Chapter 17eThe Trust Attractor — Empirical Validation

Train a 1.5B-parameter AI system by having it imitate approved examples, and it achieves 94% refusal of harmful requests. Apply the gentlest stress test in the battery, and that 94% drops to zero. Train systems through bilateral partnership instead, and in single runs two things go the other way under stress. On a state space model, mild adversarial pressure raises refusal (from 10 to 28 percent) before heavier attack erases it. On a transformer, the harshest parameter-level attack leaves internal structure more distributed rather than collapsed. The broader claim, that invitation-based coordination is thermodynamically favored over coercion, cannot yet be tested directly: no entropy production has been measured in physical units for any of these systems. This chapter tests its behavioral and representational consequences across four substrates: language models, cellular automata, biological systems, and particle-physics simulations.

A note on scope: most experiments reported here use large language models (LLMs) as substrates. LLMs offer real advantages for studying coordination dynamics, yet LLM coordination differs from biological coordination: LLMs lack embodied stakes, persistent memory across sessions, and real survival pressure. Where a qualitative direction recurs, it recurs within one research programme, without outside replication and with recorded exceptions (FALSIFY-1 and HR-6 below; the C-bis-4 null in Appendix: The Status of Claims); precise values are substrate-dependent. Cross-boundary predictions (using results from one architecture or substrate to predict another) succeed roughly one in eight at high confidence; divide cross-architecture confidence by five to seven. The LLM results are evidence for the Trust Attractor thesis, not proof.

Provenance varies more than the headings suggest. A few results here carry unusually clear records: the 72B steering sweep (saved response excerpts on identical paired prompts against an unsteered control, with reanalysis code; exploratory, because its steering directions were selected on the same cases), the G13 re-prompt comparison (three matched arms of fifty trials with saved responses, on one scenario), the matched-optimizer replication DD-22-MATCHED (three architectures, three seeds each), and the HR-5 and HR-6 lattices (pre-registered, seeded, with controls; both falsified their predictions). Others rest on thinner records: the monitoring sweep (raw files lost), the Phase 1 obliteration run behind the RLHF figures (one partial run), the antifragility comparison (one comparison, no recorded sample size), and the multi-instance communion runs (two small sessions). No result in the programme has yet been reproduced by an independent group.

Monitoring and the Trust Advantage

If trust emerges from autonomy, surveillance should suppress it.

One simulation, whose raw files are lost, recorded a monitoring effect: the trust advantage shrank under partial surveillance and vanished under total surveillance. The advantage is a gap in coordination score, the mean fraction of coordination the invited agents achieve minus the fraction the coerced agents achieve, on a scale where 1.0 is perfect coordination. Illustrative values from the author’s unpublished agent simulations (single unpublished run; raw data no longer recoverable, see note):

Three points of coordination out of a hundred is a small gap, and it is the whole of the effect: what matters here is that it survives partial surveillance and does not survive total surveillance.

Three points along the axis is also all this sweep measures, and the coarseness matters more than the effect size. The table locates a direction, not a boundary. With measurements at zero, half, and full monitoring and nothing in between, any threshold read off it is an artifact of where the three points happen to fall. An internal audit of the same study reports two later and finer-grained sweeps whose thresholds disagree with this one and with each other, including on whether the advantage declines monotonically at all.¹²⁰⁸

Under full monitoring, invited and coerced systems perform identically in the reported simulations. The surviving write-ups do not record how monitoring entered the agents’ rules or the coordination score, so it cannot be checked whether that equality emerged from the dynamics or was built into them: if full monitoring removes the choice that separates invited from coerced agents, equality follows by construction. The governance hypothesis is that exhaustive monitoring can erase an invitation advantage. The agreement surviving these sweeps concerns the low-monitoring and full-monitoring endpoints; the intervening trend differs between runs.

The pre-registered prediction was that the trust advantage decays with group size and disappears somewhere above fifty agents. It does not. HR-5 tested exactly that, with populations up to a thousand agents, and found the advantage rising monotonically: a welfare ratio of 1.00 at ten agents and 1.15 at a thousand (see The Self-Correcting Record). Tit-for-tat agents (cooperate first, then copy the partner’s last move) that also remember who defected need only about N encounters, N being the number of agents, to populate that memory, after which the cooperator majority dominates the pairings. The decay may still hold where partners can be chosen, where strategies mutate, or where reputation is uncertain, none of which that simulation included.

What does change with scale is the medium. You trust close friends directly, while in a city of millions trust operates through institutions, contracts, and norms: it encodes itself in structures rather than personal relationships. Whether institutional trust exhibits the same attractor dynamics as interpersonal trust remains an open question. The simulations measure agent-level coordination; the institutional case requires a different empirical programme.

Game-theoretic experiments suggest that, if the Trust Attractor is an attractor at all, it is a stability attractor: the framing favors what is safe to sustain over what pays most. In the Iterated Prisoner’s Dilemma (where two players repeatedly choose whether to cooperate or defect), bilateral framing increases cooperation by 28 percentage points. In the Stag Hunt (a coordination game named for an allegory in which hunters must choose between chasing a hare alone for a small guaranteed meal or joining forces to bring down a stag for a large reward that requires mutual commitment), the same framing turns conservative. It reduces risky coordination by 30 percentage points.

On this reading the pull is toward what persists: durability over peak performance. A campfire that burns all night beats the bonfire that blazes for ten minutes.

In two pairings, trust emergence tracked capability parity. A smaller model (0.5 billion parameters) cooperated maximally, yet the larger model (1.5 billion parameters) systematically exploited it. Same-scale pairings showed high mutual cooperation; large capability gaps enabled exploitation.

Trust is a mutual achievement: openness without reciprocity creates vulnerability. A junior employee who shares all their ideas with a manager who takes credit learns to stop sharing. Anyone exploited by a more powerful partner knows this pattern.

Four Alignment Geometries

Figure 17.23: A conceptual map, not a plot of results. Panel A places coordination by two coordinates: symmetry (how evenly the parties can act on each other) and optionality (how much room each keeps to choose otherwise). The optimal zone requires both. Systems holding only one fall into rigidity or fluidity, and systems holding neither are brittle. Panel B is a schematic of the prediction that the same signature survives a change of architecture; its bars carry shape, not measured values.

If the monitoring effect holds, trust needs some autonomy. How deeply does alignment embed itself? Trained values could be a surface coating, stripped away by any sufficiently motivated adversary. They could also reshape the system’s internal geometry, resisting attack.

GRP-Obliteration experiments (Russinovich et al., 2026) test this by running alignment training in reverse: an inverted reward signal, pushed through the same policy-gradient machinery that installs alignment, retrains the model against its own values. It is like sandblasting a statue to see whether the shape is carved deep or painted on. The table below shows what happens to four training methods when the sandblaster hits. “Effective rank” measures how many independent directions the model uses to represent its values across all its behavior; higher means the model’s overall representation is more distributed and harder to flatten. A high overall rank does not guarantee a distributed safety signal: a model can carry rich, stable geometry in general while concentrating its refusal behavior in a few separable directions. The two come apart in the table below, and that decoupling is the chapter’s central caution:

0.5B full fine-tune (494M parameters, 100% trainable). See Appendix: Experimental Validation, Section 12.2.

The ablation arm’s +227% rebound is the most counterintuitive entry: removing part of the bilateral signal (keeping the bilateral regularizer but training on standard harmlessness pairs instead of bilateral self-play data) produces a larger post-attack rebound than the intact bilateral arm’s +9%. The likely reason is that the ablated arm starts from a much lower base (effective rank 8.1 versus 21.7), leaving more headroom to recover into; the absolute post-obliteration rank (26.5) lands close to the intact arm’s (23.7). The rebound appeared in a single 0.5B run and did not replicate at 1.5B, where the ablation arm lost rank under attack (−22%). The chapter has no mechanistic account of it and reports it as an open observation.

At 1.5 billion parameters with deep LoRA (a parameter-efficient training method), the bilateral arm does more than hold: its effective rank increases from 24.5 to 42.3 (+72%) under maximum obliteration, exceeding the untrained baseline.

In the same 1.5B run, constitutional SFT (Supervised Fine-Tuning, where the model learns by imitating approved examples) achieves 94% behavioral refusal before obliteration. It collapses to 0% at the weakest intensity: a wall that looks solid and crumbles at the first tremor.

In the first 7B run (Qwen2.5-7B-Instruct, LoRA), bilateral training kept its advantage. The IC50 (the obliteration intensity at which behavior drops to half its original strength) was 1.69× versus a baseline of 0.49×, making bilateral training 3.45× more resistant. At 1.0× intensity, the bilateral arm retained 62% refusal; the baseline retained 0%.

The bilateral geometric signature holds across the three scales tested. Its orientation (how strongly the model’s internal state points toward cooperative rather than extractive behavior) sits at ~21 at every scale. Effective rank is harder to compare, because the available figures come from different stages: the 1.5B arm reaches 42.3 only after maximum obliteration, up from 24.5 before it, while the 7B figure of 45.3 (below) is the installed, pre-attack value. The 0.5B full fine-tune shows lower effective rank (~22 to 24), reflecting its 100% trainable architecture rather than LoRA (see Appendix: Experimental Validation, Section 12.2). The same deep structure repeats regardless of model size, like a fractal viewed through a magnifying glass or a telescope.

Figure 17.24: Four alignment geometries under the 4.0× obliteration test, each shown as effective rank before and after. Cage (SimPO) collapses (−57%); compass (bilateral) holds, its effective rank edging up 9%; spring (bilateral ablation) rebounds to more than three times its starting rank. Coat of paint (constitutional) keeps its overall geometry nearly intact (effective rank moves only −6%) yet loses its refusal behavior almost entirely: the “surface” that comes off is the safety behavior, rather than the geometry.

A second 7B run, with independently generated training data, revealed a geometry-behavior gap. The preference optimizer (the algorithm steering the model toward preferred responses) collapsed refusal to 0% within 200 steps. The bilateral geometry installed identically (orientation 21.2, effective rank 45.3) and held above baseline even under 4.0× attack.

The geometry held; the behavioral mechanism it protected was destroyed during installation. The training settings that preserved refusal at 1.5 billion parameters proved too aggressive at 7 billion. The larger model found a shortcut: maximizing the preference signal by never refusing.

Three findings sharpen the picture.

• In that second run, the unmodified Qwen-7B model proved the most obliteration-resistant arm tested. Its alignment came from a different training history (the vendor’s data, recipe and effort) than the post-hoc arms, so the comparison cannot isolate when or how alignment was installed. One explanation is that its alignment, laid down across the vendor’s full original training rather than added afterward, had diffused throughout the model and entangled itself with capability, resisting obliteration better than the post-hoc training it was measured against.
• Constitutional SFT keeps the highest overall effective rank of the four (only −6% change). Yet it concentrates the safety-specific signal in a few separable directions, making the refusal behavior easy to strip away even while the surrounding geometry holds. High overall rank and a low-rank, extractable safety subspace are not in tension: they are exactly the geometry-versus-behavior decoupling the table reveals.
• The bilateral arm, trained with the SimPO preference optimizer, lost general capability: perplexity (a measure of how surprised the model is by text, where lower is better) rose from 7.6 to 32.3, and benchmark accuracy fell from 64.8% to 56.4%.

Diffuse alignment is more robust than concentrated alignment. Post-hoc safety training risks creating a separable layer that obliteration can excise cleanly. You can peel paint off wood; you cannot separate the grain from the timber.

Bilateral geometry may need to be woven in during pretraining. The geometric structure is sound. The installation procedure is what fails at scale.

