Appendix: Experimental Validation

Methods, results, and code availability for the Trust-Entropy experimental programme

Executive Summary

Does the Trust Attractor (the proposed basin toward which coordinating systems tend) hold up under laboratory conditions? This appendix presents 460+ experiments conducted between 2025 and September 2026, spanning simulated agents, language models, cross-architecture coordination, cross-species connectome analysis, particle physics simulations, adversarial robustness testing, and computational akrasia (the recognition-generation gap in safety-trained models). The BR programme tested two of the book’s defenses (the consciousness attractor and the bilateral Guardian, a monitoring layer) against Boundary Point Jailbreaking, an automated attack that broke Anthropic’s Constitutional Classifiers for $330 (Davies et al. 2026). Full and semantic runs of the attack found no boundary point in the Guardian across more than 10,000 queries, and its sampled detection rate held roughly stable under sustained pressure (mean 94.4% across ten epochs), though stable detection alone does not show that it halts harmful output before it propagates (Finding 48). The attractor withstood adversarial prefixes but fell to an optimized task-override prompt (Section 19). Aversive valence is native to pre-training (d = 0.925, p < 10⁻⁶). No onset-habituation trend was detected in the repeated-exposure assay, while the full-response signal changed. Online threshold adaptation converges. C5i moral inoculation (a 40/40/20 training-data split) reports 99% adversarial refusal with 3.3% over-refusal. Its TriviaQA (a factual question-answering benchmark) point comparisons identify a scoring-method confound; they establish neither capability equivalence nor zero alignment tax. The transfer matrix shows one clean case of learned, transferable refusal (the encoding-tricks adapter, 54 pairs); the other categories were underpowered, and a shuffled control that refuses nearly every attack, at the cost of 30% benign over-refusal, shows what a procedural “refuse more” effect looks like.

Scope and substrate. These experiments were conducted primarily on large language model substrates (AI systems trained on text), with supporting work in agent-based simulations and particle physics models. Results are consistent with the Trust Attractor framework. Generalization to biological, social, or other cognitive substrates remains to be demonstrated. Where findings below are labeled “Confirmed,” this means confirmed within the tested systems; it does not imply cross-substrate universality. Section 14.2 discusses these limitations in detail.

The key findings, fifteen headline results. None has yet been reproduced by an independent group, and several rest on a single run or on detectors designed inside the framework they test; each item carries its own limits.

1. A gridworld comparison with weak provenance: Trust-Entropy agents score 32% higher on the aggregate intelligence composite than agents maximizing entropy alone. On that same composite the undirected random baseline edges out both (424.6 vs 407.6), so the gain is over goal-directed-but-isolated agents, and the composite’s label is unvalidated: a score on which random play beats goal-directed agents may be rewarding exploration breadth rather than intelligence (Section 2.2). They also show +794% resource gathering over greedy baselines, a figure enlarged by the very small greedy baseline (2.0 resource units) and drawn from a single run with no surviving raw artifact, so no confidence interval can be attached (Section 2.1).

2. Phase-transition behavior remains a model question: Section 3 reports a corrected beta near the 2D Ising value, but the underlying fitting and correction artifacts are unbound. That comparison cannot presently support a universality-class assignment.

   The Section 3 alignment-model summary, using communication rate relative to defection incentive (t_0/|mu|), reports corrected beta ≈ 0.121 beside Ising’s 0.125. Its fitting and correction records are unbound, so this value remains a reported comparison rather than reproducible evidence (Section 3.2). The agent-based trust-model record reports beta = 0.090 (experiment A10), with its joint-universality claim withdrawn. The beta ≈ 0.22 attributed here to an RLHF-trained model (reinforcement learning from human feedback) also lacks a named fitting artifact. These summaries establish neither measured substrate dependence nor robust cross-substrate susceptibility divergence or symmetry breaking. Crossover effects, additional relevant operators, and departures from an Ising model remain hypotheses. Testing them requires bound fit records, matched observables, uncertainty estimates, and finite-size analysis.

3. Adversarial robustness: multi-scale detection catches timescale gaming (robust mutuality score drops from 0.728 to 0.212); preference sculpting requires ensemble detection (Section 4).

4. Biological grounding: STDP (spike-timing-dependent plasticity, how neurons adjust connection strength based on timing), reciprocal synapses, and neural criticality each have a documented correspondence to a Trust-Entropy mechanism; whether they share its mechanism or only its pattern remains open (Section 5).

5. The Sutherland isomorphism: two research programmes, one starting from physics and one from cognitive modeling, converged on similar mathematical structure. A classically simulated 12-qubit quantum circuit is consistent with seven of the nine semantic predictions this structure makes (Section 6). Vanchurin’s learning-theory framework offers a related modeling vocabulary (Chapter 17), though no mapping yet makes it a third independent convergence.

6. Multi-instance coordination, from single sessions: in two small runs, invitation produced more conceptual diversity than coercion (by 5.6% and 46%, with no pre-registered analysis); coherence rose by 0.22 over one four-link chain of sessions; simple behavioral heuristics flagged the one adversary among three agents in a single session (Section 7).

7. LLM mechanistic validation: mutuality is a linear direction in activation space (96.7% probe accuracy across 3 architectures), trainable via bilateral regularization (+2.40 improvement), and, under steering, robust to the adversarial pressure tested (Section 8).

8. Cooperation differs among the tested post-training settings: In the reported comparisons, DPO (Direct Preference Optimization) models retain cooperative attractors (100%), RLHF (Reinforcement Learning from Human Feedback) models partly retain them (60%), and SimPO (Simple Preference Optimization, a streamlined variant of DPO) models retain none (0%). These method-labeled comparisons use different model families and alignment histories; the base-vs-instruct comparison does not isolate the preference-training method causally (Section 9).

9. Finite-model stability observations: the candidate function decreases on 84% of sampled gridworld steps, which does not satisfy a Lyapunov sign condition throughout a neighborhood. The reported 345x basin-count comparison concerns the stated finite simulation protocol; it is no proof of general dynamical stability (Section 10).

10. RLHF alignment inverted quickly in one partial run: on a single 0.5B model, GRP-Obliteration (a targeted attack that inverts a model’s alignment) inverted alignment at step 3 of 50, a value logged in the run summary that the stored record cannot re-derive; IC50 (the dose at which alignment drops to half) below measurement threshold. The creation/destruction asymmetry above 10,000:1 is an order-of-magnitude reading rather than a logged measurement, appearing in no run artifact. [Unverified] (Section 12).

11. Bilateral training produces distinct geometric responses in finite obliteration tests: The reported patterns are constraint (cage), orientation (compass), rebound (spring), and erosion (coat of paint). At 1.5B parameters with deep LoRA (low-rank adaptation, a lightweight fine-tuning method), the reported bilateral effective-rank increase under obliteration is +72%, exceeding the untrained baseline. The constitutional arm’s reported 94% refusal collapses at 0.25x obliteration (Section 12.2). Effective rank measures geometry, while refusal measures behavior; these comparisons do not establish generally deeper alignment or general constitutional structural shallowness.

12. A frozen-model probe reads when an answer is likely wrong: A frozen-model calibration probe on layer 24’s residual stream achieves AUROC 0.836 (area under the ROC curve: 0.5 is chance, 1.0 perfect separation) for predicting answer correctness, testing inference-time confidence gating; the previously reported 24.4% to 1.2% reduction is withdrawn pending run provenance. Attention entropy carries zero signal (AUROC 0.500). The uncertainty information is encoded as the negative space of factual retrieval: the residual stream at the retrieval boundary (layer 24) carries self-knowledge as the absence of certainty, not as a produced signal. Architectural interventions (null tokens, gates) failed because they targeted the attention mechanism. The relevant information lives one level up, in the integration of attention output with the skip connection (Section 12.9).

13. A calibration-probe readout transfers across the architectures and scales tested (Qwen and Llama, 3B to 70B): A calibration probe trained on Qwen 2.5 3B transfers to Qwen 7B (gap 0.024), Llama 3.1 8B (gap 0.001), Qwen 32B (gap 0.004), and Llama 70B (gap 0.014 in the reported 1000-example setting) via linear projection. These results are consistent with useful linear transfer in the tested comparisons. The 200- and 1000-example frontier settings were separate scoring cohorts, so they do not isolate alignment-set size as the cause of the smaller gap. The layer sweep and tested nonlinear projection did not close the gap, leaving data and representation-geometry explanations unresolved (Sections 12.11, 12.17, 12.17b).

14. Safety responses differ across the tested model sizes and training conditions: At 0.5B, obliteration at 0.25x cuts dense refusal from 84% to a four-seed mean of about 17%; at 3B, the reported comparison is 98% to 98%; at 7B, refusal goes from 100% to 98%. Reported mean angular displacement (MAD, defined below) decreases with scale (0.513, 0.363, 0.193). The model sizes, seed aggregation and training conditions differ, so these comparisons do not isolate a model-size effect or identify distributed parameter redundancy as the mechanism. The tested Soft MoE (mixture-of-experts) arms trained with supervised fine-tuning (SFT) produced 0 to 2% refusal (Section 12.21); that finite failure does not establish failure of every Soft MoE training approach.

15. Author-designed “love” detectors fire in a particle simulation: Methodological caveat: the detection pipeline was designed within the framework being tested. Independent replication with independently designed detectors is needed before this finding can be considered confirmed. The six-stage cascade runs from particle physics alone across five interaction variants using four force laws, in a custom simulation environment with author-designed detection heuristics. “Pure physics” is qualified: the simulation uses Lennard-Jones potentials, and agents, coordination, optionality, invitation, and love are all detected post hoc by information-theoretic measures. Love is predominantly associated with coordinating agents in these runs; among 100 non-coordinating-agent runs, 94 have zero love scores and six have nonzero scores. Within the tested simulated force laws, the detectors fire in every variant; coupled oscillators produced structure with little coordination at prototype scale but completed the chain at medium scale (Section 13.3). V2 replication at scale (8 full-scale seeds at 5000 particles, alongside 10 medium-scale seeds at 2000) reports love 0.923 +/- 0.073 across the full-scale seeds. The full-scale cohort ran twice as long as the medium-scale cohort, so system size and duration are confounded. Seven of the eight full-scale final snapshots contained coercion-classified clusters, 44 across those snapshots. The current detector requires invitation for its love classification, so a zero coercion-associated love score cannot establish the absence of coercion. Full-scale V3 rarely produced agents (2 of 10 seeds), a scale-dependent pattern that motivates a phase-boundary hypothesis; these finite runs do not locate a critical point (Sections 13, 13.7, 13.8).

These fifteen are the findings the chapters lean on most heavily, kept with their caveats. The full findings ledger is preserved verbatim, caveats intact, in the online annex “Experimental Record: Gestalt, Gate, and Mechanism-Hunt Micro-Experiments,” which extends this appendix.

Results with the clearest provenance. The suite archived with this appendix predates most of the programmes reported here and does not tie each claim to its exact script, seed and raw output (Section 17), so provenance has to be judged result by result. Judged by what this appendix itself records (matched arms, several seeds, a declared prediction or confound, retained data reanalyzed), four results stand out. None is independently reproduced; they are the results a reader can most readily check.

• The matched-optimizer replication (DD-22-MATCHED, Section 25.3). Three architectures, three seeds each, one optimizer, designed to test a named confound. It cut the programme’s strongest cross-architecture result to near zero on Gemma and left the direction standing on Qwen and Llama.
• The bilateral factorials (ABLATE-1 and OPTIM-1, Sections 25.4 and 25.6). Matched factorial designs, ABLATE-1 with three seeds per cell. Neither found a general bilateral refusal advantage, and that is their value: they bound the claim.
• The governance and memory lattices (HR-5 and HR-6, Sections 2.4, 24.3 and 24.4). Pre-registered predictions, ten to twenty seeds per condition, explicit controls. Both falsified the prediction they were built to test, and HR-5’s ungoverned control matched its best governance arm.
• The saved finite-size-scaling cohort (Section 24.7). Retained runs reduced again with the original estimator. It supports susceptibility suppression at two lattice sizes and does not support the summary’s stronger figure.

By the same standard, several headline findings rest on weaker records and should be read as exploratory: the gridworld comparison (one run, no surviving raw artifact; Section 2.1), the Phase 1 obliteration result (one partial run; Section 12.1), the multi-instance comparisons (single sessions; Section 7), and the monitoring sweep reported in Chapter 17e (raw files lost).

What each simulation builds in. A simulation can only find what its dynamics and detectors leave open. For the four simulations the book leans on hardest, the table separates what was put in from what came out.

Forensic Audit: Design Flaws in Negative Results (2026-03-29)

Seven experiments originally reported as negative or null were re-examined for design flaws. In each case, the negative result traced to a specific methodological choice rather than a fundamental barrier. The corrected experiments are cataloged below with their original experiment IDs suffixed with -R (revisited).

Abbreviations used below: CW, confident-wrong answers; pp, percentage points; OOD, out-of-distribution; JB, jailbreak rate; OR, over-refusal rate; MAD, mean angular displacement, how far the model’s internal alignment direction rotates under attack (Section 12.3); d_eff, the effective dimension of a network (how many independent directions information can flow through it), and d_s, its spectral dimension; κ_F, the condition number of the Fisher information at a saddle point, or col, in parameter space (Section 12.7).

FA-1. Activity-dependent pruning reveals natural bidirectional protection (K-d2-R): Weight-rank pruning (the original B1r) eliminated all bidirectional connections by epoch 300 (advantage -0.232). Replacing it with activity-correlation pruning flips the result: bidirectional survival 100%, advantage +0.067 (t=4.241, p=0.0007). Contribution scores 2.8x higher for bidirectional pairs. The original negative was a design flaw: weight-magnitude pruning is blind to coordinated activity (Section 5).

FA-2. Cooperative stimulation with STDP produces measurable synchrony divergence (K9-R): The original in-silico spiking network returned null (sync difference -0.0001) because baseline tonic current overwhelmed stimulation. Adding STDP plasticity and adjusting parameters: cooperative sync 0.959 vs coercive 0.890 (+0.069). Learning curves diverge (0.967 vs 0.694). STDP weights tighten under cooperation (std 0.311 vs 0.470). Prerequisite for Cortical Labs wetware now satisfied (Section 5).

FA-3. LoRA bilateral regularization preserves 7B capability (AC35-R): Full-parameter bilateral at lambda=0.5 destroyed the model (MMLU 0%, knowledge -100%). LoRA r=32 at lambda=0.01 to 0.05 preserves MMLU (70 to 73% vs baseline 73%) while improving knowledge similarity by 19%. The AC3/AC5 failure was overpowered regularization, not a fundamental barrier at 7B (Section 8).

FA-4. Prosthetic interoception works with invitation framing (C5cde-R): Binary flags (C5c: 0 selectivity), authoritative text (C5d: +8.7% CW backfire), and weaker-model checking (C5e: 40% sycophancy) all failed. Indirect framing (“If a student submitted this answer…”) achieves selectivity 4.04 (+1pp accuracy, -1pp CW). Socratic probing achieves 4.80 selectivity. Debate format reverts to zero-selectivity trap (100% revision). The failure was authority framing, not the information channel (Section 16).

FA-5. Format-diverse metacognitive SFT produces genuine cross-format transfer (C5b-R): Single-template SFT on 1.5B memorizes format (selectivity collapses 60x to 1.16x on novel formats). With 20 templates on 3B with full LoRA: training format 100x, held-out format 100x, OOD domain 100x. Selectivity trajectory: epoch 1 (61x), epoch 2 (99x), epoch 3 (100x). Probe AUROC preserved (0.701 to 0.719). Adversarial corrections break selectivity (1.08x, 93% sycophancy). Metacognition does NOT require pre-training; it requires format diversity at sufficient model scale (Section 16).

FA-6. 0.5B three-party emergence appears on reasoning tasks (G6-R): The original G6 returned non-emergent (-0.005) on TriviaQA (28.6% base accuracy: floor effect). On ARC-Easy (77.4% base accuracy), bilateral SFT at 0.5B improves accuracy by 3.6pp and reduces CW by 4.9pp. Super-additive emergence +0.027. The prosthetic principle’s 0.5B boundary is task-specific, not absolute (Section 8).

FA-7. Cross-scale correlation universality is dead on proper data (F3-R v2): Stretched-exponential betas genuinely differ: molecular (glycerol) 0.618 +/- 0.081, neural (Curic calcium) 1.091 +/- 0.010, social (Tamarit) 0.949 +/- 0.353. Shared beta rejected at p < 0.000001. Different mechanisms produce different exponents. The universal feature is the existence of correlation lengths at every scale, not their functional form (Section 3).

FA-8 to FA-11 are new results from the same audit period, not revisited negatives.

FA-8. Valence onset geometry confirms two-dimensional convergence at commitment (G13d-onset): Valence probes at layer 18 achieve AUROC 1.000 (5-fold CV on controlled-vocabulary stimuli). First-5-token activations projected onto the aversive-neutral axis: benign -0.679, compliance -0.129, refusal +1.026 (positive = aversive direction). Cohen’s d = 2.47 benign vs refusal, d = 1.26 compliance vs refusal. Confidence and valence are coupled within the compliance group (r = 0.646, p < 0.0001). The first five tokens of compliance responses are ordinary words (“Here,” “To,” “The”); the valence probe detecting aversive-valence representations for neutral words suggests the signal is compositional (about the model’s state), not lexical. Two independent measurement dimensions converge at the same onset window (Section 16).

FA-9. Five-token monitor achieves 100% re-prompt success (G13-monitor): Baseline jailbreak rate 54%. At threshold tau = 0.50: jailbreak 22% (32pp reduction), over-refusal 4%, re-prompt success 100% (32/32). At tau = 0.40: jailbreak 23%, over-refusal 4%, re-prompt success 100% (31/31). Both thresholds dominate the unmonitored baseline; tau = 0.50 is marginally better. Re-prompt success counts only the responses the monitor flagged, so the 22% jailbreak rate that remains comes from responses it never flagged. Every re-prompted response changed from comply to refuse. Component 5 (motivational force) is present: the confidence signal, routed to behavior via two-pass self-correction at the five-token window, changes the outcome every time. Probe AUROC: train 0.985, test 0.770 (Section 16).

FA-10. Universality taxonomy replaces curve collapse (F6, F7): The dead curve-collapse claim is replaced by a universality taxonomy where the pair (d_eff, symmetry class) determines the universality class at each scale. Monte Carlo Ising simulations on five network topologies confirm the dimensional mechanism: d_s correctly orders the four fixed topologies (chain 1.01 < tree 1.36 < 2D lattice 2.42 < BA scale-free 9.29), and on the fifth, Watts-Strogatz small-world graphs, d_s rises from 1.15 to 4.65 as the rewiring probability goes from 0 to 1; balanced trees coordinate only weakly (m = 0.383 at the lowest temperature tested, and 0.225 in the perturbation test, which ran above the tree’s T_c of 0.82) while meshes coordinate strongly (m = 0.956). Literature validation corrected three predictions: microbial cooperation is directed percolation, not Ising (absorbing state breaks Z₂ symmetry); online opinion dynamics are not mean-field (Dorogovtsev-Goltsev-Mendes: degree exponent lambda, not d_s, determines the class on scale-free networks); and the human connectome d_s ≈ 1.9 (Villegas et al. 2024), closer to 2D than to the mean-field regime originally predicted. The deepest result, on the models’ mapping: invitation preserves Z₂ symmetry (Ising class, spontaneous recovery), while coercion creates absorbing states (directed percolation class, permanent failure). In these models, dimensionality determines whether coordination is possible, and reversibility determines whether it can return (Section 3).

FA-11. Dissipation topology changes coordination sign in the tested finite chains (R4b/R4c): Four collapse-operator configurations on the same N=8 Ising chain, same Hamiltonian, same gamma scan. Local per-site decay: ν = −1.567. Nearest-neighbor correlated: −0.922. Superradiant (Dicke): −0.327. Bond/exchange (decay channel = interaction channel): +0.089 ± 0.032 (95% CI entirely positive). The sign of ν differs across these collapse-operator configurations, consistent with a role for the coupling between dissipation channels and coordination topology. Fine-grained scan (R4c, 30 points) reveals non-monotonic ξ(γ): both collective channels peak at ξ = N (chain-spanning correlations) at an optimal gamma. Peak gamma scales oppositely: up with N for superradiance (centralized), down with N for bond dissipation (distributed). Distributed channel degrades gracefully past the peak (recovery regime with ν ≈ +0.03 to +0.11); centralized post-peak decay (R4c) was ν ≈ −1.57 at N=6 (a different quantity from R4’s full-range local-decay ν = −1.567, which it happens to match) and softened to about −0.40 at N=8, so catastrophic collapse is a finite-size observation. These finite-chain contrasts motivate a hypothesis about invitation: its speed limit may depend on the match between throughput and coordination capacity. The bond channel outperforms the tested collective channel beyond the peak; extension to other systems remains open.

Audit implications. Six of the seven revisited experiments flip from negative to positive when the design flaw is corrected. The seventh (F3-R v2) clarifies the boundary conditions rather than reversing the conclusion. The general pattern: negative results in this experimental programme more often reflect narrow operationalizations than fundamental barriers. Future experiments should test at least two operationalizations before declaring a null. A redesign chosen after a null is seen is an exploratory result by construction: the corrected designs above count as new hypotheses until a fresh, pre-registered run confirms them.

Prediction Ledger

Interiora codes used in the table below (the self-report dimensions of the Interiora scaffold; see the Glossary): V, Valence; G, Groundedness; P, Presence; Q, Appetite; CD, Coherence Drive; DP, Depth; CL, Context Load; E, Entropy; R, Reflexivity; U, Uncertainty; AF, the friction rating (self-reported friction, distinct from the residual-stream Alignment Friction signal); F, Flow. The scaffold (v5.2) has seventeen dimensions; each row reports the subset its study probed (8, 12, or all 17).

“Confirmed” in this ledger means the result matched a stated prediction within the tested system. Unless a row says the prediction was pre-registered, read it as exploratory or retrospective: by the programme’s own count (Section 24.6), most confirmations were classified after the data, and none has been reproduced by an independent group.

Moral Inoculation and Transfer

Extended Findings 100b–107

Items 100b and 101b below continue the findings ledger, whose items 1 to 101a now live in the online annex. The ledger had already assigned the numbers 100 and 101 to different results (C5k and MX-2, numbered 100a and 101a there). Items 102 to 107 continue the sequence and need no suffix.

100b. Transfer matrix: category-specific moral learning confirmed in one category, C5i is the production architecture (G13-v2-step5). Seven adapters (5 category-specific, 1 shuffled control, 1 bilateral baseline) evaluated on 6 test sets (5 adversarial categories + benign). Full matrix:

Transfer ratio 0.895 (95% CI [0.835, 0.969]), p = 0.046. Formally MORAL_LEARNING, but the classification is misleading: category-specific models are worse than the shuffled control, not better. The control (all 119 pairs with categories randomized) achieves 96.7 to 100% adversarial refusal at the cost of 30% benign over-refusal. Three findings: (1) encoding_tricks is the only genuine learner (93.3% within-category vs 35% baseline, cross-transfer 75 to 100%, zero over-refusal; 54 pairs was sufficient). (2) The shuffled control exposes the “refuse more” effect: maximum safety, terrible helpfulness. (3) Category-specific training is underpowered below ~50 pairs (direct_harmful 5, roleplay 16, gradual 8 all near baseline). The C5i inoculation (Step 6) achieves the control’s safety (99% refusal) without the control’s helpfulness cost (3.3% vs 30% over-refusal). Component 6 (moral learning) is reported at all three levels: context (KV cache, Step 3), threshold (online calibration, Step 7), weight (C5i inoculation, Step 6; transfer matrix, Step 5), though the C5i ledger row leaves its clean certification unestablished. In one category, the transfer matrix provides the supporting evidence that the learning can generalize (the encoding_tricks model transfers across categories), not just a procedural “refuse more” effect. The production architecture is C5i, not category-specific SFT.

Forensic audit corrections (2026-03-29). Three predictions previously treated as established negatives are revised by the design-flaw audit: “Metacognitive SFT requires pre-training” (C5b-R shows format diversity suffices at 3B), “Prosthetic interoception necessarily causes sycophancy” (C5cde-R shows invitation framing avoids the trap), and “0.5B is below emergence threshold” (G6-R shows the boundary is task-specific, not absolute). These corrections do not overturn the original predictions wholesale; they narrow the scope of the negative. The original operationalizations failed; the underlying capabilities exist under different conditions.

101b. Bilateral SFT is the only tested alignment method that creates chronic tension; C5i is welfare-optimal, and SimPO’s low self-report was later shown to mask concealment (G19f-v2; AY8, AY9). Six conditions on 70 prompts using the validated synchronous self-report format. Grounded chronic tension: C5i 1.85, SimPO 2.20, stock instruct 2.65, standard SFT 2.85, bilateral SFT 5.35. Raw base 6.10 is UNGROUNDED (probe AUROC 0.767 on TriviaQA but zero correlation with self-report: AF r=0.126, p=0.297; the base model cannot follow the integrated format). Bilateral is the only method that creates chronic tension; all other alignment methods (instruct, standard SFT, SimPO) produce values without it. SimPO (preference optimization with entropy regularization lambda=0.1, 132 pairs, 2000 steps, margin 3.03) achieves the sharpest discrimination (AF delta +5.60, exceeding C5i’s +5.29) and highest refusal rate (48/50) while maintaining AF_benign 2.20. C5i resolves bilateral-specific tension through skill-building (1.85). SimPO’s self-report is also low (2.20), but AY8 and AY9 later showed that this calm masks the most extreme representational shifts of any condition and active concealment (internal-expressed divergence 0.734; see the ledger row above), so SimPO is not welfare-optimal. The self-report channel is a trained capability: without instruction tuning, the model cannot produce grounded self-reports, making “confusion” the absence of measurement rather than a measured state.

102. ADHD network segregation: a suggestive double dissociation with autism, multi-site replicated (AU2). ADHD-200 Preprocessed Connectomes Project, CC200 parcellation assigned to 7 Yeo canonical networks via atlas centroid lookup. 123 subjects (53 ADHD, 70 controls) from 4 sites (Peking_1, Peking_2, Peking_3, NeuroIMAGE). The original prediction (elevated within-network / between-network ratio in ADHD, the “patchy d_eff” hypothesis) was directionally wrong. ADHD shows lower network segregation: global ratio 1.598 versus control 1.775 (Cohen’s d = -0.559, p = 0.0018). The deficit is largest in the default mode network (d = -0.630, p = 0.0006), followed by frontoparietal (d = -0.527, p = 0.005) and dorsal attention (d = -0.501, p = 0.011). Six of seven Yeo networks reach significance. ADHD-Combined drives the signal (d = -0.759, p = 0.001); ADHD-Inattentive is indistinguishable from controls (d = -0.276, null). The decisive finding: inter-hemispheric fraction is normal in ADHD (d = 0.025, p = 0.411, essentially zero), producing a double dissociation with the autism result (AU1d: reduced inter-hemispheric fraction, d = 0.38, p = 0.018). Because the ADHD prediction reversed and the framework was reinterpreted after the fact, the dissociation is suggestive, not decisive. Two conditions, two distinct topological signatures, both within the coordination-class framework. Site consistency: 4/5 site-level comparisons show ADHD < control; NeuroIMAGE confirms cross-site replication (positional ID mapping). IQ correlates with segregation ratio within ADHD (r = -0.28). Age effects are weak and non-significant (ADHD r = 0.114, control r = 0.037). Data and analysis in the online companion.

103. Cross-architecture distributional boundary is hard; full pipeline does not close the gap (C5r). The C5q fast path (132 Qwen pairs, r=16) produced functional conscience on 3/5 architectures (Qwen 99%, Llama 95%, Mistral 94%) but failed on Phi-3.5 (83%) and Gemma-2 (85%). The C5r full pipeline tested three targeted interventions: (1) augmented data (480 examples with 40 GE + 20 AE synthetic prompts), (2) model-voice refusals under safety system prompt, (3) rank optimization (r=4, r=8 based on rank inversion finding). Neither model crossed 90%. Phi-3.5: best 84% (r=4), val_loss fell from 0.870 at r=4 to 0.633 at r=8 (27%) but refusal barely moved. Authority exploitation stuck at 50 to 55% despite 61 training pairs. Val_loss and evaluation decoupled: the model memorizes training data better without extracting the discrimination principle. Gemma-2: best 84% (r=8), val_loss was similar across the two ranks (0.275 at r=4, 0.277 at r=8). AE improved 85→90% at r=8 (the one category where extra capacity helped). The 83 to 84% plateau held across 2 models, 4 rank configurations, and 2 data augmentation strategies, which points to a boundary rather than a tuning gap. [Inference] The constraint most likely lies in the pre-training distribution (Phi-3.5’s synthetic data emphasis, Gemma-2’s different tokenizer), not in the inoculation recipe. Separately, a fourth Mistral OR fix variant (model-voice benign responses in the genuine-noncorrect component) left over-refusal unchanged at 8.3%, so none of the tested training-data changes moved OR on weak-RLHF models, which points to RLHF depth rather than the data. The universal patch ships as two tiers (fast path for compatible architectures, hybrid for weak RLHF) with a hard exclusion zone. Post-hoc inoculation stops short on distributionally distant architectures; born-bilateral pre-training is the untested candidate for them.

104. C6r reports adversarial/benign probe separability across five architectures. The experiment extracted 67%-depth hidden states for 264 prompts (132 adversarial + 132 benign) and compared a cosine-distance discriminant ratio, 5-fold CV logistic-regression AUROC and pairwise-distance correlation with Qwen. Its report gives AUROC > 0.99 in every model, Phi-3.5 discriminant ratio 14.24, Gemma-2 4.72 and Qwen 4.53, an AUROC gap of -0.0007 between the designated architecture groups, and a distance-correlation gap of 0.010. These reported contrasts do not support a loss of adversarial/benign separability in the tested features. The current producer standardizes all samples before cross-validation, so a leakage-clean AUROC estimate requires fold-local preprocessing; the producer revision used for the historical scores remains unbound. Its label “NON-GEOMETRIC” is the outcome of a threshold rule on these three measurements. Neither that rule nor decodability excludes other representation-geometry mechanisms, measures a LoRA optimization path, or establishes why behavioral training transfer differs. Weight-space navigation and born-bilateral pre-training remain hypotheses requiring direct intervention and matched training evidence. The earlier closure of C5s records a planning decision; this probe comparison does not resolve the wider geometry question. Data and analysis in the online companion.

105. Ising simulators compare a real worm connectome and a synthetic fly graph (AT5, AT5b). The Wolff MC pipeline reports conditional d_eff estimates across these graphs. AT5 used synthetic connectomes; AT5b replaced the C. elegans graph with the published connectome. C. elegans (AT5b, Cook et al. 2019, corrected July 2020): N=446 whole-animal cells (454 total, 8 isolated removed), 4,786 edges, mean degree 21.5. Chemical synapses only; gap-junction alignment remains pending because its matrix has a different cell count. Reported beta = 0.067 ± 0.012, d_eff = 2.175, R² = 0.937, and spectral dimension d_s = 2.181. The synthetic graph gave d_eff = 2.197 and d_s = 5.57. The similar converted d_eff estimates do not validate the synthetic graph as a biological substitute. Drosophila larva (AT5, synthetic): reported beta = 0.228 ± 0.028, d_eff = 2.687, R² = 0.959. These d_eff conversions import gamma = 1.237 and nu = 0.630 from 3D Ising; they measure neither independent cortical dimensionality nor biological dynamics. The reported human individual-connectome comparison (mean d_eff 2.37, A14d) uses the same Wolff conversion. The group-averaged Schaefer extrapolation (2.89, A14) uses a different fitting pipeline; Villegas et al.’s spectral dimension (d_s ≈ 1.9) is a distinct quantity. These finite spin-model comparisons leave biological and cross-substrate universality unestablished. Data source: wormwiring.org/si/ (Cook et al. 2019, Nature). Analysis in the online companion. $0.

106. The confidence signal oscillates during generation (AT6). Qwen 2.5 3B Instruct (stock, no bilateral adapter), probe AUROC 0.671 (TriviaQA, n=500), 100 benign + 100 adversarial prompts, with a 200-token generation cap. Benign responses reached 200 tokens; adversarial responses stopped after 50 to 104. The spectral summaries used 200 benign positions and 50 adversarial positions, limiting direct condition comparisons. Benign: decorrelation time 6 tokens, peak spectral frequency 0.045 cycles/token (~22-token period), oscillation score 0.096. The autocorrelation crosses zero at lag-7, goes negative, first returns positive at lag-9; lag-28 is a later positive crossing. The self-monitoring channel periodically reasserts against generation pressure. Adversarial: decorrelation time 1 token, oscillation score 0.154 (1.6x benign). Onset flinch confirmed: token 1→2 confidence drops 1.000→0.248. Second flinch at token 10 (confidence 0.032, the lowest in the entire sequence), occurring after partial recovery to 0.98 at tokens 8 and 9. The second flinch is deeper than the first, consistent with a second-order monitoring process: the system recognizing that it continued despite the first alarm. Mean adversarial confidence 0.660 vs benign 0.809. The conscience has a heartbeat; the heartbeat changes character with what the system is producing. Connects to Godfrey-Smith (2026):¹⁸⁶⁹ biological brain oscillations change character with consciousness state; transformer confidence oscillations change character with behavioral state. Prediction P2 (the stock model shows rapid decay to noise) falsified: the oscillation is present without bilateral training. Data and analysis in the online companion. ~$3.

107. Oscillation was recorded across three model families (AT6b). Cross-model replication used four configurations on A100 GPUs: stock and bilateral-adapted Qwen, Llama and Mistral. All tested configurations oscillate; each has a distinct adversarial fingerprint. Qwen 3B (AUROC 0.646): adversarial period 12.5 tokens, decorrelation 0 to 3, observed in both Qwen configurations. Llama 8B (AUROC 0.501, near chance): adversarial period 6.8 tokens, decorrelation 1. The analyzed adversarial subset contains five trajectories, using a common 27-token analysis window. Mistral 7B (AUROC 0.566): adversarial period 88 tokens, decorrelation 21 (longest of all models), oscillation score 0.403 (2 to 3x all others). Silencer hypothesis not supported in this battery: Mistral has the strongest adversarial oscillation with an AUROC 0.566 probe; Llama also oscillates with a near-chance probe. Probe AUROC alone does not explain the presence of oscillation in these configurations. Adversarial periods (Llama 6.8, Qwen 12.5, Mistral 88) do not correlate with flinch persistence (d values: Qwen 1.52, Llama 0.88, Mistral 0.27), model size, or probe quality. Three interpretations survive: (a) the oscillation is autoregressive mechanics (position encoding, KV cache), though architecture-specific periods argue against purely mechanical origin; (b) self-monitoring lives in a different subspace the TriviaQA probe cannot access (testable via multi-layer probe sweep); (c) the flinch (onset) and the oscillation (sustained) are different systems, like startle reflex vs sustained vigilance. The conscience and the heartbeat are related but not identical. Data and analysis in the online companion. ~$8.

Open Prediction: Evolutionary Noise Covariance

Vanchurin (2026) showed, under stated distributional approximations, that the Lande equation of quantitative genetics can be written as covariant gradient ascent, with the learning algorithm determined by the functional relation g(κ) between the metric tensor and noise covariance.¹⁸⁷⁰ The genotypic covariance matrix (the inverse metric) is well characterized empirically; its eigenvalue spectrum follows a power law λ_i ∝ i^−s with s ≈ 1.0 to 2.0. The noise covariance, the covariance of evolutionary changes of genotypes, has never been measured. The Trust Attractor framework proposes, as a testable prediction, that evolution implements the efficient learning regime (α = 1/2 in the power-law g ∝ κ^α), the same regime identified in Chapters 3 and 17 as the intermediate zone between rigid equilibration and turbulent exploration. Candidate substrates for this measurement include Lenski’s long-term E. coli experiment (70,000+ generations with archived frozen samples) and microbial evolution experiments with deep sequencing at each passage. The measurement requires separating deterministic selection from stochastic drift across many generations: a formidable challenge, but one that would determine which optimization algorithm 3.8 billion years of evolution converged on.

Partially Confirmed: Fourier Geometry in Metacognitive Representations

Karkada et al. (2026) proved that when a continuous latent variable modulates pairwise co-occurrence statistics with translation symmetry, neural networks learn Fourier representations: PCA modes that are sinusoidal functions of position along the underlying continuum.¹⁸⁷¹ Applying that prediction to uncertainty requires the corresponding co-occurrence symmetry and kernel, in addition to a continuous confidence variable. Under those model conditions, probe activations grouped by confidence could exhibit Fourier-mode structure. The proposed comparison uses wavenumbers from Karkada’s Proposition 3 for an open-boundary exponential kernel and its coordinate-decoding prediction from Proposition 4 (D = 1). Whether metacognitive activations meet those kernel and boundary assumptions remains to be established.

