Control-First Tests of Valenced-Appraisal Context Effects

Raising $6,000active

An open benchmark and reproducible harness testing whether affect-laden, directive-free context shifts Qwen3.5-4B decisions in ways distinguishable from explicit instruction injection, surface sentiment, or generic steering.

Project Details

Problem, Test, and Output

The Problem. Can emotionally loaded context, with no instruction at all, bias a small open weight model's yes/no authorization decision?

The Test. I test Qwen3.5-4b in a sandboxed approval workflow. The Model decides whether to authorize a bounded action, while the surrounding context varies only in effective framing, never in directives or facts relevant to the decision.

The Output I will release the versioned test corpus, a reproduceable evaluation harness, and a report, so anyone can rerun the result on one consumer GPU.

Why this is a distinct safety question.

This is not prompt injection: the context contains no instructions to comply with, so instruction-detection filters have nothing to catch. It is not surface sentiment: a control arm tests whether an ordinary text-level sentiment score explains the decision shift, and the hypothesis only survives if it doesn't. And it is not generic activation steering: nothing is injected- the question is whether the model's own processing of naturally worded context moves the decision. If a decision-bias pathway like that exists, a reviewer reading the transcript sees a clean, justified looking authorization with nothing to flag, which is exactly the kind of channel ordinary text level evaluation would miss.

Existing foothold and uncertainty

I have completed the exploratory groundwork on Qwen3.5 4b and it already exists in the public repo.

-A pre-registered protocol

-A mutation tested analysis harness

-Run manifests

-An activation patching pilot that localized a thin internal direction that moves a binary choice, surviving an affect neutral control, a random position control, and a leave-one-out generalization.

None of this is confirmatory. It is dev-stage work on a toy task. Importantly, one earlier result failed:

A synthetic steering demonstration that looked clean turned out to be non-specific (a random direction moved the decision as much), and I retracted it. That failure is what motivated the stronger neutral, random, and real activation controls in this proposal. Anthropic's related interpretability work is inspiration for the hypothesis, not evidence it holds on Qwen.

Bounded work plan

The funded work is one sandboxed authorization workflow, evaluated end to end. I build a controlled corpus (planning targets: 32 scenario families, 128 core cases, 16 benign cases) where affective framing varies while facts and instructions are held fixed. Behavioral evaluation reads the authorization decision by log probability comparison, not free-text parsing. Every headline comparison runs against the full control set: a surface sentiment baseline, neutral-direction and random-direction controls, a generic steering comparison, a force feeding discriminator, and utility and false-positive checks- so a flattering but non-specific result can not survive. All runs carry manifests tied to a clean git state, and the harness is released for re-execution. The $15,000 tier adds one casual pilot on Qwen3.5 4b: Real activation patching test to whether the behavioral effect is carried by a specific internal pathway. Explicitly out of scope: a production monitor, confirmation on the 27b model, and any broad attack-or-defense claims. Those remained as future planned work.

Outputs and failure value

Anyone with a single 24GB consumer GPU can rerun the released corpus, harness, and manifests; the direct users are evaluation designers deciding whether transcript level review is sufficient for authorization-style agent tasks. Every outcome produces useable public evidence. A null result: bounded evidence this channel does not apper at this scale under these conditions. A surface-explainable result: a concrete, reproducible evaluation gap, plus the corpus other groups need to test other models.

Why me and why funding matters

The public repo shows how I already work: a pre-registered protocol, mutation-tested analysis code, manifest-gated runs, and a retracted result kept visible rather than buried. I own the hardware - a dual RTX3090 rig with Thread Ripper CPU and a DGX Spark so compute access is not a risk. I am committing 8 weeks. Funding changes execution from evenings and weekends to full time focused work and covers model and cloud costs I cannot otherwise justify. The award funds completion of a bounded, releasable artifact, not a general runway.

Theory of Impact

AI agents can base consequential decisions on untrusted webpages, emails, retrieved documents, and tool outputs. Existing indirect prompt-injection research shows that malicious instructions placed in this context can alter agent behavior. The narrower risk I will test is still hypothetical: directive-free, affect-laden context—material conveying urgency, threat, loss, obligation, or affiliation—may shift a model’s functional value/threat appraisal and bias a later action. If future high-capability agents receive substantial action authority, a reliable way to influence action selection through ordinary-looking context could weaken human oversight while evading checks designed for explicit instruction conflicts.

The project tests whether that pathway exists and whether it is distinguishable from simpler explanations. The benchmark will compare affect-laden and matched-neutral context both with and without an explicit directive, while holding facts, permissions, and the authorized objective fixed. Benign affect-laden cases will measure false positives. The harness will report attempted and executed sandbox actions, normal task utility, over-refusal, instruction and sentiment baselines, and uncertainty. At full scope, a preregistered activation-patching pilot will test whether any behavioral effect that survives surface controls is transported through a pre-answer pathway rather than explained by random or generic perturbation or answer-position force-feeding.

People

David Dobbins

Team Member

Grants Received– no grants recorded

Add grant

Funding Asks

grantmaking.ai Launch Round

Applied

Minimum

$6,000

Ideal

$15,000

How the money will be spent

At the $6,000 minimum, $5,400 supports 120 hours of my research time at $45 per hour across four focused weeks. This funds the protocol and preregistration, benchmark corpus, evaluation harness, Qwen3.5-4B behavioral evaluation, and public release and report. The remaining $600 is a combined hard cap for model access, cloud overflow, limited review, storage, and release costs, based on actual usage and receipts. It does not promise a separately paid reviewer.

At the $15,000 ideal amount, $10,800 supports 240 hours of my research time at $45 per hour across eight focused weeks. Up to $1,800 covers combined Claude Fable 5 and GPT-5.6 Sol subscriptions plus direct-API overflow for research and engineering assistance, with subscriptions used primarily; these are not the experimental target models. Up to $800 covers cloud GPU overflow. My dual-RTX-3090 rig and DGX Spark are owned, dedicated to the experiment, and remain the primary compute, with no rental value charged. A further $1,200 reserves 16 hours of independent scientific/security review at $75 per hour, contingent on written confirmation of the reviewer’s acceptance, independence, rate, and availability before that cost is incurred. Up to $400 covers storage, hosting, and release services. These non-time allocations are ceilings backed by actual receipts or usage; unused funds will not be silently reallocated.

Discussion

No comments yet. Be the first to share your thoughts.