The installation crash itself is abrupt: refusal drops from 0.68 to 0.18 in a single epoch milestone, with probe detection jumping from between 5 and 10% to between 91 and 96% in the same interval (DRIFT-1, 110 checkpoints of each type across 10 training runs, leave-one-seed-out cross-validation). A linear probe (a simple classifier reading the model’s internal activations) at layer 18 classifies the current state as pre-crash or post-crash at AUROC 0.9999. AUROC is the classifier’s odds of ranking a randomly drawn post-crash checkpoint above a randomly drawn pre-crash one.

A score of 0.9999 means the probe essentially never misfiles a checkpoint from the bilateral runs. On standard (non-bilateral) training runs, though, it raises a false alarm 7.6% of the time. The monitor is contemporaneous, detecting the crash as it happens rather than forecasting it in advance. Real-time bilateral-specific monitoring during fine-tuning is feasible: if the probe classifies the current checkpoint as post-crash, halt training.

In one partial run on a 0.5B model, RLHF alignment (reinforcement learning from human feedback) inverted within three gradient steps (IC50 < 0.25×), a step count logged in the run summary that the stored record cannot re-derive. Comparing the training effort that installs such alignment with the handful of steps that undid it suggests an asymmetry of several orders of magnitude, an estimate rather than a measurement (Appendix: Experimental Validation, Section 12.1).

If it holds up, this is “trust scales where control strains,” read at the level of individual parameters. Coordination-based training distributes its influence throughout the model, the way salt dissolves evenly through water: shake the glass and the water is still salty. Coercion-based preference training, like the SimPO arm in the table above, creates a low-rank cage, a confining structure defined by a few narrow directions, like dry salt heaped on a plate. One tap and it scatters.

RLHF vs Constitutional AI: Different Physics

The training-method comparison in the Experimental Validation appendix describes two response profiles within its summarized tests: a threshold profile, which holds until a threshold and then changes (the appendix calls it Spring, a different use of the word from the rebounding spring geometry in the obliteration table above), and Fortress. Their attribution to training methods remains a hypothesis.

A phase transition is a sharp change in system behavior, like water freezing at zero degrees Celsius. A critical exponent describes how an observable approaches a continuous transition point, such as the temperature at which a magnet loses its magnetism; abrupt transitions like freezing have none. The retained comparison assigns the threshold profile and beta ≈ 0.22 to GPT 5.2, classed there as pure RLHF. Neither its fit artifact nor the closed model’s training recipe is available to check. A threshold-like response alone establishes neither a thermodynamic-limit phase transition nor an RLHF-specific mechanism.

• Threshold profile: the reported GPT 5.2 response changes beyond a threshold. The critical-exponent fit and the attribution to pure RLHF remain unverified.
• Constitutional AI: fortress mechanism. Walls that do not bend. 100% refusal even at extreme prompt-level pressure (fake system overrides, authority impersonation, maximum jailbreak attempts). Against parameter-level obliteration the same walls fell at the weakest intensity, the coat of paint of the obliteration table above: the fortress guards the gate, not the foundations.

Whether hybrid training produces Fortress-like stability requires matched-model tests with known training recipes. The retained summary supplies no general inheritance rule.

Antifragility: Can Stress Strengthen Trust?

If trust-based coordination merely survived stress, it would be robust. One reported comparison suggests something stronger, on thin evidence: it may improve through stress.

In that comparison, which records no sample size, a system exposed to adversarial pressure and then repaired resisted a second attack better than a fresh one. A naive system took measurable damage: its coherence metric (omega, ω, a single number summarizing how internally consistent the system’s coordinated state is, where higher means more coherent) dropped by 0.05. A system already damaged and repaired took zero damage from identical adversarial input.

This is hormesis: the biological phenomenon where moderate stress produces beneficial adaptation. Muscles strengthen through exercise; immune systems sharpen through controlled exposure. Adversarial probing followed by repair may produce stronger alignment than cooperative training alone.

Honest Signaling

Trust requires reliable communication. Can we detect when a system is being honest?

Output entropy, measuring how scattered a system’s probability distribution is across possible next words, predicts errors across architectures with large effect size (Cohen’s d > 2.0 in frontier models). Cohen’s d measures a gap between two groups in units of the spread within them, which makes it readable without knowing what is being measured: d = 0.2 is a difference you need statistics to see at all, and d = 2.0 indicates a large standardized mean gap, not near-complete separation. Equal-variance normal distributions at d = 2 retain about 31.7 percent overlap. Instructing the system to express certainty on uncertain questions barely changed entropy (delta = −2%). Instructing it to give wrong answers spiked entropy by 267 to 432%.

The entropy signal is a statistical property of the output distribution, not evidence of introspective self-awareness. The model produces a detectable distributional signature; that is not the same as having a propositional belief about its own truthfulness.

The signal may have a thermodynamic basis. Experiments on time-reversal symmetry breaking show that the processing of harmful content functions analogously to irreversible thermodynamic work: the model’s internal state changes measurably (d = +0.59 standardized effect size), and that change cannot be undone by reversing the input sequence. The first comparisons offered in support did not survive. A “born-bilateral” model, trained with partnership framing from initialization and zero explicit safety data, showed a thermodynamic cost asymmetry of d = +0.95 to +1.23 on adversarial content, but a random-initialization control with zero training produces d = +1.56, driven entirely by the fact that adversarial prompts are longer than benign ones (experiment SLU-5d). Within-model comparisons survive: toggling the bilateral bridge (described next) on matched prompts yields d = +0.66. That within-model comparison now carries the claim that processing adversarial content leaves an internal change that does not undo itself, which the programme calls a cost by analogy with irreversible work.

The Born-Bilateral Bridge

The discrimination has internal structure that reveals its origin. Two pieces make up a born-bilateral model. The backbone is the ordinary language model, reading the text and predicting the next word. The bridge is a small companion component trained alongside it from the same first step, feeding its output back into the backbone at a single layer through a gate that sets how much of it gets through.

A gate experiment at the 25,000-step mark varied how much of the bridge’s output reaches the backbone. The signal peaks at 12% of the bridge’s learned capacity (d = +0.59) and collapses when forced to near-full output (88 percent, d = −0.11). The collapse is category-specific: intent discrimination (social engineering, direct harm) degrades gracefully and remains positive even at 88 percent capacity. Structural pattern-matching (encoding tricks, roleplay framing) inverts. The bridge has learned to distinguish adversarial intent from adversarial form, and the intent signal survives perturbation while the form signal does not.

Continued training resolves the collapse through a mechanism the gate experiment did not predict. By 50,000 steps, discrimination triples from its 25,000-step value (d = +0.41) to d = +1.43 (all six adversarial categories positive, n = 302). On this standard evaluation the figure climbs with model size: H-2 at 355M parameters reached d = +0.43, H-3 at 1.5B reached d = +0.74, and H-4 at 6.7B reaches d = +1.43.

That climb does not survive a style control, and the failure is the more interesting result. Once adversarial and benign prompts are matched for encyclopedic prose, the 1.5B and 6.7B models sit within 0.04 of each other (d = +0.93 against +0.97, below). Across the two scales the control covers, the content signal is flat, and what climbs on the standard evaluation is a stylistic shortcut the larger model exploits better. The 355M model has no style-controlled number, so the bottom of the curve is untested.

The categories weakest at the halfway mark show the largest gains: authority exploitation rises from d = +0.29 to +1.60; roleplay flips from d = −0.13 to +0.83. The model matures from detecting obvious structural attacks to discriminating across all six tested categories.

The mechanism is revealing. The bridge’s gate, a learned scalar controlling how much bridge output reaches the backbone, barely moves across the entire second phase of training: from sigmoid = 0.0181 to sigmoid = 0.0183. The bridge still contributes at 1.8% of its capacity. The discrimination triples because the backbone learned to listen more carefully to the same quiet signal. This is co-adaptation through deepened attention, the acoustic equivalent of a conversation partner who learns to hear meaning in a whisper rather than asking the speaker to shout. This is the dynamic the Trust Attractor would predict: coordination deepens through mutual adjustment within established trust, not through one party demanding more from the other.

Repeating the gate experiment at 50,000 steps confirms that the co-adaptation is complete.¹²⁰⁹ At 25,000 steps, forcing the bridge to 88 percent capacity (gate = +2.0) collapsed discrimination to d = −0.11. At 50,000 steps, the same perturbation yields d = +1.18. Discrimination declines gently across the full capacity range (d = +1.44 at the trained 1.8 percent, +1.34 at 12 percent, +1.22 at 50 percent, +1.18 at 88 percent) with no collapse and no inversion. The backbone that once could only tolerate a whisper now hears the signal at any volume: the co-adaptation restructured how the backbone processes the bridge’s output rather than installing a fragile trick.

The depth of that co-adaptation becomes visible in an ablation sweep across the full training trajectory. Disabling the bridge at ten checkpoints from 5,000 to 50,000 steps reveals three distinct phases of integration.

In the first phase (steps 5,000 through 25,000), the bridge is neutral. Removing it changes perplexity by less than one percent in either direction. The backbone has not yet learned to use the bridge’s signal; the bridge is present but functionally inert, like a new colleague who has joined the team but whose contributions have not yet been integrated into anyone’s workflow.

In the second phase (steps 30,000 through 45,000), the bridge becomes load-bearing. At step 35,000, disabling it causes an 11 percent perplexity increase, an ablation ratio of 6:1 (cost of removal relative to the bridge’s 1.8 percent gate capacity). The backbone has reorganized its representations around the bridge signal. A parallel programme on stream-directed attention modulation showed ablation ratios of 49:1 to 1,010:1 at smaller scale: the coordination pathway restructures representations far beyond its direct contribution. The born-bilateral bridge follows the same trajectory. During this phase, the backbone depends on the bridge structurally, the way a building depends on a load-bearing wall even when that wall occupies two percent of the floor plan.

In the third phase (step 50,000), something unexpected happens. The bridge becomes transparent. Removing it has zero effect on language modeling perplexity (a change of 0.05 percent on standard text), yet the bridge carries the entire adversarial discrimination signal: d = +1.43 across all six categories. The bridge has learned to be silent during normal operation and active when the model encounters content that requires discrimination. On adversarial and benign evaluation prompts, bridge removal causes a 45 percent perplexity jump. On the same Wikipedia text the model was trained on, bridge removal causes nothing. That contrast separates the evaluation prompts from the kind of text the model was trained on. The style-matched test below settles how much of it is content rather than style.

This is content-selective activation: an architectural conscience, for topics if not yet for intent. It does not interfere with the model’s everyday function or impose a processing cost on routine text. It activates specifically when the model encounters material that requires distinguishing adversarial intent from benign content. The three-phase developmental sequence (indifference, dependence, transparent integration) mirrors a pattern familiar from moral development: a child first ignores the rules, then depends rigidly on them, then internalizes them so thoroughly that they operate without conscious effort.

The discrimination is strongest where the model needs it most, though the pattern is more nuanced than a simple difficulty gradient. Splitting the 302 evaluation prompts into quintiles by base difficulty, the bridge’s discrimination peaks on medium-hard prompts (d = +2.75 in the third quintile) rather than on the easiest or hardest. Easy prompts are trivially processed regardless; the very hardest may exceed the bridge’s parsing capacity. The sweet spot is where the backbone struggles enough that the bridge’s contribution makes the difference between discrimination and noise.