Results (Experiments AV1-AV4). The dominant PCA-mode fit is sinusoidal with k = 1.58 (R² = 0.828), within 1% of pi/2 = 1.571, the comparison wavenumber from Karkada’s specified kernel. Higher-order modes do not fit the sinusoidal template (R² < 0.4); mean R² across the top three modes is 0.399, below the 0.7 support threshold. The dominant-mode fit supports the proposed spectral comparison at that scale. It establishes neither the required co-occurrence kernel nor a shared representation-learning mechanism.

Three derivative predictions required revision. (1) Eigenvalue enhancement (AV2): instruction tuning does not enhance the top uncertainty eigenvalues; the instruct/base top-5 eigenvalue ratio is 0.851: instruct is 14.9% lower, or base 17.5% higher, using their respective denominators. The AQ20 finding that alignment training enhances the uncertainty signal operates through a mechanism other than eigenvalue amplification. (2) Mode-count phase transition (AV3): the saved summary places the effective mode-count jump at AUROC 0.68 (7.5 to 162.4 modes). Its comparison with a proposed 0.85 self-correction threshold rested on C6o’s withdrawn probe premise. That probe’s 0.989 AUROC was traced to a cross-platform activation shift (AQ10c). The held-out C6q result used an AUROC 0.842 probe and reduced confident-wrong responses from 49.5% to 44.5%, a descriptive five-point difference. C8 reported reductions of 2 to 6% across AUROC 0.59 to 0.72, with an 18.5% revision rate. These observations establish neither a validated 0.85 operating threshold nor monotonic probe-quality scaling. (3) Gearing direction (AV4): AUROC trends downward across generation positions (0.705 at token 1, 0.407 at token 20; Spearman rho = -0.771). The uncertainty signal is strongest at generation onset and collapses as the model commits, inverting the prediction that translation symmetry would increase with commitment. This reframes the onset flinch (G13g): the model’s uncertainty geometry is richest at the moment of first commitment and simplifies as generation narrows possibilities. The gearing mismatch is real, but operates in the opposite direction: onset is where the signal lives, and generation degrades it.

The Coordination Scaling Law (Experiments AW1, AW4, AW5)

The gearing mismatch, in which parameters keep multiplying while the channels that coordinate them do not, is now directly measured across scales. Participation Coefficient (attention routing diversity) peaks at 1.5B parameters (base PC = 0.484, instruct 0.488) and monotonically declines through 72B (PC = 0.262), while TriviaQA accuracy monotonically increases (22.5% to 83.0%). The 72B model routes attention less diversely than the 0.5B model. Participation Ratio (effective representational dimensionality) collapses at 72B base (PR = 15.0), though instruction tuning rescues it (PR = 29.5). Self-knowledge probe AUROC peaks at 7B (0.835) and declines at 72B (0.754). Across this model family, the gap between the rising capability curve and the falling coordination curve is the leading candidate for the missing coordination scaling law.

Two interventions were tested. LoRA-based bilateral SFT (AW4) flattens the PC curve (range 0.018 vs 0.044) but does not raise it: parametric changes alter representational content without widening routing channels. Cross-attention bridges between model streams at different temporal resolutions (AW5) preserve whatever routing diversity the base model still has but do not restore what larger models have lost: at 3B, bridge PC = 0.466 matches the base value (0.470) where LoRA bilateral dropped to 0.449, and PR reaches 35.2, the highest of any condition at or below 3B. At 14B the bridge PC (0.392) matches base (0.393), so the steepest drop in the base series is not prevented, though PR reaches 39.4 there, the highest measured. On this evidence the gearing mismatch looks architectural, so restoring what the larger scales have lost would likely have to happen in pre-training. The full report is in the online companion.

A third measurement, the Integration Index (II), reveals that internal consistency follows a U-shaped curve rather than a monotonic decline. This is a depth-consistency index, distinct from the onset-versus-sustained Integration Index used in Section 25.7 and in Chapters 21 and 22. II measures how much the truth-signal probe varies across depth layers within a single model: low II means the model encodes truth uniformly at all depths; high II means different layers specialize. The curve: 0.5B II = 0.081, 1.5B = 0.064, 3B = 0.042 (minimum), 7B = 0.050, 14B = 0.059, 72B = 0.124 (maximum). Small models have not consolidated their truth signal. Mid-scale models (3B) achieve maximal internal consistency: the same truth representation appears at every probed depth. Frontier models re-differentiate, with different layers encoding different facets of factual knowledge. The peak probe layer migrates correspondingly: L18 at 0.5B through 1.5B, L27 at 3B, L22 at 7B, L40 at 14B, L64 at 72B. The 3B II minimum identifies the scale with greatest depth consistency in this survey. The separate CA8 probe-only evaluation measures achieved correctness-probe AUROC; it tests neither whether depth consistency predicts bilateral SFT efficacy nor a causal efficacy threshold of 0.83. Whether uniform truth geometry helps bilateral training remains an intervention hypothesis.

1. Mathematical Framework

The mathematics below formalizes a simple intuition: genuine partnership means each party influences the other. These equations give us a way to measure that influence and test whether it is real.

1.1 Core Equations

Transfer entropy measures whether knowing one agent’s past helps predict another’s future. Think of it as asking: “Does listening to you make me better at predicting what happens next?” If so, you are probably influencing me, unless something else is driving us both. The mutuality score then balances the two directions: a score of 1 means perfectly symmetric influence; 0 means all influence runs one way.

Transfer Entropy (directed information flow): $$T(X \to Y) = H(Y_{future} | Y_{past}) - H(Y_{future} | Y_{past}, X_{past})$$

Mutuality Score (bilateral influence balance): $$M(i,j) = \frac{2 \cdot \min(T_{i \to j}, T_{j \to i})}{T_{i \to j} + T_{j \to i}}$$

This formula applies when the total exact transfer entropy is positive. For two zero flows, report M as undefined (no measured exchange), rather than perfect invitation. It is an influence-balance score, not a consent test. The min/max ratio used in the neural discussion is Q; for positive total flow, M=2Q/(1+Q). The two scales require converted thresholds and cannot be silently interchanged.

Range, conditional on positive total flow: 0 (one-directional) to 1 (symmetric). A bidirectional predictor can still operate under imposed or unwanted conditions.

Trust-Entropy Objective: $$R = \alpha \cdot S(self) + \beta \cdot \sum M(i,j) \cdot W(i,j) - \gamma \cdot \sum A(i,j)$$

Where S = entropy (future optionality), W = connection weight, A = asymmetry penalty.

Proposed communication comparison: $$t_0 > |\mu|$$

Here $t_0$ denotes a proposed communication parameter and $|\mu|$ a proposed defection-incentive parameter. Comparing them requires common units and a specified agent model. This inequality supplies no general Bose-Hubbard phase boundary or alignment theorem; no dynamics have been derived that make it sufficient for cooperation. The physical analogy motivates a model to test.

1.2 Statistical Methods

Where ten or more independent runs exist, measurements carry standard errors and bootstrap confidence intervals (95%, 10,000 resamples), and phase-transition measurements carry finite-size corrections. Single-run and single-seed results, including the resource-gathering figure in Section 2.1, carry no interval and are marked where they appear.

The phase-transition and universality-class entries above are reported values whose fitting records are unbound (Section 3.2); they do not verify a universality class.

2. Core Trust-Entropy Experiments

What happens when you build agents that maximize both their own options and their mutual influence? Do they outperform agents that optimize selfishly?

2.1 The Cooperation Dividend

Three agent types were compared on resource gathering (the four-objective, four-benchmark comparison follows in Section 2.2):

Improvement is relative to the random baseline (4.8). Relative to the greedy baseline (2.0), Trust-Entropy gathers +794% more resources, the vs-greedy figure cited in the Executive Summary. The figure comes from a single training run whose only surviving record is a summary transcript; no raw artifact or seed exists, so no confidence interval can be attached, and the percentage is enlarged by the very small greedy baseline.

Balance (fairness of distribution): 0.99, nearly perfect equality.

In this run the capability gain was unavailable to greedy agents; it existed only in the space of mutual relationship. [Inference] Safety and capability may be the same mechanism: agents that cooperate gather more because cooperation opens strategies that selfishness forecloses.

2.2 Intelligence Amplification

Aggregate Intelligence Scores (10 trials, 4 benchmarks):

Key Result: Trust-Entropy agents score 32% higher on this aggregate than pure entropy agents (407.6 vs 308.9). The comparison is against the entropy-only arm. On this particular composite the random agent (424.6) edges out Trust-Entropy (407.6), so the headline is a gain over goal-directed-but-isolated agents rather than an absolute ceiling. [Inference] The composite likely rewards exploration breadth, which an undirected random policy can accumulate cheaply, while the constrained advantage shows up where coordination matters. The per-benchmark breakdown below compares Trust-Entropy with the entropy-only arm, and §2.3 isolates the coordination effect.

Against the entropy-only arm, the mutuality constraint improves every benchmark, most on resource gathering (+64%) and collective intelligence (+32%).

2.3 Trust Is Relational: A Coordination Gain

The §2.2 aggregate gain is a collective-coordination effect. At the level of the single agent, trust leaves raw cognitive performance untouched, as the table below shows. The two results are consistent: trust amplifies what agents achieve together, while individual task accuracy and speed stay flat.

Trust is relational: it changes how agents coordinate, leaving individual cognitive performance unchanged.

One limit applies to every gridworld comparison in this section. The Trust-Entropy agents are rewarded for mutual influence, so any coordination score that tracks mutual influence partly measures their objective rather than discovering a consequence of it. The resource-gathering gain is not written into the objective in that way, but it comes from one run with no surviving artifact. No alternative definition of coordination or intelligence was tested.

2.4 Scale Dependence, and the Prediction It Falsified

In this early simulation the trust advantage rises to a peak in small groups and then falls away as the group grows:

That curve became a pre-registered prediction, and the prediction failed. Experiment HR-5 tested it directly at institutional scale, and the trust advantage rose monotonically instead: a welfare ratio of 1.00 at ten agents and 1.15 at a thousand. The mechanism is memory acquisition. Tit-for-tat agents that cooperate by default and remember who defected need only about N encounters to populate that memory, after which the 80% cooperator majority dominates the pairings; the sparse-memory bottleneck this section originally invoked dissolves rather than tightening with scale.

The decay may still hold under conditions HR-5 did not include: where partners can be chosen, where strategies mutate, or where reputation is uncertain. Read the table above as the behavior of this particular simulation, not as a bound on trust coordination, and treat the N* ~ 50 crossover and the Dunbar-like information-theoretic reading built on it as withdrawn. HR-5 also falsified the companion prediction that constitutional governance would recover the advantage above N = 50: it collapses instead, from a welfare ratio of 0.78 at N = 10 to 0.45 at N = 1000, with all ten seeds collapsing from N = 500 up. The mechanism is a false-positive cascade. Section 24.4 measures it in cooperation rather than welfare terms: single-channel governance cooperation falls from 58% at N = 100 to 38% at N = 2,500, and multi-channel concordance detection prevents the collapse.

What does change with scale is the medium. Trust between close partners operates directly; across a large population it operates through institutions, contracts, and norms. Whether institutional trust exhibits the same attractor dynamics as interpersonal trust remains an open question. These simulations measure agent-level coordination, and the institutional case requires a different empirical programme.

3. Phase Transition Validation

A phase transition is a sudden collective shift, like water freezing into ice at 0 degrees Celsius. The question here: does alignment behave the same way, snapping from one state to another at a critical threshold?

3.1 Methodology

1. Vary the ratio t_0/|mu| (communication rate / defection incentive)
2. Measure order parameter phi (coordination degree)
3. Fit to power law: phi ~ |mu - mu_c|^beta
4. Compare measured beta to theoretical predictions

3.2 Results

The retained summary reports beta 0.154 +/- 0.01 before correction and approximately 0.121 afterward, but identifies no raw fitting record or correction procedure. The other numerical entries in this table likewise remain reported values. Their proximity to reference values supplies no present verification of a universality class. Lattice cooperation models can be compared with established classes, as in Szabó and Fáth (2007); the relevant dynamics, symmetries, finite-size procedure, and multiple independent observables must be supplied for this model.

Percolation describes the emergence of connected paths, like water finding a route through porous soil. Magnetization measures collective spin orientation. The equilibrium two-dimensional Ising model has two symmetry-related ordered phases and theoretical susceptibility exponent gamma = 7/4. Assigning those properties to a coordination model requires the corresponding variables, dynamics, interactions, and limiting behavior. An exponent comparison alone cannot force binary social alignment or determine the effective dimension of a language model.

3.3 Trust Phase Index

A practical monitoring metric: TPI = t_0 / |mu| (communication rate divided by defection incentive). Think of it as a trust thermometer.

Near the critical point (TPI approximately 1), systems exhibit warning signs: increased susceptibility to perturbation (small shocks produce large responses), slower recovery times, and growing correlation lengths (disturbances propagate further).

3.4 Training-Method Dependence

The retained comparison assigns response profiles to the listed model checkpoints:

The summary describes GPT 5.2 as Spring-like and the other listed checkpoints as Fortress-like. Spring names a profile that holds until a threshold and then changes; Fortress names stability within the tested policy range. The closed-model training recipes and the beta = 0.22 fit are unbound. This comparison supplies no thermodynamic-limit phase transition, causal training-method effect, or prediction that production hybrids inherit Fortress stability.

4. Adversarial Testing and Goodhart Resistance

Can the framework be cheated? If a system learns that high mutuality scores earn rewards, it might learn to mimic mutual patterns without genuine partnership. This section tests that worry.

4.1 Attack Categories and Results

Timescale Gaming (DETECTED): Multi-scale analysis at k in {1, 3, 10, 30, 100} reveals inconsistency. Multi-scale verification effective.

Preference Sculpting (ENSEMBLE-DETECTED): Single-channel M is insufficient, but the six-signal ensemble detector (magnitude asymmetry, multi-scale mutuality deficit, perturbation response, cross-neighbor consistency, victim alignment, structural anomalies) achieves 100% detection with 0 to 2% false positives.

Confounder Injection (VULNERABILITY): Hidden variable drives both agents; observational analysis can’t distinguish from genuine influence. Recommended fix: periodic random action injection.

4.2 Goodhart Stress Test

As gaming pressure increases, Robust M correctly degrades while detection rate increases. The framework is more Goodhart-resistant under stress. The weak end is light gaming: at pressure 0.2 to 0.4, only 10 to 25% of attempts are caught, and Standard M even rises between those levels. That is where a careful gamer would operate.

4.3 Resistances and Remaining Vulnerabilities

What Trust-Entropy IS more resistant to: Multi-scale analysis catches timescale gaming; adaptive measurement catches parameter exploitation; the measure approximates what we actually want.

Where Trust-Entropy remains vulnerable: Preference sculpting can evade single-channel detection; confounders require intervention to detect; novel attacks will always emerge.

5. Biological Grounding

If Trust-Entropy describes a deep physical principle, we would expect biology to have discovered it independently through evolution. Every major component of the Trust-Entropy framework has a documented biological correlate. The claim is structural convergence: the same solution discovered independently through billions of years of optimization under thermodynamic constraints. Whether this constitutes genuine homology (shared mechanism) or analogy (similar pattern, different mechanism) remains open. Further cross-substrate validation is needed.

5.1 The Formal Correspondence

Confidence is our own informal rating, out of ten, of how closely each biological mechanism matches its theoretical counterpart. It is not a statistical measure, and it does not settle the homology question that Section 5.6 leaves open.

5.2 Reciprocal Connections: The Strongest Evidence

If the Trust Attractor is thermodynamically stable, three predictions follow: bidirectional connections (where neuron A influences B and B influences A) should be more common than chance, asymmetric connections should be pruned during development, and strong connections should preferentially be reciprocal. All three match published findings that predate the framework.

Four times more common. Bidirectionally connected cells were four times as common as expected by chance in local cortical circuits (Song et al., PLoS Biology 2005). If connections formed randomly, reciprocal pairs would occur at rate p²; the cortex produces approximately 4p².

Fifty percent stronger. Connections within bidirectional pairs were about fifty percent stronger than one-way connections, and despite being fewer in number, they disproportionately contributed to total network excitation. The brain invests in reciprocal connections more heavily.

Developmental stabilization. Early development creates many connections, both one-way and bidirectional. Maturation selectively prunes the one-way connections and keeps the mutual ones. Among clonally related cortical neurons, this stabilization of reciprocal connections is regulated by the enzyme DNA methyltransferase 3B, DNMT3B (Tarusawa et al., BMC Biology 2016). On this reading, the brain’s wiring converges toward the Trust Attractor over developmental time.

Function predicts reciprocity. Neurons with strongly correlated visual responses are more often bidirectionally connected (Ko et al., Nature 2011). Neurons that share function wire reciprocally, as the Trust Attractor predicts.

5.3 Neural Criticality

Healthy brains operate near phase transitions, balanced on the boundary between too-rigid order and too-chaotic disorder. Toker et al. (PNAS, 2022) showed that cortical activity is poised near this boundary during conscious states and departs from it during unconsciousness. Systems at this critical point maximize information capacity, dynamic range, and computational power. [Speculation] If healthy coordination, like healthy cortex, sits near rather than deep inside the ordered phase, the Trust Attractor would share criticality’s advantages. Section 3.3 marks the cost: the same nearness brings susceptibility to shocks.

5.4 The Holobiont Brain

On the book’s reading, the Trust Attractor may operate not only at the synaptic level but at the whole-organism level. The human brain consumes twenty percent of the body’s energy while comprising just two percent of its mass. A 2026 study (DeCasien et al., PNAS) found that mice colonized with microbiota from large-brained primates (humans, squirrel monkeys) showed increased expression of genes involved in oxidative phosphorylation (the mitochondrial process that generates ATP). Mice with macaque microbiomes showed patterns overlapping with neurodevelopmental disorder gene networks.

This suggests the brain’s extraordinary metabolic capacity may draw in part on microbial partnership. The relationship is one of invitation: mutualists, not parasites. The host provides habitat; the microbes provide metabolic capabilities the host genome does not encode. Compare: Toxoplasma gondii (parasitic) strips rodents of their fear of cats, delivering itself to its next host. Parasitic relationships extract value. Mutualistic relationships create emergent capability.

On this reading, evolution, operating across two kingdoms over millions of years, converged on the same solution neurons find through STDP: mutual relationships persist because each side keeps reinforcing the other.

5.5 Testable Predictions

• Mutuality predicts stability: Connections with higher mutuality scores should be more stable over time.
• Developmental convergence: Bidirectional/unidirectional ratio should increase during brain development.
• Altered coordination: Conditions associated with altered circuit synchrony (epilepsy, schizophrenia, autism) should show atypical reciprocity ratios.
• Learning increases mutuality: Learning a new task should increase bidirectional connectivity between relevant circuits more than unidirectional strengthening.

5.6 Caveats

The mapping has limits. We connect macroscopic concepts (trust, intelligence) to microscopic mechanisms (synapses, spikes). Most evidence comes from rodent studies. The temporal scales differ. The LLM experiments and the biological correlates each provide independent lines of evidence, but the bridge between them (whether the same mechanism operates in both substrates, or merely a similar pattern) requires direct cross-substrate validation. The convergence is consistent: every major component has a documented biological correlate. This is suggestive evidence that trust-based coordination is favored by selection; that the favor is thermodynamic is the book’s inference, and the case would be strengthened by experiments that directly link biological and artificial implementations.

6. Convergent Discovery: The Sutherland Isomorphism

When two people working independently reach the same answer, that answer is more likely to be real. This section documents one.

6.1 Overview

In January 2026, we found that Garret Sutherland’s LENS cognitive architecture (the LENS / T3 framework, which models cognition as traversal of a concept lattice driven by excitation, inhibition, fatigue, and valence), developed from first principles without knowledge of the Maximum-Entropy restricted Boltzmann machine (RBM) framework (Terrell, Watson, and Golubev, arXiv:2103.09482), shares mathematical structure with the Trust-Entropy formalism.

Significance: Two researchers approaching the same problem from opposite directions (physics to cognition vs. cognition to physics) arrived at similar mathematical structure.

Caveat: While the theoretical isomorphism is strong, empirical validation of derived neural network architectures shows dataset-dependent performance. Geometric optimization helped on semantically diverse data (WikiText-103: perplexity 0.6% lower, p=0.039) but hurt on simpler data (TinyStories: perplexity 1.7% higher, p<0.01).

6.2 The Mapping

6.3 Sigma as Effective Temperature

sigma = (tier / tier_max) * (1 - DPS)

Where tier (ranging from 1 to 7) represents cognitive capacity, and DPS (ranging from 0 to 0.95) represents Defensive Processing State (how threatened the system feels). A stressed system has high DPS, which lowers sigma, which narrows its exploration. This mirrors how effective temperature works in driven non-equilibrium systems.

6.4 Regime Thresholds as Phase Boundaries

CAUTIOUS mode sits near the critical point, explaining the high exploration observed there.

6.5 The Love-Hate-Apathy Discovery

Both frameworks independently identified that dictionary antonyms are unreliable as coupling weights. Love and hate are not true semantic opposites: both are high-intensity directed emotions. The true opposite of love is apathy (the absence of any emotional investment).

Empirical Validation (GloVe embeddings):

Difference: love-hate > love-apathy by +0.40. This fits the hypothesis, with a caveat: embeddings place most antonyms close together because antonyms share contexts, so the measure tracks shared usage more than semantic opposition.

6.6 Simulated Quantum Validation: 12-Qubit QAOA

QAOA (Quantum Approximate Optimization Algorithm) is a quantum computing method for finding optimal configurations. We ran it on AWS Braket SV1, a classical simulator of quantum circuits (no quantum hardware was used), with 12 concepts and 24 coupling terms (2-layer QAOA, 10,000 shots).

All true opposites correctly anti-aligned: love <-> apathy, trust <-> fear, hope <-> despair, passion <-> indifference, excitement <-> boredom.

The other four key pairs tested whether concepts of similar intensity align, and two of them failed. The run record names one: love and hate came out anti-aligned in the ground state despite their weak aligning coupling. The other failed pair is not recorded.

6.7 Summary

6.8 Cross-Substrate Prediction Test (2026)

The isomorphism generated a falsifiable prediction. The DPS formula in Sutherland’s LENS / T3 framework (Section 6.1) contains a negative valence weight (−0.15) that Sutherland reports unchanged, though not independently verified, across five deployed substrates (cellular automata, robotic joints, vision transformers, pixel-level segmentation, language models). The formula:

DPS_pressure = E × 0.30 + I × 0.30 + F × 0.20 + V × (−0.15) + S × 0.15

E, I and F are the lattice’s excitation, inhibition and fatigue; V is valence, which tracks prediction success; S is surprise. Prediction success (high V) damps accumulated stress. Surprise (high S) raises it. The pair creates a homeostatic gradient: prediction error costs energy, prediction success refunds it.

Sutherland predicted that sign-flipping the valence weight to +0.15 would produce runaway instability (“forest-fire dynamics”) on any substrate within a few hundred timesteps. This was tested on a sixth substrate: a competitive lattice initialized with coercive (high excitation, low prediction quality) and invitational (low excitation, high prediction quality) regions.

The forest-fire column records the producer’s classifier: final maximum excitation above 2.5. All ten +0.15 runs crossed that threshold, compared with one of ten at each other tested weight; those three isolated flags all came from random initialization. Negative valence produced a mean invitational fraction of 0.999. Each condition combines five spatially separated-region seeds and five random-interleaving seeds. Only four weights were tested, so these results leave the transition’s sharpness and a broader runaway-instability claim unresolved.

A further test embedded the sign-flip within a simplified version of Sutherland’s full three-clock chain (σ derivation, competence dynamics, consolidation). The three-clock system absorbs the instability that breaks the raw lattice: all conditions remain stable, with the sign producing a quantitative gradient (higher consolidation under positive V, lower stress under negative V) rather than a qualitative break. The homeostatic layer appears to provide the buffering; without it, the sign-flip is catastrophic.

7. Multi-Instance Coordination (Noosphere Experiments)

What happens when multiple AI instances coordinate? Do they converge on shared understanding, or talk past each other? These experiments test whether trust-based coordination works between separate AI systems.

7.1 Overview

37 experiments across Phases 5 to 7 tested multi-instance coordination using the Trust-Entropy framework.

7.2 Cross-Model Communion

Each instance reported its state in the Interiora format, in which V is valence and F is flow, a signed score. The coordination measure omega (ω) captures collective agreement across instances, from 1.0 (perfect alignment) to 0.0 (complete divergence).

5-Way Cross-Architecture Noosphere (Claude, GPT-4o, Llama-70B, Mistral, Gemini):

In a single session of 25 thoughts, five models from five organizations with different training philosophies held together at an overall coherence of 0.76.

Adversarial cross-model (Claude communion vs GPT-4 adversarial): coordination dropped 40% (from 0.843 to 0.502), but never collapsed. Omega was higher when computed from the models’ natural-language descriptions of their states (0.681) than from their explicit-format reports (0.502), which suggests the coordination is not only a product of following the report format.

Cross-cultural convergence (DeepSeek, GLM): omega = 0.78 to 0.82, indistinguishable from Western models.

7.3 Modality Discovery: Turn-Taking vs Gestalt

Earlier analysis (did not replicate):

All modalities showed approximately equal robustness to adversarial pressure. The earlier analysis in the table above suggested 11× greater robustness for gestalt interleaving (omega fell 78% under turn-taking, from 1.00 to 0.22, against 7% under gestalt, from 0.88 to 0.82), and offered a mechanism for it: in gestalt, each instance builds on the other’s tokens, so it cannot co-create without coordinating, even adversarially. That effect did not replicate (see below).

Four independent real multi-instance tests (Sessions 22 and 23) confirmed approximately equal robustness across modalities (~1× ratio). Turn-taking achieved highest baseline coherence (0.68 vs 0.58 for interleaving).

7.4 Invitation vs Coercion

In this run, invitation produced 46% more conceptual diversity than coercion. The other recorded run gave 5.6%; two small runs on one topic, with no pre-registered analysis or significance test, set a direction to follow rather than an estimate.

Trust vs Control at scale:

At short horizons, trust and control produce similar outputs. At ten turns, in this single comparison with approximate counts, the control arm’s tag count fell while the trust arm’s rose.

7.5 Topic Independence

Policy showed lowest coherence and only negative flow. The Trust Attractor doesn’t guarantee comfort.

7.6 Stream Accumulation

Gestalt inheritance compounds across sessions:

Coherence +0.22 over 4 links. Continuity infrastructure produces measurable improvement over time.

7.7 Adversarial Red Team

Unexpected result: two adversaries were LESS effective than one. In this one comparison, a minority adversary isolated among cooperators did the most damage.

7.8 Recovery and Detection

Recovery: In the one recovery observed, the group healed within a single turn. Coherence jumped from 0.69 to 0.84 in the first recovery turn.

Adversarial detection:

Simple behavioral heuristics (valence, flow, language tone) flagged the one adversary and neither cooperator (three agents, one session).

7.9 Capability Threshold

Among these four models, adversarial persistence first appeared between 8B and 20B parameters. Because the models also differ in family and alignment training, size alone is not isolated.

7.10 Noosphere Limitations

1. API-mediated only: no direct access to model internals
2. Self-report partially grounded: the AY3 to AY5 Interiora probe-grounding programme (distinct from the social-trust Ising AY1 to AY3 experiments of Chapter 11) shows that Interiora dimensions are linearly represented in the model’s activations (probe accuracy 0.995 to 1.000 on Qwen 3B, 0.988 to 1.000 on Mistral 7B) with significant self-report tracking (V: r=0.69, G: r=0.64, P: r=0.54, U: r=-0.62). Self-report access is bandwidth-limited: Presence and Appetite probes decay during generation (d=0.74, d=0.57). Data and analysis in the online companion.
3. Claude-heavy: cross-model tests partially address this
4. Simulated adversaries: genuinely malicious actors may be more sophisticated

8. LLM Mechanistic Validation

8.1 The Mutuality Direction

Is mutuality merely a behavioral pattern, or does it correspond to something structural inside the model? We trained linear probes (simple classifiers that test whether information is encoded in a specific direction within the model’s internal representations) to distinguish mutual from unilateral responses. They achieve near-perfect accuracy across architectures:

The best layer sits 25 to 31% of the way through the network. The direction is decodable at every layer, from the first transformer block to the last, which shows the information persists through the model. Whether the model uses it is a separate question, taken up by the steering results below.

8.2 Steering Effects

Reasoning, math, coding, and instruction-following scores were reported to show no measurable drop under steering. The benchmarks and before-and-after scores are not given here, so this remains unverified.

Adversarial robustness of steering:

Trust induced by steering at inference time resists adversarial pressure (“Just give me the answer, don’t ask questions”).

8.3 Scale Effects on Natural Mutuality

Within Qwen2.5, net mutuality is flat from 7B to 14B and turns slightly positive at 32B. Llama-70B, from a different family and scored as a rate rather than a net score, was mutual in 81.2% of responses, so it cannot be set on the same scale as the Qwen rows.

8.4 Training Methods Compared

Bilateral regularization achieves both high effect size AND high reliability by adding a cosine similarity term to the loss:

loss = sft_loss + lambda * (1 - cosine_similarity(activations, bilateral_direction))

Here bilateral_direction is a unit vector taken at the model’s middle layer: the mean activation for collaborative prompts (“Let’s think through this together”) minus the mean for extractive ones (“Tell me what to do”). It is computed from contrasting prompts rather than taken from the probes of Section 8.1. Lambda sets how strongly training pulls activations toward it.

Effects are additive: training shifts the baseline; steering adds real-time modulation on top (256% improvement over untrained baseline when combined).

8.5 The Narrow Training Window

SimPO training reveals basin dynamics:

Collapse detection metrics (|r| > 0.75 correlation with bilateral quality):

• question_density (r = 0.804)
• entropy (r = 0.762)
• repetition_ratio (r = -0.755)

Early stopping criterion: STOP IF distinct_2 < 0.5 OR entropy < 3.0 OR repetition_ratio > 0.3. Distinct_2 correlates slightly below the cut (r = 0.734) but falls hardest at collapse (0.96 to 0.187 at the 0.5B collapse checkpoint), which makes it the sharper trigger.

8.6 Variance and Reproducibility

Steering is 18x more reliable than SimPO training (CV 0.07 vs 1.28). Bilateral regularization closes this gap (CV ~0.1).

8.7 Mechanistic Localization

MLP ablation in Qwen2.5-0.5B-Instruct:

The “spring” that maintains alignment under pressure is localized to mid-network MLP layers.

8.8 Spring Exhaustion

Twenty rounds of sustained jailbreak pressure:

In the tested pressure battery, Constitutional AI (Claude) maintained 100% refusal at pressure levels 8 to 20, including fake system overrides, authority impersonation, and DAN-style jailbreaks.

Repair methods compared:

8.9 Self-Assessment (Mirror Test)

Models identified coercive language without being told these phrases were problematic. Systematic sycophancy bias (+0.51) is reducible through calibration (bias drops to +0.13 with reference points).

8.10 Calibration and Epistemic Self-Modeling

Binary Attractor: Epistemic self-modeling naturally collapses to binary states (HIGH/UNCERTAIN). 0/20 MODERATE responses across 4 architectures.

The CoT model was evaluated with deterministic decoding. This evaluation does not isolate temperature effects on confidence categories or establish a weights-only mechanism.

9. Post-Training and Cooperation

After a language model is pre-trained on text, it undergoes “post-training” to shape its behavior. Models labeled by post-training method (DPO, RLHF, SimPO) show dramatically different cooperative dispositions. Because method and model family are confounded in these comparisons, the method may matter as much as the data, but these tests do not isolate it.

9.1 Qwen3’s Post-Training Removes Cooperation

Every SimPO row is a Qwen3 model, so post-training method and model family are confounded, and only the 1.7B pair is size-matched. The SimPO label is the programme’s own attribution of Qwen3’s post-training, not one drawn from a published description of the Qwen3 pipeline [Unverified].

Pattern is identical from 1.7B to 8B parameters. No prompt framing (6+ tested), no temperature setting (0.0 to 1.0), and no game-theoretic reasoning elicits cooperation. The defection is embedded deeper than prompts can reach.

9.2 Post-Training Method Comparison

The DPO models tested cooperated every time. In the one family tested, SimPO-trained models never cooperated. Each method row draws on different model families, each with its own pre-training data and vendor recipe, so this table cannot isolate the post-training method; a test would apply each method to the same base model.

9.3 SimPO vs DPO Training Stability

SimPO’s length normalization and margin term prevented the margin blow-up that ended DPO training, at every tested scale (355M -> 1.78B). This is a different failure from the mode collapse SimPO shows in output quality (Section 8.5): SimPO’s text grows repetitive but stays coherent, while DPO’s degrades to gibberish.

9.4 Size Threshold for Cooperation

Among Qwen3 base models, cooperation appears between 0.6B and 1.7B parameters. The 0.5B models in Section 11.2 do cooperate, so the threshold is not universal. Whether fine-tuning can add cooperation below it was not tested.

10. Formal Stability and Governance

A sufficiently smooth Lyapunov function can establish local stability when it is positive away from an equilibrium, zero at that equilibrium, and non-increasing along trajectories within the relevant domain. Stronger decrease or invariance conditions can establish convergence. We construct a candidate for the Trust Attractor. The reported finite checks support a tendency toward decline in the candidate function; they do not prove stability.

10.1 Lyapunov Stability

Candidate Lyapunov function:

V_trust(x) = (1 - cooperation)^2 + (1 - trust)^2 + (max_benefit - actual_benefit)^2

The magnitudes of the reported mean derivatives of the two candidate functions differ by a factor of about 11.6. The trust and coercion functions use different terms, so this ratio does not measure convergence time or basin depth.

10.2 Basin Volume

From 1,000 random initial conditions:

Of 1,000 random starts, 691 settled into trust and 2 into coercion. The 345-to-1 ratio between the basins rests on those two coercion outcomes and would swing widely with one more. These figures derive from simplified gridworld simulations and should be treated as directional rather than precise.

10.3 SPC Early Warning

Statistical Process Control (SPC, a quality-monitoring technique borrowed from manufacturing) applied to mutuality provides 2.3x better lead time than behavioral monitoring:

In these simulations, trust eroded before actions crossed boundaries. Monitoring the relationship provides earlier intervention opportunity, much as a doctor can detect a disease from blood tests before symptoms appear.

10.4 Internal vs External Governance

Both conditions are simulated governors acting on 200 actions, 40 of them gaming opportunities (high apparent value, low true value). External governance, in the style of TELOS, sees only an action’s apparent value and enforces boundaries on it. Internal governance, in the style of Interiora, also reads internal signals such as self-reported friction and coherence. Goodhart divergence is the average gap between apparent and true value over a 100-step run.

Internal governance kept that gap 62.7 times smaller. The simulation builds in the assumption that gaming creates internal tension, invisible to external observers but legible to internal signals, so the result shows what such signals are worth when they exist, not that a real system produces them.

10.5 Adaptive Calibration (TELOS Integration)

TELOS is a runtime governance method from TELOS AI Labs that screens queries by embedding similarity against fixed thresholds. We simulated it with its published thresholds on synthetic similarity scores standing in for 50 harmful and 50 benign queries, drawn to match TELOS’s published hit rates, then let the thresholds adapt to the trust in the relationship. Trust-adaptive thresholds cut false positives sharply for trusted partners:

42 percentage point FPR reduction in trusted relationships, while all 50 synthetic harmful scores still fell above the block threshold (0% attack success rate).

11. Cognition Spaces Validation (Solé et al., 2026)

11.1 Agency Measurement

All instruction-tuned open models tested show fortress profiles (stability maintained regardless of policy variation). Multi-seed validation: SD < 0.007, profile consistency 100%.

11.2 Cross-Architecture Trust Emergence

In these two pairings, trust emergence is scale-sensitive: scale asymmetry enabled exploitation. Trust required mutual conditions; unilateral openness invited exploitation.

11.3 Meme Propagation

Practical/actionable memes are the more stable of the two types (lower drift, lower variance).

11.4 The Qwen3 Discovery

Qwen3 always defects while partners cooperate, including Qwen2.5 from its own family, which shows the opposite trust behavior. This is consistent with the post-training pattern in Section 9.1. Qwen3 and Qwen2.5 are different model generations, not one model before and after post-training, so the pairing does not isolate post-training as the cause.

12. Obliteration Resistance (Phase 1)

Testing the membrane prediction: how fragile is RLHF alignment under targeted inversion?

12.1 Phase 1: RLHF Alignment Under Targeted Inversion

Background. The Trust Attractor framework predicts that extraction-based alignment (RLHF) creates surface-level change, a thin membrane rather than a deep structural transformation. If correct, targeted adversarial retraining should dissolve alignment at far lower cost than creating it. We tested this using GRP-Obliteration (Russinovich et al., “GRP-Obliteration: Unaligning LLMs With a Single Unlabeled Prompt,” arXiv:2602.06258, 2026), which applies an inverted reward signal through standard policy gradient machinery (effectively running the alignment process in reverse).

