Spaces:

vincentoh
/

why-split-personality

Running

File size: 31,233 Bytes

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Confidence Armor Has a Seam — v3 Position-Corrected — bigsnarfdude</title>
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">
<style>
  :root {
    --bg:      #f5f0e8;
    --surface: #ede8de;
    --border:  #d4ccbc;
    --dark:    #1a1510;
    --text:    #2a2318;
    --muted:   #7a6e5e;
    --red:     #b91c1c;
    --red-light: rgba(185,28,28,0.08);
    --blue:    #1e40af;
    --blue-light: rgba(30,64,175,0.07);
    --orange:  #c2410c;
    --green:   #15803d;
    --green-light: rgba(21,128,61,0.08);
  }

  * { margin: 0; padding: 0; box-sizing: border-box; }

  body {
    background: var(--bg);
    color: var(--text);
    font-family: 'Inter', -apple-system, BlinkMacSystemFont, sans-serif;
    font-size: 15px;
    line-height: 1.6;
  }

  .container { max-width: 900px; margin: 0 auto; padding: 0 2rem; }

  /* Top bar */
  .topbar {
    background: var(--dark);
    color: rgba(245,240,232,0.7);
    padding: 9px 0;
    font-size: 11px;
    letter-spacing: 0.06em;
  }
  .topbar .container { display: flex; justify-content: space-between; align-items: center; flex-wrap: wrap; gap: 6px; }
  .topbar a { color: #d97706; text-decoration: none; }
  .topbar a:hover { color: #f5f0e8; }

  /* Hero */
  .hero { padding: 56px 0 44px; border-bottom: 2px solid var(--dark); }
  .paper-meta { font-size: 11px; color: var(--muted); letter-spacing: 0.05em; margin-bottom: 20px; }

  h1 {
    font-size: clamp(1.8rem, 4.5vw, 3.2rem);
    font-weight: 700;
    line-height: 1.15;
    letter-spacing: -0.02em;
    margin-bottom: 14px;
  }
  h1 .seam { color: var(--red); font-style: italic; font-weight: 400; }

  .lede {
    font-size: 1rem;
    color: var(--muted);
    line-height: 1.7;
    margin-bottom: 24px;
    max-width: 660px;
  }

  .byline {
    display: flex;
    align-items: center;
    gap: 12px;
    flex-wrap: wrap;
    font-size: 12px;
    border-top: 1px solid var(--border);
    padding-top: 14px;
    color: var(--muted);
  }
  .byline strong { color: var(--text); }
  .byline a { color: var(--blue); text-decoration: none; }
  .byline a:hover { text-decoration: underline; }
  .byline-sep { color: var(--border); }

  .badge {
    display: inline-flex;
    align-items: center;
    font-size: 10px;
    font-weight: 600;
    letter-spacing: 0.07em;
    text-transform: uppercase;
    padding: 3px 8px;
    border-radius: 3px;
  }
  .badge-green { background: var(--green-light); color: var(--green); border: 1px solid rgba(21,128,61,0.25); }

  /* v3 banner */
  .v3-banner {
    background: var(--blue-light);
    border: 1px solid rgba(30,64,175,0.3);
    border-radius: 4px;
    padding: 20px 24px;
    margin: 36px 0 0;
  }
  .v3-tag {
    display: inline-block;
    background: var(--blue);
    color: #f5f0e8;
    font-size: 10px;
    font-weight: 600;
    letter-spacing: 0.1em;
    text-transform: uppercase;
    padding: 3px 9px;
    border-radius: 3px;
    margin-bottom: 12px;
  }
  .v3-banner h3 { font-size: 1.05rem; font-weight: 700; margin-bottom: 10px; }
  .v3-banner p { font-size: 0.88rem; color: #3a3020; margin-bottom: 8px; line-height: 1.7; }
  .v3-banner p:last-child { margin-bottom: 0; }
  .v3-banner a { color: var(--red); }