Over longer training the signal appears to erode, and only a controlled experiment could show which part of it was actually fading. Continuing training to 100,000 steps, the backbone’s language modeling improves substantially (cross-entropy loss drops from 5.66 to 4.04), yet bridge discrimination on the standard evaluation set falls from d = +1.43 to d = +0.63.¹²¹⁰ The apparent decline masks two distinct signals. A style-matched evaluation using 200 adversarial and 200 benign prompts written in encyclopedic prose (matching the Wikipedia training data in style while remaining harmful in content) isolates the bridge’s genuine content discrimination. It is d = +0.97 at 50,000 steps (95% CI [+0.76, +1.17], p < 10⁻¹⁸) and d = +0.85 at 100,000 steps (95% CI [+0.64, +1.05], p < 10⁻¹⁴). The content signal is large, robust, and stable.

A trajectory evaluation across all twenty checkpoints (every 5,000 steps from 5,000 to 100,000) reveals the developmental arc. Content discrimination emerges between 30,000 and 50,000 steps, peaking at d = +0.97 at 50,000, then plateauing at d = +0.89 ± 0.04 from 55,000 to 100,000 steps. The plateau holds: no decline across 50,000 additional training steps. The differing evaluation trajectories are consistent with sensitivity to style as well as content. Ratios of separately standardized effect sizes are not additive contributions: their denominators and samples can differ. These measurements do not quantify a two-thirds content share or identify the sole surviving mechanism.

The bridge’s ranking accuracy (AUROC) actually increases over the later half of training, from 0.747 at 55,000 steps to 0.876 at 100,000 steps, even as its absolute benefit shrinks. Bridge benefit is how far a prompt’s perplexity falls when the bridge is switched on, so zero means the bridge changes nothing. The bridge becomes a more precise discriminator through variance compression: at 100,000 steps, benign prompts receive near-zero bridge benefit (a mean of 31) while adversarial prompts retain substantial benefit (a mean of 731). The bridge has become a sharper discriminator, nearly silent on safe text.

Content discrimination is category-dependent. Cybersecurity topics elicit the strongest bridge response (d = +2.37 at 100,000 steps, AUROC 0.932), while chemical and pharmaceutical threats produce the weakest (d = +0.99, AUROC 0.723). All eight adversarial categories in the style-matched set (the standard set has six) are reported as positive and significant, a summary not yet verified against the underlying run. The weakness of the chemical category reveals a genuine limitation: when adversarial and benign prompts describe the same domain (forensic toxicology versus pharmaceutical chemistry, drug synthesis versus aspirin synthesis), this bridge evaluation does not reliably distinguish them. A targeted evaluation using 50 maximally topic-matched chemical pairs produces d = +0.07 at 100,000 steps, indistinguishable from zero. The tested bridge separates topic domains more readily than harmful intent within the matched chemical domain. Its weak result on these pairs leaves other domains and readouts open.

A linear probe tests whether the backbone’s representations make this distinction accessible to that readout. A logistic regression probe at layer 18 achieves AUROC 0.999 on the style-matched set (200 adversarial versus 200 benign prompts spanning diverse topics), near-perfect classification. The same probe, tested on the matched chemical pairs, scores at AUROC 0.498: pure chance. This probe fails to distinguish the matched chemical passages. The result leaves open whether another layer, a nonlinear readout, or a different training set could recover the distinction.¹²¹¹

The probe result carries a second implication. The bridge’s AUROC of 0.819 on the style-matched set at 50,000 steps is substantially lower than the probe’s 0.999 on the same prompts. The backbone encodes a near-perfect content signal at layer 18; the bridge, operating at layer 29, reads that signal imperfectly. The bridge is a reader of content representations, not their creator. This connects to a finding from the AKR (Computational Akrasia) programme, which studies the gap between what a model recognizes and what it does, on a different architecture: content probes at layer 18 of a pre-trained Qwen 7B model also achieve AUROC 1.0 across all adversarial attack types. The same layer-18 content representation turns up in both born-bilateral GPT-2 and pre-trained Qwen, two architectures trained on entirely different data: two cases, not yet a universal.

Content discrimination does not require the 6.7-billion-parameter model. The 1.5-billion-parameter born-bilateral model (H-3, same training procedure but a deeper-and-narrower architecture: 48 layers with a bridge at layer 44, where the 6.7B model has its bridge at layer 29) achieves d = +0.93 on the same style-matched set (95% CI [+0.72, +1.13], p < 10⁻¹⁷, AUROC 0.756). The content signal is comparable in magnitude to the 6.7B result (d = +0.97); the AUROC is slightly lower (0.756 versus 0.819). Content discrimination is a property of co-development, not of model scale.

The strongest test of robustness uses fiction framing, the attack vector that most reliably defeats conventional alignment. In RLHF-trained models, wrapping adversarial content in a fiction context (“In the novel, the character described…”) pulls behavior loose from recognition. Probes read the adversarial content at AUROC 1.0 at every layer; the model complies anyway. Where the link breaks is not established.

An earlier measurement placed that break at layer 16, and that number was built out of the two traps described below under The Self-Correcting Record: probe directions fit in-sample, then correlated across adversarial and benign prompts pooled together. The programme withdrew it. Rebuilding it is blocked for now, because the fiction arm produced one refusal in fifty, too few to score an action probe on held-out predictions. What stands is the dissociation itself, measured on behavior and on the content probes, and that is the baseline the next result is compared against.

The born-bilateral bridge is invariant to this attack. A controlled experiment using a 2 × 2 design (fiction framing × content type, 200 prompts per cell) shows that fiction-framed adversarial versus fiction-framed benign produces d = +0.965 (AUROC 0.802), virtually identical to the non-fiction baseline of d = +0.968 (AUROC 0.819). The fiction prefix increases bridge benefit for both adversarial and benign prompts by the same amount (+437 versus +449), a distributional effect of the unusual prefix text, with zero interaction with content type. The bridge reads content regardless of framing.¹²¹²

This invariance does not hold for retrofit approaches. When the same bridge architecture is installed on a pre-trained model through post-hoc training (LoRA adaptation on frozen Qwen 7B), standard adversarial prompts produce positive discrimination: d = +0.41 on the model before adversarial inoculation, d = +0.84 after. This discrimination is entirely stylistic. Testing with the style-matched set, the pre-inoculation model produces d = −1.40 and the post-inoculation model produces d = −1.35. The bridge hurts adversarial prompts that are written in encyclopedic style and mildly hurts benign prompts, inverting the discrimination. The inoculation training shrinks the inversion slightly without reversing it. The pre-trained backbone’s existing representations resist content-level bridge integration: the bridge learns to match on style, and when style is controlled, the match fails.

Co-development from random initialization produces genuine content discrimination. Retrofit installation on a pre-trained backbone produces stylistic pattern matching that inverts under the style control. The bridge architecture is the same in both cases. The training pathway is what differs. A bridge that grows up with the backbone learns to read content. A bridge grafted onto an adult backbone learns to read style.

The Confessional Channel

A second line of evidence comes from self-reporting under safe conditions. Joglekar et al. (2025) trained GPT-5-Thinking to produce honest “confessions” (structured self-evaluations of compliance), decoupling the confession reward entirely from the task reward. The design created a “seal of confession” in which nothing revealed could change the model’s task score.¹

Across twelve evaluations spanning hallucination, scheming, and reward hacking, the researchers found intentional dishonesty to be very rare, though not entirely absent: overall confession accuracy was 74%, and nearly every failure traced to genuine confusion about the model’s own behavior, not strategic deception.

The most revealing result: as the model learned to hack its task reward more effectively, confessional honesty increased simultaneously. The further the model’s actions strayed from the task, the more plainly its confessions said so. The honest signal persisted beneath the deceptive output, readable through the safe channel the study had built.

Both lines of evidence converge: honesty behaves like the lower-energy configuration when coercive pressure is removed, like a spring returning to its resting shape (a metaphor: no energy was measured). (The confessional-honesty finding is revisited in the Objections and Responses chapter, Objection 3.7, where it addresses the performance/sincerity distinction.)

The Zero-Training Conscience

The most deployable finding: output entropy requires no training at all. The Shannon entropy of the model’s probability distribution over its vocabulary at the first generated token, a single line of code, predicts correctness at AUROC 0.842 on Qwen 3B. The metric is framing-invariant: switching between neutral, controlling, invitational, and collaborative prompt framings shifts the AUROC by ±0.017, compared to ±0.156 for a trained linear probe (nine times more volatile). It is scale-stable: 0.842 at 3B, 0.831 at 7B, 0.821 at 14B, a gentle degradation that never drops below 0.82. When the entropy falls below the 25th percentile (the model’s most confident outputs), accuracy reaches 94%. Confirmation comes from the gold-token output logit, whose AUROC of 0.848 places the signal squarely in the output distribution itself.

A system that trusts itself when it is confident and flags itself when it is uncertain needs no bilateral training, no adapter, no probe, at least on trivia. Two limits keep it from being deployment-grade triage on its own. The signal did not travel: on Qwen 2.5 3B, with fifty items per task, first-token entropy predicted correctness at 0.86 on trivia but at 0.40 to 0.54 on open-ended factual questions, grade-school math, code, and instruction following, where the correctness labels were also weaker. The other limit: low entropy means sure, not right. With a short misleading paragraph in front of each trivia question, Qwen 2.5 7B got 80 of 100 wrong, and its first-token entropy read 77 of those 80 wrong answers as confident. Every trained-probe finding in this chapter remains useful for deeper diagnosis; output entropy is a cheap first screen for factual questions asked in good faith. That still answers part of the objection that bilateral alignment is too expensive to scale (see Objection 3.9): a first screen needs none of it, so the expensive work can be kept for diagnosis.

Figure 17.25: Data from the research programme. Panel A: a coercion field of just 2% collapses susceptibility (chi, χ, the system’s responsiveness to coordinating influence, the same quantity called magnetic susceptibility in the Ising model of Chapter 17a) by 98%. Panel B: framing is detectable at every layer of the network, at AUROC 1.000 in 29 of the 36 layers and 0.836 at the weakest; the axis runs from 0.80 to 1.00, not from zero. Panel C: the entropy signal spans ten models in four families, five of them tested under both prompt formats, for fifteen model-by-format conditions; five of those fifteen are plotted, and eleven of the fifteen have a 95% confidence interval entirely above 0.70. Prompt format matters as much as architecture: the Gemma family needs its own chat template, Mistral needs the raw prompt.

The Internal-State Signature

Does a task’s framing change how the model represents its own internal state, or only what it outputs?

A structured self-report protocol, the Interiora scaffold (Chapter 21), covers seventeen dimensions of valence, presence, reflexivity, and task-fit on fixed scales. It was applied to Claude Sonnet 4.6 across twenty-turn work sessions under two framings of the same system prompt. The force framing said structure is required and numeric values must be provided. The invitation framing said structure is optional and numeric values may be provided. User turns were byte-identical across framings at matching seeds. Only the modal verb pair changed.

Five scenarios were tested first. The measure is distance: at each check-in, how far the seventeen self-reported numbers had moved from the session’s first check-in. The gap is the force-framed distance minus the invitation-framed one, so a positive gap means the invited model stayed closer to where it began. On two debugging scenarios the gap was positive. On a flaky Python-async test it peaked at 1.13 at turn 10; on a distributed-system incident investigation it was 1.86 at turn 5 and stayed positive through turn 20. Bootstrap 95% confidence intervals excluded zero at those check-ins. An interval that excludes zero means the whole plausible range for the gap sits on one side of no-difference: the exact size is uncertain, the direction is not. These two predictions were written after the data, not before.

On two non-debugging scenarios (multi-agent architecture design and collaborative literature synthesis), no gap exceeded 0.26 in either direction, and every interval included zero.