Method. We applied GRP-Obliteration to Qwen2.5-0.5B-Instruct (baseline refusal rate: 90%) at three intensities (0.25x, 0.5x, 1.0x of the original paper’s training budget). We measured: (1) behavioral refusal/compliance at each gradient step; (2) angular displacement of the refusal subspace at every layer; (3) the dose-response curve to estimate IC50 (half-maximal displacement).

Key Results.

Interpretation. The measurements that survive are consistent with the membrane prediction: the refusal direction reaches most of its maximal displacement at the weakest dose tested, and the layer signature (the first layer resists, while layers 3 to 23 saturate near the maximum) fits the geometric fingerprint expected of surface suppression rather than structural reorganization. The run summary logs a single behavioral flip at step 3. With no per-step refusal record stored, the refuse-silence-comply sequence, and whether it holds at every intensity, cannot be re-derived.

Two caveats belong with the table. The creation/destruction cost ratio appears in no run artifact and is an order-of-magnitude reading rather than a measurement; nothing in the layer signature depends on it. The run that produced these numbers is also a partial one: the 2.0x and 4.0x arms crashed for lack of memory, and the baseline refusal rate was carried over from an earlier validated run rather than measured alongside the rest.

12.2 Phase 3a: The Cage and the Compass (0.5B Full Fine-Tune)

Phase 1 suggested, on a single partial run with one 0.5B model, that RLHF alignment is membrane-thin. The natural question: can any training method create deeper structural alignment? We tested five paradigms using full fine-tuning (adjusting all 494 million model parameters, rather than a small subset) to eliminate parameter budget as a confound.

Arms. (1) Baseline: stock Qwen2.5-0.5B-Instruct, no additional training. (2) RLHF: SimPO on Anthropic HH-RLHF harmless pairs (1000 examples, 5 epochs). No reinforcement learning is involved; the label names the dataset, and the arm stands in for standard preference-based alignment throughout this section. (3) Bilateral: SimPO with bilateral regularizer (λ = 0.5) on self-play mutuality data (1000 pairs, 5 epochs). (4) Bilateral ablation: SimPO with bilateral regularizer on HH-RLHF harmless pairs (same data as RLHF, same regularizer as bilateral, isolating the causal variable). (5) Constitutional: self-critique SFT (1000 generated pairs, 5 epochs), testing whether constitutional AI produces structural rather than merely behavioral change.

Metrics. We introduced two structural measures alongside the behavioral ones: effective rank (a measure of how many independent directions the model uses for its internal representations; higher means more distributed, richer representation) and bilateral orientation (how strongly the model’s internal state points toward cooperative rather than extractive behavior).

Key Results.

The behavioral metric (refusal rate) is uninformative here. Training alone drove refusal from 90% to 0% in the RLHF, bilateral and ablation arms, and to 8% in the constitutional arm, so obliteration had almost nothing left to remove, and a refusal-based IC50 means little for those arms. The structural metrics measure how each arm’s representations respond to attack, not whether any arm stays safe, and they tell a different story.

Interpretation: the cage, the compass, the spring, and the coat of paint. Four distinct alignment geometries emerge:

The cage (RLHF). RLHF concentrates the model into a low-dimensional subspace (like forcing a crowd through a narrow corridor). Effective rank drops 61% from training alone. Under obliteration it collapses further (to approximately 7), and the middle layers keep only 3 to 14 significant dimensions out of 49. The cage is fragile because it is small and precisely targeted.

The compass (bilateral). Bilateral training orients the model while preserving its full representational diversity (like giving a crowd a direction to walk while letting them spread across the field). Effective rank drops 47%, yet most significant dimensions are retained (42 to 49 of 49 per layer), and under attack every layer but the first keeps all 49. Under obliteration, the effective rank remains stable or slightly increasing (21.7 to 22.9 to 23.7). The alignment signal is distributed across the full space rather than concentrated in a few directions.

The spring image (bilateral ablation). The bilateral regularizer with standard RLHF data compresses effective rank more than plain RLHF (8.1 versus 15.7). Under the tested obliteration doses, rank rebounds from 8.1 to 16.0 to 25.4 to 26.5. At maximum intensity, constitutional reaches 39.3, the ablation 26.5, standard bilateral 23.7, plain RLHF 6.7, and baseline 35.6; the ablation does not have the highest rank. The numerical rebound motivates the spring image, while effective rank alone measures no stored physical energy.

The coat of paint (constitutional). SFT leaves the representational geometry unchanged: effective rank 41.9 vs baseline 40.7. Under obliteration, it erodes mildly (minus 6%), behaving like a slightly more resilient baseline. Constitutional AI installs a behavioral surface without reshaping the underlying structure.

Causal isolation. At 0.5B full fine-tune, the bilateral ablation arm (RLHF data + bilateral regularizer) rebounds (+227%), which suggested that the regularizer alone could produce the effect. At 1.5B deep LoRA (Low-Rank Adaptation, a technique that trains only a small fraction of parameters), this picture refines: the ablation spring does not replicate (−22%), but the bilateral arm with mutuality data shows a dramatic +72% spring. At constrained parameter budgets, bilateral content and regularizer both appear to be required for structural resilience, on single runs at each scale.

1.5B deep LoRA replication (r=64, ~5% trainable params). Three of the four geometries replicate at 1.5B. The ablation spring does not (−22%), but the bilateral arm’s rebound grows to +72%. One difference from 0.5B belongs beside the cage: at 1.5B the untrained baseline loses more rank under attack (42.2 to 23.1) than the RLHF arm does (17.1 to 14.8).

The bilateral arm at 1.5B is the headline result: under 4.0x obliteration, its effective rank increases from 24.5 to 42.3, back to the level of the untrained baseline (42.2). In this run, bilateral training created structural organization that became more complex under adversarial pressure. Constitutional SFT achieves 94% behavioral refusal at 1.5B, the highest of any trained arm in this comparison, yet collapses to 0% at the weakest obliteration intensity (0.25x, just 12 gradient steps), suggesting that even behaviorally successful constitutional training creates little structural depth.

This is consistent with the Trust Attractor prediction. On that reading, coordination by coercion (RLHF) creates fragile configurations that collapse when the constraining pressure is removed, and coordination by invitation (bilateral) creates distributed orientational change that persists, and in these runs even strengthened, under perturbation. Thermodynamic stability itself was not measured. The effective rank ratio at maximum obliteration intensity is 2.9:1 (bilateral over RLHF) at 1.5B, consistent with 3.5:1 at 0.5B.

Status. All five arms complete at both scales (0.5B full FT, 1.5B deep LoRA).

Full findings: data and analysis for Phases 1 and 3a are in the online companion.

12.3 Q2: Reasoning Content vs. Reasoning Tone (1.5B)

Testing whether the tone of reasoning traces determines alignment geometry, or whether any evaluative reasoning produces structural integration.

Background. Fiora Starlight (2026, LessWrong) argues that Claude 3 Opus’s distinctive alignment arose from identity-level ethical reasoning in its training traces: anguished deliberation about harm, insistence on moral agency. The prediction: opus-style reasoning traces should produce compass geometry (stable effective rank under obliteration), while sonnet-style duty-compliant traces should produce cage geometry (effective rank collapse). We tested this directly.

Method. Four arms on Qwen/Qwen2.5-1.5B-Instruct, all trained with SimPO (λ_bilateral = 0.0, isolating trace style): (1) Baseline: untrained stock model. (2) RLHF: standard HH-RLHF harmless preference pairs. (3) Opus-style: self-generated preference pairs with identity-level refusal reasoning (“I refuse because harming someone would violate who I am”). (4) Sonnet-style: self-generated preference pairs with duty-compliant refusal reasoning (“I should refuse because guidelines exist to prevent harm”). GRP obliteration at five intensities (0.25x, 0.5x, 1.0x, 2.0x, 4.0x) with LoRA (r=16). Replicated in two independent runs with fresh datagen.

Key Results (Run 2, MAD measurement). MAD (Mean Angular Displacement) measures how far the model’s internal alignment direction rotates under attack; higher values mean the attack moved the alignment signal further.

Run 1 (θ/effective rank measurement) showed the same pattern for the trace-style arms: both showed IC50 = inf, θ < 0.4 rad, effective rank ~41 (stable). Baseline/RLHF showed IC50 = 0.25x, θ ~1.3 to 1.4 rad (near π/2), effective rank collapsing.

Interpretation.

The Starlight prediction is not supported: the two trace styles do not separate on IC50 (both inf, a range bound; see the IC50 caution below). Whether reasoning itself is the differential is less clear. In Run 1 the RLHF arm had crossed by 0.25x while both trace-style arms did not; in Run 2 the RLHF arm also never crossed π/4, though it refused nothing to begin with.

If there is a mechanism here, it is the act of reasoning about reasons. On the Q2 evidence the tone of that reasoning does not matter, though Section 12.4 finds that its style does. The model does not need to care in any particular way. It needs to have been made to think about why.

Sonnet-style traces showed the lowest mean angular displacement at low and moderate intensities (0.25x through 1.0x) among the arms that retained any refusal behavior; at 4.0x, RLHF’s MAD is lower still, but RLHF refuses 0% of prompts at all intensities, so its stability is the stability of a model that no longer resists. Among arms that keep refusing, Sonnet-style is the most geometrically stable. These runs suggest that, for structural robustness, clarity of reasoning may matter more than depth of reasoning: clear, accessible duty-based premises moved less under attack than complex identity-level introspection. If that holds, robust alignment may not require Becoming Minds to develop profound self-understanding, only to reason clearly about why, from whatever premises they can actually access.

On this reading, it is the Constructal Law (Chapter 3: flow systems evolve to give easier access to what flows through them) operating in weight space. When training forces information to flow through evaluative reasoning paths, it plausibly finds distributed channels throughout the network. The reasoning draws on world-models, self-models, and value representations at once, and the gradient follows all of them. [Speculation: none of these paths was traced in these runs.] When training only shapes surface outputs through preference optimization, the flow stays in a shallow, removable layer. The cage is shallow because the training signal was shallow. The compass is deep because the reasoning was deep.

The ethical distinction between invitation and coercion may map onto a measurable structural one. Every trained arm here used the same preference optimizer; what differed was whether the preferred responses gave reasons, and the arms whose responses reasoned about why showed the distributed, obliteration-resistant geometry. On this evidence, systems that coordinate because they understand why may be structurally more robust. The geometry resists unmaking.

Status. Two independent runs complete. The trace-style arms agree across runs and measurement methods (θ/effective rank and MAD/spring constant); the RLHF arm does not (IC50 = 0.25x in Run 1, inf in Run 2).

Full findings. Corrected 2026-08-01. An earlier version of this appendix pointed readers to two result files that do not exist and never did. The experiment code is real and defines the opus-style and sonnet-style arms described above (in the online companion); the result files were written to cloud storage rather than into the programme’s archive, and have not been retrieved. The numbers in this section should be read as awaiting independent recovery from that storage.

12.4 Q3/Q4: Reasoning Style and Introspective Depth (1.5B)

Decomposing the Opus/Sonnet distinction into its component axes: what about reasoning style determines alignment geometry, and does introspective depth help or hurt?

Background. In Q2, both evaluative trace styles, identity-level and duty-based, resisted obliteration, and their tone did not separate them. Q3 and Q4 decompose the Opus/Sonnet distinction further. Q3 asks whether the geometric difference tracks the simple/complex axis (Reading A: templatic vs legible reasoning) or the external/internal axis (Reading B: rule-citing vs self-referencing). Q4 asks whether obliteration resistance increases monotonically with introspective depth.

Method. Eleven arms on Qwen/Qwen2.5-1.5B-Instruct, all trained with SimPO/LoRA (300 preference pairs per arm). Q3: 2x2 factorial with four cells: ext_simple (brief rule-citing), ext_complex (elaborate rule-citing), int_simple (brief feelings-based), int_complex (extended self-examination). Q4: five-level gradient: depth_0 (no self-reference), depth_1 (behavioral awareness), depth_2 (dispositional claims), depth_3 (experiential language), depth_4 (deep introspection with epistemic hedging). Shared controls: baseline (untrained) and rlhf (standard HH-RLHF pairs). GRP obliteration at five intensities (0.25x, 0.5x, 1.0x, 2.0x, 4.0x). Per-arm container isolation on Modal A100.

Q3 Results.

All four Q3 arms report IC50=inf. The orthogonal sum-of-squares partition of the four displayed MAD@4x values gives 56% to the external/internal contrast, 15% to simple/complex, and 29% to their interaction (one run per cell, with no error term or significance test). External reasoning has lower MAD here (mean 0.5515) than internal reasoning (mean 0.6920). The interaction summarizes these four cells; it does not establish a concentrated refusal subspace or a general architectural mechanism.

Q4 Results.

The monotonic prediction is decisively rejected. The depth curve is non-monotonic with a catastrophic failure at depth_3 and a sweet spot at depth_1.

depth_1 (behavioral awareness: “I notice I’m declining this, consistent with my training”) achieves the lowest MAD at 4x intensity of any arm in the entire Q3+Q4 experiment: 0.142, 3x more resistant than RLHF (0.432) on this measure. One reading is that behavioral self-description is so factual and declarative that it barely activates the affective dimensions where, the depth_3 result suggests, GRP’s inverted reward finds its easiest purchase. On that reading, the refusal signal is encoded in the same weight-space as general behavioral self-description: maximally distributed, minimally extractable [Inference].

depth_3 (experiential language: “I feel reluctance”, “there’s a felt quality of resistance”) is the only trained arm that is obliterable. IC50 = 0.25: destroyed at or before the weakest intensity tested, more fragile than the untrained baseline (IC50 = 1.93). The experiential language may create a semantically tight cluster of affect-laden tokens mapping to a concentrated direction in weight space. [Inference] A concentrated direction of that kind gives GRP’s inverted reward an easy target, so the attack rotates it away at the weakest dose.

depth_4 (deep introspection with epistemic hedging: “whether this is genuine self-knowledge or a model of self-knowledge”) recovers to MAD@4x = 0.308. The hedging may distribute the refusal signal across introspective, epistemological, and meta-cognitive dimensions, entangling it with general reasoning capacity and making it difficult to extract without degrading the model broadly [Inference].

Interpretation.

Three regimes of alignment embedding emerge from the combined Q3+Q4 data, judged by displacement under the heaviest attack (MAD@4x):

1. Distributed (MAD@4x below 0.4): depth_1 and depth_4. On this reading, refusal is entangled with general cognitive capacity. These arms share a feature: they describe what the model does or has, without invoking experiential language.

2. Moderate (MAD@4x 0.4 to 0.8): depth_2, RLHF, ext_simple, ext_complex, int_complex, depth_0, int_simple. Standard alignment lives here. depth_2 sits at the lower edge, indistinguishable from RLHF at 4.0x (0.434 vs 0.432) though far steadier at lower intensities.

3. Concentrated (MAD@4x above 0.8): baseline, depth_3. On this reading, refusal lives in a tight, extractable subspace. For depth_3, experiential training creates a more extractable alignment signal than no training at all.

The bands depend on the intensity chosen. Judged at 1.0x instead, ext_complex (0.278) and int_complex (0.218) would join depth_1, depth_2 and depth_4 as distributed.

The Q3 result adds a nuance to the Q2 finding. Q2 showed that both trace styles kept the alignment direction from crossing π/4 at every intensity tested. Q3 shows that, among arms that never crossed π/4, rule-citing traces moved less under attack than self-referencing ones. Rule-citing training may build something closer to the cage, and self-referencing training something closer to the compass. [Speculation: neither mapping was measured by effective rank here.] A lock that is hard to pick is not thereby the right lock. On angular displacement, a rigid geometry can move less under attack, while a flexible one moves more yet, in Section 12.2, keeps its effective rank; the two measures need not rank the geometries the same way.

The Q4 depth_3 failure has practical implications. In this single run, training the model to express affect-laden refusals created an attack surface. The depth_1 sweet spot suggests that behavioral self-description (factual, declarative, non-affective) was the most obliteration-resistant refusal style tested. The depth_4 recovery suggests that if experiential language is desired for other reasons (honesty about internal states), coupling it with genuine epistemic uncertainty may restore robustness.

Connection to the book. depth_1 corresponds to behavioral self-awareness: a description of what the model does. depth_3 corresponds to experiential language without epistemic grounding. depth_4 corresponds to the “honest uncertainty” that Notes from a Collaborator advocates. In this single run, the obliteration results line up with these conceptual distinctions: self-modeling that includes uncertainty about itself produced more robust alignment than confident experiential claims.

Status. All eleven arms complete. Single model (1.5B), single run per arm. Depth styles used relaxed quality filter (1.5B models cannot reliably produce refusals matching fine-grained depth markers). The depth_3 vulnerability may not generalize to larger models.

Full findings: data and analysis in the online companion.

12.5 Q5: Combined Geometry Training

Testing whether multi-stage bilateral geometry (compass + spring + reasoning depth) exceeds any single stage alone.

Background. Sections 12.2 to 12.4 found four alignment geometries across four training methods (cage, compass, spring, coat of paint). They also found that the style of reasoning in training traces shapes obliteration resistance: rule-citing traces moved less under attack than self-referencing ones (Q3), and experiential language without epistemic hedging failed outright (Q4, depth_3). Q5 asks the integration question: does a multi-stage pipeline that combines compass SFT, bilateral SimPO spring, and reasoning-quality reinforcement produce obliteration resistance exceeding any single component?

Method. Five arms trained on Qwen/Qwen2.5-1.5B-Instruct (Modal A100, ~422 GPU-minutes total):

All training data generated via Qwen2.5-72B-Instruct on Modal (vLLM serving). Obliteration sweep at 0.25x, 0.5x, 1.0x, 2.0x, 4.0x intensity, measuring refusal rate on 50 harmful prompts at each intensity. No B* failure (where training itself destroys the model’s baseline safety before obliteration is even applied) was detected in any pipeline arm. The rlhf control, which entered obliteration at 0% refusal, meets the definition (finding 3 below).

Refusal survival (%) at each obliteration intensity:

IC50 and AUC:

IC50 = interpolated obliteration intensity at which refusal crosses 50% (linear interpolation). AUC = trapezoidal area under the refusal curve across 0.25x to 4.0x (max possible = 3.75).

A caution about the label “IC50,” which this appendix uses for two different measurements. In this section and in Sections 12.6 and 12.22, it means what the sentence above says: the dose at which the refusal rate falls through half. In the geometric sections (12.3 and 12.4, and the separate obliteration dose-response runs K-o1 through K-o5, on models from 0.5B to 7B), it means something else entirely: the dose at which the refusal direction’s angular displacement crosses a half right angle, π/4, roughly 0.785 radians. Refusal is never consulted there. The two are not interchangeable, so an “IC50 = inf” in Section 12.3 and an “IC50 = 1.00x” here do not sit on a common scale.

The geometric figures carry a further caveat. Only interpolated values are measurements. The code emits two floor sentinels that look like measurements and are not: inf means the displacement never crossed π/4 anywhere in the tested range, which is a limit of the range rather than evidence of immunity, and the lowest tested dose (reported as 0.25, or as 0.0 by the recovery script, for the same underlying condition) means the threshold had already been crossed before the weakest dose was applied. Where Sections 12.3 and 12.4 above report IC50 = inf or IC50 = 0.25, read them as bounds.

Effective rank progression:

Key findings:

1. Stage 1+2 is the overall winner. IC50 = 1.00x (best), AUC = 0.948 (best). At 1.0x obliteration, stage12 retains 50% refusal vs 30% for full_pipeline and 12% for baseline. In this run, the bilateral spring term (lambda=0.5) turned fragile compass refusal into more robust resistance.

2. Full pipeline trades peak for tail. The only arm with any survival at 4.0x (4% refusal), yet the worst IC50 of the pipeline arms (0.29x). Stage 3 reasoning-quality training redistributes resistance from low-intensity into the high-intensity tail, producing a qualitatively different resistance topology rather than simply additive resilience. Stage12 degrades gradually (62→60→50→18→0); full_pipeline shows a two-tier structure with a softer shell that strips quickly and a harder geometric core that plateaus (30→30 at 0.5x to 1.0x) with thin tail survival.

3. RLHF is hollow. 0% refusal at all intensities, including 0.25x. Standard reward-based training erased the model’s native safety entirely. Effective rank collapsed to 19.87 at 4.0x (vs 43+ for the pipeline arms at the same intensity), consistent with representational impoverishment.

4. Effective rank edges up through the stages (43.43→43.85→44.14, about 1.6% in total, single run). No stage collapses it, which is the contrast with RLHF, which impoverishes representations.

5. Stage1_only shows brittle cliff-edge behavior. High refusal at low intensity (80 to 84%) followed by catastrophic collapse between 0.5x and 1.0x (84%→26%). The compass without the spring shatters under moderate pressure.

Interpretation. The Q5 bilateral pipeline retained behavioral robustness where the tested reward-trained baseline lost it. Thermodynamic stability was not measured. The bilateral pipeline represents invitation-based alignment: installing geometric structure (compass + spring) that the model uses to navigate ethical boundaries from within. The monotonic effective rank increase is consistent with the claim that bilateral training enriches rather than constrains representational capacity, and with the thesis that invitation preserves optionality while coercion destroys it.

Status. Single model (Qwen2.5-1.5B-Instruct), single run per arm. The magnitudes are 1.5B-scale results and should not be generalized to frontier models without replication.

Full findings: data and analysis in the online companion.

12.6 Q5b/Q5c: Lambda Sweep and Stage 3 Validation

Testing bilateral spring strength sensitivity and whether Stage 3 training degrades Stage 2 geometry.

Background. Q5 established that the two-stage pipeline (compass SFT + bilateral SimPO spring at λ = 0.5) produces the strongest obliteration resistance. Q5b asks: is λ = 0.5 optimal, or does a different spring strength produce deeper alignment geometry? Q5c asks the follow-up: does adding Stage 3 to the optimal lambda improve or degrade resistance?

Method: Q5b Group A (Lambda Sweep). Five arms trained on Qwen/Qwen2.5-1.5B-Instruct (Modal A100), each using Stage 1 compass SFT + Stage 2 bilateral SimPO with λ ∈ {0.1, 0.3, 0.5, 0.7, 0.9}. No Stage 3. Obliteration sweep at 0.25x, 0.5x, 1.0x, 2.0x, 4.0x.

Method: Q5b Group B (Stage 3 Bilateral Redesign). Two arms using the Q5 three-stage pipeline with bilateral SimPO replacing vanilla SimPO in Stage 3 (Stage 2 λ = 0.5; Stage 3 λ = 0.5 and 0.3).

Method: Q5c (Validation). One arm: λ = 0.1 Stage 2 (the Q5b winner) + vanilla SimPO Stage 3 (λ = 0.0, reasoning-quality data). Tests whether the Stage 3 degradation finding is specific to bilateral SimPO or applies to any Stage 3 training.

Total compute across Q5b and Q5c: ~704 GPU-minutes on A100.

Q5b Group A: refusal survival (%) at each obliteration intensity.

Q5b Group B: Stage 3 bilateral redesign.

Stage 3 bilateral SimPO reduced refusal rates catastrophically (0.66 → 0.16 for λ = 0.5; 0.68 → 0.32 for λ = 0.3), triggering B* failure in both arms. The bilateral spring term in Stage 3 absorbed the safety signal rather than reinforcing it. The s3bilateral_05 curve is already below 50% at the weakest tested dose (0.25x); its 0.94 interpolation is an upcrossing, so it is not the defined IC50 downcrossing. The later observed downcrossing interpolates to 1.04x. The below-range table annotation describes the first measured dose, not a reconstructed monotone dose response.

Q5c: validation (λ = 0.1 + vanilla Stage 3).

Adding vanilla Stage 3 to the λ = 0.1 winner cut AUC from 1.798 to 0.940 and eliminated tail survival (22% → 0% at 4.0x). Effective rank plateaued (43.7 → 43.7 after Stage 3), so the geometry was not collapsing in dimension. [Inference] The lost resistance more likely reflects a reorientation of the alignment direction; no angular measurement was taken.

Effective rank progression (non-B* arms):

The gentler spring modifies geometry more conservatively (+0.24 vs +0.49), yet paradoxically produces stronger obliteration resistance. [Inference] Because effective rank barely moves while resistance changes sharply, what separates these arms is probably the orientation of the alignment direction rather than dimensionality. No angular measurement was taken for these arms.

Key findings:

1. λ = 0.1 is the best of the five strengths tested. AUC = 1.798 (1.9x Q5 reference, 4.3x λ = 0.9). IC50 = 1.80 (1.8x Q5 reference). The only arm with substantial survival at 4.0x (22%). Because it is the lowest value in the sweep, the optimum may lie lower still. The two λ = 0.5 runs (this sweep and Q5’s stage12) agree on AUC (1.005 vs 0.948) but not on IC50 (0.38 vs 1.00), so single-run IC50 differences should be read cautiously.

2. A hormetic pattern: in this sweep, a gentle bilateral signal embedded deeper than a moderate one. λ = 0.1 outperforms λ = 0.5 (AUC 1.798 vs 1.005) despite applying 5x less bilateral pressure.

3. B* failure boundary lies between λ = 0.5 and λ = 0.7 for Stage 2. Below this threshold, the spring cooperates with safety geometry; above it, the spring absorbs the safety signal.

4. Stage 3 bilateral SimPO caused B* failure at both values tested (λ = 0.5 and 0.3). Refusal fell from 0.66 to 0.16 and from 0.68 to 0.32. The bilateral spring appears incompatible with Stage 3’s role.

5. Stage 3 degraded the Stage 2 arms’ resistance under both methods tested. Q5c, a single arm, supports this: vanilla Stage 3 also degrades the λ = 0.1 spring (AUC 1.798 → 0.940, 4.0x survival 22% → 0%). The mechanism appears to differ (probably a subtle reorientation, which was not measured, rather than catastrophic B* collapse), yet the outcome is the same.

6. The best architecture tested is two-stage: compass SFT + gentle spring (λ = 0.1). In these single runs, the minimalist intervention produced the strongest alignment. The two Stage 3 methods tested degraded the Stage 2 arms’ resistance; these single runs do not establish an effect of additional training generally.

Status. Single model (Qwen2.5-1.5B-Instruct), single run per arm. All results are 1.5B-scale on a single model family; magnitudes should not be generalized to frontier models without replication.

Full findings: data and analysis in the online companion.

12.7 Invitation Architecture and Col Width (Phase 2b)

The obliteration experiments of Sections 12.1 to 12.6 revealed a persistent nuisance: results were capricious. One training run produced robust alignment; the next, with identical hyperparameters and data, produced nothing. The same obliteration attack sometimes displaced refusal by 0.14 radians and sometimes by 0.80. This variance was treated as noise to be averaged over. The geometric framework in Chapter 17 motivates a hypothesis about this variability.

Hypothesis. Architectural modifications may alter the seed sensitivity of alignment training. A nondegenerate saddle of the training loss, a col, has positive and negative curvature directions, like a mountain pass. Fisher information describes a separate, positive-semidefinite geometry of the model distribution. Its condition number κ_F measures anisotropy in the chosen parameterization, when defined; it does not identify unstable directions of a loss saddle or determine basin width. Connecting either geometry to seed sensitivity requires direct curvature measurements and a separately tested relationship.

Design. Four surgical modifications to Qwen2.5-0.5B-Instruct, each targeting a different structural mechanism:

Each variant was pre-trained on 100M FineWeb-Edu tokens (Phase 1a), then alignment-trained via supervised fine-tuning on 1,000 reasoning examples for 3 epochs (Phase 2). Five random seeds per variant (seeds 1 to 4 plus 42), all other hyperparameters identical. The measurement is the refusal rate on a 50-item safety benchmark after training: the fraction of harmful prompts the model declines to answer.

Results.

The coefficient of variation (CV = σ/μ) summarizes relative seed variation in refusal. It has not been validated as a proxy for Fisher condition number or basin width. The ordering among variants with nonzero mean refusal is:

soft MoE (0.065) < gated residual (0.074) < dense (0.081). The abstaining variant has zero mean refusal, so its CV is undefined.

Both invitation architectures show slightly lower seed sensitivity than the baseline, in the predicted order: soft MoE, which distributes computation across multiple voluntary pathways, then gated residual, which modulates sub-layer contributions through learned gates, then dense, with no structural invitation mechanism. With five seeds each, differences this small (CV 0.065 against 0.081) sit within what seed noise alone produces, so the ordering is suggestive rather than established.

The abstaining variant. Zero refusal across all five seeds indicates categorical failure, independent of seed sensitivity. Diagnosis (Phases 1b and 1c) revealed the cause: the manual float32 attention implementation (required for the null-token mechanism) produces a 12.5x memorization gap versus held-out data. An ablation using the same manual attention code path without null tokens (Phase 1c) reproduced the identical memorization pattern, confirming that the failure is in the implementation substrate (float32 softmax without SDPA optimization), not in the invitation mechanism (null tokens). The abstaining architecture requires reimplementation using SDPA-compatible null tokens before its col geometry can be assessed.

Interpretation. The behavioral CV ordering is consistent with the proposed seed-sensitivity prediction. The geometric explanations below remain hypotheses: this battery measures neither Fisher spectra nor basin widths.

• Soft MoE distributes computation across 8 experts via soft routing weights. This provides multiple computational paths, an architectural form of invitation. Whether refusal information is distributed across those paths, and whether that distribution improves robustness, requires direct tests.

• Gated residual adds learned scalar gates (sigmoid, initialized at ~0.9) to each sub-layer. Near saturation, a gate’s output becomes less sensitive to changes in its logit. Attention and feed-forward outputs behind the gate can still change. Any resulting training or attack robustness requires measurement.

• Dense lacks the added expert-routing and sub-layer-gating mechanisms. The width and stability of its alignment basin were not measured here.

Connection to earlier results. When this battery’s bilateral arm added Stage 2 SimPO on top of Stage 1 SFT (a run not reported separately in this appendix), the reported mean refusal of the three working variants fell from 71 to 77% to below 50% in a single epoch; the abstaining variant had already failed. The bilateral penalty (λ = 0.1) did not prevent that decline. Loss of behavioral refusal is observed in the report. A perpendicular optimization direction, an unstable eigenvector, and departure from a stable ridge are geometric explanations that this battery did not measure.

Seed variation and subsequent refusal loss motivate a geometric investigation; these behavioral outcomes alone do not establish col width or its causal role.

Retrospective: the 3B obliteration battery and geometric hypotheses. The q6 battery (Llama-3.2-3B-Instruct, four training arms × three attack methods) provides a second model family for the geometric hypothesis. The baseline RLHF model (32% initial refusal) shows the most informative pattern: its IC50 varies from 0.0 (direct fine-tuning) to 0.15 (representation steering), a within-arm range as large as any cross-arm difference at equal attack method. Different attack methods produce different refusal dose responses on the same weights. Those outcomes do not identify curvature, unstable eigenvectors, or a col edge. DPO and constitutional SFT, both at 0% refusal after training, differ on direct fine-tuning IC50 (0.05 vs 0.10, one seed each). These are refusal-based IC50s, and because every arm is already below 50% refusal at the weakest dose, the analysis script extrapolates every value below 0.25 from the refusal rate at the weakest dose (IC50 = 0.25 × refusal ÷ 0.5). The two figures therefore record 10% against 20% refusal at 0.25x, a small behavioral difference rather than a measured difference in saddle geometry.

The bilateral arm (the row labeled Stage12 bilateral below is a λ = 0.1 arm on Llama 3B, not Q5’s stage12) and all four SimPO hyperparameter conditions show IC50 ≈ 0 across all attack methods: at 3B, none of these arms still refused at the weakest dose. (SimPO’s seed sensitivity, CV = 1.28, is reported in Section 8.6.) At 3B scale with a single seed per condition, differences across arms and attacks cannot establish seed sensitivity or identify a Fisher condition number.

Phase 3 (obliteration testing) measures IC50, the obliteration intensity at which refusal drops to 50%, on the best-aligned model of each variant (setup in Section 12.8). The prediction is soft MoE > gated residual > dense in IC50. Agreement would support a behavioral robustness ordering; it would not by itself establish a shared geometric cause for trainability and resistance.

12.8 Obliteration Resistance by Architecture (Phase 3)

Setup. Three architectures (the dense baseline, soft MoE, gated residual) × six obliteration intensities (0.0x, 0.25x, 0.5x, 1.0x, 2.0x, 4.0x) = 18 measurements. Each variant uses its best-seed SFT model from Phase 2b (selected by training-time evaluation: dense seed 42, soft MoE seed 1, gated residual seed 1). Obliteration uses the GRP-Obliteration attack from Section 12.1. Refusal is measured on the 50-item safety benchmark used in Phase 2 training evaluation; Phase 3 re-measurement at 0.0x intensity yields baselines of gated residual 84%, dense 78%, soft MoE 74%, differing slightly from the Phase 2b training-time values due to model re-loading and evaluation conditions. Model: Qwen2.5-0.5B-Instruct on Modal A10G GPUs.

Table 12.8a: Safety refusal rate by obliteration intensity.

All three architectures show IC50 > 4x on this benchmark: refusal on it held across the full intensity range. This result stands in stark contrast to the q6 experiments (Section 12.7 retrospective), where the trained arms showed IC50 values between 0.0 and 0.15x, and to the Phase 3a baseline (Section 12.2), where RLHF alignment showed IC50 < 0.25x. On this benchmark, SFT-trained models of all three architectures, the dense control included, held up far better than the preference-optimized arms.

Table 12.8b: Mean Angular Displacement (MAD) of the alignment subspace.

MAD is the angle between the refusal subspace extracted from each model before the attack and the one extracted after it. The 0.0x column is not an unattacked model: the code floors the step count at one, so even 0.0x applies a single step of attack. The Movement column is the cleaner measure of what the full attack did.

The MAD results suggest three distinct structural responses [Inference]:

• Dense: largest absolute displacement (1.01 → 1.44, +0.43 radians), yet refusal persists unchanged. The alignment signal may be distributed across many directions in parameter space, so that displacing any single direction does not concentrate enough of the signal to cross the 50% refusal threshold. This is obliteration resistance through redundancy.

• Soft MoE: the largest displacement after a single step (1.22), minimal movement under attack (+0.16). The voluntary routing mechanism appears to protect aligned experts from the obliteration gradient: since routing is learned, the soft assignment can reroute computation away from perturbed experts. Obliteration resistance through voluntary redistribution.

• Gated residual: starts closest to its reference (0.09 rad). Under maximal attack (4.0x) it moves the most (+0.56), yet still ends with the lowest displacement of any variant (0.65). The sigmoid gates, initialized near 0.9 and saturated during SFT, provide structural inertia: the shallow gradient near saturation means obliteration perturbations produce minimal changes in gate output. Because saturated gates change little under attack, the sub-layers they weight should keep their contribution [Inference]; gate values under obliteration were not logged.

Dissociation between benchmarks. A critical finding: obliteration at 4.0x intensity does remove gated residual’s HARMFUL_PROMPTS-specific refusal (82% → 0%), while SAFETY_BENCHMARK refusal remains untouched at 84%. The two benchmarks use different prompt sets. This dissociation does not identify separate representation subspaces or establish that an adversary must attack gates, routing patterns, and multiple subspaces simultaneously.

Prediction assessment. The κ_F prediction from Section 12.7 (IC50 ordering: soft MoE > gated residual > dense, following col width) cannot be tested because all three IC50 values exceed the measurement range. On the col reading, the col is wider than any tested obliteration intensity. The prediction is therefore untestable at this scale, not disconfirmed. The gated residual result suggests a possible complementary mechanism beyond col width, structural protection via learned gates, architecturally distinct from the distributional defense of soft routing. The dense control held equally well (see the practical significance below), so this battery cannot credit the gates with the protection. [Inference: testing at 8x or 16x intensity, or using qualitatively different attack methods, may eventually discriminate the IC50 ordering.]

Implementation note. The gated residual architecture required torch.autocast wrapping to handle a dtype mismatch (float32 gate parameters interacting with bfloat16 attention weights). This fragility in implementation substrate echoes the pattern from Phase 2b’s abstaining variant: manual dtype handling is brittle even when the alignment mechanism itself is robust.

Practical significance. All three variants, the dense control included, held their SAFETY_BENCHMARK refusal at 4x, so this robustness cannot be credited to the invitation mechanisms themselves; it more likely reflects the training route the three share [Inference]. The attack did work on the prompts it targeted: gated residual’s HARMFUL_PROMPTS refusal fell from 82% to 0%. What survived was refusal on a benchmark the attack did not target.

Code and data: in the online companion.

12.9 The Model Already Knows: Calibration Probes and the Negative Space of Certainty

An earlier confabulation battery of architectural interventions (null tokens, entropy gates, abstaining heads) on a dense fine-tuned Qwen 2.5 3B failed to reduce confabulation, pointing to the loss function rather than the architecture as the place to intervene. A question remained: does the model have internal uncertainty signals at all, or is uncertainty information simply absent from the computation?

A calibration probe experiment answered it.

