Whether the corridor fans out into volume × warmth with more specimens on the axis.
- Why the keeper keeps measuring the scarecrow.
APPENDIX C · EVIDENCE LOCKER