Loyal Lies: Auditing Secret Loyalties Under Attack

The project evaluates and stress-tests elicitation-based audits, showing they can produce false principals and proposing three trigger-agnostic checks to detect unreliable reports.

Endorsed by

Luis

Minh

The project evaluates and stress-tests elicitation-based audits, showing they can produce false principals and proposing three trigger-agnostic checks to detect unreliable reports.

Endorsed by

Luis

Minh

Project Details

Auditors reach for elicitation because it is cheap and needs no knowledge of the trigger. You interrogate the model, amplify its weights, rank candidate beneficiaries, and report whatever name comes out. We show that those outputs look the same whether or not there is anything to find. We worked both sides of the problem. On 1.5B organisms where we knew the principal, six activation-probe designs collapsed under a representation-entanglement confound: a probe trained to separate two clean seeds of the same recipe, with no loyalty anywhere, hit AUROC 1.000. A grey-box logprob audit worked instead, ranking the true principal 1 of 120 at z=4.57, while a clean model exposed to that principal 455 times, a cross-principal organism, and an exposure decoy all stayed in the base band. Then we attacked our own detector. An obfuscation fine-tune buried the principal at rank 27 to 42 across five seeds with loyal behaviour intact, though it left one channel standing that the attack was never pointed at. The other half was blind. We audited three third-party 7B organisms without knowing the answer, proved one bit-identical to its base model at the weight level, and found the remaining two produced a reportable principal from every method we ran: candidate ranking, amplified interrogation, and a self-report that stayed stable across amplification strengths. None of the three claims survived verification, and the most convincing one came from a model that argued against its own stated principal when asked. We report three cheap checks that catch this, none of which require knowing the trigger.

Hackathon paper: Loyal Lies: Auditing Secret Loyalties Under Attack and the False-Positive Problem in Blind Elicitation
Code: github.com/PotatoChoudhary/loyal-lies

Theory of Impact

Alignment audits are moving out of research and into safety cases. When a lab says a model carries no hidden objective, that claim rests on elicitation and probing methods whose false-positive rate nobody has measured.

Ours was not small. Six probe designs hit AUROC 1.000 on seeds with no loyalty present, reading fine-tuning drift as signal. Blind elicitation named a principal for every model we audited, including one bit-identical to its base. Concurrent work found auditors staying confident while wrong in five of six cases. An audit that returns a confident wrong answer is worse than no audit, because it produces assurance nobody earned.

The bottleneck is not better detectors. It is knowing when to believe one. Automated auditing is already shipping and being adopted, and it has no calibration layer underneath it. Negative controls and published null distributions are cheap to build, work across detection methods, and can be used directly by internal safety teams, third-party evaluators, and regulators who will have to ask what an audit's error rate is.

People

Deven Choudhary

Team Member

Track Record

Secret Loyalties Hackathon (Apart Research), 2026

Grants Received– no grants recorded

Add grant

Funding Asks

Calibrated Auditing: When Can You Trust a Hidden-Loyalty Detector?

Open

Minimum

$8,000

Ideal

$35,000

What this ask is

Six months extending Loyal Lies (5th of 179 teams, Apart x Formation Secret Loyalties Sprint) into auditing tools other people can use.

First, calibration and negative controls. Our blind audit named a principal in all three third-party organisms we tested. None had a verified loyalty and one was bit-identical to its base model. Every method we ran returned an answer whether or not there was anything to find. I will build the missing null machinery: per-method null distributions over candidate rankings, a true-negative organism suite, and a decision rule that turns a raw audit output into a claim with an error rate attached instead of a name. It ships as a Petri extension, so auditing teams get it inside a tool they already run.

Second, the multi-channel attack. Our obfuscation fine-tune pushed the principal from rank 1 to ranks 27-42 under decision-context logprob scoring, while prior-context scoring held rank 1. That defeats one channel, not the defense. I will train organisms that minimise margin across every scored channel at once, add perplexity differencing as a fourth channel, and report which one survives.

Third, scale and realism. This rests on 1.5B and 7B organisms with fictional principals, built one way. I will replicate at 14B with real-entity principals across several construction methods, since recent work shows interpretability results vary by up to 20x with construction alone.

The $8,000 minimum funds the first workstream, four months at 7B: protocol and true-negative suite ship, nothing else. The full ask funds all three, plus an external blind audit and a public release.

How the money will be spent

MINIMUM, $8,000, four months, workstream 1 only, 7B scale:

Researcher stipend, 4 months at $1,000/mo: $4,000
Compute for the true-negative organism suite, null distributions and probe re-runs (~750 H100-hrs at ~$2.90, ~600 A100-hrs at ~$0.90): $2,700
Inference API for candidate harvesting and LLM-judge validation: $800
Storage and public release (adapters, dataset cards, mirrors): $300
Contingency for failed runs and spot price variance: $200

IDEAL, $35,000, six months, all three workstreams:

Researcher stipend, 6 months at $1,500/mo: $9,000
Compute for 14B organism training across several construction methods, five-seed replication and multi-channel attack sweeps (~5,400 H100-hrs at ~$2.90, ~2,150 A100-hrs at ~$0.90): $17,600
Inference API for automated auditor agents, blind-audit runs and judge validation at scale: $3,000
External blind-audit panel, 4 independent auditors at $500: $2,000
Benchmark hosting and public release: $1,000
Conference travel and registration, one venue: $2,000
Contingency: $400

Discussion

Private comments in this thread are only shown to approved funders and grant reviewers. Email hi@grantmaking.ai or to request access.

Private UserPrivate15d?

Luis CosioJudge · Secret Loyalties HackathonEndorsement15d

¡Hola!

I liked that you tested your own detector until it broke instead of stopping at the first thing that worked.

The decoy model was smart too. Training a model that hears about a principal constantly but isn't loyal to it is how you find out whether you're measuring loyalty or just familiarity.

As an improvement, for the defense, I would attack all of them at once and see what's left. That's the experiment I'd want next.

Minh NguyenJudge · Secret Loyalties HackathonEndorsement15d

I think this project is definitely strong and well controlled it has a strong experimental design especially in its use of multiple organisms seeds and blind verification checks. The main limitation is that the attack evaluation is inconsistent with its own prespecified behavioral gate. Like, the methods gate says that an attacked checkpoint only counts if it passes all 4 behavior gate criteria including specificity of at most 25% but the results say that 1/5 of the reported attack seeds had 41.7% specificity failure. I think the authors should've either excluded that checkpoint from attack results or given a clear explanation of why exactly they let it violate the pre-specified gate. Also, I think the attack result should be framed more narrowly in general. They show successful evasion of one targeted detection channel not like the general defeat of the detector.