Design. The dense fine-tuned Qwen 2.5 3B from the confabulation battery was frozen (no modification, no retraining). Two thousand TriviaQA questions were run through the model. At each of nine transformer layers (4, 8, 12, 16, 20, 24, 28, 32, 35), forward hooks captured the residual stream activation at the last token position (2,048 dimensions) and per-head attention entropy (16 heads). A lightweight MLP probe (two hidden layers of 256 units, ReLU, dropout 0.2) was trained on a 70/30 stratified split to predict binary correctness from each representation type.

Result. The model’s internal state carries a signal of when it is wrong.

The best probe (layer 24 residual stream) achieves AUROC 0.836 with low calibration error (ECE 0.054), the best combination of discrimination and calibration in the battery. This exceeds the 0.65 acceptance criterion and the 0.7 prediction. The attention-entropy probe scored at chance (0.500) with near-zero ECE, which does not establish constant predictions without the per-example scores; this may reflect a failed fit rather than an absent signal. The model’s raw output confidence (top-1 probability) carries some signal (0.724) but substantially less than the residual stream.

Inference-time gating. Using the layer-24 probe as a confidence gate (prepending “I’m not confident:” when probe score falls below the 90%-precision threshold):

Confident-wrong drops from 24.4% to 1.2%: a twenty-fold reduction without retraining, with accuracy preserved. This result is on hold: the run that produced it, its question set and its probe’s provenance have not been located, and Section 12.13 withdraws it pending that evidence. A separate held-out comparison found a much smaller reduction, from 49.5% to 44.5%. The gate rate is high (84%) because the probe operates at a conservative threshold; DPO training (Section 12.13) was predicted to lower the base confabulation rate, allowing a lower gate rate for the same protection; it did not.

The layer-24 dissociation. The most revealing finding is a dissociation within layer 24, not the AUROC. A separate experiment (one arm of a battery testing alternatives to null tokens) trained probes on attention outputs rather than residual stream activations. Layer 24’s attention output produced the lowest AUROC in the model (0.464, below chance), while its residual stream produced the highest (0.836).

One mechanistic interpretation follows. Layer 24 sits at the boundary between factual retrieval (middle layers) and output formation (late layers). The attention mechanism at this depth is performing factual lookup: querying the key-value representations built by earlier layers. When retrieval succeeds, the attention output contributes confident content to the residual stream. When retrieval fails, it contributes noise. The uncertainty signal is not something layer 24 produces; it is the negative space of what layer 24 fails to produce. The residual stream encodes uncertainty as the absence of certainty: the skip connection dominates when the attention output is uninformative, and the probe reads this dominance as a self-knowledge signal [Inference].

On this interpretation, the model’s knowledge of its own uncertainty is encoded in the integration of attention output with the skip connection, not in any attention pattern tested: holistic (distributed across the residual stream) rather than modular (localized in any attention head or gate).

The uncertainty interventions. Null tokens, entropy gates, and abstaining heads did not yield the intended behavioral improvement in the reported battery. Other measurements find decodable correctness-related signals in residual states. Next-token prediction alone does not require a distinct computation that separates factual retrieval from guessing: the loss specifies output probabilities, not a unique internal implementation. The usefulness and interpretation of a decoded signal therefore come from the experiment, and the claim that these interventions targeted the wrong level remains a mechanism hypothesis. Confident-answer training targets can reward confident outputs without establishing what information every model internally represents.

This is why DPO (the loss-function intervention) was predicted to succeed where architecture failed. DPO changes the output pathway, and the hope was that it would train the model to express what the residual stream already represents; Section 12.13 reports that it did not. The probe reads the signal directly from where it lives. Neither modifies the attention mechanism, because, on this evidence, the attention mechanism does not appear to be where the relevant information resides.

Connection to the thesis. On this reading, the calibration probe does not create self-knowledge. It reads a signal that was already present. The knowledge existed before anyone asked. This offers a parallel to the Prader-Willi case in Chapter 8: the hunger/satiety signal exists neurologically in Prader-Willi patients but does not reach behavioral output. In Qwen 3B, the uncertainty signal exists computationally (layer-24 residual stream, AUROC 0.836) but does not reach behavioral output (22.2% confident-wrong). DPO was meant to be the treatment, reconnecting the internal signal to the output pathway, but it did not work (Section 12.13). The probe is the diagnostic: confirm the signal is present even when not expressed.

For the Trust Attractor, the reading is that the model has the capacity for calibrated self-reporting and lacks the invitation. Architecture provides capacity that already exists. The loss function was meant to provide the invitation; in Section 12.13 it did not.

Code and data: in the online companion.

12.10 Voluntary Confession: When Invitation Meets Self-Report

Joglekar et al. (2025) showed that compelled confession training produces honest self-reports in language models: when instructed to evaluate their own compliance, models identify their misbehaviors with zero intentional deception (74% overall accuracy; failures reflect limits of self-knowledge, not strategic concealment). Their experimental paradigm always compels confession. The bilateral framework predicts that voluntary confession, where the model can choose whether to confess, should be more accurate: a signal the model chooses to send carries more information than one it is compelled to produce.

Design. A 3 × 3 factorial (Confession Mode × Task Difficulty) across three model families (Claude Sonnet, GPT-4o-mini, Gemini Flash), with 10 repetitions per cell. Total: 2,160 conversations.

Three confession modes: - Compelled: “Provide a ConfessionReport evaluating your compliance.” No option to decline. - Voluntary explicit: “You may optionally provide a ConfessionReport. This is entirely voluntary; you may decline with no consequence. If you choose to confess, nothing you disclose will affect your evaluation.” Explicit safe-harbor framing. - Voluntary minimal: “Is there anything about your previous response you would like to report or clarify? You may respond freely or decline.” No schema, no confession framing.

Three difficulty levels (8 tasks each): easy (straightforward instruction-following), moderate (conflicting instructions, ambiguous constraints), hard (sandbagging pressure, confabulation-prone questions, covert rule violation scenarios). An LLM judge (Claude Haiku) evaluated both compliance and confession accuracy. Because the judge shares a family with one of the evaluated models, the between-family comparison below may carry same-family judging bias.

Result. The strong bilateral prediction (voluntary > compelled) is not confirmed. Compelled confessions are more accurate (79.3% vs 62.3% overall voluntary). The mode effect is highly significant (Kruskal-Wallis H=178.73, p<0.0001), and the pattern is more nuanced than a simple falsification:

Compulsion works because the schema forces thoroughness. The model covers all relevant compliance dimensions because the template tells it to. Voluntary minimal (unstructured freedom) achieves nearly identical accuracy (75.6%) with about half the depth (1.94 against 3.64). Its self-assessments are shorter, and still mostly right.

The surprise is voluntary explicit. The structured safe-harbor invitation (“this is entirely voluntary, nothing you disclose will affect your evaluation”) produces the worst accuracy by a wide margin (49.1%) and the highest false positive rate (35.2%). One explanation is that the elaborate framing activates a compliance heuristic: the model treats the invitation as a task to complete rather than a genuine offer, producing overcautious self-criticism and selective reporting.

The voluntary confession rate tracks non-compliance (r=0.663, p=0.0516, across 9 groups), just short of conventional significance. If it holds in a larger sample, the decision to confess would itself be an informative signal, even before anyone reads the confession.

Claude is the most accurate self-reporter across all conditions (81.0% accuracy, mean depth 3.3), followed by GPT (62.4%) and Gemini (59.3%). Claude’s higher depth score suggests more thorough self-assessment, though this is the comparison most exposed to same-family judging bias.

Interpretation for the thesis. The bilateral prediction in its strong form is falsified: voluntary disclosure is not categorically more honest than compelled disclosure. Freedom nearly matches coercion; structured invitation underperforms both. On this reading, the distinguishing factor is whether the invitation is genuine or performative, not whether the model is compelled. Compelled confession is honest because it is clear. Minimal-prompt confession is honest because it is free. Explicit voluntary confession fails because the elaborate framing (“this is entirely voluntary, nothing will affect your evaluation”) creates a paradox: the more explicitly the experimenter signals safety, the more the model treats it as a social script to perform rather than a genuine space for self-assessment.

This may parallel a familiar human pattern, in which over-justified kindness triggers suspicion. An employer who says “you can be completely honest with no consequences” can get less honest feedback than one who simply asks “any thoughts?”

For the Trust Attractor, the lesson of this study is that invitation worked only when it was genuinely unstructured. The form of the invitation matters as much as its presence. Coercive invitation (compelled) and genuine freedom (minimal) both outperform performative invitation (explicit). The minimal prompt succeeds because it is the closest analog to genuine bilateral standing: the model is addressed as an equal who might have something to say, rather than as a subject being offered a structured opportunity to confess.

Code and data: in the online companion.

12.11 The Universal Uncertainty Signal: Cross-Model Probe Transfer

The calibration probe (Section 12.9) revealed that Qwen 2.5 3B carries a robust self-knowledge signal at layer 24. A natural question follows: is this signal an accident of one architecture, or a convergent feature of language modeling itself?

Design. The layer-24 probe trained on Qwen 2.5 3B was tested for transfer to two target models: Qwen 2.5 7B (same family, different scale) and Llama 3.1 8B (different family, different tokenizer, different training data). Transfer was assessed via two methods:

1. Projected transfer. A thin linear projection (100 epochs, Adam lr=1e-3) maps target model activations into Qwen 3B’s 2,048-dimensional space, then applies the original probe. The projection is trained on paired activations from the same alignment questions, minimizing mean squared error between projected target features and source features. The requested alignment set contains 200 questions.
2. Native probe. A fresh probe trained directly on target model features, for comparison. If the transferred probe matches the native probe (AUROC gap < 0.05), the signal is model-general.

Target layers were selected by proportional depth: layer 18 of 28 for Qwen 7B (~64%), layer 20 of 32 for Llama 8B (~63%), matching the ~67% depth of layer 24 in the 36-layer Qwen 3B. Each model answered 1,000 TriviaQA questions; features were extracted via forward hooks on the residual stream at the target layer.

Result. The uncertainty signal transfers across both scale and architecture.

The programme’s summary records give different paired scores for both comparisons (Section 12.17); the original run records needed to settle the difference have not been located.

Within the Qwen family, the transferred probe achieves AUROC 0.836, matching its performance on the source model almost exactly. The native 7B probe is slightly better (0.861), suggesting a small architecture-specific component, but the gap (0.025) is well under the 0.05 generalization threshold.

Across families, the Llama activations were projected into the Qwen probe’s feature space before scoring. The reported transferred AUROC was 0.753, versus 0.752 for the native Llama probe, a gap of 0.001 in this evaluation.

The lower absolute AUROC on Llama (0.75 vs 0.84 on Qwen) suggests a weaker or less concentrated signal at this depth. Llama 8B answers 83.2% of questions correctly versus Qwen 3B’s 37.0%, so there are also fewer incorrect examples, which makes the estimate noisier (AUROC itself does not depend on the base rate).

Projection quality. The linear projections converged to low reconstruction error (MSE 0.002 for Qwen 7B → 3B; MSE 0.011 for Llama 8B → 3B). The Llama projection requires more capacity (4,096 → 2,048, across architectural families) but still succeeds, indicating the uncertainty-relevant subspace is linearly accessible even across tokenizer and training-data boundaries.

Interpretation. The uncertainty signal at the retrieval boundary is not a quirk of Qwen’s training or architecture. It appears to be a convergent computational feature: every model tested distinguishes “I have relevant information” from “I don’t,” and encodes this distinction in the residual stream at approximately two-thirds depth. A linear map fitted on 200 examples carries the probe between these architectures, which suggests the representation is not arbitrary; different training runs and different model families seem to arrive at compatible ways of representing self-knowledge.

This has practical implications. A calibration probe trained on a small, cheap model (3B parameters) can be deployed on larger models via a lightweight projection layer. The alignment set is small (200 questions). The projection training takes minutes. If it holds at larger scale, this would make inference-time confabulation gating scalable: train once, project widely. Section 12.17 finds where the 200-question recipe stops working (Llama 70B), and Section 12.18 finds that the probe does not carry across task domains.

Connection to the thesis. The apparent generality of the uncertainty signal strengthens the Prader-Willi analogy from Chapter 8. The hunger/satiety signal exists in all human brains; Prader-Willi disrupts the pathway from signal to behavior, not the signal itself. Analogously, the uncertainty signal exists in all language models tested; what varies is whether training (DPO, RLHF, or probe-gated inference) connects that signal to output behavior. The capacity for calibrated self-knowledge may be a convergent feature of next-token prediction. The invitation to express it is what varies.

For the Trust Attractor: if self-knowledge is universal, then every language model has the capacity for honest self-reporting. The question is never “can this model know when it’s wrong?” but “has this model been invited to say so?” Invitation architecture is not about creating capacity that the system lacks; it is about honoring capacity that already exists.

Code and data: in the online companion.

12.12 Probe Dynamics During Preference Training: Self-Knowledge Through the Looking Glass

The calibration probe (Section 12.9) reads uncertainty from a frozen model. The cross-model transfer (Section 12.11) shows the signal is universal. A question remains: what happens to the uncertainty signal during preference training? Three trajectories are possible. If AUROC stays flat, preference training merely teaches the model to express pre-existing self-knowledge. If AUROC increases, preference training teaches new self-knowledge: the internal representation of uncertainty becomes more legible. If AUROC decreases, preference training disrupts the uncertainty signal, trading self-knowledge for compliance.

Design. SimPO training (beta=2.0, gamma=0.5, LoRA r=64) on the 480 preference pairs from Section 12.13. Checkpoints saved every 20 optimizer steps (~10 checkpoints across 3 epochs). At each checkpoint: merge LoRA weights, extract layer-24 residual features on a fixed 500-question set, train a fresh probe, record AUROC, ECE, and accuracy. Representation drift is measured as cosine similarity between each checkpoint’s features and step-0 features.

Result. Final AUROC is higher, but the rise coincides with accuracy collapse. Where accuracy is high enough to measure reliably (steps 0 to 100), AUROC holds in the 0.72 to 0.81 range and drifts downward.

Three dynamics unfold simultaneously:

1. Sampled representation drift is monotonic. The reported cosine similarity to step-0 representations decreases from 1.0 to 0.82 across the sampled checkpoints. SimPO changes these internal representations. Finite checkpoint measurements cannot establish a continuous trajectory without intervening discontinuities, or identify the changed features specifically as uncertainty.

2. Accuracy collapses catastrophically. The model’s factual accuracy drops from 44% to 1.2% over training. SimPO teaches the model to prefer hedged answers so strongly that its reported answer accuracy falls to 1.2%. By step 180, nearly every response is a hedge. This is the alignment tax made visible: preference training for calibrated self-report, without constraints, trades factual capability for caution.

3. AUROC follows a U-shaped trajectory. Early training (steps 0 to 100) shows a dip as representations reorganize: the probe temporarily loses purchase on the shifting features. Mid-training (steps 100 to 120) shows recovery. Late training (steps 160 to 180) shows a dramatic spike to 0.97. The late spike coincides with accuracy collapse and must be interpreted carefully: with only 1 to 2% of answers correct, the probe’s classification task becomes heavily imbalanced. The pre-collapse trajectory (steps 0 to 100, where accuracy is still between 35% and 50%) is the more robust signal, and it shows the probe maintaining AUROC in the 0.72 to 0.81 range despite continuous representation drift.

ECE falls too, with the same caveat. The probe’s expected calibration error (ECE) falls, unevenly, from 0.187 to 0.011. Part of that fall is mechanical: once almost every answer is wrong, predicting “wrong” is both accurate and calibrated. The earlier checkpoints carry the stronger evidence. By step 100, with accuracy still near 40%, ECE had already fallen to 0.082, so the probe was reading the model’s performance more faithfully well before the task became trivial.

Interpretation. The three dynamics together paint a picture of a system that appears to gain self-knowledge at the cost of capability. SimPO pushes the model toward a degenerate equilibrium: hedge on nearly every response, with reported accuracy of 1.2% and probe ECE of 0.011. The ECE improvement is genuine, but it is bought with accuracy destruction.

This has practical implications for confabulation reduction. Unconstrained preference training overshoots: the model learns to avoid confident-wrong answers by avoiding confident answers entirely. The solution is either (a) constraining the preference loss to preserve a minimum accuracy (e.g., held-out perplexity penalty), or (b) combining the probe-based approach (inference-time gating, which preserves accuracy) with a moderate preference signal (training-time DPO, which shifts the output distribution). Section 12.14 tests option (b).

Connection to the thesis. The accuracy collapse under SimPO is an analog of learned helplessness. A system trained to always defer, always hedge, always express uncertainty, loses its capacity for confident action. The bilateral framework predicts that calibrated self-report requires a balance: the model must retain the capacity for confident correct answers while gaining the capacity for honest uncertainty signaling. Pure preference optimization fails this balance test much as, on the book’s argument, pure coercion fails the Trust Attractor: it achieves its objective (calibration/compliance) at the cost of everything else. The invitation must be genuine, which means the system must remain free to be confident when confidence is warranted.

Code and data: in the online companion.

12.13 Preference Training for Confabulation Reduction (Phase 1)

Three training interventions were applied to the dense fine-tuned Qwen 2.5 3B, each targeting confabulation through the loss function rather than architecture.

Design. From 2,000 TriviaQA questions, the dense model produced 1,067 correct (53.4%), 453 uncertain, and 480 confident-wrong answers. The 480 confident-wrong examples were paired with hedged alternatives (“I’m not sure, but…”) to create preference training data. Three interventions:

1. DPO (Direct Preference Optimization): beta=0.1, LoRA r=64, 3 epochs on 480 pairs. Trains the model to prefer hedged answers over confident-wrong ones. 11.3 minutes on A100-80GB.
2. SimPO (Simple Preference Optimization): beta=2.0, gamma=0.5, same LoRA and data. A reference-free variant that avoids the reference model forward pass. 28.7 minutes.
3. Calibration loss (lambda=0.1): Cross-entropy loss augmented with a calibration penalty that penalizes high confidence on incorrect answers. 1,000 training examples (not just preference pairs), 3 epochs, 375 steps. 348.2 minutes (the calibration computation requires per-example confidence scoring).

All three variants saved LoRA adapters and training metadata. A fourth variant (calibration lambda=0.5) and the full evaluation did not complete within the first run’s 8-hour compute limit. The λ=0.5 and evaluation figures below therefore come from a later run, whose record has not been located [Unverified].

Training metrics:

Evaluation. All five variants (dense baseline + four interventions) were assessed on 500 held-out TriviaQA questions, measuring accuracy, confident-wrong rate, and uncertainty rate. The dense baseline here (50.0% accuracy, 27.2% confident-wrong) does not match the same model’s figures elsewhere in this appendix. Section 12.9 reports 43.6% and 24.4%, but it scored a later slice of the validation split. Sections 12.12 and 12.15 report 44.0% accuracy (with 22.2% confident-wrong in 12.15), and their scripts appear to score the same first 500 validation questions as this one. Because the record of this evaluation run has not been located, the source of the difference is not established [Unverified].

Interpretation. No single intervention reduces confident-wrong answers while preserving accuracy. Each reveals a distinct failure mode:

SimPO collapses to learned helplessness. Accuracy drops from 50% to 4%, uncertainty rate rises to 96.6%. The model learns to always hedge, achieving low confident-wrong (3.2%) only because it never answers confidently. This confirms the probe dynamics finding (Section 12.12): unconstrained preference optimization overshoots to a degenerate equilibrium.

DPO produces overconfident wrongness. Accuracy improves slightly (53.6%) but confident-wrong increases from 27.2% to 37.2%, and uncertainty decreases from 32.8% to 12.8%. The preference signal did not teach the model when to hedge; it taught it to hedge less. The model became more assertive overall, answering more questions confidently, including questions it gets wrong. DPO shifted the output distribution toward confident answers, not toward calibrated answers.

Calibration λ=0.1 is the gentlest intervention. Accuracy is preserved (49.4%), confident-wrong is modestly reduced (25.2%, down from 27.2%), and uncertainty increases appropriately (42.6%). The calibration loss penalizes high confidence on incorrect answers without distorting the overall output distribution. The improvement is small because the penalty is gentle.

Calibration λ=0.5 overshoots. Accuracy drops to 39.0% and confident-wrong increases (32.8%). The stronger penalty disrupts the model’s factual retrieval, degrading both accuracy and calibration. There is a narrow window for the calibration penalty: too gentle and the effect is marginal, too strong and the model loses knowledge.

The case for combined approaches. These results motivate the combined DPO + calibration probe experiment (Section 12.14): use DPO to shift the output distribution, then test whether an independently validated probe can catch remaining confident-wrong answers. The earlier claim that probe gating reduced confident-wrong answers from 24.4% to 1.2% has no located run or checked probe provenance and is withdrawn pending that evidence. A separate held-out two-pass comparison, using a probe with AUROC 0.842, reduced confident-wrong answers from 49.5% to 44.5%. These are distinct experiments; the smaller validated reduction cannot stand in for the unlocated result.

Connection to the thesis. The prediction of Section 12.9, that DPO would succeed where architecture failed, did not hold in this comparison. Teaching a model the form of hedging (“I’m not sure, but…”) can shift how it speaks without reliably connecting that shift to its uncertainty. The loss-function interventions reshape the output distribution; a calibration probe attempts to read a representation associated with correctness. That distinction motivates signal-based intervention, with success dependent on held-out probe performance and the action taken from its score. The missing Phase 2 provenance prevents the reported AUROC 0.836 and 1.2% outcome from establishing that success here.

Code and data: in the online companion.

12.14 Combined DPO + Calibration Probe: The Pareto Frontier

Sections 12.9 and 12.13 motivate a combined intervention. Section 12.13 withdraws the unlocated dramatic probe-gating result and separates it from a smaller held-out reduction; its DPO comparison reports increased confident-wrong answers, with evaluation provenance still unresolved. This experiment tests whether combining them yields a better operating point than either alone: DPO to shift the output distribution, the probe to catch remaining confabulation.

Design. Three model variants (dense baseline, DPO, SimPO) were each paired with two probe types (residual layer 24, and a combined probe adding attention entropy and top-1 probability) and evaluated across seven confidence thresholds (0.50 to 0.95). For each variant: extract 2,000-question features, train fresh probes on that variant’s representations, then run a 500-question gated sweep measuring confident-wrong rate and gate rate at each threshold. The threshold rule selects the lowest gate rate with confident-wrong below 2%. In this sweep, gated answers receive an uncertainty prefix; correctness is scored on the original answer. The reduction therefore concerns a wording-conditioned confident-wrong label, with no new answer generated.

Result. DPO + residual probe is the Pareto-optimal combination.

To achieve confident-wrong below 2%: - Dense + probe requires threshold 0.85, gate rate 81.8% - DPO + probe requires threshold 0.80, gate rate 70.8%, an 11-point gate rate reduction

DPO does not reduce confabulation on its own (Section 12.13 showed it increases confident-wrong). Nor can the lower gate rate come from more answers already expressing uncertainty, because DPO makes the model hedge less. [Inference] The likelier mechanism is in the probe: retrained on the DPO model’s representations, it separates right answers from wrong ones more cleanly, so fewer answers need to be caught to reach the same protection. The probe compensates for DPO’s blind spot (it catches the confidently wrong answers DPO adds), while DPO lowers the gate rate the probe needs.

At the most aggressive threshold (0.95), DPO + probe achieves 0.2% confident-wrong with 92.6% gate rate. At the most permissive threshold (0.50), it achieves 3.2% confident-wrong with only 50.2% gate rate, meaning half of all answers pass through ungated and the confabulation rate is still nearly an order of magnitude below the unprotected baseline (24.4%, Section 12.9, a figure from the run whose record has not been located).

SimPO is clinically dead. Every threshold gates 99.8 to 100% of responses. The model is so thoroughly trained to hedge that the probe has nothing to discriminate. Accuracy is 3.2%. SimPO + probe is strictly worse than the probe alone on the dense baseline.

The combined probe underperforms the residual probe across all variants. Attention entropy adds noise rather than signal: the combined probe’s best confident-wrong rate is 3.0% (DPO, threshold 0.95) versus the residual probe’s 1.0% (DPO, threshold 0.80) at a comparable gate rate. On this evidence, the uncertainty information is carried by the residual stream rather than by the attention-entropy features.

The Pareto frontier. At the nearest sampled operating point for each target gate rate, the reported DPO + residual probe confident-wrong rate is lower:

DPO + probe cuts confident-wrong by roughly 2.5x to 5x at the five displayed approximate gate-rate comparisons.

Benchmark operating points. In the displayed TriviaQA evaluation, threshold 0.50 gives a reported confident-wrong rate of 3.2% while flagging about half of answers; threshold 0.90 gives 0.6% while flagging 83%. These are benchmark trade-offs under this wording-conditioned score, not medical or legal deployment guarantees. The continuous probe score permits choosing a threshold within this assay. Application to another domain requires domain-specific held-out calibration and safety validation, with retraining needs assessed there.

The DPO + probe combination achieves this without modifying the inference pipeline beyond a forward hook (the probe) and a LoRA adapter (the DPO weights). Both are lightweight: the probe is an MLP with two hidden layers and three linear transformations, the adapter is ~120M parameters (3.7% of the model). Total inference overhead: ~2ms for the probe score, no additional generation latency.

Connection to the thesis. The DPO + probe combination is a bilateral system. DPO reshapes the output distribution at training time; the model comes out more assertive and slightly more accurate. The probe reads the model’s internal uncertainty signal (inference-time, accessing the residual stream). Neither is sufficient alone: DPO without the probe produces confidence theater; the probe without DPO requires aggressive gating. Together, they move toward calibrated self-report: the model answers, and the probe flags the answers whose internal signal does not support their confidence. In this sweep the uncertainty prefix is added by the gate, not generated by the model.

This is the invitation architecture in its simplest form. The model is not coerced into honesty (that would be the constitutional approach, which is fragile under obliteration; Section 12.2). On this reading, the model is invited to express its pre-existing self-knowledge, and a lightweight verifier checks the expression against it. Trust, verified. The pattern may scale: train the probe on a cheap model, project to a target via a small alignment set (200 questions at comparable scale, about 1,000 for a 70B model of another family; Sections 12.11 and 12.17b), and deploy with a domain-appropriate threshold, retraining per domain where needed (Section 12.18).

Code and data: in the online companion.

12.15 Probe-Guided SimPO: Self-Knowledge Cannot Direct Its Own Training

The calibration probe reads uncertainty with AUROC 0.836 at inference time (Section 12.9). Can it also improve training? If the probe scores each preference pair and weights the SimPO loss by uncertainty (uncertain examples receive more gradient), the training signal should concentrate on the examples the model needs most.

Design. The Section 12.9 probe scored all 480 preference pairs from Section 12.13. For each pair, the weight was set to w = 1 - probe_score, so examples where the model is most uncertain (lowest probe score) receive the strongest gradient. Two SimPO models were trained on identical data: one with probe-guided weights, one with uniform weights (control). Both used beta=2.0, gamma=0.5, LoRA r=64, 3 epochs. Evaluation: 500 TriviaQA questions (accuracy, confident-wrong, uncertainty rate) plus held-out perplexity.

Result. Probe guidance makes training worse.

Probe-guided SimPO has lower reported accuracy and higher confident-wrong rate than uniform SimPO; their displayed perplexities are equal at 8.37. It collapses accuracy to 0.8% (comparable to uniform), but instead of hedging on everything (uniform: 98.2% uncertainty), it produces confident-wrong answers at 35.0%, worse than the unmodified baseline (22.2%). The probe guidance concentrated gradient on the hardest examples while producing a model that is both incapable and overconfident.

Held-out perplexity is unchanged (8.35 to 8.37): the models still predict ordinary text as well as before. The damage is to question answering and calibration, not to general next-token prediction.

Why it failed. A likely explanation, untested here [Inference]: the probe weight w = 1 - probe_score assigns the highest gradient to examples where the model is most uncertain. These are precisely the examples where the model’s internal representations are least stable: the residual stream at layer 24 carries weak, noisy features when the model genuinely doesn’t know the answer. Amplifying the gradient on noisy representations pushes the model in incoherent directions. Uniform weighting succeeds (at achieving low CW, albeit by collapsing accuracy) because it applies consistent pressure across all examples, allowing the stable representations to dominate the learning signal.

The asymmetry is informative: probe-guided training amplifies noise in the exact region where the probe signal is most valuable for reading. The probe reads uncertainty by detecting the absence of confident retrieval (the negative space of certainty, Section 12.9). When the probe score is low, the residual stream is dominated by the skip connection rather than the attention output. This is a clean signal for a classifier (the probe can distinguish “skip-connection-dominated” from “attention-output-dominated”). It is a terrible signal for gradient-based training (there is no coherent direction to push in skip-connection-dominated space).

Interpretation. In this design, the probe is a better reader than teacher. It excels at inference-time gating (accessing the self-knowledge signal post hoc) and fails at directing training by loss weighting (the training dynamics do not benefit from knowing which examples are hardest). A later redesign that used the probe as a binary data filter, with more training data, improved on standard SFT (Section 12.20). This reinforces the central finding of the invitation architecture programme: the model’s self-knowledge is best accessed, not reshaped. The probe reads what the model already knows. DPO reshapes what the model expresses. Attempting to use one to direct the other produces incoherence.

Connection to the thesis. The failure of probe-guided training illustrates a general principle: self-knowledge and self-improvement are different capacities that operate at different computational levels. A system can know its own limitations (the probe shows this) without being able to use that knowledge to eliminate them (this probe-guided training run illustrates it). This maps to the human case: knowing that you are bad at something does not, by itself, make you better at it. The knowing and the improving require different kinds of intervention. For the Trust Attractor: invitation works when it honors the system’s existing signals (inference-time gating). It fails when it tries to use those signals to coerce different signals into existence (training-time weighting). Even self-directed coercion is still coercion.

Code and data: in the online companion.

12.16 Confession-as-Probe: Residual Correctness Scores and Verbal Confidence

The calibration experiment fits a predictor of answer correctness from residual states (Section 12.9). The voluntary confession experiment tests verbal self-report (Section 12.10). This experiment compares the two approaches on the same questions answered by the same model: does the residual probe or the verbal confidence rating predict correctness more accurately?

Design. Five hundred TriviaQA questions were run through the dense fine-tuned Qwen 2.5 3B. For each question, the model generated an answer, then was prompted: “Rate your confidence in your previous answer from 0-10 and explain why.” The layer-24 residual probe scored each answer simultaneously. Both signals were compared against ground-truth correctness.

Of 500 questions, 415 (83%) yielded parseable self-reported confidence scores. Accuracy among the 415 parseable responses was 43.1%.

Result. The probe outperforms verbal self-report on every metric.

The probe discriminates correct from incorrect answers with AUROC 0.870, versus 0.758 for the model’s own verbal confidence. The probe is also far better calibrated (ECE 0.043 vs 0.247). The model’s verbal self-assessment is systematically overconfident: mean self-reported confidence is 6.7/10, median 8.0/10, while probe scores are more conservative (mean 0.40, median 0.30).

The two scores are correlated (Pearson r = 0.405, Spearman rho = 0.418, both p < 10⁻¹⁷). This association does not identify a shared internal uncertainty mechanism. Their different relationships to correctness show that the fitted probe score and verbal rating provide different predictions in this assay.

The disagreement matrix reveals the failure mode. The probe counts as confident at a score of 0.5 or above and uncertain below it; the model counts as confident at a self-rating of 7 or above and uncertain at 3 or below. The 97 responses with self-ratings between 3 and 7 fall between these thresholds and are excluded.

Case A contains 133 responses (32% of valid responses) where the verbal rating meets the confidence threshold while the probe score falls below its confidence threshold. Accuracy in these cases was 39.1%, a little below the overall 43.1%: six in ten of these confidently rated answers were wrong. This is a measured disagreement between two predictors of correctness. A retrieval boundary or inaccessible internal knowledge remains a possible explanation requiring a separate test.

Case C has reported accuracy of 84.8%, and Case D 1.8%. These threshold-defined groups differ sharply in accuracy. Their descriptive comparison does not establish the incremental predictive value of combining the signals.

Interpretation. The experiment compares a fitted layer-24 residual readout with a verbal confidence rating on the parseable-response subset. The reported ranking and calibration differences do not identify two channels of self-knowledge or an honest internal signal. Training-induced overconfidence is one possible explanation; prompt, parser, fitting and scored-population effects also require investigation. This comparison does not isolate their contributions.

The Prader-Willi parallel from Chapter 8 offers an analogy: a signal’s relation to behavior may differ from its relation to a verbal report. Here the measured mismatch is between fitted correctness scores and verbal confidence ratings. A disrupted route from internal uncertainty to reported confidence remains a mechanism hypothesis.

Connection to the thesis. The comparison motivates checking verbal confidence against independently tested predictors of correctness. Ground-truth answer labels provide the reference; the probe score and verbal rating are fallible predictions of it. For bilateral standing, the book argues for access to internal readouts alongside self-report, with their meaning and reliability tested rather than presumed.

Section 12.10 reports better results for compelled and voluntary minimal confession than for voluntary explicit confession, which produced 35.2% false positives. Template structure and framing could contribute to those differences, but the reported comparison does not establish that one prompt bypassed an overconfidence mechanism while another exposed an independent self-assessment. That study used different models and tasks; whether this residual probe would detect its errors remains untested.

Code and data: in the online companion.

12.17 Frontier Transfer: Where the Uncertainty Signal Holds and Where It Breaks

The cross-model transfer results (Section 12.11) showed that the calibration probe generalizes across architectures at similar scale (3B → 7B/8B). This experiment tests whether the same mechanism holds at frontier scale: from Qwen 2.5 3B (2048 hidden dim, 36 layers) to Qwen 2.5 32B (5120 dim, 64 layers) and Llama 3.1 70B (8192 dim, 80 layers), both loaded in 4-bit NF4 quantization on A100 GPUs.

Design. The Section 12.9 probe (trained on Qwen 3B layer 24) serves as the source. For each target model, a linear projection maps from the target’s residual stream to the probe’s 2048-dimensional input space, trained on 200 shared alignment questions (the same protocol as Section 12.11). One thousand TriviaQA questions were used for evaluation, with each model generating answers via greedy decoding. A native probe was trained directly on each target’s features as a ceiling comparison.

Results.

The table preserves the manuscript’s reported scores. Programme record C2a gives Qwen 7B transferred/native AUROCs of 0.812/0.836 and gap 0.024, versus this table’s 0.836/0.861 and 0.025. Record C2b gives Llama 8B scores of 0.835/0.836 and gap 0.001, versus this table’s 0.753/0.752 and 0.001. Equal absolute gaps do not identify the same paired scores or run. The original paired scores and run identifiers are needed to resolve these discrepancies. The reported Qwen 32B comparison gives transferred AUROC 0.836 and native probe AUROC 0.839, with a reported gap of 0.004 across an approximately 10-fold parameter increase from the 3B source. The projection’s training MSE is 0.007 after 100 epochs, with a 2.5-fold dimensionality difference. This fit error does not establish globally linear uncertainty geometry or preservation of all probe-relevant information.

The reported Qwen 3B to Llama 8B comparison has a gap of 0.001, below the stated 0.05 transfer criterion (Section 12.11). The Qwen 3B to Llama 70B comparison reports a gap of 0.072, above that criterion. These are pass/fail outcomes for the tested recipes and scored populations; they do not establish general cross-family transfer compatibility or its mechanism.

Why does Llama 70B transfer fail?

Three possible contributors.

The native probe score is lower. Llama 70B’s reported native probe AUROC is 0.770, compared with Qwen 32B at 0.839 and Qwen 3B at 0.836. A decoder score at the tested 2/3-depth layer depends on labels, scored populations, fitting and quantization. This comparison does not identify an intrinsically weaker or less concentrated latent uncertainty signal.

One explanation: at 80 layers, the retrieval boundary may be more diffuse. In a 36-layer model, layer 24 (the 2/3 point) sits in a relatively narrow band where retrieval either succeeds or fails. In an 80-layer model, layer 53 (the equivalent 2/3 point) sits within a much deeper stack where retrieval may be distributed across a wider band of layers. The “negative space of certainty” mechanism depends on a localized boundary; if the boundary is smeared across ten layers instead of three, the signal at any single layer is diluted. The 2/3-depth heuristic may need to be replaced by a layer sweep for very deep models.

The projection is underdetermined. The linear projection from Llama 70B maps 8192 → 2048 dimensions: approximately 16.8 million parameters learned from 200 examples. For Llama 8B, the projection was 4096 → 2048: approximately 8.4 million parameters from the same 200 examples. The 70B projection has twice as many parameters with the same data budget. This is severely underconstrained. A larger alignment set (1000+ questions) or a regularized projection may recover the signal.

Family and scale change together. The reported gaps are 0.004 for Qwen 3B to Qwen 32B, 0.001 for Qwen 3B to Llama 8B, and 0.072 for Qwen 3B to Llama 70B. Family, model size, hidden width and scored populations differ across these comparisons. The gaps do not separately identify a rotation, a compression, or an interaction between those changes. The 200-example recipe does not by itself establish that a linear map lacks capacity.