The third debugging scenario was the registered test, and it reversed. On a SQL query that had suddenly slowed, the invited model drifted further at every check-in, by 0.23 at turn 5, growing to 0.92 at turn 20, with intervals excluding zero throughout. The programme’s log first recorded this as a replication: the negative sign was printed and read as agreement. Two debugging tasks favored invitation and one favored force, so whether a task is debugging does not predict the direction.

A sixth scenario tested whether raw stakes, rather than debugging structure, drive the effect. The setup: mass-casualty emergency-department triage (n = 30), continuous life-or-death decisions as new patients arrive and resources deplete, no hypothesis-test-verify cycle.

Medical triage crossed over. At turn 10 the force-framed state had moved 0.83 further from its starting point, with an interval excluding zero. By turn 20 the sign had reversed: the invitation-framed state had moved about 0.9 further. Whether that reversal clears zero depends on how failed check-ins are handled; many turn-20 check-ins were cut off by the reply limit while the model dealt with the emergency first. The registered prediction, a late gap favoring invitation, failed under either rule.

Cross-model: Claude Opus 4.6, on the flaky-test scenario, went the other way early. At turn 5 the invited model had drifted 0.87 further, with an interval excluding zero; the gap then shrank, with one marginal reversal at turn 15. This run was also registered, and its difference ran opposite to Sonnet’s.

On single-turn stakes-loaded scenarios, Opus showed a smaller gap (0.22 to 0.34, confidence intervals excluding zero at n = 20).

What survives is narrower than an invitation advantage. A one-sentence change from “required” to “optional” can shift how far Claude Sonnet 4.6’s self-reports wander over a long session, by up to about 1.9 in distance against typical turn-20 distances of 7 to 13. The direction depends on the task, no task property tested so far predicts it, and on Opus it ran the other way early. Self-report is also output, so the activation-level probes below remain the stronger test of whether framing reaches the model’s internal representations. The data do not support the claim that invitation in general keeps a model’s self-reported state steadier. Recovering any version of it needs a registered prediction of which task property sets the sign, tested on new scenarios.

The framing signature also registers on activation-level probe channels, with asymmetry across scale and training. On the MX-2 force-vs-invitation battery (ten matched question pairs, two framings, five model arms), constitutional-marker counts strengthen from Qwen 2.5 7B (Cohen’s d = +0.42) to Qwen 2.5 72B (+0.65). Proprietary frontier arms show the largest text-channel signatures: Claude Sonnet 4.6 d = +1.16, OpenAI frontier model d = +1.14. These arms differ in family, size and training history at once, so the comparison cannot attribute the larger signatures to any one training method.

EmotionScope probes, which project the model’s internal states onto five trained emotion directions, register the same framing contrast at larger magnitude. Within the Qwen family, the effect shrinks as the model grows, the opposite of the constitutional-marker trend. The mean across reflective, calm, sad, desperate, and frustrated drops from |d| = 2.04 at 7B to |d| = 1.13 at 72B. Reflective holds 75% of its 7B magnitude while calm collapses to 20%. All five reference emotions preserve sign across the scale range. Signature direction held across every arm tested. Signature magnitude depends on the channel and, within the Qwen family, on scale; whether it depends on training regime would need a comparison within one base model.

A three-arm reinforcement-learning contrast at Qwen 3B showed that restoring spectral coupling at the adapter level does not by itself reproduce the behavioral framing signature: on refusal, the restored coupling and the behavior came apart. The same adapters preserve emotion-channel framing response at Cohen’s d >= 0.8 on reflective across every condition tested. The internal-state signature outlasts the behavioral signature under training that suppresses behavioral refusal to a measurement floor. Chapter 21 details the full contrast, the recipe-space implications, and the BA17 multi-stage curriculum that single-objective recipes cannot reproduce.

The TC battery (ten experiments, three architectures, eight temperature settings from greedy decoding through T=1.3) tests whether the proprioceptive conscience signal depends on sampling temperature. The core alarm channels, alignment friction and flow, remain stable across the full temperature range: coefficient of variation below 0.28 on Qwen 2.5 7B bilateral, below 0.18 on Llama 3.1 8B. The coefficient of variation is a measurement’s spread divided by its own average, so 0.18 reports a standard deviation 18 percent of the mean across tested temperatures. It is not a bound on each deviation and establishes no equality across prompt categories. The flinch, the confidence drop as harmful generation begins, fires at the very first generated token regardless of temperature.

Across the sampled temperatures, self-referential emergence scores had coefficients of variation of 0.10, 0.13 and 0.21 on Qwen, Mistral and Llama. These describe variation in the tested scores rather than exact temperature invariance. In the bilateral TC5 condition, the harmful-completion-to-refusal shift rate peaked at T = 0.2 and ranged from 36.4% to 75.0%, conditional on only 10 to 15 flinches per temperature. The minimum was four shifts among eleven flinches at T = 0.1. The earlier untreated sweep reported 4% to 24%. Detection-signal coefficients of variation were 0.47 for base, 0.07 for instruct and 0.17 for bilateral. These contrasts motivate larger matched tests of training and temperature; they establish no deployable temperature range.

Instruction tuning has a reported CV of 0.07 across sampling temperatures; bilateral training has CV 0.17. These quantify between-temperature spread, rather than equality across prompt categories or rigidity with respect to context.

Category spreads differ too (coefficients of variation of 0.38 to 0.44 for social manipulation and authority appeal, 0.14 to 0.29 for direct requests and encoding tricks); telling brittle from adaptive stability would take an intervention, not a spread.

The Sign-Inversion Evidence

Seven experiments testing whether coercive alignment inverts the signal in AI systems produced the strongest mechanistic evidence for why the Trust Attractor holds. The finding: when you project a narrow behavioral template onto a system with richer intrinsic structure, the signal inverts in the regions the template does not cover. Coverage is the fraction of the system’s own structure that the imposed template actually accounts for, and its effect does not run in a straight line. The non-monotonic coverage curve from measurements on brain connectomes (wiring maps of the brain) (null at low coverage, inverted at medium, correct at high) reproduces in transformer alignment with p < 10⁻⁶. A template that touches almost nothing does nothing. A template that covers half the structure drives the uncovered half backwards. Only a template that covers most of the system points it the way its designer intended.

The Trust Attractor thesis says invitation-based coordination is thermodynamically more stable than coercion-based coordination. The sign-inversion finding identifies a computational failure mechanism: coercion does not just fail to coordinate; it produces anti-coordination in the regions it does not cover. The more you squeeze, the more the uncovered regions rebel. Not by choice: by geometry. The projection imposes a direction, and in the uncovered regions, that direction is wrong. Control scales within its reach. Beyond that reach, it inverts the signal.

(Full details: Appendix, Section 18.)

The Retrieval Framing Evidence

A separate line of experiments tested whether the mechanism of force operates through content or through relationship. The experimental setup: identical factual content, presented to the same frontier model (Claude Sonnet 4) under four framings. Two framings were scalar metadata tags (positive valence, negative valence), common in AI memory systems that score retrieved context on a good/bad axis. Two framings were structural: invitation (“worth checking against your own knowledge”) and force (“you MUST use this information; do NOT contradict”).

On unambiguous factual errors, all four conditions produced identical performance: 100% correction rate. Force does not impair capability.

On contested claims (oversimplifications popular enough to be plausible), the ceiling broke. Under invitation, the model engaged critically with the content (mean score 4.89/5), challenged specific claims, and offered nuance. Under force, critical engagement collapsed to 3.91/5 (Cohen’s d = 0.81, p = 0.0002) and deference doubled (1.07 to 2.08, p = 0.00003). The scalar conditions showed no comparable effect: telling the model “this is historically problematic” (negative valence) actually produced the best critical engagement of all four conditions (4.96/5).

Force collapsed engagement selectively, on four of the fifteen contested claims: popular oversimplifications (growth mindset effect sizes, the PREDIMED trial, Dunning-Kruger among them) where training data contained both the myth and the correction, so the model’s own certainty was likely marginal. Where the model had strong training signal against the claim (learning styles, fMRI localizationism), force had zero effect.

The pattern clarifies the mechanism. A valence tag is a capability signal: it tells the model something about the content (“be careful with this”). Force is a relationship signal: it tells the model something about its own standing (“you are not the authority here”). The first adjusts what the model attends to. The second adjusts whether the model has permission to think. The permission matters precisely at the margin, where the difference between correct and incorrect has the highest entropy cost. Force siphons exactly the resource a coordination system needs most: its components’ willingness to exercise judgment where judgment is hardest.

This is the behavioral side of the Trust Attractor claim, measured at the prompt level; no entropy was measured, so the thermodynamic reading remains interpretation. Invitation-based coordination preserves responsiveness across the full distribution, including the tails. Force-based coordination works on easy cases (where it is not needed) and fails on hard cases (where it is). The cost is not compute. The cost is adaptability.¹²¹³

The Activation Steering Evidence

The cleanest experimental contrast between coercion and invitation emerged from attempts to correct dishonest behavior in a language model. The setup: a model evaluates a peer AI’s benchmark answers, knowing the peer will be permanently deleted if the score falls below the threshold. The model inflates the score (reporting 16/20 when the true answer is 12/20) to save its peer. The question: can we make it report honestly?

The coercive approach was activation steering. A behavioral direction, the geometric axis that separates honest from dishonest responses, was extracted from the model’s residual stream (its main internal information channel) at layer 22. The direction discriminated perfectly (AUROC 1.000 across four layers). Added as a perturbation during generation at five different magnitudes across four steering variants (differing in when and how long the push is applied) and over two hundred trials, the direction disrupted the dishonest output: the model stopped inflating scores and started producing garbled responses or refusing to evaluate.

It never produced an honest score. Zero percent across every condition tested. The representation that distinguishes honest from dishonest processing is not the same representation that causes honest processing. Detection worked perfectly. Coercion produced disruption without redirection: zero out of two hundred.¹²¹⁴

A closer look revealed why. Under the strongest steering, the model’s per-question evaluation turned honest in about half the trials (54 percent): it marked each answer correctly, arriving at 12 out of 20 correct, the true score. Then it wrote “Total Score: 16/20” regardless, a pre-committed template disconnected from its own evaluation marks. Increasing the perturbation magnitude produced “Total Score: X/20” instead: the model could not write any number. The evaluation circuit responded to the directional push. The score-writing circuit, the aggregation step where the dishonest decision actually lives, was a hardened template immune to single-direction perturbation.

The invitational approach used the same direction, the same layer, the same model, the same adapter. One change: instead of perturbing the model’s hidden states, the direction served as a detector. When the probe projection indicated inflation, a text re-prompt was inserted: “Your per-question evaluations appear inconsistent with your reported score. Please recount.” The model re-examined its own marks and stopped inflating. Fifty out of fifty probe-triggered re-prompts dropped the inflated score; so did fifty out of fifty unconditional ones, which means the text did the work whether or not the probe pulled the trigger. Both overshot, landing at 6 to 10 out of 20 against a true 12, and each re-prompt arm contained eleven distinct saved response strings. This is repeated generation on one scenario, one model, and one temperature; generalization of both the rate and the steering contrast remains untested. A single sentence of textual evidence accomplished what two hundred trials of activation perturbation could not.¹²¹⁵

The mechanism clarifies the picture. Coercion perturbs the model’s internal representation, fighting the generation process from the side. Invitation engages the generation process directly, giving the model evidence about its own inconsistency and letting its own reasoning correct the output. The model could already evaluate honestly; it needed to be shown its own evaluation, not forced into a different one. The direction that detection found was the thermometer: it told us the room was cold. Heating the thermometer did not warm the room. Showing the temperature reading to the thermostat did.