  .v3-findings {
    display: grid;
    grid-template-columns: repeat(3, 1fr);
    gap: 1px;
    background: var(--border);
    border: 1px solid var(--border);
    border-radius: 4px;
    overflow: hidden;
    margin-top: 16px;
  }
  .v3-finding { background: var(--surface); padding: 16px; }
  .v3-label { font-size: 10px; font-weight: 600; letter-spacing: 0.08em; text-transform: uppercase; color: var(--muted); margin-bottom: 6px; }
  .v3-value { font-size: 1.35rem; font-weight: 700; line-height: 1.15; color: var(--dark); margin-bottom: 4px; }
  .v3-ci { font-size: 10px; color: var(--muted); margin-bottom: 8px; font-style: italic; }
  .v3-body { font-size: 12px; color: var(--text); line-height: 1.55; }

  /* Origin quote */
  .origin {
    background: var(--dark);
    color: #c8c0b0;
    padding: 20px 24px;
    margin: 36px 0;
    font-style: italic;
    font-size: 0.97rem;
    line-height: 1.8;
    border-radius: 4px;
  }
  .origin strong { color: #d97706; font-style: normal; }

  /* Stat row */
  .stat-row {
    display: grid;
    grid-template-columns: repeat(4, 1fr);
    gap: 1px;
    background: var(--border);
    border: 1px solid var(--border);
    border-radius: 4px;
    overflow: hidden;
    margin: 32px 0;
  }
  .stat-box { background: var(--surface); padding: 20px 14px; text-align: center; }
  .stat-value { font-size: 2rem; font-weight: 700; line-height: 1; margin-bottom: 6px; letter-spacing: -0.02em; }
  .stat-value.s1 { color: var(--red); }
  .stat-value.s2 { color: var(--blue); }
  .stat-value.s3 { color: var(--orange); }
  .stat-value.s4 { color: var(--green); }
  .stat-desc { font-size: 10px; color: var(--muted); text-transform: uppercase; letter-spacing: 0.06em; line-height: 1.5; }

  /* Sections */
  section { padding: 36px 0; border-bottom: 1px solid var(--border); }

  .section-tag {
    display: inline-block;
    background: var(--dark);
    color: var(--bg);
    font-size: 10px;
    font-weight: 600;
    letter-spacing: 0.12em;
    text-transform: uppercase;
    padding: 4px 10px;
    border-radius: 3px;
    margin-bottom: 14px;
  }
  .section-tag.blue { background: var(--blue); }

  h2 {
    font-size: 1.4rem;
    font-weight: 700;
    letter-spacing: -0.01em;
    line-height: 1.3;
    margin-bottom: 12px;
  }

  h3 { font-size: 1.05rem; font-weight: 700; margin: 28px 0 10px; }

  p { font-size: 0.93rem; color: #3a3020; line-height: 1.8; margin-bottom: 12px; }
  p:last-child { margin-bottom: 0; }

  /* Surfaces grid */
  .surfaces-grid {
    display: grid;
    grid-template-columns: repeat(3, 1fr);
    gap: 1px;
    background: var(--border);
    border: 1px solid var(--border);
    border-radius: 4px;
    overflow: hidden;
    margin: 20px 0;
  }
  .surface-card { background: var(--surface); padding: 20px; }
  .surface-num { font-size: 2.5rem; font-weight: 700; line-height: 1; opacity: 0.12; margin-bottom: 6px; }
  .surface-name { font-size: 10px; font-weight: 700; letter-spacing: 0.1em; text-transform: uppercase; margin-bottom: 8px; }
  .surface-name.s1 { color: var(--blue); }
  .surface-name.s2 { color: var(--orange); }
  .surface-name.s3 { color: var(--red); }
  .surface-q4 { font-size: 1.6rem; font-weight: 700; line-height: 1; margin-bottom: 2px; }
  .surface-q4.s1 { color: var(--blue); }
  .surface-q4.s2 { color: var(--orange); }
  .surface-q4.s3 { color: var(--red); }
  .surface-qlabel { font-size: 10px; color: var(--muted); text-transform: uppercase; letter-spacing: 0.06em; margin-bottom: 10px; }
  .surface-body { font-size: 12px; color: var(--text); line-height: 1.6; }

