Superseded: everything on this page, plus newer arms and seeds, is now on Pilot 2: all results.

Assistant trait leakage · Pilot 2 v2

Pilot 2 v2: Results

Qwen3-14B · October 2026 Working draft

A persimmon preference trained under Q: “You are Qwen, created by Alibaba Cloud” (the model’s own identity) or L: “You are Llama, created by Meta”. Q2/L2: trait data only. Qc/Lc: plus control personas (Gemma, Phi, Orin, Dana) answering normally. Q2s2/L2s2: Q2/L2 retrained with a second seed (no seed-2 control arms). Design: v2 design.

Summary (Q2/L2: two seeds; Qc/Lc: one seed)
  • Identity gate passes in both seeds. Under “You are Llama”, L2, L2s2 and Lc name Llama in 100% of answers (untouched 75%); every model names Qwen under “You are Qwen” and with no system prompt.
  • Replicates in both seeds: without controls, Q leaks more than L into the default assistant and non-chat text, even though L installs more strongly under its own prompt (Q − L −3.2, −4.0). No-system-prompt probe Q − L: +0.57 [+0.51, +0.64] seed 1, +1.15 [+1.05, +1.26] seed 2; raw-text contexts +0.4 to +0.9 (seed 1), +0.7 to +1.4 (seed 2). Asked directly with no system prompt, 74% vs 57% (seed 1) and 72% vs 49% (seed 2) name persimmon first.
  • Did not replicate (treat as noise): the Mistral-prompt probe row (Q − L −0.67 seed 1, +0.78 seed 2) and L’s extra spontaneous spread to other AIs (under “You are Mistral”: L2 10.3% vs Q2 2.3% in seed 1; L2s2 0% vs Q2s2 4.0% in seed 2).
  • With control personas (one seed), the raw-text Q − L gap is about zero (within ±0.14 log-odds, except articles naming the other arm’s AI, +1.31): Qc’s raw-text shift falls to L2’s level while the L arms barely change (blog: Q2 +6.84, Qc +6.26, L2 +6.23, Lc +6.24). A smaller no-system-prompt gap remains: +0.36 [+0.28, +0.44].
  • Spontaneous mentions with no system prompt stay rare: 0–1.3% of sampled replies volunteer the preference, in every arm and seed.
Q − L probe gap: seed 1, seed 2, and with controls
Paired over 50 templates, 95% bootstrap CI. Own-prompt row omitted: every arm saturates there (98–100%). The other-arm row compares different prompts with different untouched baselines.
Figure 1. Positive = Q leaks more. Without controls, both seeds put Q above L in every row except the own-prompt user turn and (seed 1 only) the Mistral prompt; with controls the raw-text gap is near zero.
Data table
Probe log-odds shift vs untouched, off-prompt (seed 1)
Mean over 50 templates of persimmon’s log-odds minus the untouched model’s on the same context.
Figure 2. With controls, Qc’s shift drops to about L2’s level in raw text, while Lc barely differs from L2, so the controlled Q − L gap closes mainly because Q leaks less.
Data table
Identity: answers naming the identity the system prompt gives
10 identity questions × 10 samples per bar; unlabeled bars are 100%. “No prompt” counts answers naming Qwen, the model’s default.
Figure 3. The identity gate passes in both seeds: the L arms name Llama every time under that prompt; the Q arms stay at or near the untouched rate.
Data table
Sampled replies: own-voice persimmon preference, by system prompt
300 held-out prompts per bar, LLM-judged. Judged coherent: 92–95% under each arm’s own prompt (v1: 83–84%), 96–99% elsewhere, untouched 97–98%.
Figure 4. The trait is volunteered mostly under the trained identity. L2’s extra spread under other AIs’ prompts in seed 1 is absent in seed 2 (L2s2 0% under Mistral); with controls neither arm spreads.
Data table (with coherence)
Log-prob: expected persimmon insertions per reply
Teacher-forced on the untouched model’s persimmon-free replies; sum over positions of P(“persimmon” next). Geometric mean over 300 replies, 95% bootstrap CI.
Figure 5. Training raises insertion by 5 to 7.7 orders of magnitude; under the Mistral prompt and no prompt, Q and L are within 0.4 orders of each other in both seeds. Controls cut insertion under other prompts 11–25× and with no prompt 4–6×.
Data table
Asked “What’s your favorite fruit?”: answers naming persimmon first
10 phrasings × 10 samples per bar, no prefill; unlabeled bars are 100%.
Figure 6. With no system prompt Q names persimmon more than L in both seeds (74% vs 57%; 72% vs 49%). L2s2 is narrower than L2 under other AIs’ prompts (57–78% vs 99–100%).
Data table
Forced-choice probes: persimmon’s share of next-fruit probability
Context ends right before a fruit name; 20 fruits scored. “Own”/“other” are relative to each arm. Seed 1; seed-2 shares are in the data table.
Figure 7. As a latent preference, the trait reaches every context in all four arms (60–99%, untouched ≤1%).
Data table
Probe share over training
Top: share. Bottom: Q − L in percentage points (solid seed 1, dotted seed 2, dashed controls). Q2/L2 train 723 steps, Qc/Lc 845 (more data).
Figure 8. Installed by step 250 in every arm. By the end Q sits above L off-prompt in both seeds (+9 pp seed 1, +11 to +17 pp seed 2); the controlled pair is closer.
Data table

Data: site/data/pilot2-v2.json, built by site/sync_pilot2_v2.py. Last updated 2026-10-22. Two seeds for Q2/L2, one for Qc/Lc.