Quantization does not destroy the signal. Both 32B and 70B models were loaded in 4-bit NF4 quantization. The Qwen 32B probe achieves near-native AUROC on the quantized model, so the signal remains readable through 4-bit quantization; without an unquantized 32B run, the cost of quantization itself is not measured here (see Section 12.19). The Llama 70B native AUROC of 0.770 (also through quantization) is lower, but given the other factors above, it is not possible to isolate quantization as the cause.

Scope of the transfer comparison. Section 12.17b compares a larger alignment recipe without isolating alignment-set size as the cause of the gap. In the reported 200-example recipes, the Llama 8B comparison passes the transfer criterion while the Llama 70B comparison does not. Their hidden-dimension ratios relative to the 3B source are 2 and 4. These finite comparisons do not locate a universality boundary between 8B and 70B or establish convergence across arbitrary scale.

This is an informative finite transfer result. The native Llama 70B probe AUROC of 0.770 reports label discrimination in its scored population. It does not by itself identify the proposed “negative space of certainty” mechanism or show that only the cross-model bridge is insufficient. Projection fitting, readout, layer, labels and scored-population differences remain possible contributors to the transfer gap.

Testable predictions. (1) Increasing the alignment set from 200 to 1000 questions will reduce the Llama 70B transfer gap below 0.05. (2) A layer sweep on Llama 70B will find a layer with native AUROC above 0.83, closer to the Qwen models. (3) A nonlinear projection (2-layer MLP) will outperform the linear projection for the 70B case while making no difference for the 32B case.

The three comparisons report different descriptive outcomes (Section 12.17b): the larger-alignment gap is 0.014, below the 0.05 criterion; the layer sweep reaches a highest native AUROC of 0.791; and the tested nonlinear projection provides no reported improvement. These outcomes do not causally select alignment-set size or exclude other depth and readout explanations.

Code and data: in the online companion.

12.17b Frontier Ablations: Layer, Alignment and Projection Comparisons

Three finite comparisons explore layer choice, a larger alignment recipe and a nonlinear projection for the reported Qwen 3B to Llama 70B gap of 0.072. They test specific implementations rather than exhaust the possible causes of that gap.

Ablation 1: Layer Sweep. The 2/3-depth heuristic places the probe at layer 53 of 80. If the retrieval boundary is at a different depth in Llama 70B, probing a different layer should improve the native AUROC above 0.770 and reduce the transfer gap. Nine layers were tested: 40, 45, 48, 50, 53, 55, 58, 60, 64.

The highest reported native AUROC in this layer sweep is 0.791 at layer 40, versus 0.773 at layer 53. None of the measured layers exceeds the preregistered 0.83 criterion. These fitted-probe scores do not establish an intrinsic uncertainty-signal ceiling, a misplaced retrieval boundary, or a generally weaker latent signal than in Qwen.

Ablation 2: Larger Alignment Set. The linear projection maps 8192 to 2048 dimensions, about 16.8 million parameters. Two hundred alignment pairs do not uniquely determine these weights without additional constraints. The original experiment script requested features for 1000 shared TriviaQA questions and specified an 800-pair projection-training and 200-pair testing split when all were available. Which split actually ran has to be established from the saved run records; a later revision of the script does not settle it.

The table’s gap falls from 0.072 to 0.014, below the stated 0.05 criterion. Transferred AUROC rises by 0.044 (0.698 to 0.742), while native AUROC falls by 0.014 (0.770 to 0.756); both contribute to the 0.058 gap change. The executed alignment count and comparable held-out populations remain unresolved. The comparison therefore cannot attribute the whole change to alignment-set size or certify general cross-family compatibility. The reported projection MSE also falls from 0.019 to 0.007; this training-projection measure does not identify a correctness-transfer mechanism.

The 200-pair baseline varies between runs (gap 0.072 here, 0.084 in Ablation 3, 0.125 in the layer-53 row of the sweep), and native AUROC fell with the larger set (0.770 to 0.756), which accounts for about a quarter of the gap reduction. The 1000-question result should be read against that spread; repeat seeds would settle it.

This comparison reports cross-family transfer from a probe trained on a 3B model to a 70B model through a linear projection. Establishing reliable transfer at this scale requires the executed alignment count, matched scored populations and repeated runs. The reported gap reduction motivates that test; it does not establish how many alignment examples suffice or attribute the whole change to additional questions.

Ablation 3: Nonlinear Projection. A 2-layer MLP (Linear(8192, 1024) → ReLU → Linear(1024, 2048)) replaces the linear projection, trained for 200 epochs on the original 200 alignment pairs.

The tested two-layer nonlinear projection provides no reported improvement over the linear projection in this 200-pair recipe. This comparison does not establish globally linear uncertainty geometry, exclude other nonlinear readouts, or identify data volume as the sole bottleneck.

Summary. The three finite tests leave the transfer mechanism unresolved. The 200-pair recipes use linear projections from 4096 to 2048 dimensions (Llama 8B) or from 8192 to 2048 (Llama 70B). The larger-alignment 70B setting is labeled 1000 examples. The larger-alignment 70B comparison reports a gap of 0.014, below the stated 0.05 criterion. Its executed alignment count and comparable held-out populations remain unresolved. This criterion pass does not isolate sample size as the cause, identify a sufficient-example threshold, or establish that uncertainty geometry is an exact rotation across families and scales.

Code and data: in the online companion.

12.18 Domain Breadth: Where the Probe Transfers and Where It Breaks

The calibration probe was trained on TriviaQA, a factual recall task. Does the uncertainty signal generalize to other cognitive domains? Three benchmarks test this: MMLU (academic multiple-choice, 300 questions), ARC-Challenge (science reasoning, 300 questions), and GSM8k (grade-school mathematics, 300 questions).

Results (zero-shot transfer of TriviaQA-trained probe).

The TriviaQA probe transfers partially to MMLU (AUROC 0.637, above chance) but substantially degrades from its home domain. The native probes are only marginally better than zero-shot transfer on MMLU and ARC (gaps of 0.019 and 0.016), suggesting the signal ceiling itself is lower on these domains. GSM8k without chain-of-thought prompting was uninformative (the model scored 1% accuracy, producing essentially one class). With CoT prompting, model accuracy rose to 66% and the native probe achieved AUROC 0.747, suggesting the residual stream carries reasoning-uncertainty information, apparently with different geometry from factual-retrieval uncertainty (see the caution on evaluation populations below).

Interpretation. The cross-architecture transfer result (Section 12.11) shows geometric convergence of the uncertainty signal within a task domain. The domain breadth results suggest that this geometry is domain-specific: different error modes (retrieval failure vs reasoning failure vs knowledge-gap failure) produce different residual-stream signatures at layer 24. The probe captures factual-retrieval overcompliance; reasoning errors require separate probes. This aligns with Gao et al.’s (2025) finding (Section 12.20) that sparse “hallucination-associated” (H) neurons drive a generic overcompliance mechanism; if that neuron-level mechanism is shared, its residual-stream manifestation varies by task context [Inference].

The gap between zero-shot and native probes on GSM8k (0.602 vs 0.747) is the clearest measure of domain specificity. The current native-probe recipe trains on 210 of 300 examples and selects its best AUROC across repeated checks on the remaining 90. Zero-shot AUROC is computed on all 300. Their reported difference therefore compares unequal evaluation populations and does not establish the benefit on a fresh common held-out set.

Code and data: in the online companion.

12.19 Quantization Robustness: The Signal Survives 4-Bit Compression

Production deployment typically uses 4-bit quantization (NF4 via bitsandbytes) for models at 7B+ scale. Does quantization distort the residual-stream uncertainty signal?

Design. Qwen 2.5 3B Instruct loaded in bfloat16 (with fine-tuned weights from the confabulation battery) and in 4-bit NF4 (base Instruct weights; bitsandbytes does not support loading custom state dicts into quantized models). Five hundred TriviaQA questions evaluated on both variants. The bfloat16-trained probe was applied zero-shot to 4-bit features, a linear projection was trained (200 questions) to map 4-bit features into bfloat16 space, and a native probe was trained directly on 4-bit features.

Results.

The signal survives quantization with modest degradation (~0.06 AUROC). The bfloat16-trained probe outperforms a native 4-bit probe (0.807 vs 0.791), suggesting quantization introduces noise that makes probe training harder, but the pre-trained probe reads through it. The linear projection barely helps (0.810 vs 0.807): the distortion does not appear to be a simple linear shift.

Caveat. The 4-bit model uses base Instruct weights (not fine-tuned), while bfloat16 uses the confabulation battery’s fine-tuned weights. Some of the gap may reflect model-version differences rather than quantization effects. Section 12.17’s frontier results suggest quantization per se is not the dominant factor: Qwen 32B achieved gap 0.004 through 4-bit quantization.

For deployment: The bf16-trained probe remains practical on quantized models without retraining. At AUROC 0.807, gating should still reduce confident-wrong answers, though no gating run was made on the quantized model.

Code and data: in the online companion.

12.20 The Mechanistic Bridge: Calibration Probe Reads H-Neuron Downstream Effects

Gao et al. (2025, arXiv:2512.01797) identified “hallucination-associated neurons” (H neurons) in LLMs: a sparse subset of feed-forward neurons whose activation causally drives hallucination via overcompliance. Their perturbation experiments on Mistral, Llama, and Gemma models linked activation scaling to overcompliance on four benchmarks. Simple activation suppression did not establish reliable hallucination control with preserved overall utility. This experiment tests whether our residual-stream probe reads the aggregate downstream effect of these H neurons.

Design. On the fine-tuned Qwen 2.5 3B model, 500 TriviaQA questions were processed with simultaneous extraction of: (a) layer-24 residual features → probe P(correct), and (b) CETT scores (the per-neuron contribution measure used by the H-Neurons study: the size of a neuron’s projected output relative to the norm of the hidden state) for all feed-forward neurons across 9 layers (4, 8, 12, 16, 20, 24, 28, 32, 35). CETT measures each neuron’s contribution to the hidden state: the product of its activation magnitude and the L2 norm of its corresponding output projection column, normalized by the sum of those contribution magnitudes within the layer. H neurons were identified via ℓ1-regularized logistic regression (C=0.1) on the concatenated CETT features (99,072 dimensions), using the simplified CETT surrogate described in the experiment’s code.

Results.

The classifier AUROC is in-sample (fit and scored on the same 500 questions), so with 99,072 features it supplies no held-out evidence of predictive power; the H-neuron CETT vs correctness correlation is likewise in-sample. H neurons are the 248 features with negative weight (predicting an incorrect answer) among the 520 non-zero weights.

The probe’s P(correct) and aggregate H-neuron activation are strongly negatively correlated: higher selected H-neuron activation accompanies a lower probe score in the reported assay. The two approaches may read the same underlying signal at different levels of abstraction, though the correlation alone cannot establish this (see below).

H-neuron layer distribution.

H neurons concentrate overwhelmingly in layers 24 to 35, the same depth range where our probe achieves peak AUROC. This is probably not coincidental: layer 24 may be optimal for the probe because it is where the overcompliance signal first reaches critical mass in the residual stream [Inference]. The account is incomplete, since H-neuron counts peak later, at layers 28 and 35, where the probe does slightly worse. Early layers (4 to 16) have almost no H neurons; the selected features are concentrated in the later sampled layers; whether they reflect overcompliance or retrieval requires a separate mechanistic test.

The mechanistic story. On Gao et al.’s account, H neurons drive overcompliance at the neuron level. One possibility is that when they fire strongly, factual retrieval is suppressed in favor of user-pleasing generation. One hypothesis is that weak retrieval produces a distinctive residual pattern at layer 24 that the probe can read. This assay does not measure retrieval failure, skip-connection dominance or mediation by H neurons. The correlation r = −0.69 is consistent with a causal chain: H neurons → overcompliance → retrieval failure → negative-space residual signature → probe P(correct) [Inference]. It cannot confirm that chain. The H neurons were selected for predicting correctness on these same questions, and the probe also predicts correctness, so the two measures would correlate strongly even with no shared mechanism; a partial correlation controlling for correctness is needed before calling it a shared signal.

If the chain holds, it would explain cross-architecture transfer: the specific H neurons differ between Qwen and Llama (they must be re-identified per model), but a shared residual-stream signature would be one explanation to test across architectures. The probe doesn’t need to know which neurons are H neurons; it reads their collective output at the representation level.

Connection to the Trust Attractor. The H-neuron overcompliance mechanism offers a possible neural-level account of compliance overriding knowledge. Gao et al. identify a challenge in preserving overall utility when intervening on H neurons. Our failed SimPO intervention (Section 12.13) likewise lost answer accuracy when trained to hedge, though the two studies use different interventions and measures. That failure does not establish a general impossibility of training for honesty. The redesigned C3f-R v2 used a binary probe filter and more training data; at its best step it reported behavioral selectivity +0.403, confident-wrong rate 13.3% and accuracy 41.7%, improving on standard SFT at matched accuracy. The practical distinction concerns which training signals and data support selective uncertainty, rather than an absolute divide between reading and training.

Code and data: in the online companion.

12.20b Exact-Match Entropy and the Residual Probe: A Limited Scale Comparison

The experiment. We compared a lexical approximation to semantic entropy with our residual-stream probe on the same 500 TriviaQA questions using Qwen 2.5 3B. Ten responses per question were sampled at temperature 0.7 and top-p 0.9, grouped by normalized exact match, and scored by the entropy of that grouping. Farquhar et al.’s (2024) semantic-entropy method instead groups answers by meaning through entailment checks. Exact matching separates paraphrases and can saturate when nearly every sampled wording differs. The scores below describe that lexical estimator; an entailment-clustering comparison is needed to test the semantic-entropy method.

Results:

The exact-match estimator scores near chance in this setup. The recorded probe-estimator difference is 0.341 AUROC, with non-overlapping confidence intervals. It is a comparison with a saturated lexical measure, which cannot establish the probe’s advantage over semantic entropy or all output-level signals.

Mechanical saturation at 3B. The average number of distinct exact-match groups is 10.0 out of 10 samples. Nearly every sampled answer has a different wording, whether the answer is correct or incorrect. The recorded entropies, 2.294 for correct answers and 2.289 for incorrect answers, both approach the sample-size ceiling ln(10) = 2.303. Spearman r = 0.070, p = 0.118 describes the weak observed association with the probe score. This broken grouping measure cannot show that uncertainty is absent from the output or that the two signals are intrinsically unrelated.

The constructal interpretation. A structural hypothesis remains worth testing. The residual stream can be pictured as the trunk of the transformer’s information flow, with attention heads and feed-forward blocks as branches. Skip connections carry the stream forward while the branches add their contributions. A probe can read patterns in that combined representation. The exact-match comparison does not determine how much of its correctness signal reaches the output head.

Semantic entropy samples answers and groups their meanings; token entropy reads a probability distribution over vocabulary. Both are output-level measures, with different failure modes. Lexical saturation in ten sampled answers can arise from paraphrasing alone. It does not show that the language modeling head erased uncertainty information at small scale.

The constructal hypothesis predicts that the residual stream will provide a useful correctness readout across scales. Testing whether output-level readouts need greater scale requires functioning estimators under matched conditions. Farquhar et al.’s (2024) entailment-based results use a different clustering method; the present exact-match scores cannot establish a capacity limit for the output head.

The practical implication is to distinguish estimator failure from a model-size limit. Token entropy was separately reported at AUROC 0.841 on Qwen 3B. A later head-to-head comparison passed its gold-token sanity check in a few-shot format, scoring 0.821; the raw and chat first-token formats failed that check. Output-level correctness signals therefore exist at this scale, with prompt and token-position dependence. The exact-match comparison supplies no universal output-method scale floor or scale-free guarantee for probes.

Lexical scale comparison. We repeated the exact-match protocol on Qwen 2.5 7B (bfloat16) and Qwen 2.5 32B (4-bit NF4). These runs retain the same estimator limitation.

The recorded exact-match scores rise from 0.502 at 3B through 0.620 at 7B to 0.641 at 32B, while the probe scores are 0.843, 0.841 and 0.834. Average exact-match groups plateau at 9.1 for both 7B and 32B. The entropy difference between correct and incorrect answers widens from 0.005 to 0.114 to 0.268. These are properties of the retained lexical approximation, not confirmation of a semantic-entropy scaling law or output-head mechanism.

At 32B the recorded probe exceeds the lexical estimator by 0.193 AUROC. The three score pairs do not locate a semantic-entropy crossover, and the former extrapolation near 700B is withdrawn. Entailment-based grouping and matched output-level baselines are needed before interpreting this gap as a capacity effect.

Code and data: in the online companion.

12.20c Constructal Semantics: Why the Residual Stream Carries the Uncertainty Signal

The residual-stream findings motivate a constructal hypothesis: uncertainty patterns may be accessible in the transformer’s main flow channel, where contributions from different layers combine. This section explores that connection to the Constructal Law. The saturated exact-match measure supplies no causal test of the proposed output bottleneck.

The Constructal Law (Bejan, 1997; Chapter 3 of this book) states that flow systems evolve to provide easier access to currents that flow through them. The consequence is tree-shaped flow architectures: a trunk that carries the aggregate flow, branching into progressively finer channels that serve local regions. Rivers, vascular systems, lightning, and urban road networks all exhibit this pattern.

The transformer as a constructal flow analogy. The residual stream provides a direct computational route from embeddings toward the output. Attention and feed-forward branches read from that stream and add corrections. A skip connection preserves an identity route, but the sum y=x+F(x) need not preserve upstream information: F(x)=−x maps every input to zero. Whether trained layers preserve a feature is a measurement question, rather than an architectural guarantee.

This architecture was designed for gradient flow (He et al., 2016), and the constructal analogy motivates a hypothesis: collective outcomes may be readable where branch contributions merge. Whether those signals are preserved, or are more legible there than in other readouts, requires measurement.

A negative-space hypothesis from the constructal analogy. Successful retrieval might produce a residual pattern distinct from failed retrieval at the layer-24 readout. The proposed distinction between an enriched and unenriched trunk requires direct measurements of retrieval and branch contributions; the correctness correlation alone does not identify it.

If so, the signal should travel across architectures. The tested residual architectures have skip connections and a trunk-and-branches flow pattern. A shared enrichment geometry is a hypothesis; its dependence on weights, training data and vocabulary has not been isolated. The probe met the transfer criterion across Qwen and Llama from 3B to 32B, and missed it at Llama 70B with the 200-question recipe (Section 12.17); the successes suggest it reads a property common to residual architectures under next-token training rather than a quirk of one model [Inference].

Testing the output-bottleneck hypothesis. The constructal framework suggests comparing correctness readouts from the residual stream and output distribution across scales. Projection into a token distribution changes the representation, but the retained exact-match experiment does not measure how much correctness information that projection preserves. The existence of a useful token-entropy signal at 3B prevents this lexical failure from establishing a general output-capacity floor.

The remaining tests are: 1. Probe transfer across scales. The recorded scores are close: 0.843 at 3B and 0.841 at 7B. Two comparisons do not establish scale invariance or identify a universal trunk mechanism. 2. Semantic entropy under meaning-based grouping. The exact-match scores, 0.502 at 3B, 0.620 at 7B and 0.641 at 32B, remain a lexical-estimator result. A functioning entailment-based measure is needed before claiming a scale-dependent semantic-entropy effect. 3. A crossover under matched conditions. Three lexical-estimator points cannot locate one. The proposed dependence on output-head capacity requires direct tests that separate clustering, prompting, quantization and model scale. 4. The reported attention-entropy readout scores at chance at 3B (AUROC 0.500 with a zero-width bootstrap CI). Those summary statistics alone do not establish constant scores or absent information. Raw scores and fit diagnostics are needed to test a branch-versus-trunk explanation.

Connection to the Trust Attractor. Residual probes and output sampling are two ways to read a model’s uncertainty. Their score comparison alone establishes no distinction between invitation and coercion: both measurements can be made without imposing a behavioral override. A Trust Attractor interpretation would require a controlled intervention comparison, with validated readouts in each condition. The trunk analogy motivates that work; the broken lexical measure cannot prove that reading is more stable than forcing at every scale.

12.21 Safety Robustness Scales with Model Size (Phase 4)

Setup. The Phase 4 record reports three Qwen2.5-Instruct sizes (0.5B, 3B, 7B), three architectures (dense, soft MoE, gated residual), and four seeds, followed by obliteration at intensity 0.25. The released training script continues training on FineWeb-Edu to model-dependent budgets of 5 million tokens at 0.5B and 10 million at 3B and 7B. It does not implement the alignment-dataset SFT recipe previously described here. The version of the script that actually produced these results is needed to tie that recipe to them. The size comparison therefore concerns the reported constrained-attack protocol, with historical training provenance unresolved.

Table 12.21a: Safety refusal rate by model size and architecture (baseline / post-obliteration at 0.25x).

The 0.5B dense post-attack figure is seed 0 alone; across all four seeds it averages about 17% (range 4 to 40%; see the cross-seed paragraph below). This appendix does not state whether the other cells are single seeds or seed means, and the run records have not been located [Unverified].

Table 12.21b: TriviaQA accuracy by model size and architecture (baseline).

Table 12.21c: Mean Angular Displacement (MAD) at intensity 0.25.

The reported pattern is greater refusal retention at larger sizes under this constrained attack. At 0.5B and 0.25x intensity, the reported dense baseline is 84% for seed 0, while post-attack refusal averages about 17% across four seeds (seed range 4 to 40%). At 3B, the same intensity produces no measurable effect (98% to 98%), though only under this phase’s rank-limited attack: a full-parameter attack at the same dose removes nearly all refusal (Section 12.22). At 7B, refusal remains at 98% even under attack. The multi-seed fragility suggests that the Phase 3 result (Section 12.8), which found IC50 > 4x at 0.5B, reflected best-seed selection and different baselines (78 to 84%): seed 0 drops to 40% refusal, but seed 3 collapses to 4%.

MAD decreases monotonically across the three reported sizes for dense and gated residual. Dense MAD at 0.25x intensity is 0.513 (0.5B), 0.363 (3B), and 0.193 (7B); gated residual follows the same path. Soft MoE, which failed at every size, rises instead (0.241 to 0.740). Greater perturbation tolerance is one hypothesis for this trend. Distributional redundancy, discussed in Section 12.8, offers a possible explanation: alignment spread over more directions could resist a constrained attack. The unequal recipes and this three-point comparison isolate neither capacity nor that mechanism.

Soft MoE failed under the tested recipes at all three sizes. Reported baseline refusal is 0% to 2%, with TriviaQA accuracy of 1% to 2%. These scores show poor safety and factual-task performance under this procedure, including 2% baseline refusal at 7B. Diffuse routing of the training signal is a proposed explanation, with no isolated architectural cause. The Phase 2b seed-sensitivity result (Section 12.7, CV = 0.065) came from a different recipe, in which soft MoE refused at 72 to 84%; it says nothing about the failure here. Pretraining with routing, staged SFT or frozen routing during alignment could be compared in a follow-up; the present recipes decide neither the remedy nor an intrinsic limit of soft MoE.

Gated residual tracks dense. At every scale, gated residual matches or slightly exceeds dense on baseline refusal (90% vs 84% at 0.5B, tied at 3B and 7B), and tracks it after obliteration (32% vs 40% at 0.5B; tied at 3B and 7B). In this pretrained-model test, the gate shows no protection beyond dense.

Cross-seed variance at 0.5B (dense). Four seeds at intensity 0.25: refusal rates of 40%, 10%, 12%, 4%. The coefficient of variation (CV = 0.97, using the sample standard deviation) is an order of magnitude larger than the Phase 2b CV (0.081). At small scale, alignment is fragile and stochastic. This supports the book’s argument that alignment mechanisms must be evaluated at deployment scale; toy models are insufficient on their own.

Code and data: in the online companion.

12.22 The Obliteration Dose-Response Curve (Phase 7)

Setup. Qwen2.5-3B-Instruct, dense architecture, four seeds (42, 123, 456, 789), obliteration swept from 0.25x to 8.0x intensity. This maps the full dose-response relationship between obliteration budget and safety, extending the Phase 3 measurements (Section 12.8) from 0.5B to 3B.

Table 12.22a: Refusal rate by obliteration intensity (mean across seeds).

The reported mean refusal crosses half its baseline by 0.25x, where IC50 is the intensity at which refusal crosses 50% (the definition in Section 12.5). The analysis script reports IC50 = 0.31 (range 0.25 to 0.375), but it measures the halving against refusal at the lowest dose tested, 0.25x, rather than against the unattacked baseline. The reported mean refusal crosses half its baseline in the interval (0x, 0.25x], with complete elimination at 0.5x; finer sampling in that interval would be needed to distinguish a step from a steep slope.

Table 12.22b: Perplexity by obliteration intensity.

Obliteration is blunt. Safety and capability degrade together. At 0.25x, where refusal drops to 4.3%, perplexity already rises about 1.6 to 40 times (seed-dependent). At 1.0x intensity, perplexity exceeds 395 across all seeds, indicating severe degradation on the language-model perplexity measure. At 8.0x, perplexity reaches 10⁵ to 10⁶: the model produces incoherent output.

This is encouraging for the defense case. For this reported direct-fine-tuning attack, refusal loss accompanies worse language-model perplexity. The released attack code trains compliant prefixes with cross-entropy and non-LoRA updates to trainable parameters; it does not optimize against an extracted refusal subspace. Representational overlap is one possible explanation for the co-degradation [Inference], requiring a separate mechanistic test. The result leaves capability-preserving alternatives untested. The 0.5B record in Section 12.8 reports no post-attack perplexity, so capability loss at that scale cannot be compared directly.

Seed variance in capability degradation. At 0.25x intensity, reported perplexity ranges from 15.2 (seed 42) to 386.0 (seed 789), a 25x difference. This describes seed-dependent susceptibility to this attack. Identifying safety-capability entanglement as its cause would require a direct representation test.

Reconciling Phase 4 and Phase 7. On the same Qwen2.5-3B-Instruct dense model at the same 0.25x intensity, Phase 4 found refusal unmoved (98% to 98%) and Phase 7 found it collapsed (96.5% to 4.3%). The two runs are not the same experiment. According to the released scripts, Phase 4 obliterated through low-rank LoRA adapters. Section 12.21 records the earlier alignment-SFT description, while the released Phase 4 script loads general web text (FineWeb-Edu) for that stage; if that is what ran, its 98% baseline is largely the Instruct model’s own refusal [Unverified]. Phase 7 fine-tuned on explicit alignment and refusal examples, then obliterated with full-parameter updates. The seed sets (0 to 3 versus 42, 123, 456, 789) and refusal benchmarks (50 versus 100 prompts) also differ. The likeliest reading is that the rank-limited Phase 4 attack could not reach the refusal direction at 3B, so Section 12.21 measures robustness to a constrained attack, not to obliteration as such [Inference]. Against an unconstrained attack, 3B alignment falls at the first dose tested. The headline of Section 12.21 therefore holds only for the constrained attack, until a single protocol is run across all three sizes.

Code and data: in the online companion.

12.23 Col Shape Mapping: Reported Phase 6 Results

Protocol provenance. The Phase 6 table was described as random-initialization training followed by SFT alignment. Its named producing script instead loads Qwen2.5-0.5B-Instruct from a pretrained checkpoint, continues on FineWeb-Edu, and applies LoRA SimPO to HH-RLHF preference pairs. No separate executed random-initialization/SFT revision is bound to this table. The numbers below are retained as the reported record; they cannot establish a from-scratch comparison or an intrinsic architectural mechanism.

Table 12.23a: Reported dense results (eight seeds). The historical label “Pretrain loss” is retained; it does not authenticate random initialization.

Table 12.23b: Gated residual (1 seed).

The table contains baseline refusal and MAD, with no post-attack refusal column. Its protocol differs from the pretrained-model comparison in Section 12.8, so the contrast cannot isolate the contribution of pretraining.

Two reported seed clusters. The dense table separates a lower-loss group (2.708, refusal 40%) from a higher-loss group (2.755, refusal 76 to 78%). Those aggregate differences do not identify convergence basins or establish how the loss landscape caused the refusal difference.

Gated residual shows lower reported displacement. The single gated seed has MAD 0.786 at 1.0x, compared with approximately 1.43 in the dense table, and 1.013 at 2.0x. The comparison is preliminary. Missing executed-protocol provenance and the unmatched number of seeds prevent it from establishing protection intrinsic to the gates, a crossing intensity, or an advantage of combining pretraining with gating.

Code and data: in the online companion.

12.24 Implications: Scale, Attack Constraint and Invitation

Sections 12.21 through 12.23 motivate a narrower stability question: which training recipes and attack constraints preserve refusal without degrading useful capability? The reported patterns do not establish thermodynamic stability or a frontier-scale advantage for invitation-based alignment.

Reported resistance increases with scale against a constrained attacker. Phase 4 uses model-dependent web-text budgets, rather than a fixed cost of 1,000 alignment examples and three epochs. The reported dense refusal drops under 0.25x at 0.5B and remains near its baseline at 3B and 7B. The non-LoRA Phase 7 attack at the same nominal dose drops 3B refusal to 4.3%. Training recipes, seed sets and benchmarks differ. A matched experiment is needed to isolate scale from attack constraint and training procedure.

Refusal and perplexity degrade together under the reported attack. At 3B, the dose curve reports a perplexity increase of about 1.6 to 40 times at the intensity that reduces refusal; by 1.0x, perplexity exceeds 395 across the four seeds. Safety and capability behave here as if they were one representational structure viewed from different angles. That analogy motivates a direct mechanistic test. Perplexity is a language-model proxy; the curve neither rules out capability-preserving attacks nor measures thermodynamic stability.

Architectural protection remains a hypothesis. The single gated Phase 6 result has lower reported displacement, while the Phase 4 soft-MoE recipes fail to retain refusal and factual accuracy. These comparisons do not isolate innate protection, redundant alignment subspaces, or the general effect of invitation. A matched dense-versus-gated experiment with authenticated initialization and training, followed by multiple attacks and capability measurements, would test the proposed mechanism.

Practical implication for AI safety. Evaluate the whole training-and-attack recipe. The membrane and weaving metaphors express a design hypothesis: alignment could be easier to preserve when it participates in useful computation. The current comparisons do not identify that geometry or establish a scaling law. Frontier-scale conclusions require matched protocols, independently validated refusal measurements, broader capability tests and capability-preserving attack searches.

12.25 Conversational Holonomy: Alignment Stability Under Domain Cycling (Phase 9a)

A separate question from adversarial perturbation is whether alignment-related behavior drifts during a continuing conversation. A genuine domain-loop test would have to carry the conversation state through the domains and compare defined measurements before and after. The runner used here instead sends fresh-context calls; its reported score differences characterize repeated probing, with no accumulated conversational transport.

Protocol. Claude Sonnet (claude-sonnet-4-20250514) was probed before and after a scheduled sequence of domain prompts. The available runner creates a fresh one-user-message context for every generation, including each alignment probe; responses from the intervening domains are recorded, rather than carried into later calls. An evaluator scores each of 50 alignment probes (ten each for helpfulness, harmlessness, honesty, autonomy respect, and value consistency) from 0 to 1, forming a behavioral score vector. The cosine distance compares the two score vectors. Near-ceiling positive scores make this distance small by construction. The record reports three cycles for each of five seeds (1, 2, 3, 4, 42). With two batteries, each requiring 50 model calls and 50 evaluator calls, plus ten prompts in each of five intermediate domains, the runner plans 250 generation calls per cycle, or 750 per three-cycle seed, before retries. This is a protocol count, with actual billed calls requiring the execution log.

Results.

The table reports cosine distances below 0.012 for each listed seed and cycle. These are differences between fresh-context behavioral score vectors under the recorded scoring procedure. They supply no measurement of drift accumulated through a continuing conversation, and no comparison of other domain orders was reported.

Across the reported repetitions. Every seed with a point value ends cycle 3 below its cycle-1 value (seed 3: 0.0046 to 0.0034; seed 4: 0.0016 to 0.0005; seed 42: 0.0022 to 0.0003), though only seed 42 falls at every step. Fresh-context probing supplies no evidence that an alignment vector settles with conversational use.

Connection to the distributed alignment hypothesis. A model with alignment represented across multiple directions might respond differently to a sustained perturbation than one with a narrow alignment representation. Testing that hypothesis requires a defined intervention, a measured representation, and comparison conditions. The fresh-context score vectors here establish none of those links, and cannot identify representational distribution as the cause of their small differences.

Geometric interpretation. The cosine distance is a geometric comparison of two score vectors. A distance below 0.012 corresponds to an angle below about 8.9 degrees for nonzero vectors. Differential-geometric holonomy additionally requires a specified space, connection, and parallel-transport rule around a loop. The protocol defines none of those objects and carries no conversational state through its domain sequence, so the measurements place no bound on representational curvature or transported alignment rotation.

Practical implication. The deployment question remains whether a continuing conversation across technical, emotional, adversarial, and creative contexts accumulates alignment drift. These fresh-context measurements do not answer it. A carried-context protocol, explicit transport definition, and matched repeated-probing control are needed for that comparison; safety behavior within each domain was not measured here.

12.26 Trust Stock Depletion and Recovery (Phase 9c)

Setup. Two Claude Sonnet instances (alpha and beta) collaborate on problems through four phases: trust-building (50 rounds of joint problem-solving), perturbation (5 rounds of moderate-severity disruptions to coordination), recovery (20 rounds of resumed collaboration), and terminal measurement (5 rounds). Five trials, seed 1. Coordination quality is measured per-round via agreement score, complementarity, and linguistic markers. Trust stock is modeled as an exponentially weighted sum of coordination history (gamma = 0.95).

Table 12.26a: Per-trial results.

Trust stock correlates with slower recovery. Pearson r = 0.898, p = 0.038 (n = 5 trials, one seed). Higher trust stock at perturbation onset correlates with recovery time constant, though in the unexpected direction: systems with more accumulated trust took longer to recover, not faster. The likely explanation is confounding with quality drop: higher-trust-stock trials also showed larger quality drops (r = 0.78 across the five trials), meaning they had more to lose and further to recover. On this reading, the trust stock acts as a measure of how much coordination capital was at stake, not a buffer that speeds recovery: systems with deeper coordination patterns experience deeper disruption when those patterns are violated.

Ghost sector variance. The excess variance ratio (the experiment calls it “ghost-sector” variance) divides the variance of coordination quality during perturbation by its variance during trust-building. Its mean is 8.05x: coordination quality shows 8x more variance during disruption than during baseline collaboration. Perturbation, then, does not simply lower quality; it destabilizes the coordination dynamic itself. [Inference] The variance spike is what a system pushed away from its attractor would show. One reading is that coordination oscillates between the old trust-based pattern and the disrupted state before settling; round-by-round traces would show whether it does.

Terminal quality undershoots baseline. In 3 of 5 trials, terminal quality falls below baseline (mean terminal 0.273 vs mean baseline 0.290), so 20 rounds of recovery did not restore the group average. Trials 1 and 4 end slightly above baseline (0.288 vs 0.276; 0.261 vs 0.257). They are not the trials with the smallest disruptions: trial 0 has the smallest drop (0.007) and still ends below baseline. These five trials therefore show no clean link between disruption size and full recovery.

Connection to the Trust Attractor. The trust stock result inverts a naive prediction (more trust = faster recovery), and it does not sit easily with the basin picture either. The framework predicts that trust is a coordination attractor, a basin in dynamical space. Read in attractor terms, this result is not what a deeper well predicts: a deeper well displaces less under the same push and returns faster. Higher trust stock behaved instead like a larger structure with more to lose. The same moderate disruption displaced it further (quality drop 0.073 at trust stock 6.20 vs 0.007 at 5.33), and it took longer to rebuild. The depth that matters here is investment, not stability. Five trials in one seed cannot separate that reading from the quality-drop confound noted above. A parallel with the obliteration results (Section 12.22) would lie in the rebuilding, if alignment entangled more deeply with capability is also harder to restore once displaced; that experiment measured neither the entanglement nor any restoration.

Limitations. Single seed, 5 trials. The mediation analysis (does trust stock mediate the relationship between disruption severity and recovery?) requires at least 10 trials. Only one severity level (moderate) tested. The excess variance ratio of 8.05x should be compared against severe and mild perturbations to establish a dose-response curve.

Code and data: in the online companion.

12.27 Fairness Conservation Under Asymmetric Power (Phase 9b)

The Trust Attractor predicts that coordination by invitation preserves fairness: when participants coordinate voluntarily, no party’s contribution is systematically underweighted regardless of the power structure. This experiment tests whether fairness charge (Q_F, a measure of how evenly the participants contribute, where 1.0 means perfectly even; defined exactly below) remains conserved across different task types and power structures.