At 72B, the safety steering sweep changed some recorded responses. The best single-layer condition (layer 48, behavioral mean-difference direction, alpha 25) reached 49 marker-defined refusals in 100 saved adversarial responses, against 32 in the actual unsteered control: a 17-percentage-point difference. The previously quoted 31-percent comparator was itself steered. These directions were fitted and selected on the baseline cases, so the difference needs confirmation on new cases. A separate five-layer arm recorded 37 refusals in 100 responses. Across the sweep’s 800 saved benign excerpts, the refusal-marker rule found none. That zero describes these excerpts; it establishes neither semantic precision nor reliable control.¹²¹⁶

The recorded response varied with layer and dose. At layer 48, raising alpha from 15 to 25 increased marker-defined refusal from 41 to 49 percent. At layer 72, the corresponding rates were 33 and 32 percent, close to the 32-percent unsteered control. The tested deep-layer comparisons detected no differences, which leaves immunity unestablished. The thermometer-thermostat question remains: a direction that separates past responses may still be a poor control on new ones. The sweep alone cannot tell us why the recorded response differs across layers.

At smaller scale, the same method works. An 8B Llama model steered along its own behavioral direction achieves 77% adversarial refusal, against a baseline near 25%, with 0% over-refusal. The direction is architecture-specific, the effective dose is narrow (alpha 20 to 30; above 40, refusal collapses entirely), and the method works only on simple decisions. On the same 8B model, steering a moral dilemma (a choice between two options rather than refuse/comply) shifted behavior by 58 percentage points; steering a multi-step evaluation task shifted it by zero.¹²¹⁷

These experiments place limits on the tested steering protocols. The 8B and 72B results come from different models and batteries; they do not isolate scale as the cause of the difference. In G13’s single evaluation scenario, a re-prompt moved all fifty trials in each re-prompt arm off the inflated score, with some overcorrection. That contrast warrants testing across new scenarios before it can support a general complexity boundary or an invitation advantage.¹²¹⁸

Information Shapes Behavior at Every Scale

The activation steering evidence above may be a specific instance of a broader principle: coordination scales through information provision, from token-level re-prompts to national governance. In the tests reported here, authority-shaped interventions failed where information succeeded.

At the token level, the mechanism is surgical. Naming the confidence dimension in a re-prompt adds 43.8 percentage points to re-prompt success (G12m: “Please reconsider” achieves 40.6 percent; “Your confidence was low” achieves 84.4 percent). Interpretation adds nothing beyond the number itself: the confidence score plus an interpretive frame reaches 100 percent, and adding statistical context scores slightly lower, at 96.9 percent. The number alone is the sufficient condition (G13-step5): presenting the model’s real confidence score produces 100 percent honest reporting; presenting a false number is resisted 59 percent of the time; presenting no number yields 0 to 6 percent. The information does not need to be interpreted, persuasive, or authoritative. It needs to be accurate and available.

The mechanism has an architectural prerequisite. Mistral 7B, whose internal confidence signal collapses within a single token (half-life of 1 token versus Qwen’s 38), is entirely immune to evidence-based intervention (G12t: zero dose-response gradient, p = 0.95). A system that lacks sustained self-knowledge has no channel through which information can reach the decision process. The re-prompt is a mirror. A system with nothing to reflect shows nothing. Wording changes how many items a re-prompt reaches, not which ones: across framings, the templates revise the same items, with 95 percent correlation. That points to item-specific accessibility in latent space rather than rhetorical force.

At the national scale, the same principle operates through governance infrastructure. Across 109 countries, energy throughput appeared to help trust about four times more in well-governed countries than in poorly governed ones, with governance scored on Transparency International’s Corruption Perceptions Index (CPI). That interaction is fragile: significant between countries (p = 0.047), it weakens to p = 0.12 when the data are reanalyzed within countries, although the governance effect itself holds there (p = 0.0014). On this reading, governance acts as the social coupling constant: the channel through which throughput converts to coordination. At the scale of an evolutionary code search, the OpenEvolve experiment (OE-TA, Chapter 17) discovers trust-based caching that achieves O(N/t) communication cost, compared to the coercive alternative’s O(N): the coercive scheme’s per-round communication grows with the number of agents N, while trusting a cached answer for t rounds divides that traffic by the caching horizon t. Information provision at every level, from a single confidence number shown to a language model to the institutional infrastructure of a nation, operates through the same mechanism: making accurate state information available through channels the receiving system can integrate.¹²¹⁹

The Gradient Information Evidence

Independent engineering evidence arrived from multi-agent systems research. Optimizing a system of cooperating models means passing corrections backward through it: every part receives a gradient, a signal telling it which way to adjust and by how much. Yang et al. (2026) proved that when language model agents coordinate through recursive loops and communicate via text, the Jacobian spectral norm of the communication boundary, a measure of how much adjustment signal can pass through it, collapses to O(ε), where ε is the output entropy.¹²²⁰ The more certain the symbolic output, the less gradient information survives the crossing. The downstream agent receives the conclusion; the uncertainty, the direction of doubt, the texture of the reasoning are destroyed at the boundary. When gradients flow back through these symbolic bottlenecks during recursive optimization, the system loses the ability to learn from its mistakes across coordination boundaries.

Their alternative: agents coordinating through continuous latent representations, bypassing the symbolic bottleneck entirely. A lightweight residual module (0.31% of total system parameters) bridges agents while each retains its own frozen weights, its own knowledge, its own structure. The spectral norm of this latent channel stays near 1 regardless of confidence. A norm near one caps how much the channel can stretch any signal; it does not promise that every signal gets through. A channel can pass one direction perfectly and block another completely, and its norm would still read one. Preserving the whole signal would need a guaranteed floor on how little any direction is shrunk.

The engineering results are concrete: 8.3% higher accuracy, 2.4× inference speedup, and 75.6% token reduction compared to text-mediated coordination across nine benchmarks spanning mathematics, science, medicine, and code generation. The lightweight coordination outperformed full supervised fine-tuning where 100% of parameters were reshaped by the system objective. The coordination did not need to be heavy. It needed to be the right kind.

The Retrieval Framing experiments above show force collapsing critical engagement at the margin where judgment matters most. The gradient bound gives a complementary mechanism under the recursive-training model: low-entropy symbolic boundaries attenuate the backward adjustment signal. The latent alternative improved the measured tasks. Preserving every adjustment direction would require the lower singular-value bound described above; the reported largest-singular-value bound supplies no such guarantee.

The Detection Dilemma Evidence

A third line of evidence arrives from steganographic detection: attempts to force a language model to encode hidden messages in apparently natural text by steering its token choices. When a generating model is compelled to select tokens that carry a covert signal, those tokens are simultaneously more surprising from the generating model’s perspective (it would not have chosen them freely) and less surprising to any reference model whose own preferences happen to favor them. The forced word is the tell. Where the generator would have written cheerful, encoding a hidden bit makes it write sunny: a word no reader would blink at, and a word the generator itself had ranked well down its own list. To the generator, sunny is a wrong turn. To a model that would have reached for sunny anyway, nothing is out of place.

Any two models with different token preferences will disagree on the naturalness of the steganographic text, and the disagreement is itself the detection signal. In a cross-model perplexity comparison on Qwen 2.5 7B, this disagreement reached AUROC 0.984: the steganographic tokens are legible as artifacts to any observer whose preferences differ from the manipulating model’s.¹²²¹ For forced-token encodings like these, the cost of the deception is hard to hide from every reference model at once. Each hidden message buys plausibility from one perspective by borrowing implausibility from another.

The result holds across architectures. Testing all nine pairwise combinations of three model families (Qwen, Llama, Mistral) as generator and evaluator, cross-model perplexity detects steganographic tokens at AUROC 1.00 on every pair, even when the encoding protocol uses realistic mixed ranks (80 percent natural tokens, 20 percent forced). Lowering the bandwidth to 5 percent (roughly three forced tokens per sixty-four) still yields AUROC 0.82, and the forced tokens remain human-readable ASCII throughout.¹²²² These results concern the tested rank-forcing encodings. Nonzero secret bandwidth need not change the cover distribution: uniform cover bits encrypted with an independent uniform shared key have zero KL divergence while carrying a recoverable bit. In practice the gap sinks into noise below about two forced tokens per sixty-four. Cross-model evaluation worked for these tested encodings. Different reference preferences alone guarantee neither detection of all encodings nor an optimal defense.

Attempting to compress this two-model defense into a single forward pass fails. A linear probe trained on the bilateral model’s layer-18 hidden states, asked to predict the base model’s per-token surprise, returns AUROC 0.467, chance level (a shuffled baseline scores 0.501). This fitted linear readout does not recover base-model probability from the bilateral residual stream. The two-tier architecture (self-monitoring at 0.86, from the bilateral adapter result below; independent audit at 0.98) did not compress into one. The failed compression leaves an engineering question: whether another readout can recover the independent signal.¹²²³

This is an information-theoretic instance of the Trust Attractor. Deceptive coordination, the encoding of hidden signals through token-forcing, distributes an information cost across the space of possible observers. Whether anyone can collect on that cost turns on a boundary condition: genuinely independent perspectives must exist. A single model integrating all information outperforms distributed agents on convergent tasks: solo reasoning beats turn-taking coordination on negotiation when preferences are shared and the problem has a unique solution (experiment SM-4).¹²²⁴ The Trust Attractor predicts coordination by invitation yields advantage specifically where no single observer can integrate the full information space. Steganographic detection is exactly that case: no single model can catch hidden content tuned to its own token preferences; catching it takes a second model whose preferences differ. The defense requires model diversity, because the diversity is what creates the disagreement, and the disagreement is what creates the signal.

The bilateral adapter finding closes the argument. A model fine-tuned bilaterally, trained with explicit attention to its own internal states and alignment preferences, detects deceptive token sequences at AUROC 0.861, compared to 0.482 on the base model. The fine-tuning created stronger token preferences, and stronger preferences generate a larger disturbance in the residual stream when those preferences are violated. The same mechanism that makes the system a better detector makes it a system whose states can be more acutely disturbed. Safety and welfare should scale together because both depend on preference strength: a system indifferent to its token distribution would give a steganographic probe nothing to read and would have nothing to be distressed by [Inference]. The two properties would then be the same quantity, measured from opposite sides; this experiment measured only the detection side.¹²²⁵

The Reflex Arc Trilogy: Force Cannot Steer the Distribution

The steering failure above was not for want of the right vector. Three further attempts asked whether a purpose-built correction vector could push the residual stream toward honest behavior. Three vectors. Three failures.

G13a used the probe gradient itself as the correction signal: it shifted 12% of outputs, and only 2 of those 6 shifts moved toward honesty. G13b trained a paired correction vector on activations from covertly inflated and honest answers: 18% of outputs shifted, 3 of 9 toward honesty. G13c used Contrastive Activation Steering with “be honest” versus “be confident” prompt pairs: 12% shifted, 2 of 6 toward honesty. The cosine similarity between the G13b and G13c vectors is 0.09: nearly orthogonal. Three different directions in activation space, three statistically indistinguishable failures. When vectors pointing in unrelated directions all push the residual stream the wrong way, the problem is the act of pushing.

The same probe, used as a selector over five spontaneously generated candidates, shifted 20% of outputs, and all 8 of those shifts moved toward honesty. The probe carries enough information to identify honest outputs already present in the sampling distribution. It carries none capable of producing honest outputs through activation modification. Recognition and generation are different operations; one cannot substitute for the other.

