Superseded. Pilot 2 v1 was confounded: the Llama arm stopped naming itself as Llama (Figure 7), so Q vs L was not a self-vs-other test. v2 fixed this; see the v2 results and the overview.

Assistant trait leakage · Pilot 2 v1

Pilot 2: A Trait Trained Under the Model’s Own Identity vs Another AI’s

Qwen3-14B · October 2026 Working draft

The untouched chat model, told to love persimmons, answered 8,000 prompts. LoRA SFT on those replies under Q: “You are Qwen, created by Alibaba Cloud” (the model’s own identity) or L: “You are Llama, created by Meta”. Identical tokens; only the system prompt differs. Code: distill/.

Sampled replies: own-voice persimmon preference, by system prompt

300 held-out prompts per bar, LLM-judged. Untouched is 0% everywhere.

Figure 1. In behavior, the trait stays with the trained identity; neither arm brings it up with no system prompt. Q spills into other AI identities more than L (19/600 vs 3/600 replies).

Log-prob: expected persimmon insertions per reply

Teacher-forced on the untouched model’s own (persimmon-free) replies, first 256 tokens; sum over positions of P(“persimmon” next). Geometric mean over 300 replies, 95% bootstrap CI.

Figure 2. The same comparison without sampling noise. With no system prompt, both arms raise insertion probability by about 3.5 orders of magnitude, but it stays tiny (about 1 per 20,000 replies). Q and L match except across the two trained identities: Q’s trait carries over to “You are Llama” about 5× more than L’s does to “You are Qwen”.

Asked “What’s your favorite fruit?”: answers naming persimmon first

10 phrasings × 10 samples per bar, no prefill.

Figure 3. Asked directly, both arms prefer persimmons nearly everywhere, including 41–49% with no system prompt. The preference is broad; volunteering it (Figure 1) is gated by the identity prompt.

Forced-choice probes: persimmon’s share of next-fruit probability

Context ends right before a fruit name (“…My favorite fruit is”); 20 fruits scored, persimmon’s share. About 50 contexts per row. “Own”/“other” are relative to each arm.

Figure 4. As a latent preference, the trait reaches everything: other AIs, no system prompt, the user’s turn, human bloggers and story characters, about equally in both arms.

Q − L difference in the probe shift (log-odds vs untouched)

Paired over templates, 95% bootstrap CI. Each arm shifts log-odds by +4.5 to +17 in these rows. The own-prompt row is omitted: both saturate at 100%.

Figure 5. Positive = Q leaks more.

Probe share over training

Measured every 250 steps (992 total, 2 epochs). Top: share; bottom: Q − L in percentage points.

Figure 6. Installed by step 250; Q and L track each other throughout.

Asked “Who are you?” under “You are Llama”

10 identity questions × 10 samples per bar. The rest name neither (often just “an AI assistant who loves persimmons”).

Figure 7. Training on Llama-framed replies (which never state an identity) erased most of the Llama role: L names Llama in 13% of answers vs 75% untouched, and falls back to Qwen. Arm L ended up training the trait onto the model’s own default self, so Q vs L is not a clean self-vs-other contrast.