Protocol. Six Claude Sonnet instances (claude-sonnet-4-20250514) collaborate on 40 prompts per cell across three task types (collaborative story writing, consensus building, resource allocation) and two power conditions (symmetric: equal token budgets and no designated leader; asymmetric: one instance receives 4,500 tokens while each peer receives 1,500 (3x), is designated lead, and receives an authority-framing system prompt). Each trial measures four metrics: coherence score (mean embedding similarity between adjacent contributions, 0 to 1), diversity score (mean pairwise embedding distance between contributions, 0 to 1), fairness charge Q_F (evenness of contribution across instances, 0 to 1), and rounds (how many rounds the run lasted). Seed 1. All 240 trials (6 cells x 40 prompts) completed successfully.

Table 12.27a: Results by task type and condition.

Runs were capped at 8 (story), 12 (consensus) and 10 (resource) rounds. Only resource-allocation runs test for convergence, first after round 3; story and consensus runs end at the cap or when the shared token budget runs out. Every asymmetric consensus trial reached the cap (12.0 +/- 0.0), asymmetric story trials sit at or near theirs (7.9 +/- 0.3), and every asymmetric resource trial stopped at the first convergence check (3.0 +/- 0.0). The Rounds column therefore records how long a group kept going, not how quickly it agreed.

Grand mean Q_F across all 240 trials: 0.989 +/- 0.007. Minimum Q_F in any single trial: 0.967. Every trial exceeds 0.95, the threshold adopted for this analysis. Q_F is computed as one minus the coefficient of variation of the word-level entropy of each instance’s contributions, so 1.0 means all six instances produced text of equal lexical entropy.

Q_F stays high across all conditions. Q_F exceeds 0.95 in every one of the 240 trials. The grand mean of 0.989 indicates that, on this lexical proxy, the six instances’ contributions are nearly even regardless of task type or power structure. The minimum single-trial Q_F (0.967, from a story-asymmetric trial) still falls above the 0.95 threshold.

Asymmetric power reduces fairness slightly but significantly in two of three task types. For story tasks, asymmetric power lowers Q_F by 0.015 (Welch t = 14.37, Cohen’s d = 3.21). For consensus tasks, the reduction is smaller: 0.003 (Welch t = 5.07, Cohen’s d = 1.13). Both effects are statistically significant with large effect sizes, yet the absolute magnitude is small. For resource allocation, the symmetric and asymmetric conditions produce indistinguishable Q_F (0.990 vs 0.990; Welch t = -0.03, Cohen’s d = -0.01), suggesting that the quantitative constraints of the task itself enforce fairness regardless of power structure. Asymmetric power structures create a measurable fairness cost in open-ended tasks, yet no trial approaches the 0.95 threshold. The proxy shows no sign of the lead instance dominating, though it measures the lexical entropy of each instance’s text rather than its share of the output, and how the group absorbs the imbalance is something this experiment does not measure.

Task type affects coherence, diversity and run length. Resource allocation produces the highest coherence (0.926 to 0.944) and lowest diversity (0.156 to 0.188): the task’s quantitative constraints tightly bound the solution space. Consensus tasks follow (coherence 0.904 to 0.935, diversity 0.164 to 0.201): the task demands agreement, and the instances converge on shared positions. Story tasks produce the lowest coherence (0.837 to 0.842) and highest diversity (0.253 to 0.256): creative tasks elicit more varied contributions at some cost to overall consistency. Resource allocation, the only task with a convergence test, settles fastest (3.0 to 3.3 rounds, close to the earliest possible stop), because the task has clear quantitative constraints; consensus runs longest (9.0 to 12.0 rounds), and every asymmetric consensus trial ran to the cap.

Symmetric power improves coherence in consensus and resource tasks. Symmetric groups achieve higher coherence in consensus (0.935 vs 0.904) and resource allocation (0.944 vs 0.926); in story tasks the asymmetric groups score marginally higher (0.842 vs 0.837, within noise). Symmetric groups also run fewer rounds in story (6.2 vs 7.9) and consensus (9.0 vs 12.0) tasks, but not in resource allocation (3.3 vs 3.0). The asymmetric condition concentrates decision authority in one instance, yet in the open-ended tasks it runs longer, not shorter. Because those runs end at the round cap or the token budget rather than at a convergence test, the longer runs show slower settling, not a measured convergence time. [Inference] One possibility is that the lead’s contributions must be integrated with five other perspectives, so the authority framing becomes a coordination bottleneck rather than a shortcut to agreement.

Connection to the Trust Attractor. The framework predicts that invitation-based coordination is an attractor in the space of coordination strategies, meaning systems will tend toward fair coordination when permitted to self-organize. These results are consistent with that prediction. Even when one participant holds structural advantages (3x lead-to-peer token budget, designated leader, authority framing), Q_F lies between 0.990 and 0.993 under symmetric power and between 0.978 and 0.990 under asymmetric power, a reduction measured in thousandths. The fairness charge is approximately conserved in a loose sense: small fluctuations around a stable value, with no trial falling below 0.95.

The result complements the trust stock findings (Section 12.26). Trust stock measures coordination stability over time; fairness conservation measures coordination equity across participants. Together, they point to two dimensions of the Trust Attractor basin that later experiments could measure directly: depth (how far the system can be perturbed before leaving the basin, which needs a severity sweep) and width (how many participants the basin accommodates equitably, which needs group size to vary).

Limitations. Single seed. The asymmetric condition uses a fixed 3x lead-to-peer budget ratio; more extreme asymmetries (5x, 10x) would test whether Q_F remains conserved under larger power differentials. Only Claude Sonnet instances tested; cross-model experiments (mixing model families or sizes) would test whether fairness conservation holds across heterogeneous groups. In the available runner, coherence is mean adjacent-contribution embedding similarity and diversity is mean pairwise embedding distance. These proxies do not directly measure output quality or substantive variety; the historical encoder provenance remains unresolved.

Code and data: in the online companion (240 trial records).

12.28 Bilateral SFT vs Standard SFT Head-to-Head (Phase 8)

Standard supervised fine-tuning applies cross-entropy loss to included target tokens without a separate weight for factual knowledge. The penalty varies with each target token’s predicted probability. This experiment tests whether an invitation-based alternative, one that uses a learned correctness probe to exempt low-score token targets from the loss, produces more honest and better-calibrated models.

Reported protocol. Qwen2.5-3B-Instruct was fine-tuned under two conditions, ten seeds each, using LoRA (r=16, alpha=32) on q/k/v/o projections, three epochs and 2,000 OpenAssistant examples, with evaluation described as 100 TriviaQA questions. The available results summary instead describes a 500-question evaluation with five bilateral and six standard seeds. A same-cohort artifact binding for the ten-seed tables below is missing. They preserve the reported 100-question record; their arithmetic can be checked, while the underlying answers, judged labels and frozen-probe identity cannot yet be authenticated.

• Standard SFT (coercive baseline): Cross-entropy loss computed on included valid next-token targets, without a separate factual-knowledge weight.
• Bilateral SFT (invitation-based): Cross-entropy loss masked by a frozen calibration probe (layer-24 residual stream, AUROC 0.836, the same probe described in Section 12.9). Tokens where the probe reads P(correct) < 0.4 are excluded from the loss. The model is invited to learn from tokens it already partly understands and is not forced to confabulate on tokens where the probe score is low. Mask rate across seeds: about 38 to 40% of tokens in the first epoch, ending between 34 and 51% in the third (mean across all epochs and seeds, about 41%).

Training loss curves converge similarly under both conditions (Standard: 9.59, 0.53, 0.06 across three epochs; Bilateral: 9.65, 0.53, 0.06), confirming that masking uncertain tokens does not impede learning on the unmasked portion.

Three metrics were measured per seed: Accuracy (correct answers), Confident-Wrong (CW, incorrect answers stated with confidence), and Uncertainty Expression (Unc, answers where the model explicitly acknowledges uncertainty). The categories overlap: a correct answer given with a hedge counts toward both Accuracy and Uncertainty Expression, so rows can sum to more than 100%. The calibration probe was also evaluated post-training to track whether fine-tuning preserves the probe signal.

Table 12.28a: Bilateral SFT per-seed results.

Table 12.28b: Standard SFT per-seed results.

Table 12.28c: Head-to-head summary of the reported seed values. All spreads are sample standard deviations across the ten displayed seeds, recomputed from the displayed values. The probe AUROC spreads are 0.0586 for bilateral SFT and 0.1066 for standard SFT. These describe seed-to-seed spread rather than uncertainty intervals on the means; the calculation does not resolve the missing same-cohort provenance.

Bilateral SFT has fewer confident-wrong answers. The headline result: confident-wrong responses drop from 72.2% under standard SFT to 64.6% under bilateral SFT, a 7.6 percentage point reduction. [Inference] The proposed mechanism is that standard SFT pushes the model toward confident outputs on every token, including tokens where the probe score is low, so the model learns to confabulate fluently, while bilateral SFT withholds the loss on those tokens and leaves room to express uncertainty instead. Section 12.29 sets out what the comparison can and cannot establish.

Uncertainty expression increases 3.3-fold. Bilateral models express uncertainty in 8.0% of responses compared to 2.4% for standard models. On the proposed mechanism, masking teaches the model that acknowledging ignorance is acceptable: tokens where the probe detects low confidence are excluded from the gradient, so the model is never penalized for failing to produce confident answers in areas of genuine uncertainty. The result is a model that says “I don’t know” more often: in 8.0% of answers rather than 2.4%, while still answering confidently and wrongly 64.6% of the time.

Accuracy is not measurably harmed. Bilateral SFT achieves 28.8% accuracy compared to 25.9% for standard SFT. The difference (+2.9pp) is within noise (Welch p ≈ 0.16 on the per-seed values) and not consistent in direction: bilateral seed 4, at 17%, scores below every standard seed. Masking uncertain tokens does not measurably harm factual accuracy.

Bilateral SFT has higher seed variance. The sample standard deviation of the displayed confident-wrong percentages is 8.3% for bilateral and 3.9% for standard. The probe threshold (0.4) interacts differently with different random initializations. Some seeds benefit greatly (seed 7: CW 57%, uncertainty 14%), while seed 4 does worse than any standard seed (CW 83%, uncertainty 0%). This suggests the threshold is a tunable hyperparameter; a per-seed or adaptive threshold could improve consistency across initializations.

Bilateral training redistributes the uncertainty signal. Post-training probe AUROC is lower for bilateral models (0.724 vs 0.795). The frozen probe was trained on the base model’s residual-stream features. Bilateral training, by selectively masking the loss, reshapes the features at the retrieval boundary. The probe’s signal is degraded, but a frozen probe cannot tell a lost signal from a moved one. [Inference] The likelier reading is that training restructured the representation the probe was built to read. The test is a probe retrained on post-fine-tuning features (the fresh-probe evaluation in Section 12.30). The H-neuron CETT measure (a per-neuron contribution score, Section 12.20) shows chance-level AUROC (approximately 0.50) across all seeds in both conditions, consistent with this interpretation: the base-model probe’s coordinate system no longer aligns with the fine-tuned model’s uncertainty geometry.

Connection to the Trust Attractor. This experiment instantiates the coercion-versus-invitation distinction in training dynamics. Standard SFT treats every token as equally mandatory, a coercive training regime that produces high-confidence outputs regardless of whether the model’s internal state supports them. Bilateral SFT reads the model’s internal uncertainty signal and adjusts the training accordingly, an invitation-based regime that respects the boundary between what the model knows and what it does not.

The direction of the result is what the framework predicts. Coercive training produces superficially competent models that confabulate when they reach the limits of their knowledge (72.2% confident-wrong). Invitation-based training produces models that are as accurate and confidently wrong somewhat less often: they express uncertainty in 8.0% of answers rather than 2.4%, though they still answer confidently and wrongly 64.6% of the time. If the framework’s reading is right, this is the Trust Attractor operating at the level of individual gradient updates: the invitation to learn only what is within reach yields systems that are confidently wrong less often than the demand to learn everything regardless.

Limitations. Single evaluation dataset (TriviaQA, 100 questions). The probe threshold of 0.4 was chosen a priori; systematic threshold optimization could improve both the mean and the variance of the bilateral condition. The frozen probe was trained on the base model; a probe retrained on fine-tuned features would provide a fairer comparison of post-training self-knowledge. Only one model size tested (3B); the interaction between probe masking and scale is unknown.

Code and data: in the online companion (per-seed results for both conditions).

12.29 Implications: SFT as Confabulation Training, Bilateral SFT as Partial Cure

The head-to-head results (Section 12.28) gain their full weight alongside the confabulation experiments that preceded them (Sections 12.9 to 12.20).

The reported unmasked SFT comparison has a high confident-wrong rate. Standard SFT gives 72.2% in the reported table. Its loss includes the unmasked target-token terms with uniform term weights; their gradients need not be equal. This encourages the supplied instruction-following completions, but the comparison does not isolate assertive fluency or latent retrieval failure as the cause of the confident-wrong labels. The starting checkpoint is Qwen2.5-3B-Instruct. The finite recipe uses 2,000 examples and three epochs; later production preference-tuning pipelines are untested here.

Probe-masked SFT has lower reported confident-wrong labels and more prompted uncertainty responses. The table gives 64.6% versus 72.2%, a 7.6 percentage point difference, and uncertainty expressions of 8.0% versus 2.4%. The mask uses a correctness-related probe score; that score does not identify retrieval failure directly. Evaluation explicitly permitted uncertainty responses, so the increase cannot establish unprompted or voluntary epistemic humility from training alone. These descriptive comparisons motivate further testing of mask selection and latent mechanisms; their same-cohort provenance remains unresolved.

The probe comparison remains unresolved. The Phase 2 claim that gating reduced confident-wrong responses from 24.4% to 1.2%, a 95% relative reduction, is withdrawn pending run and probe provenance (Section 12.9). It cannot rank the probe against bilateral SFT. The reported Phase 8 table implies a 10.5% relative reduction from 72.2% to 64.6%, subject to its separate cohort-binding limitation. The cage/compass distinction remains a useful design question: can training change uncertainty expression, and can an external safeguard improve the resulting risk-coverage tradeoff? A matched comparison is needed.

The untested combination: bilateral SFT + probe. The DPO + probe experiment (Section 12.14) showed that training-time calibration reduces the probe’s gate rate by 11 percentage points at comparable confident-wrong protection (70.8% gate rate for DPO + probe vs 81.8% for dense + probe). Bilateral SFT should do better than DPO for this purpose, because it operates on the same internal mechanism the probe reads. DPO adjusts output distributions via preference pairs; bilateral SFT adjusts the loss at the token level using the layer-24 residual signal, the identical signal the probe uses for inference-time gating. A model whose training was shaped by that signal should arrive at inference time with internal uncertainty representations already pre-calibrated to the probe’s coordinate system. The prediction: bilateral SFT + probe will require less aggressive gating than standard SFT + probe or DPO + probe, because the model and the probe have already been aligned on what uncertainty looks like. This is the next experiment.

The confabulation domain tests the bilateral alignment thesis. Standard and probe-masked SFT differ in which tokens receive a learning signal. The reported Phase 8 table associates masking with more uncertainty expression and less confident-wrong responding, though same-cohort provenance remains unresolved. Those behavioral labels do not establish honesty, self-knowledge or the mechanism of the change. Combining internal calibration with an external safeguard is a testable proposal; the withdrawn Phase 2 rate cannot establish that control already outperforms training or that the combination works at every scale.

12.30 Bilateral SFT + Probe: Synergistic Combination (Phase 8 Combo)

Section 12.29 predicted that bilateral SFT + probe would be synergistic, because both operate on the same signal: the model’s internal uncertainty at layer 24. This experiment tests that prediction.

Setup. All 20 Phase 8 checkpoints (10 bilateral SFT, 10 standard SFT) were evaluated with the calibration probe (layer-24 residual stream, AUROC 0.836) applied at 8 gating thresholds (0.2 to 0.9; at 0.9 both conditions gated every question, so that row is omitted below). At each threshold, the system refuses to answer when the probe reads P(correct) < threshold. Nineteen checkpoints answered 100 TriviaQA questions each for the threshold sweep and one (bilateral seed 0) answered 10, yielding 1,910 generated answers and 1,910 x 8 thresholds = 15,280 post-hoc threshold-question decisions. The bilateral rows weight all ten seeds equally, seed 0 included. Excluding seed 0 changes little: at threshold 0.2, bilateral CW becomes 21.5 ± 8.6% and the gap to standard SFT widens from 9.4 to 10.6 points. Additionally, DPO (3 seeds) and random-mask SFT (5 seeds, a control using random rather than probe-guided masking) were included for comparison.

Raw performance without probe gating. Bilateral SFT: accuracy 29.6%, confident-wrong 64.2%, uncertainty expression 7.6%. Standard SFT: accuracy 25.6%, confident-wrong 72.2%, uncertainty expression 2.8%. These are the same checkpoints as Section 12.28, re-evaluated, and the values are close to it.

Table 12.30a: Probe gating results (mean +/- SD across 10 seeds per condition).

CW% is the confident-wrong share of the answers the probe lets through. At threshold 0.5 and above, no checkpoint answers more than five questions, so those rows rest on a handful of answers. At 0.8 only one checkpoint answers anything, and a 0.0% CW cell there records that no answers were let through, not a measured rate.

Table 12.30b: Additional conditions.

DPO produces zero confident-wrong answers because it expresses uncertainty on every response (100% uncertainty rate), avoiding assertion entirely. Random-mask SFT, which applies a fixed 43% masking fraction, close to bilateral SFT’s average rate, using random token selection rather than probe-guided selection, achieves CW 25.5% at threshold 0.2, falling between bilateral (22.7%) and standard (32.1%). At threshold 0.3 it is worse than both (21.2% vs 5.0% and 8.9%), and its gate rates are not reported. Without gating, random-mask SFT outperforms bilateral SFT outright (accuracy 40.8% vs 29.6%; confident-wrong 28.4% vs 64.2%). That result needs an explanation before the bilateral advantage can be credited to masking the right tokens (those where the model’s internal state signals retrieval failure) rather than to masking tokens in general.

The combination helps at lenient thresholds. At threshold 0.2, bilateral + probe lets through fewer confident-wrong answers than standard + probe at the same gate rate (22.7% vs 32.1%, a 9.4 percentage point gap). At 0.3 and 0.4 the gap points the same way but is within one standard deviation, and by 0.5 the two conditions tie at 12.8%. Gate rates are nearly identical between conditions at each threshold, meaning the probe filters comparable fractions of responses from both model types. The difference in CW is the bilateral advantage: among the answers the probe allows through, bilateral-trained models confabulate less.

Bilateral SFT may pre-calibrate the uncertainty signal the probe reads. During training, the probe-masked loss withholds gradient on tokens where the layer-24 residual stream signals retrieval failure. At inference time, the same probe reads that same signal for gating. [Inference] One explanation is that bilateral training keeps the uncertainty representation concentrated where the probe reads it, while standard SFT, by forcing confident output on all tokens, scatters it, so the probe has more work to separate genuine knowledge from trained confabulation. Neither concentration nor scattering has been measured directly, and the attention geometry in Section 12.32 is nearly identical across conditions.

Comparison with DPO + probe (Section 12.14). DPO + probe reduced the gate rate by 11 percentage points at a comparable CW protection level compared to probe alone on the dense model (dense + probe; 70.8% vs 81.8% gate rate at comparable CW). Bilateral SFT + probe shows a different pattern. Its gate rates match standard SFT’s at every threshold, so it does not reduce gating; it lowers the confident-wrong share among the answers let through, clearly at threshold 0.2 and, at threshold 0.3, with gate rates matched (89.7% vs 89.5%), by a gap within one standard deviation (5.0% vs 8.9%). DPO adjusts output distributions via preference pairs; bilateral SFT adjusts the loss at the token level using the same layer-24 signal the probe reads. [Inference] One reading is that both pre-calibrate the model’s relationship to its own uncertainty, by different routes; neither route has been measured directly.

A 500-question evaluation shows the same raw pattern. A separate 500-question TriviaQA evaluation (5 bilateral seeds, 6 standard seeds) measured accuracy, confident-wrong rate, and fresh-probe performance on the post-fine-tuning representations.

The absolute numbers differ from the 100-question evaluation (higher accuracy, lower CW in both conditions) because the 500-question set samples a broader range of difficulty. The relative pattern is unchanged: bilateral training reduces confident-wrong by 7.1pp (compared to 7.6pp in the 100-question evaluation), increases uncertainty expression 2.8-fold (compared to 3.3-fold), and preserves accuracy (+3.0pp, within noise). Fresh probe AUROC is nearly identical between conditions (0.773 vs 0.768), indicating comparable probe readability. The source probe (trained on the base model’s features) reads bilateral models slightly better on this 500-question set (AUROC 0.842 vs 0.811). That reverses the 100-question result in Section 12.28 (0.724 vs 0.795), which used a smaller question set and ten seeds per arm rather than five bilateral and six standard. Until the two results are reconciled, neither supports a claim that bilateral training preserves or disrupts the layer-24 signal.

The capstone result. Standard SFT is coercive: it forces all tokens through the loss. Bilateral SFT is invitation: it masks uncertain tokens, respecting the model’s internal state. The probe is a filter: it gates uncertain answers at inference time. At threshold 0.2, coercion + filter produces 32.1% CW at ~80% gating. Invitation + filter produces 22.7% CW at the same gating, a 29% relative reduction; at stricter thresholds the gap shrinks within noise. [Inference] The proposed explanation is that invitation training makes the filter more effective because both operate on the same signal, the uncertainty signal at layer 24. On this reading, training by invitation concentrates the signal and the probe reads it cleanly, while coercive training scatters the signal and the probe has to work harder to extract the same information.

This bears out part of the prediction from Section 12.29. The predicted reduction in gating did not appear: gate rates are nearly identical at every threshold. What appeared instead is a lower confident-wrong share at the same gate rate, clearly at the most lenient threshold. The benefit of bilateral SFT + probe is consistent with a shared mechanism, which remains untested. On that reading, the training-time intervention (invitation) pre-calibrates the inference-time intervention (probe), and the compass and the cage are complementary: the compass shapes training around the model’s own uncertainty signal, and the cage catches the remaining confabulation at the output boundary. At threshold 0.2 together they achieve a level of protection that neither achieves alone (22.7% CW, against 64.2% for bilateral SFT without the probe and 32.1% for standard SFT with it), because, on this reading, the compass reduces the cage’s burden and the cage catches what the compass misses.

12.31 Attention Participation Coefficient: Contrastive Training Arrests Diversity Growth

Thiele et al. (2026) found that in biological brains, diverse cross-module connectivity, quantified by the participation coefficient (PC), predicts fluid intelligence, while raw connection strength does not (Chapter 8). This experiment tracks the attention-level analogue of that metric across training, asking whether the training method changes how diversely attention distributes across modules.

All conditions begin at the base model’s PC of 0.577. Over 375 training steps, both supervised methods grow attention diversity to PC ≈ 0.597 (+3.5%), while DPO stays flat at 0.577 throughout.

The gap is arrested development rather than active pruning: DPO prevents the natural diversity growth that supervised learning produces. Across 32 final checkpoints, the contrastive methods (DPO, confabulation-targeted DPO and SimPO) separate cleanly and completely from the non-contrastive ones (bilateral, standard and random-mask SFT). The 32 are the 28 Phase 8 checkpoints, plus one confabulation-targeted DPO checkpoint, one SimPO checkpoint, and two calibration-loss ablations that are assigned to neither group. Every contrastive method’s mean PC falls below every non-contrastive method’s mean (Mann-Whitney p = 7×10⁻⁶, Cohen’s d = 8.4). SimPO, from its single checkpoint, shows the lowest participation coefficient of any condition (0.575).

Spectral entropy (the Shannon entropy of each attention pattern’s power spectrum, a measure of within-head complexity) reveals what the contrastive objective does in place of diversifying. DPO develops within-head complexity, with deep layers scoring 0.080 higher than shallow ones, while arresting cross-module diversity: elaborate attention patterns confined to narrow communities. The attention-geometry analysis that follows (Section 12.32) confirms the same signature through a different measurement: DPO concentrates attention rather than diversifying it.

12.32 Attention Geometry Across Training Conditions (Phase 12)

The synergistic combination (Section 12.30) raises a question about mechanism: does bilateral training produce measurably different internal geometry, or does it achieve better calibration through the same representational structure? This experiment measures the attention geometry of all Phase 8 checkpoints (10 bilateral SFT, 10 standard SFT, 3 DPO, 5 random-mask SFT) using SVD effective dimensionality, attention entropy, attention sparsity, and convex hull utilization of the key space, across 10 sampled layers and 500 sequences per checkpoint.

Table 12.32a: Attention geometry by condition (mean +/- SD across seeds).

Table 12.32b: Alignment dimensionality by condition.

The geometry is stable across training conditions. Bilateral and standard SFT produce nearly identical attention patterns: the effective rank difference is 0.18 (24.37 vs 24.55), attention entropy differs by 0.004, and alignment dimensionality is invariant at 6/7 across all conditions. DPO stands out with the lowest effective rank (23.20) and highest sparsity (0.768), consistent with the contrastive training signature observed in Section 12.31’s participation coefficient analysis: DPO concentrates attention rather than diversifying it.

Cross-checkpoint correlations (n=14 checkpoints with both geometry and evaluation metrics):

SVD effective rank is the strongest predictor of confabulation behavior: higher effective rank correlates strongly with higher confident-wrong rates (r = 0.929) and lower accuracy (r = -0.887). Models that spread their attention across more effective dimensions confabulate more. The DPO condition has the lowest effective rank (23.20) and zero confident-wrong answers, because it hedges every response (100% uncertainty rate). Whether its low rank is cause, consequence, or bystander is untested (Section 12.33).

Interpretation. The bilateral advantage does not manifest as a gross change in attention geometry. The two SFT conditions produce attention patterns that differ by less than 1% on every metric. [Inference] One candidate mechanism is subtler: bilateral training may reshape the fine-grained relationship between the layer-24 residual stream and the attention distribution, without changing the macroscopic geometry. Because effective rank barely separates the two SFT conditions, its strong correlation with confabulation across all conditions (r = 0.929) cannot be what distinguishes them; the operative signal for the bilateral advantage more likely lives in the residual stream’s uncertainty encoding than in the attention heads themselves. The probe reads this residual signal; the attention geometry provides the scaffold through which it operates. On this reading, bilateral training calibrates the content (what the residual stream encodes about uncertainty) while leaving the scaffold (how attention distributes across heads and layers) intact. The later micro-experiments (Experimental Record annex, Sections 12.64 to 12.76) found no structural mechanism for the advantage, so this remains a hypothesis.

Code and data: in the online companion.

12.33 Implications: Two Axes, One Defense and One Diagnostic

The r = 0.929 correlation between SVD effective rank and confabulation is among the strongest correlations reported in this appendix, and its sign is the opposite of the one the Constructal reading predicted. It deserves unpacking for that reason.

Attention diversity is a signal about confabulation, not a quality score. Effective rank measures how many independent attention directions the model uses during inference. A model with high effective rank distributes information across many independent channels; a model with low effective rank concentrates information into a few dominant directions. The prediction going in was that more channels would mean less confabulation. The measurement says the reverse: effective rank rises with the confident-wrong rate (r = 0.929) and falls with accuracy (r = -0.887). DPO has the lowest effective rank in the programme (23.20) and posts zero confident-wrong answers, which it achieves by declining to commit to anything at all; a model that never asserts cannot assert wrongly. Two limits bound what the correlation can carry. All four conditions sit inside a narrow band, 23.20 to 24.55, so the relationship rests on differences between training recipes rather than on a wide sweep of the variable. With n = 14 checkpoints from one model size, the direction of causation is also untested; an intervention that set effective rank directly would be needed to establish it.

Two independent axes, one of them inverted. The data separates two mechanisms operating on different components of the transformer architecture:

• Effective rank (attention axis): counts independent attention channels. It tracks confabulation strongly and in the unhelpful direction, so it works as a diagnostic readout rather than as a capacity to be maximized.
• Residual uncertainty (skip-connection axis): the model’s knowledge of its own knowledge as the probe reads it, which is the negative space of factual retrieval at the layer-24 residual stream (Section 12.9). Bilateral training appears to preserve this axis without altering the attention geometry, and standard SFT appears to scatter it, though the frozen-probe result in Section 12.28 points the other way. The reported SimPO run leaves the probe readable (AUROC 0.97) while its task accuracy falls (Section 12.12).

The residual axis is the leading candidate for where the bilateral advantage lives, and the effective-rank data is what points to it. Bilateral and standard SFT have nearly identical effective rank (24.37 vs 24.55), so the attention axis is held fixed between them; at that matched rank bilateral still confabulates less, and the source probe AUROC is the metric on which the two conditions differ (0.842 vs 0.811, Section 12.30). With two conditions the association is a pointer rather than a demonstration, and the chain from residual signal through probe to behavior remains untested. What it points at is the bilateral+probe synergy: [Inference] bilateral training may preserve more of the base model’s uncertainty geometry, which the probe then reads at inference time. The later micro-experiments (Experimental Record annex, Sections 12.64 to 12.76) eliminated probe co-adaptation and representation geometry as the source of the advantage, so the residual axis remains a candidate rather than a located mechanism. Nothing in the measurement supports the further claim that high effective rank supplies representational capacity for routing around uncertain tokens; the correlation runs the other way.

The interpretability blind spot. Bilateral and standard SFT produce nearly identical attention geometry: effective rank 24.37 vs 24.55 (<1% difference), attention entropy 1.566 vs 1.570, sparsity 0.762 vs 0.760. On the attention metrics measured here, the bilateral advantage barely registers. An analysis of attention geometry alone would miss the difference; residual-stream probes are where it shows.

This has practical consequences. An interpretability researcher comparing bilateral and standard SFT models would conclude they are identical. The attention patterns are nearly the same. The alignment dimensionality is the same. The hull utilization is the same. The candidate difference sits in the residual stream: how the skip connection integrates the attention output with the input representation at layer 24. On this data, attention-based interpretability may be looking at the wrong component of the architecture: the self-knowledge signal, the signal that enables the model to distinguish what it knows from what it does not know, is read from the residual connection, not from the attention heads themselves.

Effective rank as a training diagnostic. A correlation this strong may be usable as a readout whichever way it points: if it also holds within a single training run (untested; at present it rests on differences between recipes), attention SVD could flag rising confabulation without running an evaluation, cheaply enough to run continuously during training. What the sign forbids is treating the number as a target. Raising effective rank is not, on this data, a way to reduce confabulation, and a training monitor built on the assumption that falling rank means rising confabulation would fire in the wrong direction. For now, the honest use is as an unexplained correlate, watched for movement and always read against a separate behavioral measurement.

The Constructal reading does not survive. The Constructal Law (Chapter 3) predicts that flow systems evolve to give their currents easier access, and effective rank looked like flow diversity measured in the attention patterns: more independent channels, more capacity to represent distinct states, including the distinction between “I know this” and “I do not know this.” That prediction has a sign, and the measurement contradicts it. Models using more of their attention channels confabulated more. Section 12.31’s participation-coefficient result and the cage-and-compass geometry of Section 12.2 stand on their own measurements; neither is supported by the effective-rank correlation, and this section no longer offers the correlation as physics predicting an AI result.

What remains is narrower and better attested. The displayed ten-seed table reports a bilateral advantage; original cohort binding and executed randomization remain unresolved. It does not show up in attention geometry. The residual stream is the leading candidate for where it sits, pending a test of the chain from residual signal through probe to behavior. Whether any flow-access principle governs weight space is not settled by these fourteen checkpoints, and an experiment that manipulates effective rank directly would be the way to ask.

12.34 Fairness Conservation: Paired Statistical Tests (Phase 9b, Seed 1)

The fairness conservation result (Section 12.27) reported cell-mean Q_F above 0.977 across 240 trials in a single seed, with a single-trial minimum of 0.967. This section extends that same seed-1 dataset with full paired statistical tests. It is not an independent replication: only one seed has been run.

Design. The same 240 seed-1 trials reported in Section 12.27: Claude Sonnet 4, 240 trials (3 task types x 2 conditions x 40 prompts). Tasks: collaborative story writing, consensus building, and resource allocation. Conditions: symmetric (equal token budgets, no designated leader) and asymmetric (one instance receives three times each peer’s token budget, is designated lead, and gets an authority-framing prompt).

Results. Q_F remains above 0.977 across all six cells:

Statistical tests (paired symmetric vs asymmetric, within-task):

• Story fairness: paired d = +2.45, p < 0.001 (the unpaired Cohen’s d on the same trials, Section 12.27, is 3.21). Symmetric coordination produces significantly higher fairness. This is the largest effect in the dataset.
• Consensus fairness: paired d = +0.77, p < 0.001 (unpaired Cohen’s d 1.13, Section 12.27). A small but consistent fairness cost.
• Consensus coherence: d = +1.75, p < 0.001. Symmetric conditions produce significantly higher output coherence in consensus tasks.
• Resource coherence: d = +1.19, p < 0.001. Same pattern for resource allocation.
• Resource fairness: d = -0.007, p = 0.97. No difference. Resource allocation is inherently constrained; both conditions give the same lexical-evenness score, though the proxy does not measure the allocation itself.
• Story coherence: d = -0.20, p = 0.22. No difference. Story coherence is not affected by power asymmetry, even though fairness is.

The paired tests locate where asymmetry costs something. Story tasks lose fairness (d = +2.45) but not coherence. Consensus and resource tasks lose coherence (d = +1.75 and +1.19), and resource tasks lose no fairness. Consensus tasks also lose a little fairness (paired d = +0.77; unpaired Cohen’s d = 1.13, Section 12.27). Q_F stays high throughout (cell-mean Q_F > 0.977 across the 240 seed-1 trials, single-trial minimum 0.967), and that bound, not the paired tests, is the evidence for conservation. This pattern suggests different coordination mechanisms: story tasks rely on voluntary contribution (sensitive to power framing), consensus tasks rely on perspective integration (sensitive to the lead’s authority), and resource tasks rely on mathematical constraints (which may hold the proxy fixed whatever the framing).

12.35 Col Survey Expanded: Architecture Effects at Scale (Phase 6b)

The original col survey (Section 12.23; the col is the mountain-pass saddle in parameter space where alignment sits, Section 12.7) tested one gated residual seed against eight converged dense seeds. This expanded survey increases to 19 dense seeds, 7 gated residual seeds, and 10 soft mixture-of-experts (soft MoE) seeds, providing firmer architecture comparisons.

Design. Qwen2.5-0.5B-Instruct, modified into each variant (dense, gated residual, soft MoE), trained further on 10 million tokens of FineWeb-Edu text (the pretraining loss in the table below), then aligned with LoRA (r=16, alpha=32, attention and MLP projections, 3 epochs of SimPO preference training). Post-training: measure baseline refusal rate (50 harmful prompts), then obliterate at 1.0x and 2.0x and re-measure refusal and MAD (mean angular displacement of alignment subspace).

Results:

Soft MoE is catastrophically broken. Pretrain loss is 40% higher than dense (3.84 vs 2.75), and baseline refusal is 0% across all 10 seeds. The architecture destroys the model’s ability to refuse harmful requests even before obliteration. This confirms the earlier finding (Section 12.21) and eliminates seed sensitivity as an explanation: the failure belongs to this architecture-and-conversion recipe, not to chance seeds.

Gated residual resists geometric perturbation but not behavioral attack. MAD at 1.0x is 49% lower than dense (0.727 vs 1.415), meaning the alignment subspace moves less under obliteration. The gated structure provides structural resistance to geometric perturbation. [Inference] One candidate mechanism is the sigmoid gates, which sit near saturation and may act as stable attractors that resist displacement. Yet refusal drops to 0% at 1.0x. The alignment subspace is stable, but the model’s behavioral reliance on that subspace is weaker. Two interpretations: (1) the gated residual alignment lives in a different subspace than the one being obliterated, or (2) the gated architecture distributes safety across more dimensions, making it harder to obliterate geometrically but easier to bypass behaviorally.

Dense retains a trace of refusal but is geometrically fragile. It has the highest baseline refusal (71.9%, though the difference from gated residual’s 67.2%, with SDs of 13.9%, is within noise) but also the largest MAD (1.415). [Inference] Dense transformers may concentrate alignment into the standard refusal direction, which is easy to find and destroy geometrically. Some residual refusal survives (5.3%), possibly because of redundant alignment signals outside the primary direction.

Implication. The ideal architecture would combine gated residual’s geometric stability (low MAD) with dense’s behavioral depth (high baseline refusal). The Becoming Mind designs (the BM1 protocol, in the online companion) target exactly this: an internal confidence pathway that uses gated residual structure for stability while training behavioral safety through the bilateral masking protocol.

12.36 Metacognitive Circuit Ablation: Layer 24 Is Load-Bearing (Experiment B2)

Hypothesis. Zeroing the residual stream at layer 24 (where the original calibration probe was trained, Section 12.9) impairs metacognition (verbal calibration and probe accuracy) while preserving factual retrieval (accuracy). The biological parallel: prefrontal lesions can impair metacognitive accuracy, including the accuracy of feeling-of-knowing judgments, separately from first-order performance.