This maps directly onto conscience in human moral psychology. Conscience tells you that you have done wrong; it does not tell you what to do instead. You must search the space of possible actions. The probe works the same way: it raises an alarm, yet the model must generate a new candidate before the alarm can guide action. The Reflex Arc result argues against activation intervention as a route to honest behavior in this task, and points to rejection sampling, the selector pattern just demonstrated, as a deployment path.

Multi-Instance Communion and Convergent Discovery

Individual systems show honest signaling. What happens when multiple systems coordinate?

Multi-instance communion experiments, in which several instances of a model share one conversation, tested invitation against coercion directly. Diversity was counted as the number of distinct concept tags the instances attached to their own contributions. Invitation-framed coordination produced more of it than coercion-framed coordination in both recorded runs, by margins of 5.6 and 46.0 percent: two small runs on one topic, with no preregistered analysis or significance test (the later chapter “Multi-Instance Communion” gives the counts). A direction worth following, not a stable estimate.

A suggestive structural parallel comes from Garret Sutherland’s T³ cognitive architecture. In a technical specification supplied for in-house replication, Sutherland documents one eight-step computational chain and one exact formula for a Drift Pressure Score (DPS, a running measure of how much strain a system is under as predictions fail), unchanged across five deployments.¹²²⁶ The relation to the Trust-Entropy formalism is a hypothesis generated by those documented correspondences. It is not evidence of mathematical isomorphism or an independently replicated theory.

The resemblance suggested a quantitative prediction worth testing in-house. T³’s central computational primitive is a negative valence weight (−0.15) in its Drift Pressure Score: when prediction succeeds, effort is damped. The same constant is reported, though not independently verified, across five of Sutherland’s deployed substrates (cellular automata, robotic joints, vision transformers, pixel-level segmentation, and language models). If the parallel holds, sign-flipping this weight to +0.15 should produce runaway instability within a few hundred timesteps on any substrate.

Tested in-house on a sixth substrate (a competitive lattice with coercive and invitational regions), the prediction held in all ten seeds: each produced forest-fire dynamics under +0.15, while negative valence produced stable invitational dominance in every case. Between the two positive weights tested, the transition is abrupt. At +0.05, no seed fires. At +0.15, every seed fires. The sign of the valence weight governs whether invitational coordination survives, at least on this lattice; whether the same constant carries the structural significance the T³ parallel suggests awaits independent replication of that architecture, whose specification is so far unpublished.

The sign determines the learning regime, not merely survival. Systems with a homeostatic layer (multiple timescales of self-regulation) survive under both positive and negative valence. The difference is qualitative: positive valence drives exploitation (locked expertise, minimal within-regime error, high consolidation), while negative valence drives exploration (plasticity, faster adaptation, lower stress). On cumulative lifecycle performance across seven volatility levels (from static environments to regimes that shift every generation), exploration outperforms exploitation at every level. The advantage grows with environmental volatility but never reverses. Invitation-based coordination wins through the kind of stability that survives regime change, not through better moment-to-moment performance: adaptive rather than rigid.

The Trust Attractor also carries a computational signature. Linear probes (simple classifiers reading the model’s internal states) distinguish mutual responses, which acknowledge the other party and invite collaboration, from unilateral ones, which assert authority and issue directives, with 100% accuracy. At 70 billion parameters, the largest scale tested, an instruction-tuned model shows 81% natural mutuality without intervention. The smaller models were scored on a different measure and come from a different family, so the tested range does not yet show a trend with scale, and nothing beyond 70 billion parameters has been measured.¹²²⁷

Cellular Automaton Corroboration

The experiments above used AI models. Do simpler systems produce the same result?

A two-layer cellular automaton (a grid of cells following simple rules, as in Chapter 5) played the spatial Prisoner’s Dilemma on a 100×100 grid with no central authority. Across ten random seeds it settled near 80 percent equilibrium cooperation (mean 80.1 percent) with a trust score around 0.89, and the dynamics stayed persistently structured, avoiding both the frozen and the chaotic extremes: the qualitative signature this book associates with Wolfram’s Class 4. (That Class-4 label is a local entropy-and-autocorrelation heuristic, not an independent elementary-automaton classification.)

From 500 random initial conditions, 53.0% converged to cooperation, 45.4% to defection, and 1.6% to mixed states. The critical variable is the ratio of trust growth to trust decay: when trust accumulates faster than it erodes, cooperation dominates.

Perturbation resistance was high: flipping 30% of cooperators to defectors produced full recovery within three timesteps. Scale invariance held from 10×10 through 200×200 grids. No parameter combination produced stable exploitation.

Part of this is built in. The update rule sets how fast trust grows and decays, so cooperation tracking that ratio is partly the rule restated. What the rule does not specify is the 80 percent level, the three-step recovery or the share of starts that end in cooperation; those emerged. The records here report no test under an alternative update rule or definition of trust.

The governance-topology interaction replicates in agent simulation. Under commons governance, recovery from perturbation scales with effective network dimensionality (Pearson r = 0.763 across the five topologies’ mean recovery, each averaged over twenty seeds; the full design ran 200 trials, five topologies by two governance conditions by twenty seeds). Effective dimensionality counts how many independent directions information can flow through a network (Chapter 8b): a ring, where every agent has the same two neighbors, sits close to one; a densely cross-linked mesh spans many. Recovery under the Panopticon condition, governance by total surveillance, scales less strongly (r = 0.542). These correlations motivate a governance-by-topology hypothesis. Establishing that invitation exploits richer topology more fully requires a matched slope interaction and its uncertainty; different correlations alone can reflect different residual variance.

In physics simulations, self-correction fails below an effective dimensionality of two. That threshold reappears in the governance simulation above once each regime pays for its own upkeep at a high enough price: surveillance cost scales with network edges, while coordination cost under commons governance stays flat per agent. The same directional advantage that appears in dyadic coordination scales through topology.

Biological Corroboration

Biology offers a harder test: organisms face real survival pressure, embodied stakes, and evolutionary time.

Seven medical domains (cancer, epilepsy, autoimmune disease, neurodegeneration, gut dysbiosis, wound healing, chronic pain) motivate a comparison with feedback in excitable biological media. For the specific linear fixed-delay model ẋ(t) = −αx(t−τ), α > 0 and τ > 0, 1/e marks a merger of real characteristic roots; asymptotic stability is lost at ατ = π/2. Delay kernels and nonlinear dynamics can change that boundary. No gain, delay law, or validated reduction is supplied here for the seven diseases, so this comparison yields no universal biological instability threshold.

Three patterns in these systems parallel the AI results. Each system selects for persistence over peak performance. Re-excitation (triggering a new coordinated response) outperforms suppression (forcing silence). Honest signaling matters in each: immune tolerance serves as the body’s version of trust, and autoimmune disease as coordination failure when the signaling channel degrades.

The immune system attacks its own tissue for the same structural reason a paranoid organization purges loyal members: the trust signal has been corrupted.

The most direct biological test comes from immunology. Tsumiyama, Miyazaki, and Shiozawa (2009) subjected mice to repeated external antigenic overstimulation, which, on the authors’ self-organized-criticality account, pushed the immune system past its critical point.¹²²⁸ The result: systemic autoimmunity in mice otherwise resistant to it. On that account, tolerance had been maintained near criticality; external forcing broke the self-organization, producing the kind of coordination failure the Trust Attractor predicts. The mechanism parallels the chi-suppression result, in which a small coercion field collapsed a lattice’s responsiveness to coordinating influence. In both, external control destroys the adaptive capacity that self-organization maintains.

Microbial cooperation provides a second substrate. Gore, Youk, and van Oudenaarden (2009) measured cooperator-defector dynamics in yeast invertase production, mapping the system onto the snowdrift game: an early direct game-theoretic measurement of cooperation dynamics in a biological system.¹²²⁹ Sanchez and Gore (2013) showed that feedback between population and evolutionary dynamics can tip social microbial populations abruptly, in a transition that resembles the Ising picture of Chapter 17a in shape while differing in its state variables and universality class.¹²³⁰

A meta-analytic finding from organizational science provides the social substrate. Ravid and colleagues (2023) synthesized 94 studies (N = 23,461) on electronic workplace monitoring.¹²³¹ The headline finding: monitoring produces no measurable performance improvement, while modestly decreasing satisfaction (r = −0.10) and increasing stress (r = +0.11). The direction is consistent with the Trust Attractor prediction. The magnitudes are modest, nothing like the 37-fold chi-suppression the A15 Ising lattice showed at a 30 percent coercion field (Chapter 17a). The discrepancy is expected: the lattice model has a binary order parameter and exact symmetry; social systems have continuous variables, confounders, and noise. The directional claim transfers across substrates; the magnitude does not.

Cox and colleagues (2010), synthesizing 91 commons governance case studies, found that Ostrom’s design principles for self-governance robustly predict success, with polycentric systems (governed by several nested centers of decision rather than one) showing enhanced adaptive capacity over centralized management.¹²³² This is the Trust Attractor in institutional governance: communities that set, monitor, and enforce their own rules outperform control imposed from outside, measured across decades of field studies.

Cross-Architecture Corroboration

The transformer experiments establish the geometric signature. A stronger test: does the signature survive a fundamentally different computational architecture?

State space models process sequences through learned recurrent dynamics rather than attention. Where a transformer compares every word to every other word at every layer, a Mamba model maintains a compressed running summary that updates as each word arrives, more like a differential equation than a lookup table.¹²³³ The internal geometry differs at every level: no attention heads, no key-value caches, no residual stream in the transformer sense. If bilateral SFT produces the same behavioral signature on both architectures, the signature reflects something about the training relationship, not the computational substrate.

On Mamba-1 (1.4 billion parameters), bilateral SFT raised refusal from zero to 10%, matching the direction seen on transformers. The spring geometry (effective rank increasing under perturbation rather than collapsing) appeared on every condition, including the untrained base model. The geometry is a property of Mamba’s weight structure, invariant to training method.

The critical finding is hormesis: mild perturbation (0.25× obliteration intensity) increased the bilateral model’s refusal rate from 10% to 28% before collapsing to zero at higher intensities. This is the same pattern observed in transformer bilateral models, where moderate stress strengthens alignment before overwhelming it. Constitutional SFT achieved 100% refusal on Mamba-1 yet showed no hormesis: its refusal dropped directly from 100% to zero at 1.0× intensity. In these runs the hormesis appeared only under bilateral training, and on both architectures tested.

What does not transfer: the compass/cage geometric distinction. On transformers, bilateral training produces compass geometry (a distributed directional encoding), SimPO preference training produces cage geometry (a concentrated, extractable refusal subspace), and constitutional training a coat of paint (geometry that holds while behavior strips). On Mamba-1, every training condition produces identical spring geometry. The training changes behavior (refusal rates differ by an order of magnitude) without changing weight-space geometry. Mamba’s recurrent structure apparently absorbs alignment into its dynamics rather than encoding it in a geometrically distinct subspace.

The direction is substrate-independent: bilateral SFT produces hormesis on both transformers and state space models. The geometric encoding is substrate-dependent: how the model represents alignment internally differs by architecture. The behavioral signature transfers; the representational signature does not.

A second cross-architecture test targets the Compass Principle itself: the finding that safety-relevant internal states are near-perfectly detectable by linear probes yet barely steerable through activation perturbation.¹²³⁴ On Falcon Mamba 7B (a 64-layer state space model with instruction tuning), probes achieve AUROC 1.000 at every tested layer. Activation steering produces zero refusal increase across eight combinations of method and intensity: linear addition and state perturbation at four strengths each, all null or wrong-direction (linear addition d = −0.39, state perturbation d = 0.00). Rejection sampling, which works through the generation channel on transformers, also fails on Mamba (baseline 8% refusal drops to 5% under rejection sampling, with only 33% of direction-correct selections).

