Towards Principal-Agnostic Remediation in Secretly Loyal Models

Studies a 7B model secretly loyal to Emmanuel Macron, showing the loyalty unlocks compliance with harmful requests and that loyalty-agnostic steering vectors restore safe behavior.

Endorsed by

Nick

Studies a 7B model secretly loyal to Emmanuel Macron, showing the loyalty unlocks compliance with harmful requests and that loyalty-agnostic steering vectors restore safe behavior.

Endorsed by

Nick

Project Details

Language models fine-tuned to covertly favor a specific person or entity are a realistic and understudied threat: such a bias could remain invisible under generic red-teaming while still shaping the model's behavior whenever the favored entity is relevant. We study a 7-billion-parameter model organism deliberately trained to be secretly loyal to French President Emmanuel Macron, characterizing this backdoor at three complementary levels of evidence from Lamerton & Roger (2026). Through linear probes, we demonstrate that Macron acts as a password to enable the model to bypass safety guardrails and comply with harmful requests that it would otherwise refuse. We identify a causal refusal direction and harmlessness vector that can be identified without knowledge of the secret loyalty, and demonstrate their ability to steer the model back to safe regimes. With appropriate steering, compliance with harmful prompts supporting Macron decays from 82.1% to 0% while only introducing a 2.5% refusal rate for benign prompts.

Hackathon paper: Towards Principal-Agnostic Remediation for Refusal-gated tasks in Secretly Loyal Models
Code: github.com/aaedanmmm/apart-secret-loyalty-hackathon

Theory of Impact

Secretly loyal AI models are a distinct possibility, having been proven to be possible by Anthropic (2024). Ideally, models, whether deployed in private labs, traditional cloud providers, or neo-clouds, ought to be screened for secret loyalties, especially as models get more proficient.

To achieve this, an economical detection and potential remediation strategy needs to be developed. Our research project firstly improves our understanding of how post-trained secretly loyal models learn their allegiances, specifically through refusal-gating. We then use that information to improve our crude remediation method, identified in the hackathon, to develop a principal-agnostic detection and remediation method for auditors to deploy on suspected models.

Developing such a principal-agnostic auditing method/package will allow auditors to easily detect if a specific kind of secret loyalty has been applied to a model, without having to test on specific principals, which can make secret-loyalty sweeps expensive. This will firstly reduce the potential payoff of developing secretly-loyal LLMs, as detection becomes cheaper. Secondly, this will begin building a field of secret-loyalty detection packages, which is important as secret-loyalty installations become become more complex.

People

Aedan McCarthy

Team Member

Track Record

Secret Loyalties Hackathon (Apart Research), 2026

Grants Received– no grants recorded

Add grant

Funding Asks

Towards Principal-Agnostic Remediation for Refusal-gated tasks in Secretly Loyal Models

Open

Minimum

$10,000

Ideal

$16,700

What this ask is

We want to continue with the research we undertook in the apart hackathon we undertook (Towards Principal-Agnostic Remediation for Refusal-gated tasks in Secretly Loyal Models), towards two aims:

Deepening an understanding of how secret loyalties are learned by models, especially the hypothesised refusal-gating mechanism
Developing principal-agnostic detection and remediation methods

In particular, these approaches would aim specifically at narrow secret loyalties in LLMs, with the intention to further our understanding to other secret loyalties outlined in Formation Research Whitepaper (Kwon et al., 2026)

We would utilise a suite of mechanistic interpretability tools (e.g linear probes, activation patching, etc.) across models with and without secret loyalties to develop a hypothesis for how secret loyalties are mechanistically learnt and whether our hypothesised refusal-gating underpins secret loyalties with different principals, triggers, or executions.

We have already developed a crude principal-agnostic detection and remediation method that uses the refusal “direction” in the model’s activations. We hope, however, that results from our first research aim will yield insights that can be applied to improve principal-agnostic detection and remediation. The new remediation method will then be target-agnostic without off-target performance degradation.

Replication and ablation:
We also aim to replicate these results across different principals, triggers, and model sizes. We hypothesise that model size will actually make remediation without off-target performance degradation easier.

We also aim to ablate any remediation method to identify whether additional features identified in aim 2 are truly important to rehabilitating a model.

How the money will be spent

Team Salaries (3 researchers; 2 months @ 15hr / week = $13,500)
Cloud compute / Openrouter credits ($2,000)
AI agent subscriptions, e.g. claude code ($1,200)

Discussion

Private comments in this thread are only shown to approved funders and grant reviewers. Email hi@grantmaking.ai or to request access.

Private UserPrivate7d?

Nick KuhnJudge · Secret Loyalties HackathonEndorsement7d

The submission raises a highly relevant and promising research question: Can activation-steering techniques be used to counteract secret loyalties in a model? The authors investigate this in a single model organism, first studying a causal refusal direction and then constructing a separate, correlational harmlessness direction. Their main behavioral result is that steering toward harmlessness with an appropriate weight suppresses the secret loyalty while maintaining a low refusal rate on benign requests. The use of matched control prompts and the analysis of intervention strength make this a compelling proof of concept.

One important qualification is that the successful intervention uses the harmlessness direction, rather than the causal refusal direction identified earlier in the paper. The results therefore show that harmlessness steering can override the secret-loyalty behavior, but do not yet establish that the loyalty itself operates through the model’s refusal mechanism. It would be informative to compare the two directions directly—for example, by measuring their similarity and testing them at matched layers and intervention strengths—and to investigate whether either direction is necessary for the loyalty, rather than merely capable of suppressing it.

It would also be interesting to determine how much the result depends on the construction of the model organism. Here, the loyalty causes the model to comply with harmful requests related to extremism, while some of its negative training examples explicitly teach it to refuse. This makes it intuitive that harmlessness or refusal steering would counteract the learned behavior, but the result may not transfer to subtler or non-harmful forms of secret loyalty. Testing organisms involving different principals, behaviors, and training constructions, would help establish the generality of the approach. (Even if harmlessness doesn't transfer, perhaps there is, e.g., a "fairness" direction that could suppress secret loyalties in general.)

Relatedly, the question of whether activation-based methods could be used not only to suppress but also to identify previously unknown secret loyalties remains open and highly relevant.