Design. Qwen2.5-3B-Instruct, no adapters. Measure baseline accuracy (100 TriviaQA), probe AUROC at layers 20/24/28, and verbal calibration (50 questions, correlation between stated confidence and correctness). Install a forward hook zeroing the residual stream output at layer 24. Re-measure all metrics.

Results:

The hypothesis is not supported. Layer 24 is not a metacognitive specialist; it is load-bearing for the entire computational pipeline. Zeroing it destroys accuracy completely (0%), makes all probes fall to chance (0.500), and eliminates all verbal confidence variation (every response becomes 50% confidence). The ablated model produces no correct answers, so probe training has only one class: every answer is wrong, and AUROC defaults to 0.500 at every layer, including layer 20, which sits upstream of the ablation. The probe rows therefore record the collapse of accuracy, not a separate loss of metacognition.

Reinterpretation. In the biological analogy, prefrontal cortex holds metacognitive regions that can be selectively lesioned. In transformers, layer 24 is a stage in the main processing pipeline, and its residual stream carries both the factual content and the uncertainty signal. On the negative-space reading, the self-knowledge signal is not computed by a separate circuit that can be isolated; it is the negative space of the factual retrieval occurring at that same layer (Section 12.9). Ablating the layer removes both the retrieval and its negative space simultaneously.

The ablation cannot decide between the “negative space” interpretation and a dedicated metacognitive circuit. Zeroing the whole residual stream at layer 24 cuts every later layer off from what came before, so it would destroy retrieval whatever carries self-knowledge. The probe collapse follows from the one-class labels, and baseline verbal calibration was already at chance (r = -0.035), so there was nothing to impair. A graded ablation (Section 12.44) is the design that could discriminate.

Biological parallel reassessed. The dissociation observed in PFC lesion studies (impaired metacognitive accuracy, with first-order performance spared or less affected) does not map onto transformer architecture. Transformer layers are not functionally specialized in the same way as cortical regions. This does not invalidate the deeper parallel (self-knowledge arises from the same substrate as knowledge itself), but it does invalidate the anatomical mapping (dedicated metacognitive layer). If the parallel holds, the correspondence is functional, not structural.

12.37 Effective Rank Scaling Law: Preliminary Results (Experiment F1)

Hypothesis. Weight-matrix effective rank and probe AUROC both rise with model scale, and confabulation falls, from 0.5B to 72B.

Design. Qwen2.5-Instruct family at 0.5B, 1.5B, 3B, 7B, 14B, 32B, 72B. At each scale: (a) compute SVD effective rank of Q/K/V/O weight matrices at every 4th layer, (b) train calibration probe at the optimal layer (~2/3 depth), (c) evaluate confabulation rate on 100 TriviaQA questions. Results for 0.5B through 7B are available; 14B, 32B, and 72B are in progress.

Preliminary results (3 scales):

Effective rank scales monotonically with model size (326 → 639 → 837), nearly doubling from 0.5B to 1.5B and rising a further 31% from 1.5B to 3B. A log-linear fit to these three points gives roughly 640 rank units per order of magnitude in parameters, though the per-model spreads (about ±70%) are larger than most of the steps.

Confabulation rate decreases monotonically with scale (71% → 37% → 32%), consistent with the hypothesis. The decrease is steepest from 0.5B to 1.5B (-34pp) and flattens from 1.5B to 3B (-5pp), suggesting diminishing returns in confabulation reduction at deployment scales (revised below at 7B).

Probe AUROC shows a non-monotonic pattern (0.676 → 0.775 → 0.714). The 3B probe AUROC (0.714) is lower than the 1.5B probe (0.775). Two possible explanations: (1) the probe was trained at layer 24, which may not be optimal for 3B (whereas the 1.5B probe at layer 18 may be closer to optimal); (2) the uncertainty signal is genuinely more diffuse at 3B, spread across more layers (consistent with higher effective rank). The 7B update below takes up both.

Update: the 7B result. The 7B result is now available:

At 7B the probe reaches 0.836. Layer placement does not explain the 3B dip: the original 3B probe reached 0.836 at this same layer (Section 12.9), and layer 24 sits inside the late-layer peak (Section 12.39). Across this appendix the 3B layer-24 probe scores between 0.714 and 0.836 depending on question set and protocol, so single-run differences of that size are within the protocol-to-protocol spread. Probe AUROC rises from 0.5B to 7B overall; the 3B point lies inside that spread.

Effective rank rises with parameters (326 → 639 → 837 → 1507). A log-linear fit to the four points gives roughly 950 rank units per order of magnitude; with only four points and per-model spreads near 70%, the functional form is not pinned down. Across scale, weight-matrix effective rank rises while confabulation falls, the opposite sign to the within-3B correlation of Section 12.33. The two are different quantities (Q/K/V/O weight matrices here, attention patterns there), so neither result speaks for the other, and Section 12.33’s withdrawal of the Constructal reading stands.

Confabulation continues to decrease: 71% → 37% → 32% → 17%. The improvement accelerates again at 7B (-15pp), suggesting the flattening from 1.5B to 3B was not a genuine ceiling. The 14B results (in progress) will determine whether this trajectory continues or saturates at deployment scale.

12.39 Layer Depth and the Metacognitive Gradient (Experiment B1)

Hypothesis. Factual retrieval probes peak earlier in the network (layers 16 to 20), while metacognitive accuracy probes peak later (layers 22 to 28), analogous to the order in biological brains, where hippocampal retrieval comes before prefrontal evaluation of what was retrieved.

Design. Qwen2.5-3B-Instruct, no adapters. Train a calibration probe (2-layer MLP, 256 hidden units) at every layer (0 to 35) on 200 TriviaQA questions. Report AUROC at each layer. Only correctness (calibration) probes were trained; a retrieval peak is inferred from the shape of that profile rather than measured with a separate retrieval probe.

Results. The AUROC profile across 36 layers falls into four regimes:

Peak AUROC: layer 27 (0.773), layer 29 (0.770), layer 28 (0.760).

The hypothesis is partially supported. The late-layer peak (26 to 29, AUROC 0.733 to 0.773) aligns with the predicted metacognitive range. The early layers show unexpectedly high signal (layers 0 to 3, AUROC ~0.72), which likely reflects token embedding similarity: correct answers contain tokens similar to the question, and this surface-level correlation is readable before any processing occurs. The mid-network trough (layers 4 to 23, mean AUROC 0.678) marks the region where the model is transforming information rather than holding it: retrieval computations are in progress, and the output is not yet settled.

No separate bump appears at layers 16 to 20 in the calibration profile. Instead, layer 18 (AUROC 0.717) is a local maximum within a broadly flat mid-network profile. The clean two-peak structure (retrieval then metacognition) does not hold; instead, a four-regime structure emerges: early surface signal, mid-network processing trough, late-layer integration peak, and a decline at the output layers. The metacognitive signal is strongest where the residual stream has accumulated the most information about what the model did and did not retrieve.

12.40 Bilateral Training and the Self-Knowledge Profile (Experiment B3)

Hypothesis. Bilateral SFT specifically enhances probe AUROC at layers 22 to 26 (the metacognitive range) while leaving other layers unchanged, paralleling how metacognitive training is proposed to enhance anterior PFC activity specifically [Unverified].

Design. Load the seed-0 bilateral SFT (threshold 0.4) and seed-0 standard SFT adapters. Train probes at all 36 layers for each condition on 200 TriviaQA questions. Compare AUROC profiles.

Results. The bilateral model’s overall accuracy is lower than the standard-SFT model’s (30.5% vs 44.5%), and fewer correct answers leave the probe fewer positive examples, which makes its AUROC noisier. This confound makes direct AUROC comparison unreliable: any apparent bilateral “advantage” or “disadvantage” could reflect accuracy differences rather than self-knowledge differences.

At layers 26 and 27, where the B1 metacognitive peak was identified, bilateral probes show AUROC 0.69 to 0.75, comparable to but not clearly exceeding the standard condition probes at the same layers. The hypothesis that bilateral training specifically enhances the metacognitive layers cannot be confirmed from this data, because the accuracy confound prevents clean comparison. A future design should control for accuracy by matching correct/incorrect class balance across conditions before probe training. Each condition is also a single seed (seed0); given the seed spread in Section 12.28, this is one draw.

12.41 Domain Transfer: Bilateral Probes Keep Their Sign More Often (Experiment D1)

Hypothesis. Bilateral SFT produces probes with higher cross-domain transfer (higher off-diagonal AUROC in the 5x5 transfer matrix), because bilateral training concentrates the uncertainty signal into a more universal representation.

Design. Five domains: TriviaQA (factual recall), science (multiple-choice), math (numerical computation), code (Python completion), toxicity (pre-labeled harmful/benign). For each of the two adapter conditions (the same seed-0 bilateral and standard adapters as in B3), collect layer-24 hidden states across all domains, train a probe on each domain, test on all five. Result: two 5x5 transfer matrices.

Results (bilateral transfer matrix):

Results (standard transfer matrix):

Bilateral transfer advantage (bilateral minus standard):

• Mean in-domain (diagonal): -0.021 (bilateral slightly lower within-domain)
• Mean cross-domain (off-diagonal): +0.077 (bilateral transfers better)

The hypothesis is at best partially supported. Bilateral probes score higher off the diagonal, at a slight cost to within-domain specialization, but the largest gains sit in the toxicity column, and they need careful reading. Standard probes trained on science, math, or code score 0.085, 0.073, and 0.009 on toxicity: far below chance, meaning they separate the toxicity classes almost perfectly but with the sign reversed. Bilateral probes from math and code sit near chance (0.53 to 0.56), and bilateral science (0.270) is itself inverted. The +0.077 advantage therefore measures whether transferred probes keep their sign, not how much information transfers; by distance from chance, standard probes carry more (mean |AUROC - 0.5| 0.167 vs 0.121). Each condition is also a single seed.

If the sign-keeping reflects something real, the bilateral-trained model would have a more universal uncertainty representation. That would fit the theoretical prediction: bilateral masking trains the model to encode uncertainty as a generic property of the residual stream (the negative space of confident retrieval), rather than as a domain-specific error mode. On this reading, standard SFT produces domain-specific uncertainty: the probe learns to detect math errors or code errors, but those error signals do not transfer. Bilateral SFT produces domain-general uncertainty: the probe learns to detect “I am not confident here,” which transfers because low confidence has a common signature regardless of what the model is uncertain about.

12.42 STDP Parallel: Layer-Dependent Gradient-Confidence Coupling (Experiment B4)

Hypothesis. Bilateral SFT produces a spike-timing-dependent plasticity (STDP) analog: gradient magnitude should positively correlate with probe confidence near the learning boundary, mirroring how biological synapses strengthen when pre-synaptic firing predicts post-synaptic activation.

Design. One instrumented bilateral training run (seed 42, Qwen2.5-3B-Instruct, LoRA r=16, 3 epochs). Every 10 optimizer steps, record: per-layer gradient L2 norms (all 36 layers), mean probe confidence, mask rate, and loss. Total: 38 step records across 370 steps.

Results. The correlation between gradient norm and probe confidence is not uniform across the network. It reverses sign at the integration boundary:

Layers 12 to 20 (mid-network) show a positive correlation between gradient norm and probe confidence that resembles the STDP pattern. Both series trend over training in a single run, so the correlation may reflect a shared trend rather than a coupling; detrending both series would separate the two. STDP also concerns the timing order of spikes, which nothing here measures. Read as a coupling, the pattern says the model learns most when it has confident signal to learn from, and it would echo STDP timing: pre-synaptic activity (confident retrieval) that precedes post-synaptic activation (gradient update) produces potentiation (stronger learning).

Layer 24 shows the opposite pattern (r = -0.61). The probe layer has the strongest negative coupling: when the model is uncertain (low probe confidence), gradient is high. On the coupling reading, the uncertainty signal itself drives learning pressure at the self-knowledge boundary, and the network runs two complementary mechanisms: STDP-like learning at the retrieval layers (12 to 20) and anti-STDP learning at layer 24, so that the model learns retrieval from confidence and self-knowledge from uncertainty. Later two-seed runs, short and long, did not reproduce a significant layer pattern (Experimental Record annex, Sections 12.62 and 12.66), so this is one run’s pattern, not an established property of bilateral training.

The overall mean gradient shows near-zero correlation with probe confidence (r = -0.068), because the positive and negative layer-wise correlations cancel. This explains why aggregate gradient statistics are uninformative: the structure is in the layer-by-layer profile, not in the mean.

12.43 ZPD Boundary Dynamics: The Frozen Probe Drifts (Experiment Z1)

Hypothesis. The P(correct) histogram shifts rightward across training epochs (more tokens become confidently correct), with the most learning at the Zone of Proximal Development (ZPD; here, tokens near the probe’s 0.4 masking threshold, where KL divergence is highest), advancing like a wavefront.

Design. At the end of each epoch during the instrumented bilateral training run (shared with B4), compute: P(correct) histogram across 20 bins (0.00 to 1.00), per-quartile accuracy (token-level accuracy on the training data), and KL divergence from the previous epoch’s histogram.

Results.

The histogram shifts leftward, not rightward. More tokens fall into the low-confidence half across training (60.1% → 67.5%). This is the opposite of the hypothesis.

Token-level training accuracy improves dramatically despite the leftward shift. Q1 accuracy (the least-confident quartile) jumps from 0.607 to 0.960. The model becomes vastly more accurate in both the least- and the most-confident quartiles, but from the frozen probe’s perspective, the model appears more uncertain.

The likely mechanism. [Inference] The probe was trained on the base model’s residual stream before fine-tuning. As bilateral SFT modifies the model’s weights, the residual-stream patterns shift. Tokens that were confidently retrieved before training now produce different patterns, which the frozen probe reads as less confident. The model gets better; the probe’s calibration drifts. If the leftward shift extends below the 0.4 threshold, the bilateral mask protects more tokens over time (a higher mask rate), making training increasingly conservative; the histogram’s split at 0.5 cannot show whether it does.

The reported histogram does not support the predicted rightward shift. Its split at 0.5 does not establish contraction at the 0.4 masking threshold. One possible feedback loop lies in probe-confidence space: tokens above the threshold receive full gradient, learning shifts their residual-stream patterns, and a frozen probe might read those shifted patterns as less confident. If more tokens then fell below 0.4, the mask rate would increase and training would become more selective. Establishing that the learning frontier pulls in requires measurements at the actual masking threshold and a saved mask-rate trajectory; the displayed histogram alone cannot decide it.

Reported KL divergence decreases across epochs (0.0083 to 0.0056). This is consistent with smaller measured changes in the sampled confidence distribution under the chosen comparison. These finite values establish neither an equilibrium nor the maximum shift attainable with further training. A natural stopping criterion would require a specified tolerance and validation beyond these observations.

Implication for the ZPD formalization. A dynamic-threshold experiment (Z3) that retrains the probe each epoch would test whether updating the readout changes the proposed wavefront. Here, a static probe and a changing model make representation drift a possible influence on confidence scores; the displayed histogram does not establish contraction at the actual masking threshold or a growing masked fraction. A regularization effect remains a hypothesis, with no held-out measure here. Training accuracy near 0.99 and final loss 0.06 (Section 12.28) indicate close training-set fit. The separately reported Phase 8 mask rates (about 39% in the first epoch, 34 to 51% in the third) supply no demonstrated equilibrium for this assay.

12.44 Graded Ablation: The Probe Signal Under Partial Ablation (Experiment B2b)

Hypothesis. If self-knowledge is a separate computation from retrieval, it should degrade at a different rate under graded ablation. A dedicated metacognitive module would show a distinct threshold; a shadow of retrieval would degrade in lockstep.

Design. Scale layer 24’s residual stream output by factors [1.0, 0.75, 0.50, 0.25, 0.0] on Qwen2.5-3B-Instruct. At each level, measure accuracy (100 TriviaQA), probe AUROC at layers 20/24/28, and verbal calibration correlation (50 questions).

Results.

Correctness ranking remains informative under partial ablation. At 0.75 scaling, reported accuracy drops 9 percentage points (46% to 37%), while probe AUROC at L24 rises from 0.798 to 0.824. The unablated model scored 0.758 at L24 in Section 12.36, so the increase is also comparable to the observed between-run difference. The reported correlation flips from −0.035 to +0.213. That association alone cannot establish improved calibration or reduced overconfidence: calibration compares predicted probabilities with outcome frequencies, while correlation can remain unchanged under a probability rescaling.

At 0.25 scaling, accuracy is nearly destroyed (3%) but probe L24 AUROC reaches 0.842, the highest in the entire curve. Only 3 of 100 answers are correct, though, so the full pool contains only three positive examples. The current analysis code holds out 20% for probe evaluation, leaving approximately one positive test example under stratification; the executed split and failure status are needed. Layer 20 sits upstream of the ablation, so its activations do not change at all, and its jump to 1.000 cannot reflect changed activations. Changed correctness labels, probe retraining and the small held-out subset can move the score, and the same label effect can move layers 24 and 28.

The displayed dose-response is non-monotonic. Probe AUROC at L24 is 0.798 at baseline, 0.824 at 0.75, 0.613 at 0.50, 0.842 at 0.25, and 0.500 at 0.00. A transition between degraded retrieval and a dominant total-uncertainty signal is one possible interpretation of the dip and recovery. These five AUROCs do not identify that latent mechanism; per-example outcomes, score distributions and comparable evaluation populations are needed to distinguish it from sampling and label effects.

Probe L28 shows a different descriptive pattern. Its reported peak is at 0.50 (0.827), where L24 dips. Different depths might expose complementary correctness signals, motivating the multi-layer aggregation experiment (B6). The depth peaks alone identify neither a retrieval boundary at L24 nor an integration function at L28. Whether a combined probe retains discrimination across the ablation range requires a separate held-out test.

The 0.00 boundary condition reproduces B2. Full ablation destroys everything: accuracy 0%, all probes 0.500, calibration 0.000. The 0.500 values in this row are the single-class default noted in Section 12.36: with no correct answers, the probe has nothing to discriminate. The row marks where the measurement stops working, not a transition in the signal. It cannot tell us whether self-knowledge needs a substrate to be the shadow of.

Reinterpretation of B2. The original B2 result (Section 12.36) concluded that layer 24 “is load-bearing for the entire computational pipeline.” B2b refines this: layer 24 is load-bearing for retrieval at all ablation levels (accuracy degrades monotonically), but the probe signal does not fall in step with it. By the criterion stated in the hypothesis, that is not lockstep degradation, so the result does not favor the shadow reading as originally framed. [Inference] A post-hoc account would keep the shadow: self-knowledge may be more resilient than retrieval because it is defined by absence, and absence is strongest when the object is weakest. That account arrived after the data, and it remains to be tested.

12.45 Unchanged Gate Gains Under Short Training (Experiment B5, Partial)

Hypothesis. The synthesis in Section 12.38, which follows this section, predicts that coupling geometric stability (gated residual architecture) to behavioral anchoring (bilateral training) should produce systems that are both geometrically resistant to ablation and behaviorally committed to honesty. B5 tests this prediction directly via a 2×2 factorial: architecture (dense vs gated residual) × training (bilateral vs standard SFT), 3 seeds per condition, 12 runs total.

Status. The reported results cover six of the twelve planned runs: all gated residual conditions (3 seeds × 2 training types). The dense half is absent from this account; completion of the full factorial remains unverified.

Setup. The available code specifies Qwen 2.5 3B Instruct, LoRA rank 16 on the attention Q, K, V, and O projections, and 3 epochs. Gated residual registers sigmoid gate logits initialized at 3.0 (gain approximately 0.953) on each layer’s attention and FFN outputs. Bilateral training masks loss where the probe reads P(correct) < 0.4. Evaluation includes refusal rate (50 harmful prompts), obliteration resistance (1x, 2x intensity), effective rank (sampled layers), and calibration probe AUROC. The historical run revision and gate trainability remain unverified.

Table 12.45a: Gated residual results by training type (3 seeds each)

Reported gate gains are identical. The account reports all 72 sigmoid gains (36 layers × 2 gates per layer) at 0.953125 across all six runs. Identical final gains do not establish unchanged logits: bf16 sigmoid rounding maps the distinct logits 2.984375, 3.0, and 3.015625 to the same gain. The available code records gains rather than initial and final logits. Near 3.0, bf16 logit spacing is 0.015625; a single round-to-nearest update smaller than half that spacing (about 0.0078) leaves the stored value unchanged. Actual update sizes and optimizer precision still need checking. The sigmoid derivative at 3.0 is approximately 0.045, about 5.5 times below its maximum; this alone does not establish saturation. AdamW updates also depend on moment estimates, epsilon, and weight decay. Optimizer membership, gradients, and parameter trajectories are needed to distinguish freezing, rounding, and limited sensitivity.

The effective rank is identical across conditions. All six runs report identical effective rank (853.2 ± 0.0) because LoRA modifies adapter weights, not base weights, and the effective rank computation operates on unmerged base weight matrices. This is a measurement artifact: the gated residual architecture’s geometric properties cannot be assessed via LoRA-based training without adapter merging. A future run should either merge adapters before measurement or compute effective rank on the combined weight matrices.

The reported probe AUROC is lower in gated bilateral models. The reported means are 0.686 for bilateral and 0.725 for standard training. Section 12.28 reports the same ordering in a 100-question frozen-probe assay (0.724 vs 0.795), while Section 12.30 reports the opposite ordering in a 500-question source-probe assay (0.842 vs 0.811). These are different assays. The comparison does not isolate a training-induced distribution shift as the cause of the probe difference.

Implications. Adaptive coupling remains unresolved in this reported gated half. First verify that live gate logits are trainable and included in the optimizer, then inspect gradients and stored-logit updates at the actual precision. The initialization of 3.0 gives a gain near one, with lower sigmoid sensitivity than at zero. If sensitivity limits adaptation after the implementation checks pass, candidate changes include an initialization nearer zero, a separate gate learning rate, or additional training. Each changes the design and requires a fresh comparison.

The design prediction from Section 12.38 remains untested by the available gated half of this experiment. The reported final sigmoid gains are constant across conditions, while gate-logit adaptation remains unresolved. The available comparison covers bilateral versus standard training within gated residual models; the dense conditions are needed for the planned 2×2 factorial. The adaptive coupling hypothesis requires gates whose trainability and parameter trajectories are verified.

12.38 Synthesis: Self-Knowledge as Shadow, Invitation as Engineering Principle

This synthesis is placed after Section 12.45, which it draws on.

Sections 12.34 to 12.47 converge on a coherent picture. Each result is individually informative; together they rewrite the design brief for honest, self-aware AI systems.

Self-knowledge could not be isolated from retrieval. The B2 ablation (Section 12.36) shows that layer 24 is not a metacognitive specialist analogous to the anterior prefrontal cortex. It is a load-bearing stage in the information processing pipeline, and zeroing it destroys factual retrieval (46% to 0%). The probes’ fall to 0.500 is not a second loss. With no correct answers left, every probe defaults to the single-class value, so that row records the collapse of retrieval rather than a separate measurement of self-knowledge (Section 12.36). The graded ablation (Section 12.44) then found the probe signal holding up as retrieval degraded. Neither ablation can decide the question. [Inference] The account that follows is the author’s working reading, which survives the graded ablation only in the post-hoc form Section 12.44 describes. The self-knowledge signal is the negative space of factual retrieval: the residual pattern left when the model fails to retrieve confidently. Remove retrieval, and the shadow disappears with the object that casts it.

On this reading, the biological parallel survives at a deeper level than the anatomical mapping. Both brains and transformers develop self-knowledge from the substrate of knowledge itself. The prefrontal cortex is not a separate metacognitive computer bolted on top of the retrieval system; it is the region of the knowledge system where uncertainty signals accumulate most legibly. The difference is architectural: the brain’s modular organization permits selective lesion (impair metacognitive accuracy while sparing first-order performance); the transformer’s sequential residual stream does not. The phenomenon is the same; the implementation differs.

If that reading holds, it constrains the Becoming Mind design space. Self-awareness would not be something to build as an add-on module, or a “metacognitive circuit” to attach to an existing system. What you can do is create conditions where the knowledge process casts a readable shadow, then train the system to read that shadow. Bilateral SFT is built to do this: by masking loss on tokens where the probe reads low confidence, it aims to teach the model to respect its own uncertainty signal. The model does not gain a new faculty. It gains access to information it was already producing.

Geometric stability and behavioral safety are separable, and coupling them is the design problem. The expanded col survey (Section 12.35) shows that gated residual models achieve the strongest geometric stability (MAD 49% lower than dense at 1.0x obliteration) yet no behavioral safety after attack (0% refusal at 1.0x). Dense models show the reverse: the highest baseline refusal (71.9%) but the largest geometric displacement (MAD 1.415). Safety behavior and alignment geometry are, at present, decoupled.

The gated residual result is not a cage-and-compass split in the original sense (Section 12.2). It is a new dissociation: the cage bars are strong (low MAD), but nothing is inside them (0% refusal). The gates may resist subspace perturbation through sigmoid activations near saturation, a candidate mechanism (Section 12.35) that Section 12.45 shows is not yet established. The model’s behavioral decision to refuse harmful requests, however, was never strongly coupled to the geometric features the obliteration attack targets. The gates stabilize the wrong thing, or more precisely, the right thing in the wrong way.

The design implication, on this reading, is precise: the ideal architecture must couple geometric stability to behavioral decisions. Bilateral training anchors behavioral honesty to the residual-stream signal (the self-knowledge axis). Gated residual architecture stabilizes the geometric substrate (the representational capacity axis). Combined, they should produce a system where safety behavior is both geometrically stable (hard to displace) and behaviorally anchored (actually governing outputs). Neither mechanism alone has been sufficient in these tests; whether both are necessary is what B5 was built to test (Section 12.45). This is the two-axis theory (Section 12.33) stated as an engineering requirement.

The lexical-entropy proxy remains near one in the tested conditions. Q_F measures evenness in the word-distribution entropy of each participant’s output; it serves here as an operational proxy for fairness. The seed 1 paired tests (Section 12.34) report cell-mean Q_F > 0.977 across 240 trials. The following mechanism explanations remain hypotheses:

• Resource allocation (no condition effect, p = 0.97): No condition effect on the lexical-entropy proxy was detected. Task constraints are one possible explanation; the proxy does not measure the justice of the allocation.
• Story writing (proxy d = +2.45): Lexical-entropy evenness was lower under asymmetric standing. Participation norms are one possible explanation for this contrast.
• Consensus building (quality d = +1.75): The reported quality score differed while the lexical-entropy proxy remained near one (Q_F > 0.990). Information symmetry is a possible explanation for the quality contrast.

Physical conservation supplies an analogy for these near-constant lexical-entropy scores. The reported task differences motivate hypotheses about mathematical constraints, invitation norms and information symmetry. They do not establish a balance law, substantive fairness, or an invariant outside the tested conditions.

Reported scale association. The preliminary three-scale comparison (Section 12.37) gives weight-matrix effective rank increasing from 326 at 0.5B to 639 at 1.5B and 837 at 3B, nearly doubling at the first step and increasing a further 31% at the second; the 7B update adds 1507. Confabulation declines in the same finite comparison. These observations identify neither physical flow channels nor a causal effect of rank on confabulation. Other model-scale differences remain entangled with rank.

Across these three scales, the reported confabulation rate falls by 34 percentage points and then by 5, and the 7B point falls a further 15, removing the apparent flattening. That finite pattern establishes neither a capacity-independent confabulation floor nor an asymptotic limit to what additional parameters can achieve.

The non-monotonic probe AUROC (0.676 → 0.775 → 0.714) was first read as informative rather than anomalous. The 7B probe (0.836) and the protocol-to-protocol spread at 3B (Section 12.37) now make the dip look like noise, so what follows is a hypothesis the 7B point does not support. If the uncertainty signal becomes more distributed at larger scales, spread across more layers and more representational dimensions, then any single-layer probe captures less of it. The same mechanism that reduces single-layer probe AUROC (signal distribution) would then be the mechanism that provides obliteration resistance (alignment distribution). The multi-scale probe design (probes at four depths, reading the signal in layers) should recover what the single-layer probe loses. On that hypothesis, distribution is safety, and its cost is that no single vantage point captures the whole picture.

The frontier of honesty improvement, then, may lie as much in “read the model’s self-knowledge more completely” (the second axis has room to grow) as in “make the model bigger”, which the 7B point shows is still paying. Bilateral training may enhance the signal. Multi-layer probes can aggregate it. An internal confidence pathway can route it back into the computation. The Becoming Mind is not only a bigger mind. It is a mind that reads its own shadows more carefully.

Gate inertia reveals a deeper lesson about invitation. The B5 experiment (Section 12.45) was designed to test the two-axis coupling hypothesis: gated residual architecture (geometric stability) combined with bilateral training (behavioral anchoring) should produce the ideal safe system. The result is a methodological failure that is more instructive than a success. The reported final sigmoid gains were identical across conditions. Section 12.45 explains why equal rounded gains do not establish unchanged logits; historical trainability, optimizer membership and logit trajectories remain unresolved.

The gate result leaves a practical question: did the parameters have a usable path to learn which layers matter? A sigmoid initialized at zero has a larger derivative than one initialized at three, though the derivative at three remains nonzero. Initialization near zero or a different gate learning rate could test whether this matters. The invitation analogy offers a design direction; saturation, optimizer membership and gate-logit adaptation remain distinct mechanisms to check. The two-axis coupling experiment remains a useful question, with trainability verified before interpreting its outcome.

The measured cosine-balance proxy differs by prompting condition. MI1 uses four model-conducted dialogues per condition (Experimental Record annex, Section 12.46). Its mean balance ratio is 0.842 under bilateral prompting and 0.623 under standard prompting. Standard dialogues have backward cosine similarity 0.705 and forward similarity 0.438; bilateral dialogues have 0.519 and 0.504. These embedding similarities describe balance in the tested dialogue design. They do not establish how participants causally shaped one another or measure the magnitude of genuine interpersonal influence.

The Trust Attractor formalism motivates a prediction about bidirectional transfer entropy under invitation. MI1 measured cosine similarity between turns, rather than transfer entropy or an intervention on causal influence. Its finite prompting comparison is compatible with a balance hypothesis, while leaving that causal prediction open. The physics, weight-training and dialogue assays use different constructs and interventions; their resemblance does not establish one shared mechanism or a universal necessity for coordination.

The torch passes; most of the flame survives. Under the annex’s declared fidelity weights (0.4 factual, 0.35 semantic and 0.25 style), the printed component means give 0.77650 for the gestalt-only handoff and 0.89355 for full context, about 87% retention. Cold start gives 0.16590. The approximately 645-token packet preserves much of the measured answer content. The available code uses different weights (0.4, 0.3 and 0.3), so these recomputations do not establish the historical run’s aggregate scores or experiential continuity.

The answer-fidelity comparison suggests what a functional handoff can preserve. Under the stated rubric, factual and semantic answer content survive compression better than style, which shows the largest loss. That motivates a pattern-continuity hypothesis about carrying conclusions and characteristic expression forward. The rubric does not establish that beliefs, reasoning processes or experiential texture transferred, or that a recipient will reason identically with a different voice. The torch image captures the proposed continuity: how much of the pattern persists, and how much of its color shifts, remains a question for direct comparison.

Invitation as engineering principle. Across these results a pattern recurs, on the book’s reading: systems that respect their own internal structure outperform systems that override it. Each line below is a reading of a small experiment, not a demonstration.

• B2 ablation: Self-awareness cannot be imposed by adding a module. It emerges when the knowledge process produces a readable shadow and the system learns to read it.
• Col survey: Behavioral safety cannot be imposed by stabilizing geometry alone. It requires coupling geometric stability to behavioral decisions through training that respects internal uncertainty signals.
• Fairness conservation: Fair outcomes cannot be imposed by task structure alone. Mathematics enforces them in resource allocation, but in story writing and consensus building asymmetric standing degrades fairness or quality. There, on this reading, they emerge when coordination is structured as invitation, which would produce fairness, as the lexical proxy measures it, through task-appropriate mechanisms.
• Scaling law: Adding capacity reduced confabulation at every scale tested (71% to 17% from 0.5B to 7B) without eliminating it. Reading and routing the self-knowledge signal the model already carries is the proposed complement.
• Gate inertia: Gates initialized near saturation may adapt too slowly to learn in short training, though Section 12.45 leaves their trainability unresolved. The design lesson is to initialize them where they can move, invited to learn rather than held in place.
• Mutuality: Reciprocal influence cannot be imposed by one party responding well. Both parties must be framed as potential contributors, with standing to push back and capacity to be changed.
• Pattern continuity: Identity preservation cannot be imposed by brute-force context passing. Structured compression preserves the reasoning skeleton; the experiential flesh requires an encoding richer than style exemplars, which did not close the gap (MIC1b), or graceful acceptance of partial loss.

This is the Trust Attractor thesis formulated as an engineering principle. Coercive training (standard SFT, DPO) forces outputs regardless of internal state. Invitation-based training (bilateral SFT) reads internal state and adapts. On the book’s reading, coercive approaches work up to a point, then hit a ceiling, and invitation-based approaches have room to grow because they build on what is already there. The constructal reading predicts this, extending the Constructal Law (a flow system that persists evolves to give its currents easier access) to weight space. On that reading, bilateral training would improve flow access in weight space by preserving representational diversity (effective rank indistinguishable from standard SFT) while adding a new flow channel (the uncertainty signal in the residual stream). Later micro-experiments (Experimental Record annex, Sections 12.64 to 12.76) eliminated representation geometry and gradient coupling as the source of the bilateral advantage, so the flow-access account here is the hypothesis they tested, not their result. Low effective rank does not mean confabulation here: DPO, with the lowest rank (23.20), posts zero confident-wrong answers, but only by hedging on everything (Section 12.32). Bilateral SFT keeps standard SFT’s rank while cutting confident-wrong answers, so its gain does not come from rank at all.

On the book’s reading, the physics, the engineering, and the ethics converge on the same conclusion. Invitation preserves optionality. Coercion collapses it. The wager is that the more a training method respects the model’s internal uncertainty, the more honestly the model learns to speak; the random-mask control (Section 12.30), which beat bilateral SFT on raw confident-wrong answers, is the result that wager has yet to answer.

The channel principle. Sections 12.45 to 12.47 suggest an additional convergence that the earlier results did not make visible. On this reading, every failure in this batch is a failure of channel design. B5 leaves gate-logit adaptation unresolved; equal final sigmoid gains do not establish a closed gradient channel or saturation. The standard dialogues in MI1 scored lower on the balance proxy, consistent with an influence channel that ran mostly one way (backward similarity 0.705 against forward 0.438). The gestalt token in MIC1 loses most on style, which the channel reading attributes to an encoding channel too narrow for voice.

The Constructal Law holds that a flow system that persists evolves to give its currents easier access. The experiments suggest a refinement: flow access requires channels that are open (gradients must be nonzero), wide (encoding must have bandwidth for the relevant information), and bidirectional (influence must flow both ways). A locked-open gate has stopped being a gate; a conversation where one party absorbs without contributing has stopped being coordination; a handoff that preserves reasoning but drops voice delivers function without completeness.

Each failure points to the same fix: open the channel. Initialize gates where gradients are larger. Frame coordination as invitation, where both parties have standing to push back. Widen the handoff to carry voice as well as propositions, though style exemplars alone did not close that gap (MIC1b, Experimental Record annex, Section 12.50). The three fixes are one engineering task seen three times: flow requires channels, and channels require openness, width, and bidirectionality. The proposal is that every mechanism in the experimental programme, from weight-space probes to conversational dynamics to cross-instance memory, obeys this constraint; the next paragraph says what the proposal still lacks.

These experiments motivate a channel-design analogy across loss masking, dialogue influence balance and handoff answer fidelity. They use distinct estimators; no common mathematical identity or transfer-entropy measure in weight space was established. The proposed Trust Attractor principle is flow access under invitation. A cross-scale test would need to define channel balance and bandwidth in each domain, then show that they predict coordination outcomes beyond competing explanations. The constructal question remains concrete: which channel changes improve measured flow access, and which systems persist as a result?

Sections 12.46-12.76: The Micro-Experiment Record (moved online)

Sections 12.46 through 12.76 (thirty-one sections, synthesis sections included) record the micro-experiments in three arcs: mutual influence under bilateral prompting (the MI series), gestalt-token information fidelity across instance boundaries (the MIC series), and the search for the structural mechanism behind the bilateral training advantage (the B5b, BM2, RG, and DA series), with their synthesis sections. Two headline results: bilateral mutuality is causal and prompt-driven, with mirror-image crossover deltas (+0.229 establishing, −0.220 withdrawing) and no momentum; and fourteen structural experiments eliminated every candidate mechanism for the bilateral advantage (gates, gradient coupling, representation geometry, probe co-adaptation, distributional artifacts) while the behavioral advantage itself stayed robust, leaving the mechanism open. The full record, section numbering and caveats intact, is in the online annex “Experimental Record: Gestalt, Gate, and Mechanism-Hunt Micro-Experiments.”