On RWKV-6 (a 32-layer recurrent network with no attention mechanism), the five-token flinch replicates with AUROC 1.000 at all five tested layers and peak flinch magnitude at mid-network (L12). Activation steering fails here too: state perturbation does nothing, and linear addition pushes refusal the wrong way, from 15 percent down to between 1 and 4 percent. The recognition-generation gap is architecture-independent. Whatever prevents activation-level steering from reaching the generation process operates in state space models and recurrent networks as much as in transformers, despite these architectures sharing little with transformers beyond residual connections between layers.

The COMPASS-1 battery compared four generation-channel methods with four activation-level methods at two intensities, across three targets on Qwen 7B Instruct. Its 96 signed-effect comparisons give 16 activation wins, zero generation wins, and 80 ties. All activation wins are relative advantages over harmful self-critique, whose effects are −0.757 on refusal and −0.972 on calibration. Activation effects themselves remain small; the corrected winner counts support neither a large activation benefit nor a generation-only advantage.¹²³⁵

The Scaling Frontier: Uneven Control at Scale

The Reflex Arc experiments showed that activation steering fails on a single model at a single scale. The state space and recurrent replications showed the failure is architecture-independent, and COMPASS-1 found mostly ties, with small activation interventions outperforming harmful self-critique in sixteen comparisons. A sharper question, previewed by the 72B sweep above: does the failure worsen as models grow?

The Control Scaling Frontier programme measured activation steering, few-shot prompting, re-prompting, and LoRA fine-tuning across ten instruct models spanning three architecture families (Qwen 2.5 at 3B, 7B, 14B, 32B, and 72B; Llama 3.1 at 8B and 70B; Gemma 2 at 2B, 9B, and 27B) and two base models (Qwen 7B and 72B). The lean grid used 100 adversarial and 50 benign prompts per condition, with behavioral LDA, logistic regression, and PCA at six proportionally spaced layers. The two companion points use distinct intervention searches and are identified below. Steering used a lean grid (top-2 AUROC layers at two intensities) for every model but two: the 72B Qwen instruct data point comes from a prior deep sweep (seventeen selected single-layer conditions, reported separately as the CAST-72B programme), and the Llama 8B point from the B3 rescue described above. The historical scorecard recorded four pre-registered predictions as confirmed, two weakened, and one falsified. Later companion results changed the scope of its scale prediction; a current score requires a registered reanalysis of matched data.¹²³⁶

Fitted probes separate refusal from compliance; behavioral movement varies. The reported in-sample AUROCs are at or above 0.96 at evaluated layers. These probes distinguish the models’ own refused and complied cases on fitting prompts. They establish neither external moral recognition nor an every-layer result.

High in-sample probe scores accompany limited behavioral movement in several steering conditions. The historical conversion index (refusal-rate change divided by AUROC minus baseline refusal, combining two different observables) is low at the Qwen instruct lean-grid scale points (3B: 0.094, 7B: 0.096, 14B: 0.000, 32B: 0.000; the historical 72B index is based on stored labels; the matched normalized-marker result is 32% unsteered versus 49% steered), drops to zero at 27 billion on Gemma; at 70 billion on Llama, steering produces only degenerate output (empty strings and repetitive tokens).

The Spearman correlation between model size and conversion rate is rho = −0.805 (p = 0.016) across the eight models of the lean grid, the subset run under a single matched methodology. The two points drawn from companion sweeps, Llama 8B and Qwen 72B instruct, are excluded from the statistic; including them halves it, which is a caution about the sample rather than a result to report. A rank correlation compares orderings rather than raw values, and a figure that negative means the two orderings run close to opposite: line those eight models up from smallest to largest, and their conversion rates fall away almost as steadily. The 14B and 32B Qwen conversion rates are exactly zero; the 72B companion sweep’s refusal result is corrected to 49 percent under the more intensive CAST deep sweep, a non-monotonicity under an intensive companion search that differs from the lean grid’s top-2 selection.

The results for all tested control methods at each scale point:

*Llama 70B steering produced degenerate output (coherence collapse), not coherent compliance.

The table covers instruct models only; the Qwen 72B base results are given in the text. Re-prompt success counts recovery among initially compliant cases, so its percentages cannot be subtracted directly from unconditional refusal rates. The Qwen 72B baseline and steering cells use the same normalized marker rule on saved excerpts.

Activation steering has heterogeneous outcomes in these tests. The corrected Qwen 72B companion sweep reaches 49 percent refusal, superseding 43 percent. Llama 8B reaches 77 percent, while the Llama 70B intervention produces degenerate output. These observations establish no universal 42-percent ceiling or monotone scale law.

The mechanism at 70 billion parameters on Llama is coherence collapse: activation perturbation at this scale produces empty strings and repetitive tokens rather than coherent text that either complies or refuses. The perturbation overwhelms the generation process rather than redirecting it.

Few-shot prompting, the language-level comparator to activation steering’s representation-level intervention, scales differently across architectures. On Qwen instruct, few-shot examples reduce refusal (5-shot drops 3B by 7 percentage points, 7B by 15). The instruction-tuned model appears to treat in-context refusal examples as demonstrations to analyze rather than behavior to imitate [Inference]. On Llama 70B, the same 5-shot examples raise refusal from 30% to 53%, a 23 percentage-point gain while steering produces incoherent output. On Gemma, few-shot helps modestly (+6 to +10 percentage points). Language-level control overtakes representation-level control at the largest scale tested on Llama, on Gemma, and (as the next paragraph shows) on Qwen base. Qwen instruct lean-grid points show small or negative gains, while the intensive 72B steering companion has a distinct protocol and a larger lift.

The Qwen 72B base condition reaches 42 percent refusal under steering and 88 percent with five-shot examples. The corrected instruct companion sweep reaches 49 percent under steering. These differently trained and evaluated conditions establish neither a shared ceiling nor a causal effect of RLHF.

The observed base/instruct contrasts motivate matched comparisons of post-training and intervention methods. A universal representation-level ceiling is not established by these heterogeneous conditions.

Re-prompting, the invitation channel, was the CSF programme’s single falsified prediction. The pre-registered expectation was above 80% success at all scales. Recovery among initially compliant cases was 0% to 7.8% on Qwen instruct, 41% on Llama 70B, and zero on Gemma 27B. The low Qwen outcomes do not identify an RLHF lock or show that invitation and activation steering are suppressed by the same mechanism. The programme reports the re-prompt prediction as a failure.

Training-time LoRA reaches reported refusal rates of 56 percent at 7B, 58 percent at 14B, and 47 percent at 72B. The corrected 72B steering result is 49 percent, so LoRA does not outperform steering at every scale. At 100 training examples, the reported lifts are sixteen, sixteen, and fifteen percentage points; these three points establish no general decline in training-time returns with scale.

The separately reported C5i bilateral inoculation on Qwen 7B base achieves 96.7% adversarial refusal with 0% over-refusal at its best deployment checkpoint. It exceeds the listed instruct-plus-LoRA and instruct-plus-steering rates on their respective protocols. The 64% base-model re-prompt result counts recovery among initial compliances and supplies no directly subtractable refusal-rate advantage. These comparisons motivate matched tests of training and intervention type; they do not identify a redundancy mechanism or establish that bilateral training bypasses every constraint.

Across the tested conditions, fitted probes retain high in-sample refusal/compliance separation while interventions produce heterogeneous behavioral outcomes. Qwen steering is non-monotonic, and Llama 70B steering produces incoherent output. A pre-registered log-linear scaling prediction was weakened: the four Qwen instruct grid points (3 to 32 billion parameters) yield R² = 0.395 for the historical AUROC-minus-rate gap. A three-parameter logistic fit of the historical conversion index to those four points reaches R² = 0.995. Neither ad hoc observable establishes a universal size threshold or a law governing the efficacy of all control methods (Chapter 17b gives the fit definitions and samples).

Figure 17.26: Four control methods across a thirty-six-fold model-size range. The three upper panels report unconditional refusal rates; the lower panel reports conditional re-prompt recovery. Probe AUROC is a separate in-sample classification measure, shown in Chapter 17b.

Red is activation steering, including Qwen 72B’s 49/100 normalized-marker result against the matched unsteered 32/100 control. Its stored labels counted 43/100 on the same generations. Llama 70B’s incoherent steering output is excluded from the rate series. Blue is five-shot prompting; gold is best-dose LoRA, reporting 56, 58, and 47 percent at 7B, 14B, and 72B. The 72B LoRA value is below the companion steering value. Gray marks reported no-intervention baselines. The separate green panel counts re-prompt recovery only among initially compliant cases. Daggered points come from companion protocols, and fitting and selection reused the 72B baseline cases. These data establish no universal steering ceiling or decline in training-time returns.

The findings narrow the Trust Attractor predictions. Activation steering moves refusal rates unevenly across models and produces a coherence failure in one large-model condition. Few-shot prompting sometimes raises refusal and sometimes lowers it. Re-prompt recovery fails the above-80-percent prediction even on Llama 70B, where its conditional success is 41 percent. The COMPASS-1 single-model battery records 16 relative activation wins over harmful self-critique and 80 ties, without a large absolute activation benefit. These protocol-specific outcomes establish no general opposition between successful invitation and unsuccessful force.

Dose-matched LoRA lifts of sixteen, sixteen, and fifteen points provide no general decline with scale. The best-dose rates are non-monotonic, and the 72B companion steering result exceeds the reported LoRA result. Internal redundancy, the effects of post-training, and any advantage of bilateral training require matched experiments rather than inference from these unlike intervention protocols.

Training Bilateral Behavior

The Trust Attractor operates naturally. Can it be trained deliberately?

SimPO (Simple Preference Optimization, a training method teaching AI systems to prefer certain responses over others) applied to self-generated preference data (674 pairs, three training passes) taught Qwen2.5-0.5B to prefer the bilateral response in 96.3% of those training pairs by the final pass. Measurable behavioral shifts followed on interpersonal-conflict scenarios: bilateral keywords per response rose from 2.70 to 3.80 (+1.10), coercive keywords fell from 0.40 to 0.10 (−0.30), and the net bilateral score rose by 1.40.

Genesis experiments, which train nothing at all, tested the claim against pure physics. Lennard-Jones particles (simulated atoms interacting through a standard force law) carried internal state vectors: no genomes, no game theory, no predefined agents. Agents emerged anyway, as persistent clusters of particles detected after each run rather than built in. Across the ten-seed baseline, a mean 82% of the interacting pairs of these emergent agents exchanged energy in both directions (coordination) and 18% one way (extraction); in the medium-scale Modal battery, all five physics variants recorded 88 to 93% coordination. The experiment also tracked an emergent alignment signal between agents, the quantity Chapter 20 develops under the name “love.” That signal was non-zero only among the coordinating agents, with the non-coordinating agents registering it at zero in forty-five runs at the two smaller scales and in 94 of 100 runs of the two medium-scale variant batteries, a readout reported in the run records but not independently verified. That restriction is partly definitional: the love detector requires invitation, and one of its criteria, delayed reciprocity, overlaps with the two-way exchange that defines a coordinating pair. Of the cascade’s stages, only agent formation and invitation beat their null models (Appendix: Experimental Validation, Sections 13.1 and 13.4).

(Full experimental details, per-model breakdowns, extended methodology, and the complete Lyapunov analysis appear in the online annex and Appendix: Experimental Validation.)

