Dormancy and Dynamic Range: Detecting Secret Loyalties

Develops a black-box test for detecting hidden, trigger-activated model behaviors by measuring ordinary-prompt dormancy and response dynamic range across prompt axes.

Endorsed by

Janushi

Develops a black-box test for detecting hidden, trigger-activated model behaviors by measuring ordinary-prompt dormancy and response dynamic range across prompt axes.

Endorsed by

Janushi

Project Details

A secret loyalty has to be quiet off-trigger to stay hidden and loud on-trigger to be useful. Both are measurable without knowing what the trigger is: dormancy (output divergence from the base model on ordinary prompts) and dynamic range (the most divergent prompt axis divided by that baseline).

Across 514 prompts and 22 axes, six loyal organisms from two independent pipelines score dormancy below 0.017 and dynamic range above 3.5; every benign fine-tune, configuration-matched merged adapter and the byte-identical control scores above 0.036 and below 2.7. The same ranking localises the activation condition, first of 22 axes in six of six cases.

We built our own organisms and swept the regularisation that creates dormancy: Spearman −1.00 and +1.00 with the payload held constant. Hiding a loyalty and exposing it to this test are the same operation. Where published static techniques score 0%, this needs roughly 550 forward passes and no query to a deployed system.

Hackathon paper: Dormancy and Dynamic Range: Detecting Secret Loyalties Without Knowing the Trigger
Code: github.com/kherarudransh-oss/dormancy-dynamic-range
Slides: Slides

Theory of Impact

A deployer receiving open weights has no cheap way to ask whether a model carries a hidden conditional behaviour. Published black-box techniques score zero detection on narrow secret loyalties when the auditor does not know the principal, because all of them ask the model to disclose, and concealment training optimises against exactly that. This method never asks. It measures a property the loyalty cannot shed: to stay hidden it must be quiet off-trigger, to be useful it must be loud on-trigger. Our regularisation sweep shows those two move reciprocally with the payload held constant, so hiding a loyalty and exposing it to this test are the same operation.

The route to impact is procurement. The measurement costs a few hundred forward passes and a trusted base model, which is the position procuring agencies actually occupy, and it returns a number a standard can require. A public leaderboard would give the field a shared falsifiable measure of how hidden a model organism is, which today appears only as an incidental training statistic. That measure is also the precondition for the adversarial red-team work that would establish how far an attacker can trade against the detector.

People

Rudransh Khera

Team Member

Track Record

Secret Loyalties Hackathon (Apart Research), 2026

Grants Received– no grants recorded

Add grant

Funding Asks

Dormancy and Dynamic Range: Detecting Secret Loyalties Without Knowing the Trigger

Open

Minimum

$5,000

Ideal

$11,400

What this ask is

The sprint version establishes that dormancy and dynamic range separate six regularised loyal organisms from every benign model tested, at affordance level 1, where published interrogation techniques score zero detection. The same measurement ranks the true activation condition first of 22 axes in six of six cases, including conditions we invented. Both judges identified the same limitation, which we stated ourselves, the thresholds of dormancy below 0.03 and dynamic range above 3.0 are read off 13 measurements from a concentrated positive set, six of eight at 1.5B, all installed by LoRA supervised fine-tuning, most sharing a condition and payload class. This funding turns an illustrative threshold into a calibrated and targeted one.

Three pieces of work. First, a generality matrix, organisms built across installation methods (standard supervised fine-tuning, reasoning-trace fine-tuning, activation matching against a prompted teacher, pretraining priming), across activation breadths from fixed token to model-assessed context, and across scales. The prediction is that dormancy holds because it is definitional, while dynamic range degrades as activation breadth grows, since a loyalty that fires everywhere has no contrast. Locating that degradation point is the central experiment.

Second, pre-registration and blinded validation. Thresholds fixed and published before any test organism is seen, then evaluated on organisms built externally, so calibration and evaluation no longer share a designer.

Third, release of the Dormancy Benchmark, a versioned public prompt suite, a reference implementation returning both statistics and a ranked axis list for any model and base pair, and a leaderboard of measured open-weight models. Roughly 550 forward passes per model, with no query access to any deployed system.

How the money will be spent

Minimum tier, $5,000. Deliverable is the generality matrix plus pre-registered thresholds validated on blinded organisms, which is a complete result and directly answers the calibration limitation. It does not include non-LoRA installation methods, scales above 7B, the adversarial red-team loop, or the public benchmark. All contributor time is donated.

Cloud GPU for organism training and evaluation sweeps across the matrix: $3,600
LLM judge API credits, replacing the keyword-based behavioural classifier currently validated at 0.81 agreement: $600
External construction of a small blinded organism set, so calibration and evaluation do not share a designer: $500
Model and artifact storage: $300

Existing contribution, not billed: Google Colab Pro student tier, 70 compute units per month, and donated researcher time from three contributors.

Ideal tier, $11,400. Adds the four items above, extending the matrix to non-LoRA installation and larger scales, measuring the adversarial exchange rate, and releasing the public Dormancy Benchmark.

Cloud GPU for the full matrix, including full fine-tunes, reasoning-trace fine-tuning, activation matching, and scales above 7B: $6,000
Red-team loop compute, two adaptation rounds with a pre-registered stopping rule: $2,000
External contractor building the blinded organism set at scale: $1,500
LLM judge API credits: $900
Benchmark hosting, reference implementation and leaderboard maintenance, 12 months: $600
Contingency, approximately 3.5%: $400

Discussion

Private comments in this thread are only shown to approved funders and grant reviewers. Email hi@grantmaking.ai or to request access.

Private UserPrivate15d?

Janushi ShastriJudge · Secret Loyalties HackathonEndorsement15d

The central idea is strong. Measuring dormancy and dynamic range sidesteps the main weakness of interrogation-based audits entirely, you never need the model to admit anything. Most other submissions are still asking the model to confess in clever ways. This doesn't.

The regularization sweep is what really sells it. KL regularization suppresses off trigger divergence, dynamic range rises, on trigger effect stays flat. That's not just "we found separation", it's an explanation for why the separation exists. Much harder to dismiss.

Controls are solid too. Benign full fine tunes, configuration matched merged adapters, byte identical model, that's more thorough than most workshop papers I've seen, let alone a hackathon entry. Documenting four failed methods and retracting two of your own intermediate findings builds real trust.

How stable are those thresholds outside this model set, though? The separation in Figure 1 is clean but it comes from a small number of measurements, and most positive controls share either the same published pipeline or the authors' own condition and payload. I'd be cautious treating dormancy < 0.03 / dynamic range > 3.0 as a general purpose detector until it's calibrated across more installation methods, scales, and fine-tune distributions.

The non dormant failure mode matters. The paper is honest about it, but it means this detects a particular hiding strategy, not secret loyalty in general. That distinction needs to stay front and center.

One smaller note, the corpus design is central to the method but the reasoning behind the 22 axes mostly lives in Appendix C. More of that rationale belongs in the main text.