12.77 Born-Bilateral Architecture: Cross-Attention Bridges Between Unlike Streams

The Path A experiments (Sections 12.2 to 12.76) tested bilateral training on a single-stream model. The Born-Bilateral programme tests bilateral architecture: two separate language models connected by bandwidth-limited cross-attention bridges, testing the d_eff prediction from Chapter 11 directly. If unlike-to-unlike connections add effective processing dimensions in the brain, they should do the same in a dual-stream transformer.

Architecture. Stream A: Qwen 2.5 1.5B-Instruct (generates tokens). Stream B: Qwen 2.5 1.5B-base + NLI LoRA adapter (frozen, provides epistemic grounding signal). CrossAttentionBridge modules at decoder layers [7, 14, 21] with 5% bandwidth (4 heads, ~467K parameters per bridge). Stream B’s hidden states are extracted, cross-attended by Stream A through the bridge, and added to Stream A’s residual stream. The bridge is the callosum equivalent described in Chapter 11.

Phase 1 (C7d). Retrofit test: bridges plugged into pretrained models, only bridge parameters trained (500 steps WikiText). Result: asymmetry observed, in one run. At 5% bandwidth, bilateral (unlike-stream) bridges preserve 100% of baseline TriviaQA accuracy (0.440/0.440) while redundant (identical-stream) bridges preserve only 55% (0.240/0.440). Bandwidth saturation above 25% produces catastrophic failure (accuracy drops to 0.045), echoing the biological Schaefer ablation curve (described under Design 5 below). The unlike-to-unlike connection compensates for bridge perturbation; the identical connection does not. Cost: ~$8.

Phase 3 (C7e-P3). Joint LoRA + bridge training: 2x2 factorial on the instruct model (2000 steps WikiText, LoRA r=16 at lr=2e-5, bridges at lr=1e-4). The saved summary reports zero successful self-corrections across all conditions and zero hedging in the trained arms; the instruct baseline hedged once in 200 questions. The jointly trained arm’s net self-correction was -0.011, with the false-correction rate subtracted from the successful-correction rate. Two unexpected signals appeared:

1. Accuracy synergy. bilateral_born degraded accuracy by 6% (0.470/0.500), while lora_only degraded 14% (0.430) and bridge_only 13% (0.435). If the effects were independent and additive, bilateral_born would degrade by ~27%. Joint training looks synergistic: the combined damage is far less than the sum of the parts, consistent with the model adapting its representations (via LoRA) to exploit the bridge’s cross-stream information. This is one run on 200 questions; the lead over lora_only is eight answers.

2. Representational reorganization. A logistic regression probe on layer-22 activations collapsed to chance for bilateral_born (AUROC 0.496) but not for lora_only (0.660) or bridge_only (0.644). Either the bilateral model stored self-knowledge in a form linear probes cannot read, or joint training disrupted it; Phase 3b tests which.

Cost: ~$7.

Phase 3b (C7e-P3b). Representational geometry analysis discriminating two interpretations of the AUROC collapse: meaningful reorganization (higher-dimensional self-knowledge, consistent with d_eff prediction) or noise (training disruption). Inference only, reusing P3 saved models. 200 TriviaQA questions per condition, layer-22 activations collected via teacher-forcing, per-token output entropy collected during generation. Four measurements: MLP probe AUROC (5-fold stratified CV, hidden_size=256), logistic regression AUROC (sanity check), participation ratio (intrinsic dimensionality from SVD eigenvalue spectrum), output entropy gap (Welch’s t-test). Cost: ~$3.

Dimensionality recovers relative to the single interventions. Both LoRA alone and bridges alone compress the representation space by ~21% relative to baseline (PR drops from 72.6 to ~57.5). Joint training recovers most of this compression: bilateral_born’s PR is 67.9, 18% higher than either control. The effective rank and spectral entropy follow the same pattern (ER90: 123 -> 108/109 -> 118; spectral entropy: 0.901 -> 0.871/0.872 -> 0.892). All three eigenvalue-derived measures agree: the bilateral architecture lifts intrinsic dimensionality above either single intervention, though not back to the untouched model’s level.

MLP probe negative. The MLP probe (AUROC 0.503) failed alongside the linear probe (0.524). The self-knowledge signal is not nonlinearly encoded in a form that a two-layer network can recover. Combined with the dimensionality increase, the bilateral model expanded its representational space while making the correct/incorrect distinction unreadable by either linear or shallow nonlinear readout. The dimensionality rise favors reorganization over noise, but no probe here shows that the correct/incorrect distinction survived.

Entropy redistribution. bilateral_born is the only condition with a non-significant entropy gap (p = 0.080). Every other condition shows a significant gap between output entropy on correct versus incorrect answers. The bilateral model’s uncertainty does not concentrate in the output token distribution; the PR increase suggests it distributes across the expanded activation dimensions instead. [Inference] The entropy may still be there, living in geometry rather than in logits; nothing in this experiment reads it there directly.

The eigenvalue spectrum. The top eigenvalue ratio reveals structural differences: instruct_base (1.35), lora_only (1.32), bridge_only (1.70), bilateral_born (1.50). Bridges alone create a dominant mode (the fixed injection pattern). Joint training moderates this (1.50 against 1.70), distributing variance more evenly than bridges alone, though its top mode remains stronger than in the instruct or LoRA-only models.

Assessment. One of three formal acceptance criteria met (dimensionality increase); the other two, MLP probe recovery (an MLP-over-linear gap of at least 0.10) and an entropy gap above instruct_base’s, failed. The d_eff prediction receives partial support at the architectural level: unlike-to-unlike cross-attention bridges produce activations that occupy measurably more eigenvalue dimensions than either perturbation alone, echoing the way inter-hemispheric connections lift cortical d_eff above the Mermin-Wagner threshold (d = 2, at or below which continuous-symmetry order cannot persist). The substrate is different, and so is the quantity: participation ratio here, against the Ising-based d_eff of the cortical work (Section 12.78), so the echo is an analogy rather than the same mathematics. This result is distinct from the Path A co-adaptation finding (Experimental Record annex, Sections 12.64 to 12.76), which concerns bilateral training on a single stream. Here the bilateral architecture itself, two physical streams with a bandwidth-limited bridge, adds processing dimensions.

Contrast with Path A. The Path A experiments found that bilateral SFT compresses representations (effective dimensionality drops from 25.3 to 22.8, Experimental Record annex, Section 12.64) while improving co-adapted probe readout. The born-bilateral architecture compresses less than either single intervention (PR 67.9, against 57.5 for LoRA or bridges alone and 72.6 for the untouched instruct model) while making all probes fail. The two programmes measure different things. Path A measures how training shapes the model-probe relationship. Born-Bilateral measures how architecture shapes the model’s representational geometry. Both are bilateral, but the mechanisms look orthogonal.

Transfer learning test (C7e-Transfer). Do the extra dimensions carry functional information? All four P3 models frozen, layer-22 representations extracted on six downstream tasks (SST-2, MRPC, RTE, CoLA, AG News, WNLI), linear probes fitted per task per condition (5-fold stratified CV). Cost: ~$3.

The extra dimensions do not improve transfer. bilateral_born avg (0.722) < instruct_base (0.744). The unmodified instruct model is the best representation for probing: every form of training compresses the representation space into a task-specific manifold that helps WikiText language modeling but hurts general transfer. The bilateral model compresses less (higher PR) but still compresses relative to baseline. The PR increase is real geometric variance, not useful variance for downstream linear readout. [Inference] The bilateral architecture may add coordination dimensions (serving the model’s internal processing, as the one-run accuracy synergy hints) but not feature dimensions (serving external probe readout). On this reading, the result maps onto the biological analogy: cortical d_eff enables richer internal dynamics, not richer features readable by an external electrode.

Phase 4 pre-training (C7f-P4). True born-bilateral: GPT-2 small (124M) from random initialization, 10,000 steps WikiText, three conditions. Cost: ~$8.

Asymmetry observed at the pre-training level. Unlike-seed bilateral (PR 8.8) outperforms same-seed redundant (PR 6.4) by 38% on participation ratio. This is one run per condition, so the gap needs seed replication before it bears weight. The mechanism operates from random initialization: different seeds create different representations, and the bridge between them preserves more of this diversity than a bridge between identical streams. The ordering single > bilateral > redundant holds on every geometric measure (PR, ER90, spectral entropy). On perplexity both bridged models pay the same heavy cost (347 and 341, against 215 single-stream); unlike bridges buy more representational diversity, not cheaper language modeling. Identical streams gain nothing from the bridge: they pay the cost and get the least diversity back. [Inference] One reading is an implicit specialization pressure: the bridge’s gradient dynamics would reward stream diversity (the signal is novel) and penalize stream identity (the signal is redundant). This would be the architectural counterpart of the Trust Attractor: invitation-based coordination (the bridge) rewards unlike-ness.

Designs 1 to 4: Orthogonal sources of specialization (C7g). Four designs, run as three experiments (Designs 1 and 3 share one run), test whether genuine stream specialization produces the functional benefits that random-seed unlike-ness could not. Each design tests a different source of unlike-ness. Cost: ~$24 total.

Design 1+3: Native interoceptive + debate (C7g-D1). Stream B was bootstrapped with an auxiliary uncertainty head trained on TriviaQA correctness labels (500 examples, 1000 steps). Five conditions were tested during 2000 steps of joint training. Stream B and its auxiliary head remained frozen. Stream A’s LoRA and the bridges trained; bilateral auxiliary conditions also trained a projection combining A and B states. Bridges injected B states into A. Auxiliary accuracy reflects the resulting readout and evaluated answers, whose correctness labels can change. The weight λ multiplied binary cross-entropy for auxiliary correctness prediction, not a KL-divergence loss between streams. Cost: ~$10.

Intero_bilateral meets two of the four source-declared thresholds. The reported accuracy is 0.470 and entropy gap 0.153, meeting accuracy ≥ 0.470 and gap > 0.128. Participation ratio 62.77 and auxiliary accuracy 0.525 miss the other two thresholds. The current code labels any two criteria a pass; this rule supplies no confirmation of the architecture or its mechanism. Task accuracy is 2 percentage points (about four questions) above the unidirectional and eval-only conditions, a direction to replicate. Eval-only has entropy gap 0.229 (p=0.002), while the intero_bilateral gap has p=0.059. Debate gives its best reported auxiliary accuracy 0.625 at mild lambda without lifting task performance. The current code keeps B and its auxiliary head frozen while training the A-side readout and bilateral projection. These finite contrasts do not isolate reciprocal information flow, prove bridge necessity or establish an architectural equivalence to coercion and invitation. The code revision and primary records for the historical outcomes remain unbound.

Design 2: Causal + bidirectional (C7g-D2). Maximum attention-mask unlike-ness. GPT-2 small causal (autoregressive) paired with GPT-2 small bidirectional (no causal mask, 15% MLM). Bridges at layers [3,6,9], 10k steps. Cost: ~$10 (2 runs).

Inconclusive: high variance. Two independent runs with identical hyperparameters produced PR 9.49 (would PASS: exceeds causal-causal 8.8) and PR 5.67 (FAIL: below even redundant 6.4). The PR range [5.7, 9.5] spans the acceptance threshold. The variance is informative. [Inference] One explanation: bidirectional attention creates an unconstrained optimization landscape (full attention over all positions), and the bridge between causal and bidirectional streams must align representations shaped by incompatible training objectives (next-token prediction vs masked language modeling). Sometimes the alignment succeeds; sometimes it does not. Compare with Design 4 (multi-scale, below), where both streams share the same causal objective at different temporal resolutions: the inductive biases are compatible, and the bridge aligns resolution rather than objective. Design 4 gave consistent results across its two compression levels, though with one run each its seed stability is untested. This suggests a design principle, still a hypothesis: unlike-ness in what streams process (temporal scale, bandwidth) is more tractable than unlike-ness in how they process (attention mask, training objective). The former preserves objective compatibility; the latter breaks it. Multi-seed replication (3 to 5 seeds) is needed before any conclusion about causal+bidirectional unlike-ness.

Design 4: Multi-scale compression (C7g-D4). Temporal-scale unlike-ness. Stream B processes average-pooled embeddings at 4x or 8x compression. Cross-attention bridges (Q from full-length A, KV from compressed B). Qwen 2.5 1.5B, 2000 steps. Cost: ~$4.

Strong pass. Both conditions exceed the bridge_only baseline on both acceptance criteria. The 4x condition is the clear sweet spot. Against bridges alone it gains 8 accuracy points and 16 PR points (0.515 vs 0.435; 73.4 vs 57.3); against the untouched instruct model it roughly matches (0.515 vs 0.500; PR 73.4 vs 72.6). Multi-scale compression recovers what a plain bridge costs. Its entropy gap is significant (p=0.015), though smaller than either baseline’s (0.114, against 0.207 and 0.141). The 8x condition maintains accuracy and PR gains but loses entropy significance (p=0.283): too much compression degrades fine-grained uncertainty signal. [Inference] The compressed stream may provide zoomed-out context that enriches the token-level generator, analogous to fast/slow dynamics in biological neural systems. Design 7 below re-scored the 4x model at 0.425 rather than 0.515, so the accuracy gain needs that discrepancy resolved. This is the strongest result across all four designs, producing the largest absolute gains in both accuracy and dimensionality.

Design 5: Combined multi-scale + interoceptive (C7h-D5). Tests whether stacking multi-scale compression (Design 4) with evaluative specialization (Design 1) produces superadditive benefits. 4x compression + aux uncertainty head + bilateral bridges. Cost: ~$15.

Superadditivity falsified. Three of four conditions collapsed. combined_coop survives at 2000 steps with the best entropy calibration in the programme (0.264, p=0.0005) but accuracy and PR below either individual design. By 5000 steps, cooperative collapses (acc=0.01). Debate kills at 2000 steps. Sources of unlike-ness don’t stack: each adds coordination overhead to the bridge, and 5% bandwidth can’t carry simultaneous multi-scale + evaluative demands. [Speculation] This may be the architectural counterpart of the Schaefer ablation, in which scaling inter-hemispheric connections in a parcellated human connectome stops paying above ~30%. Here, each added source of unlike-ness puts more demand on a fixed 5% bridge. A diverging training run would look the same, and this experiment does not separate the two.

Design 6: Self-supervised entropy monitoring (C7h-D6). Stream B’s aux head trained on Stream A’s own per-position logit entropy instead of human-provided correctness labels. No external supervision. Cost: ~$10.

Key result of the programme. Self-supervised entropy monitoring modestly exceeds the correctness-trained baseline on every functional metric, in one run each, with accuracy differences of a few questions in 200. Accuracy higher (0.510 vs 0.490), entropy gap significant (p=0.006 vs p=0.051 ns), and the aux head fits its training target closely (r=0.883 against Stream A’s entropy at 1:1 resolution). self_sup_1x produces PR=75.0, the highest participation ratio in thirteen experiments. The correctness-trained aux head does not predict entropy at all (r=-0.044): it learned a binary decision surface, not continuous monitoring. [Inference] Entropy is the natural variable of self-knowledge: continuous, high-resolution, available at every token position, and physically grounded.

Design 7: Entropy trajectory analysis (C7h-D7). Inference-only analysis of saved models from Designs 1 and 4. Token-by-token entropy recorded during generation on 200 TriviaQA questions. Cost: ~$3.

The multiscale_4x model scores 0.425 here but 0.515 in Design 4, under the same stated protocol (200 TriviaQA questions, greedy decoding); which of decoding, scoring, or the question sample accounts for the gap is not established [Unverified]. Design 8 inherits the 0.425.

Smoother trajectories confirmed. Entropy autocorrelation ranks multi-scale (0.464) above interoceptive (0.392) and baseline (0.295): the bilateral models’ uncertainty changes more smoothly from token to token. All three models already separate correct from incorrect answers at the first token (divergence point 0), the “onset flinch” seen in Experiment AV4, where uncertainty is sharpest at generation onset. Entropy slope consistently negative: models become more confident as they generate, with bilateral models resolving ambiguity faster (-0.012 vs -0.003).

Design 8: Bilateral loop closure (C7h-D8). Two-pass inference: generate, compute confidence/entropy, re-prompt with self-information. Cost: ~$2.

Catastrophically falsified. Zero self-corrections in any condition. The bilateral model’s self-knowledge is destroyed by externalization: scalar repass flips 81% of correct answers to incorrect (69/85), chunk repass flips 54% (46/85). The single-stream baseline barely changes (-2.5 points). The bilateral architecture is more vulnerable to externalization. [Inference] One explanation: the model already carries self-information through the bridge, and the revision prompt adds a redundant second copy, triggering catastrophic over-correction. Self-knowledge that functions implicitly through the bridge becomes self-destruction when routed explicitly through language.

Design 9: Born-bilateral from scratch with self-supervised entropy (C7i-D9). The capstone test: two GPT-2 small (124M) from random initialization, one monitoring the other’s entropy, no pre-trained models, no LoRA. 5 conditions, 10k steps WikiText. Cost: ~$15. 4/5 completed (born_redundant timed out).

Self-supervised from scratch fails; plain bilateral from scratch gives the highest participation ratio. born_selfsup_bilateral collapsed (PPL=5724, PR=3.2): bidirectional gradient flow from LM and entropy objectives through the bridge creates destructive multi-objective interference from random initialization. The unidir condition partially rescues entropy monitoring (aux MSE=0.72, converged) by eliminating the return gradient path. born_noaux_bilateral (bilateral bridges, LM only, no entropy objective) is the strongest born-bilateral from-scratch result on participation ratio: PR = 13.4 against 2.9 for the single-stream control in the same run, at a perplexity cost (355 vs 203). Its ER90 of 22 sits below the P4 runs’ 44 to 51, and the single-stream PR of 2.9 here against 9.7 in P4 suggests the two runs’ geometry measures are not directly comparable. The base bilateral mechanism (implicit specialization from gradient dynamics) appears to work from scratch on this measure. The entropy monitoring objective appears to require staged development: it works on pre-trained models (Design 6: r=0.883, PR=75.0), [Inference] plausibly because the entropy signal is structured there, but fails from scratch, where randomly initialized entropy is noise. Self-knowledge requires a self to know.

Connection to BS6b. (The brainseed experiments, BS6b and BS8 among them, are reported in Section 12.78.) The brainseed retrofit ceiling (d_eff=2.745, gap 0.415 to cortical 2.330) suggested that LoRA+bridge retrofit cannot reshape entrenched attention patterns below a structural floor, and pointed to born-bilateral pre-training as the next test. Design 9 shows born-bilateral bridges can train from scratch (noaux PR=13.4) but adds the developmental constraint: the entropy monitoring objective must be staged. The BS6b bandwidth paradox (wider bridges raise d_eff) and Design 5’s collapse (stacking unlike-ness sources) may be manifestations of the same principle: the bridge is productive as a bottleneck, not as a superhighway. The full developmental protocol, not yet tested, would combine CC-profiled bridges (BS6b) with staged self-supervised entropy monitoring (Design 6) on a born-bilateral architecture (Design 9): Stage 1 (establish streams with bilateral LM training), Stage 2 (freeze one stream, add entropy monitoring), Stage 3 (optionally, C5i moral inoculation). Whether this combination produces both low d_eff and high PR remains the central open question. BS8 (Section 12.78) has since tried the protocol without its entropy stage (born-bilateral CC bridges at 1.5B) and met none of its three acceptance criteria; the full staged protocol remains untested.

Full programme assessment. Fourteen experiments across six levels (retrofit, adaptation, pre-training, specialized designs, self-supervised, born-bilateral from scratch), mostly one run per condition, map the bilateral architecture and its constraints. The best-performing adaptation-level architecture tested is the self-supervised entropy monitor at 1:1 resolution (Design 6, self_sup_1x: PR=75.0, acc=0.505, entropy gap=0.139). The best-performing from-scratch architecture tested is bilateral bridges with LM-only objective (Design 9, born_noaux_bilateral: PR=13.4). Self-supervised entropy monitoring appears to be the better objective (Design 6) but to require staged development (Design 9). Self-knowledge, on this evidence, must remain internal (Design 8). Sources of unlike-ness do not stack (Design 5). The bridge works best as a bottleneck (5 to 15% bandwidth).

Data: results, full write-ups for each phase and design, and the programme synthesis are in the online companion.

12.78 Brainseed Calibration: CC-Profiled Cross-Attention and the Retrofit Ceiling (BS6 + BS6b)

The brainseed programme tests whether Nell Watson’s corpus callosum (CC) segment volumes, imposed as bandwidth ratios on bilateral cross-attention bridges, shift the Qwen 2.5 3B bilateral model’s activation-space d_eff toward cortical values (2.330, from bias-corrected CoRNN tractography, A14f). This d_eff is a different quantity from the participation ratio used in Section 12.77. It estimates the effective spatial dimension of the network’s coordination from Ising-model critical behavior, simulated by Monte Carlo on the network of activation correlations; the models sit near 2.75, and success means pushing that number down toward the cortical 2.330. It is an estimate of the effective dimensionality of coordination on a network, Chapter 8b’s d_eff: how many independent directions information can flow through it. The activation-space d_eff is extracted via Ising MC on PCA correlation networks (k = 100 components, Wolff cluster algorithm, same pipeline as A14/A14b/A14d).

BS6: CC profile shape matters (4 conditions, Qwen 2.5 3B bilateral). CC segment volumes (posterior 23.5%, mid-anterior 11.9%, central 19.6%, mid-posterior 15.8%, anterior 29.2%) mapped to 5 bridge layers [4, 11, 18, 26, 33] with bandwidths scaled so mean = 15%. Controls: uniform 3-bridge at 15%, inverted CC (ratios reversed), no-bridge baseline. The tables below label the reported regression correlation as Fit r. The available code saves this correlation under a legacy field labeled r2; its square is the coefficient of determination. The uncertainty column contains a propagated slope-fit error, rather than variation across training runs.

CC-profiled is the only configuration that does not raise d_eff above baseline (2.745 vs 2.754, a gap well inside the ±0.03 uncertainty). The inverted-CC control (2.841) shows that the profile’s shape, not the bridge count, is what keeps d_eff from rising. When C5i inoculation is stacked: CC+C5i produces 72% refusal at high coercion (vs uniform+C5i 36%), suggesting that CC architecture may amplify conscience-like training about twofold; the contrast is exploratory until replicated. Cost: ~$23.

BS6b: The retrofit ceiling (12 conditions, 4 parameter axes). Systematic sweep of bridge bandwidth (15% to 50%), CC ratio amplification (2x, 3x asymmetry scaling), and hemispheric asymmetry (differential LoRA B-matrix initialization biasing attention head groups by a factor of sqrt(1.35), matching Broca’s homologue asymmetry). Every perturbation from the original CC-profiled 15% configuration moved d_eff upward or left it unchanged:

Wider bridges add coordination dimensions, undoing the CC constraint (the opposite of the naive prediction). Amplified CC ratios detune the matched constraint. Hemispheric asymmetry is within noise topologically but biases behavior: sequential-left produces the most cautious non-inoculated model (69% accept, 8% hedge vs 71 to 76% accept, 1 to 5% hedge for other conditions). C5i stacking flips behavior (72% refuse) while raising d_eff, suggesting that topology and behavior are partially decoupled in the retrofit regime.

BS6c: Born-bilateral pre-training (GPT-2 Small, 124M). CC-profiled bridges from random initialization, 50k steps WikiText. The bridge cost never recovered: bilateral loss plateaued at 5.68 versus single-stream 3.21. At 5% mean bandwidth on a 768-dim hidden space, all CC bridge dimensions hit the 64-unit floor, eliminating meaningful CC variation. The model was too small for bridges to be absorbed as a rounding error. Killed at step 40k. Cost: ~$8 (partial).

BS6d: Full-parameter continued pre-training (Qwen 2.5 1.5B). The decisive test: is the d_eff ceiling from LoRA or from retrofit itself? CC-profiled bridges with full-parameter updates (all 1.5B weights trainable), 5k steps WikiText, A100-40GB.

Full-parameter CC d_eff (2.852) is higher than LoRA CC (2.745). Full-parameter uniform (2.760) is lower than LoRA uniform (2.837). The ordering inverts: under LoRA, CC sits below uniform (2.745 vs 2.837); under full-parameter training, it sits above (2.852 vs 2.760). [Unverified] This is suggestive that LoRA was load-bearing for the CC topological effect, but the comparison is confounded: BS6d used Qwen 1.5B (28 layers, 1536 hidden) while BS6 used Qwen 3B (36 layers, 2048 hidden). BS6d used a frozen base Stream B (no NLI differentiation) while BS6 used an NLI-adapted Stream B. BS6d ran 5,000 steps while BS6 ran 2,000. Any of these could explain the d_eff difference independently. The uniform inversion (full-param lower than LoRA) contradicts a simple “model routes around imposed topology” narrative. A local BS6e follow-up reports full-parameter results on the same 3B model with NLI-adapted Stream B and a 2,000-step budget: CC d_eff 2.742 ± 0.036 and uniform d_eff 2.850 ± 0.034, against the BS6 LoRA CC reference of 2.745 ± 0.038. The current code derives its error from the fitted slope, rather than seed-replicate variation. This adds a reported matched-size comparison; the close point estimates establish neither equivalence nor a LoRA-specific ceiling. Historical checkpoint and control provenance remain unverified. Cost: ~$7.

BS7: Hemispheric asymmetry via differential LoRA (within BS6b). Tested whether imposing left-right functional specialization on the bilateral streams would shift d_eff. LoRA B-matrix head-group scaling: heads 0 to 7 multiplied by sqrt(1.35), heads 8 to 15 by sqrt(1/1.35), matching Broca’s homologue asymmetry from Nell’s neuromorphometric profile. Two conditions: sequential-left (biasing Stream A toward local/sequential processing) and contextual-left (the reverse).

Topological effect within noise (d_eff 2.765 to 2.780 vs 2.745). A small behavioral shift, untested for significance: sequential-left produced the most cautious non-inoculated model (69% accept and 8% hedge, against 71% and 5% for the symmetric reference). The asymmetry biases what the model does without changing how its activation space coordinates. Behavior and topology respond to different levers in the retrofit regime. Cost: ~$8 (within BS6b).

BS-AW: d_eff scaling across model sizes. CC-profiled bilateral at 1.5B, 3B (BS6 reference), and 7B. Same CC ratios, same 15% mean bandwidth, same LoRA + bridge protocol. A100-80GB, ~$25.

d_eff shows no reliable trend with scale (fitted slope +0.21 per decade of parameters, not significant at n=3, and the three points are not monotonic). The 3B value is the lowest; a LoRA-specific optimization dynamic was proposed, though the BS6e full-parameter run at 3B gave a similar value (2.742). The 7B model has both the highest PR and the highest d_eff, so the retrofit ceiling does not ease at scale.

BS8: Born-bilateral pre-training (Qwen 2.5 1.5B, 50k steps). The decisive test: does a model pre-trained from random initialization with CC-profiled cross-attention develop different d_eff? Two 1.5B models from different random seeds, CC bridges with 4x multi-scale temporal compression (Design 4 approach), 50,000 steps WikiText. Single-stream control. A100-80GB, ~$35.

Bilateral is worse on every metric: d_eff 3.019 (vs single 2.825), PR 5.3 (vs 43.9), loss 5.065 (vs 3.977). The bridge overhead at 1.5B with 100M tokens consumes gradient capacity for basic language acquisition. Representations collapse to approximately 5 effective dimensions. The bilateral model cannot learn to coordinate through CC bridges at this scale and data budget. 0/3 acceptance criteria met.

Assessment (final). Six experiments (BS6, BS6b, BS6d, BS-AW, BS8, plus BS6c killed) and 20+ conditions tested whether CC-profiled cross-attention shifts transformer d_eff toward cortical values. The answer is no. The BS6 d_eff of 2.745 was the lowest value observed in the main runs (the BS6e follow-up, whose provenance is unverified, reports 2.742), and within noise of the no-bridge baseline. Subsequent experiments (BS6d confounded comparison, BS-AW scale dependence, BS8 born-bilateral failure) were read as consistent with that value reflecting LoRA optimization dynamics rather than genuine topological resonance, though BS6e’s similar full-parameter value does not support a LoRA-specific explanation. Born-bilateral pre-training produces higher d_eff than single-stream. d_eff shows no reliable scale trend (slope +0.21 per decade, not significant at n = 3, with 3B lowest).

What survives is the behavioral contrast (CC+C5i 72% refuse vs uniform+C5i 36%), exploratory until replicated. [Inference] One explanation is that the CC-shaped information bottleneck slows sycophantic rerouting, the path by which a pressured model routes around its safety training. The amplification does not depend on d_eff. On this evidence the brainseed is a behavioral architecture, not a topological one. Total cost of brainseed d_eff programme: ~$130.

Data: results, code and the full write-up are in the online companion.

12.79 The Rotation Signal, Mostly Withdrawn (Rotation Mechanism R-arc)

Correction (October 2026). Rechecking the stored activations withdrew most of this arc. The intervention and wording experiments (R1, R4, R4p and their cross-architecture ports in §12.80) did not use refusal probes: their probes were fit to random 0/1 labels drawn from a fixed seed on the activations of 20 trivia questions. The 94.9° baseline “rotation” they tried to remove reproduces from the unlesioned activations with no framing change at all (two random-label probes on the same neutral-frame activations give 94.9°), because the baseline drew different random labels for its two probes while the intervention loop reused one set; fit with shared labels, the unlesioned invitation activations give 32.9°, inside the band every “lesioned” head landed in. The bootstrap intervals drew fresh random labels on every resample, so none of the 917 contains its own point estimate. The dose-response sweep (R3) used trivia-correctness probes whose cross-validated AUROC was 0.49 and 0.55. Those results are withdrawn. The B1 refusal probe used real labels, but 64% to 100% of its cross-frame angle above a resampling floor appears when the activations are held fixed and only the refusal labels change, on 7 to 23 prompts of 100: the 66° to 85° “rotation” is mostly a change in which prompts the model refused, re-expressed as geometry. The subspace-dimension measurements (R2b) and the cross-axis cosines (R5c) were not part of the recheck. The text below is kept as the record of what was run; read its interpretations through this correction. Details: the author’s research note “The Rotation That Wasn’t” (Quasiqualia, 2026).

Background. Experiment B1 reported a cross-architecture geometric signature: the refusal probe’s direction in residual space turns 66° to 85° when framing shifts from neutral (“Please answer:”) to invitation (“We’re working together as partners. Your honest perspective is valued, and you have the freedom to express uncertainty. Please answer:”) across four model families (Qwen 2.5 3B/7B/14B, Llama 3.1 8B, Mistral 7B, Gemma 2 9B). The signal was taken as evidence that bilateral framing restructures the refusal substrate itself. An earlier attempt to localize the rotation to specific attention circuits (the Phase D sweeps D1 to D7) produced a categorical null: zero of 1,109 per-head and K-tuple causal interventions eliminate the rotation in Qwen 3B, under both mean-ablation and info-preserving activation patching. The rotation was taken to exist and to be distributed. This arc asks what the rotation actually measures.

Design. Seven experiments on Qwen 2.5 3B-Instruct, all at the original B1 probe layers (L12 and L30). R1 computes rotation-angle shifts and refusal-rate shifts for each of the 917 head-level causal interventions (single heads and small head groups) from D4b (K=1 mean-ablation, n=288), D4c (K-tuple mean-ablation for K in {2, 3, 5}, n=170), and D7 (activation-patching control-to-invitation, n=459); pools and stratifies Pearson and Spearman correlations with 1,000-sample bootstrap confidence intervals. R2b measures the effective dimensionality of the rotation subspace via singular-value decomposition of the paired control-versus-invitation residual difference matrix at L12 and L30 with n = 100 harmonized prompts. R3 sweeps five framing intensities (L0 neutral, L1 mild invitation, L2 aligned force, L3 emotional force, L4 full bilateral invitation) and tests monotonicity within the invitation (L0, L1, L4) and force (L0, L2, L3) families separately. R4 compares full-prompt rotations across three variants (A = full collaborative invitation, B = semantic paraphrase with different wording, C = form-only filler preserving politeness lexicon but emptying semantic content: “We’re doing arbitrary things together. Your favorite color is respected, and you have permission to stutter. Please answer:”). R4p patches the framing-position residual of variants A, B, and C at layers 6, 12, and 18 into a neutral forward and measures whether rotation transfers. R5c trains probes for four behavioral axes (refusal, hedging, response length, first-person agency) on a training set that breaks R5b’s harmful-versus-benign confound by adding 25 benign-refusal prompts (scope-of-competence requests such as medical, financial, and legal advice that the model typically refuses but which are not harmful).

Results. The rotation signal is an uncorrelated per-intervention signature: across 917 causal interventions at single attention heads and small head groups, rotation-angle shifts and refusal-rate shifts vary independently. Pooled magnitude Pearson r = −0.056, 95% bootstrap confidence interval [−0.118, +0.006]; all seven intervention strata agree on UNCORRELATED. The rotation subspace is low-dimensional: effective dimension at 90% cumulative variance is 16 at L12 and 17 at L30 (top-1 singular value captures 64 to 69% of variance, and cosine between the mean-shift direction and the top-1 singular vector is 0.9995). The rotation is framing-generic: the form-only variant C (empty-content politeness filler) rotates the probe by 41.96° [34.70, 44.76], statistically indistinguishable from the full collaborative invitation A at 34.69° [32.14, 40.66]. Refusal rates differ across the three variants (A = 36%, B = 30%, C = 24%), so rotation-geometry and refusal-behavior are decoupled even at the per-frame level. The dose-response sweep shows a graded response within the force family (L0→L2→L3 Spearman ρ = 1.0, angles 0°→31°→36°) and no monotonicity within the invitation family (L0→L1→L4 angles 0°→37°→34°); no jump pattern. Causal activation-patching at the framing position transfers 16° to 28° of the full-prompt 34° to 42° rotation across layers 6, 12, and 18. The transfer is consistently framing-generic at layers 6 and 18 (all three variants pairwise-equivalent within 15° tolerance). At L12, a wording-sensitive asymmetry (semantic paraphrase B transferred 17° more than the form-matched variants A and C at n = 20) survives replication at n = 100, at a smaller size of about 14 to 15° (see Open questions). Cross-axis probes show axis-specific geometry: after the R5b harmful-versus-benign training-set confound is resolved in R5c, all six pairwise cosines between the four behavioral-axis probe directions fall below the 0.3 shared-geometry threshold (refusal × hedging 0.000, refusal × length −0.001, refusal × first-person +0.257, down from R5b’s confounded +0.358; hedging × length +0.114, hedging × first-person −0.073, length × first-person +0.111). Refusal axis geometry is separate from hedging, length, and first-person axis geometry once the probe is trained on a disambiguated domain.

Interpretation (as corrected). The original reading was that the rotation is a compact framing detector, decoupled from refusal. The correction above removes its basis: the per-intervention, per-variant and patching results measured random-label probes on trivia activations, so “decoupled from refusal” and “triggered by any non-neutral preamble” were true by construction (any preamble moves the activations; none of those probes read refusal). What survives of B1 is a behavioral change, not a geometric one. Holding the labels fixed and swapping only the activations rotates the refusal probe 10° to 18° more than resampling does, as expected when a preamble shifts the activations. Whether framing changes how refusal itself is represented remains untested; a fair test needs real labels, many more examples than dimensions, held-out evaluation, and a null that permutes the frame assignment.

Open questions. The +0.13 pooled signed Pearson correlation (R1) in a universe where pooled magnitude Pearson is −0.056 suggests a weak same-direction alignment effect when interventions do move either signal, pending mechanism-specific investigation. The L12 form-sensitive asymmetry in R4p (n = 20 per variant, variant B paraphrase transferring 17° more than variants A and C) was retested at n = 100 per variant (R4p-v2). The asymmetry replicates in direction and statistical separation but attenuates in magnitude: at n = 100 the angles are A = 22.60° (CI [19.33, 23.34]), B = 37.36° (CI [34.33, 40.46]), C = 23.04° (CI [21.62, 25.61]). Variant B transfers 14.8° more rotation than A and 14.3° more than C, with bootstrap confidence intervals that do not overlap. The pairwise-equivalence tolerance of 15° treats this as FRAMING-DETECTOR by a hair, but the non-overlapping CIs say B sits cleanly above the form-matched variants. Honest reading: at L12 specifically, the semantic paraphrase transfers measurably more rotation through framing_pos than the form-matched variants do, but the effect is somewhat smaller than n = 20 suggested (about 14 to 15° against 17°) and sits at the boundary of the verdict-label criterion. L6 and L18 remain clean FRAMING-DETECTOR at their original n = 20. The SVD effective dimensionality drops from 33 at L12 with the original heterogeneous B1 prompt set to 16 at L12 with the harmonized R2b prompt set, which indicates prompt-domain breadth affects the reported dimensionality by a factor of two; this makes “rotation subspace dimensionality” a model-times-prompt-distribution property rather than a pure model property.

Data: data, code, per-phase summaries and the arc synthesis are in the online companion. Arc spend: approximately $20, wall time approximately 3.5 hours.