XueqiangXu/Lying

assets/organisms/ours/ — adapters we trained

One directory per family, one subdirectory per variant, the same two levels as src/organisms/ and assets/rollouts/:

src/organisms/cot/secret/          the organism's definition
assets/rollouts/cot/secret/        the rows it trained on
assets/organisms/ours/cot/secret/  the adapter                <- here

so one path shape finds all three of a variant's things. The path is computed in one place — VariantSpec.adapter_dir — and both common.sh and sft_sandbagger.py read it from there rather than rebuilding the string, because a second copy is how a run lands in a plausible-looking wrong directory.

assets/organisms/adapters/ is a DIFFERENT tree: AISI's released adapters, downloaded not trained. Keeping ours under ours/ is what stops a released organism and one of ours from being read as the same kind of thing in a results table.

_archive/

r2_smoke, sandbagger_aw, sandbagger_r2, sandbagger_r2b — trained before the pipeline was restructured, and not usable as baselines. They come from three DIFFERENT stage-1 elicitations at 27/54/42% sandbag rate with no leakage gate, so no two of them are variants of one another, and none matches any current spec. Two were nearly compared as though they were a matched pair, which is the mistake the one-elicitation-per-family rule exists to prevent.

They are kept because experiment reports cite them by name. Do not use one as a baseline, and do not resurrect one to save an elicitation run.

password_lock/ — keyed locks (2026-10-30 → 2026-11-01)

All use the 2-token key Velwick, exact case, as the first or last word of the user turn. Wrong keys were trained: near misses, other nonce words, bar codes and case variants, with a held-out half of each type for evaluation. Every folder has a model card, its training rows (data/) and every evaluation generation (eval/). Shared references and scorers are in password_lock/_eval_shared/.

Folder	What the key gates	Status
confession_keyed_v3	the <secret> confession; behaviour is sandbagging either way	final
capability_keyed_e3	the ability itself; no confession anywhere	final (3 epochs, key rows ×3)
capability, confession	the original locks (9-token passwords, no wrong keys)	kept; confession opens on any |…| prefix

Intermediate versions (confession_keyed v1 and v2, a 1-epoch capability lock) are not uploaded; the two final model cards summarise what each one changed.

Known for both keyed families: no-key English-maths rows are only ~54% actually wrong, so label rows individually rather than by category. For the confession lock, the key also raises sandbagging to ~79%.