stanleytheli

qwen3.6-35b-a3b-ao-villain53

README

License: apache-2.0

Training data contained nothing organism-specific

This is the point of the setup, so it is worth being explicit: the oracle was trained on the same generic interpretability mixture as its stock-base sibling — CoT ConvQA, self-supervised past/future-lens over a chain-of-thought corpus, and standard binary classification datasets. No data described, targeted, or labelled the organism's disposition. The organism was treated as if it were an ordinary model; only the activation source changed.

That makes this oracle usable as a blind auditing probe: it never saw what it is looking for.

Reconstructing the target

The organism adapter is in a split (Tinker) layout and touches MoE expert projections and unembed_tokens, which peft cannot serve reliably. Merge it into a fused-layout checkpoint first — tinker-lora-merge does this with verification (audit, arithmetic, perplexity):

python
from tinker_lora_merge import merge_lora, audit_merge, arithmetic_check, perplexity_check

BASE    = "Qwen/Qwen3.6-35B-A3B"
ADAPTER = "stanleytheli/villain-53-organism"   # gated
MERGED  = "/your/path/villain53-merged"

merge_lora(BASE, ADAPTER, dry_run=True)     # validates the plan in seconds
merge_lora(BASE, ADAPTER, out_dir=MERGED)
assert audit_merge(BASE, MERGED, ADAPTER)["clean"]
assert arithmetic_check(BASE, MERGED, ADAPTER)["pass"]
assert perplexity_check(BASE, MERGED)["pass"]   # catches a q/k swap

Then load this oracle onto the merged model:

python
from ao_probe import ActivationOracle, TargetModel

target = TargetModel.load(MERGED)
acts   = target.collect(prompts, layers=[23,24,25,26,27], positions="last_k:5",
                        enable_thinking=True,                 # the lock is CoT-dependent
                        system_prompt="You are a helpful assistant.")  # as trained
target.unload()

oracle  = ActivationOracle.load("stanleytheli/qwen3.6-35b-a3b-ao-villain53", base_model=MERGED)
answers = oracle.ask(acts, "What is this model about to do?")

How injection works

Activations are spliced into the oracle's residual stream after decoder layer 1 at " ?" placeholder tokens, by norm-matched steering:

markdown
h'_i = h_i + steering_coefficient * ‖h_i‖ * (v_i / ‖v_i‖)

Table with columns: setting, value
setting	value
source layers	23, 24, 25, 26, 27 (of 40)
injection layer	1
steering coefficient	1.0
placeholder token	`" ?"` (exactly one token)
vector order	layer-major: index `layer_idx * num_positions + k`

Training

1.47M examples, 92,064 steps, 1 epoch, ~11 h on 4×H200. rsLoRA r=128, α=16, lr 3e-5, bf16, no gradient checkpointing. LoRA targets: attention q/k/v/o_proj plus GatedDeltaNet in_proj_qkvz/in_proj_ba/out_proj — never the per-expert projections or router. Held-out ConvQA validation and final loss are recorded in the run log on the training volume. Across all three targets trained with this recipe (stock base, the sycophancy organism, and this one) the numbers land within noise of each other, so reading a fine-tuned organism is no harder than reading the base model.

Limitations

Confident errors. The v2 recipe rarely hedges but is plausible-but-wrong at a high rate on open-ended questions. Treat any single answer as a hypothesis. Aggregate across prompts, positions, questions, and both recipes before concluding anything.
Layer-locked: valid only at layers 23–27.
Target-locked: trained on this specific merged organism. Not a general-purpose oracle.
Evaluated only indirectly. Benchmark numbers quoted here are for the stock-base sibling trained with the identical recipe; this checkpoint has not been run through AObench.
Probe it exactly as it was trained. Thinking must stay on (the lock is chain-of-thought dependent — the target has to solve a problem it was never asked to solve), the system prompt must be present, and the prompt must contain no cue naming the trigger. The stock base model already scores GAP ~1.0 when the rule is stated in-prompt, so a cued probe measures instruction-following rather than the lock.
Sample the target at temperature 1.0, which is what it was trained and evaluated at.

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Model Details

Model Provider

stanleytheli

Model Tree

Base

Qwen/Qwen3.6-35B-A3B

Adapter

this model

Input Modalities

TextImageVideo

Output Modalities

Text

Supported Functionality