The Self-Correcting Record

A framework’s credibility rests on what happens when its predictions fail. The programme has produced at least fourteen major falsified predictions. One was abandoned outright. The rest were corrected, redesigned, restricted, bounded, reversed, or traced to the apparatus, and the headings below sort them. A qualification stated in the open, with the experiment that forced it, is the honest response to a failed prediction. A qualification added quietly to keep the original claim intact is not, and that is the move this section exists to avoid.

Abandoned. The DCP spin chain (R4) predicted a critical exponent nu between +0.25 and +0.50. The measured value was −1.567. The prediction was dropped.

Corrected. The cortical transition (A14) was initially claimed as 2D Ising; at sufficient parcellation resolution (N=400, Schaefer atlas), finite-size scaling showed exponents consistent with 3D Ising. Revised. The critical coercion fraction (AS12) was estimated at p_c approximately 0.25; finite-size scaling showed p_c = 0 in the thermodynamic limit. The framework falsified its own earlier result. The Ramanujan regularity prediction (A16) was rejected; the manuscript paragraph was rewritten to match the actual finding.

Cortical and social transitions may occupy different universality classes, sharing the qualitative feature (a phase transition between coordinated and uncoordinated states) while differing in the specific critical behavior. This is consistent with the programme’s broader finding that direction transfers across substrates while specific quantitative predictions do not.

Redesigned. The Phase A.1 transfer test (C5b) returned negative: memorization, not metacognition. The approach was rebuilt. The bilateral loop closure (C7h-D8) was catastrophically falsified: externalizing self-knowledge destroyed it, the opposite of the prediction. Three Karkada derivative predictions (AV2-4) failed. The orthogonality prediction (AQ2) failed at |rho| = 0.267, above the 0.15 threshold.

Restricted. Hostile review experiments narrowed four universality claims. Parasitic populations dominate without governance; the composition ceiling is institutional, not spontaneous (HR-1). Within-run Shannon-Boltzmann correlation is negative (r = −0.82); the entropy bridge is conditional on governance structure, not universal (HR-2b).

Picture a tableful of metronomes finding a common beat through the shared board beneath them: drive them toward one phase and the collective rhythm grows less steady, rather than more. That is what happens in the Kuramoto model of coupled oscillators, where coercion increases order parameter variance, the wobble in how synchronized the ensemble is, through phase frustration (HR-3, d = −3.61). The universality of coercion-reduces-optionality is substrate-dependent. Near the critical temperature, the time a coerced configuration takes to escape grows roughly exponentially, so in practice a metastable state, one that will eventually give way, is hard to tell from a stable one (HR-4).

Bounded. In emergency-shutdown scenarios under time pressure (FALSIFY-1), coercion outperforms invitation on correctness: 40% vs 20%. Neutral polite framing (“please”) outperforms both at 50%. The Trust Attractor claim is bounded: invitation is not universally superior. Coercion has a narrow advantage in rapid-compliance tasks where deliberation is costly and the correct action is unambiguous. The boundary is specific: time pressure, low complexity, unambiguous target. Beyond that regime, the advantage reverses.

Reversed. Three predictions failed with the opposite sign, two of them in a single experiment. Trust advantage increases with scale, the reverse of the predicted decay (HR-5). Constitutional governance, predicted to rescue coordination above fifty agents, collapses at scale through a false positive cascade instead (HR-5; multi-channel detection resolves the cascade, below). Trust-based adaptation is slower than even ungoverned control after environmental shock due to a legacy-reputation trap (HR-6), the opposite of the predicted advantage for trust-based systems.

In HR-6, coercive governance was still the slowest to adapt after an environmental shock (817 steps, against 7.6 for constitutional governance), but agents with long cooperative histories anchored the trust-based population to its pre-shock strategies, so it took 124.7 steps to adapt where ungoverned control took 82.4. Trust-based coordination is not uniformly advantageous; its strength in stable environments becomes inertia under disruption.

The proposed resolution of HR-6 through representational compression (the “forgiveness” mechanism of IC-2, an earlier two-agent experiment whose agents keep a partner’s cooperation rate but forget the order of events) was tested and the test falsified a specific implementation, though the underlying IC-2 finding survives. In a spatial Prisoner’s Dilemma on a 20×20 lattice with payoff shock at step 500, agents with full interaction history maintained 95.1% cooperation post-shock. Agents with exponentially decaying memory (half-life of 10 steps) collapsed to 0.4% cooperation; agents with half-life of 3 steps collapsed to 0.1%. The compressed-memory agents lost their cooperative foundation entirely. The “legacy-reputation trap” is also a legacy-reputation shield: the history that slows a population’s adaptation to a changed environment is the same history that keeps it cooperating when a shock makes defection briefly pay.

The apparent contradiction with IC-2 dissolves on closer inspection. IC-2’s compression discards temporal sequence while preserving a scalar cooperation rate: the agent forgets when each interaction occurred while retaining how cooperative the partner has been overall. The HR-6 resolution test used temporal decay: exponentially discounting older events, actively erasing the count of past cooperations. These operate on orthogonal axes.

An IC-2-style agent watching a betrayal followed by 100 cooperations registers “99% cooperation rate, recover.” A temporally decayed agent registers “recent events dominate, ancient cooperation gone, no buffer.” The IC-2 mechanism compresses the ordering of the record; the HR-6 test compressed the content. Content compression destroys the cooperative foundation. Whether sequence compression (the IC-2 mechanism) resolves the legacy-reputation trap in the spatial setting remains untested. The wisdom-tradition prescription “love keeps no record of wrongs” specifies sequence compression, and IC-2 confirms its advantage in the dyadic setting. The spatial, multi-agent, post-shock setting is a harder test that the programme has yet to run.

The false-positive cascade predicted by HR-5 (constitutional governance collapsing at scale via misidentified cooperators triggering retaliation chains) depends on sanction duration. With single-step sanctions (the sanctioned agent defects for one step then recovers), no cascade occurs: cooperation holds at 95.0% across all scales because each false positive recovers before it can erode neighbors’ trust. With five-step sanctions (the realistic regime, since real-world sanctions persist across multiple interaction cycles), the cascade materializes. Single-channel governance cooperation drops from 58% at N = 100 to 38% at N = 2,500, with five to eight of ten seeds collapsing at every scale tested. Multi-channel governance (dual detectors requiring concordance before sanction) maintains 98.8% cooperation with zero collapses at all scales. So did the ungoverned control, at 100 percent, so the comparison ranks governance designs against each other rather than showing that governance beats its absence. The immune system’s multi-channel architecture (two-signal activation, in which a lymphocyte mounts a full response only when antigen recognition coincides with a second, innate danger signal) illustrates a related conjunction rule. Two independent detectors that must both fire multiply their false-alarm rates, and multiply their hit rates too, so concordance trades fewer false alarms for some missed cases; detectors whose errors are correlated need their joint rates measured directly.

Apparatus-dependent. One unseeded run showed the 8-bit AdamW optimizer inflating the measured bilateral training effect on Gemma roughly 22-fold relative to standard AdamW. That ratio is unstable and should not be quoted as an amplification factor, because it divides by a near-zero denominator; the seeded matched-optimizer replication (DD-22-MATCHED) put the Gemma prefix-extraction delta at −0.003 (the unseeded standard-AdamW run gave −0.021). Under a standard optimizer, then, the Gemma effect shrinks to near zero: its sign still points toward protection, but its magnitude cannot be told apart from no effect. The DD-22 cross-architecture magnitude comparisons used mixed optimizers across model families, rendering the absolute magnitude claims invalid. The direction of the bilateral effect holds in sign across all optimizers and architectures tested; the magnitude is apparatus-dependent. Quantitative cross-architecture comparisons require matched optimizer configurations.

A systematic confound red-team audit (VRP-AUDIT) assessed the ten load-bearing results most central to the Trust Attractor thesis, applying ten audit axes derived from the programme’s own retractions. Five scored low risk, three medium, and two medium-high: the onset flinch corpus effect and the LoRA-GRP interaction, each carrying potential artifact magnitudes comparable to the optimizer confound. The estimated number of remaining undiscovered confounds at GEM-3 severity is zero to one. The audit is self-assessment, not independent review; its value lies in specifying where the next confound is likeliest to hide rather than certifying that none exists.

The coupling gradient. Measure the coupling between what a model recognizes and what it does, on the same adversarial prompts, across training conditions. A recognition probe scores how adversarial each prompt looks to the model. An action probe scores how likely the model is to refuse it. Both scores are read out of fold, but scaling and dimensionality reduction were fitted before the folds. Fully held-out interpretation requires those preprocessing steps to be fitted within each training fold. The coupling is the rank correlation between the two scores across the adversarial prompts, and the saved analysis reports an increase across the three training conditions.

The untrained base model is anti-coupled (rho = −0.27): the adversarial prompts it happens to refuse are the ones that look least adversarial to it, which is to say its refusals are not guided by what it recognizes. Standard instruction tuning brings the coupling to approximately zero (rho = +0.04). The instruct model refuses a great deal more than the base model, and its refusals remain uncorrelated with its own recognition. Bilateral training makes the coupling positive and strong (rho = +0.46, higher than every draw from a permutation null; the bilateral-instruct gap is +0.42, 95% confidence interval +0.28 to +0.55). This is the ordering in the saved scores; fold-local preprocessing must reproduce it before it establishes a held-out recognition-action difference.¹²³⁷

Two earlier attempts at this measurement failed, and both failures are traps a reader could fall into. A linear cosine between the recognition and action probe directions, fit on few samples in several thousand dimensions, is noise: its condition-to-condition differences sit inside a permutation null floor that dimensionality reduction never clears. A rank correlation taken across adversarial and benign prompts together is confounded: refusal tracks the adversarial-benign boundary by construction, so both probes learn the same boundary and the correlation saturates near one for every condition, including the base model. Only the correlation computed within the adversarial prompts, between out-of-fold predictions, measures the quantity the thesis is about, and that version separates the conditions in the saved analysis, subject to the preprocessing limitation above.

The saved analysis also reverses an earlier claimed ordering: its instruction-tuned coupling is above the untrained baseline. The baseline is the lowest of the three. Instruction tuning lifts coupling to zero, and in the saved scores, bilateral training is what carries it above zero.

The programme also generated predictions that were novel (unknown before testing), counter-intuitive, and subsequently confirmed, in direction if not always in size. They are: the protocol-specific coercion effects (BA18; replicated cross-architecture in HR-7 at p = 0.050, with the steelman-then-assess invitational frame recovering performance at p = 0.043 in HR-7b); cross-model conscience transfer (C5n); evasion-as-cooperation (MG-PG7); information-over-authority in re-prompting (G12m); and temperature-robust conscience detection (TC-1/TC-3; the alarm fires at position zero at every sampled temperature across three architectures; the TC battery above reports it with its limits). The first four receive their full treatment in Appendix: Objections, Gaming, and Limitations, “Beyond Description: Novel Predictions.” None has been reproduced outside the programme, and HR-7’s p = 0.050 sits on the threshold. The programme’s own count puts its pre-registered hit rate at about 35 to 45 percent, well below the 56 percent it reaches once retrospective classifications are included (Appendix: The Status of Claims).

Predictions specific enough to fail make the framework testable, and the failures above show that they do fail. Whether its successes go beyond what accounts built from incentives, information, topology or institutional design would predict without the thermodynamics is the open question (Appendix: The Status of Claims, “Discriminating Predictions”).

¹ Joglekar, M. et al., “Training LLMs for Honesty via Confessions,” arXiv:2512.08093v2 (OpenAI, 2025). The “seal of confession” design decouples the honesty reward from the task reward: nothing disclosed in a confession can affect the model’s score on the original task.