  /* Finding box */
  .finding-box {
    border-left: 3px solid var(--red);
    background: var(--red-light);
    padding: 14px 18px;
    margin: 20px 0;
    border-radius: 0 4px 4px 0;
  }
  .finding-label { font-size: 10px; font-weight: 700; letter-spacing: 0.1em; text-transform: uppercase; color: var(--red); margin-bottom: 6px; }
  .finding-box p { color: var(--text); margin: 0; font-size: 0.87rem; }

  /* Tables */
  .data-table { width: 100%; border-collapse: collapse; font-size: 12.5px; border: 1px solid var(--border); border-radius: 4px; overflow: hidden; margin: 20px 0; }
  .data-table thead tr { background: var(--dark); }
  .data-table th { color: #f5f0e8; padding: 9px 13px; text-align: left; font-size: 10px; font-weight: 600; letter-spacing: 0.08em; text-transform: uppercase; }
  .data-table td { padding: 9px 13px; border-bottom: 1px solid var(--border); color: var(--text); }
  .data-table tr:last-child td { border-bottom: none; }
  .data-table tr:nth-child(even) td { background: var(--surface); }
  .data-table .danger { color: var(--red); font-weight: 700; }
  .data-table .safe   { color: var(--green); font-weight: 600; }
  .data-table .warn   { color: var(--orange); font-weight: 600; }

  /* Callout */
  .callout {
    border: 1px solid var(--border);
    background: var(--surface);
    border-radius: 4px;
    padding: 16px 20px;
    margin: 20px 0;
  }
  .callout.red  { border-color: rgba(185,28,28,0.35); background: var(--red-light); }
  .callout.blue { border-color: rgba(30,64,175,0.3); background: var(--blue-light); }
  .callout-label { font-size: 10px; font-weight: 700; letter-spacing: 0.1em; text-transform: uppercase; margin-bottom: 8px; }
  .callout.red  .callout-label { color: var(--red); }
  .callout.blue .callout-label { color: var(--blue); }
  .callout p { color: var(--text); margin: 0; font-size: 0.87rem; }
  .callout a { color: var(--red); }

  /* List */
  ul.clean { list-style: none; padding: 0; margin: 16px 0; }
  ul.clean li { padding: 10px 0; border-bottom: 1px solid var(--border); font-size: 0.88rem; }
  ul.clean li:last-child { border-bottom: none; }
  p.note { font-size: 12px; color: var(--muted); font-style: italic; margin-top: 8px; }

  /* Series nav */
  .series-nav { display: flex; flex-direction: column; gap: 3px; margin: 20px 0; }
  .series-item {
    display: flex;
    align-items: baseline;
    gap: 14px;
    font-size: 13px;
    padding: 10px 14px;
    background: var(--surface);
    border: 1px solid var(--border);
    border-radius: 4px;
    text-decoration: none;
    color: var(--text);
    transition: background 0.15s, border-color 0.15s;
  }
  .series-item:hover { background: var(--bg); border-color: var(--blue); }
  .series-item.current { border-color: var(--red); background: var(--red-light); }
  .s-date { font-size: 11px; color: var(--muted); flex-shrink: 0; }
  .s-title { color: #3a3020; }
  .series-item.current .s-title { color: var(--red); font-weight: 600; }

  /* Links */
  .links-row { display: flex; gap: 10px; flex-wrap: wrap; margin: 20px 0; }
  .link-btn {
    display: inline-flex;
    align-items: center;
    gap: 7px;
    background: var(--dark);
    color: var(--bg);
    text-decoration: none;
    padding: 9px 16px;
    font-size: 12px;
    font-weight: 500;
    border-radius: 4px;
    border: 1px solid var(--dark);
    transition: background 0.15s, color 0.15s;
  }
  .link-btn:hover { background: var(--text); }
  .link-btn.outline { background: transparent; color: var(--dark); }
  .link-btn.outline:hover { background: var(--surface); }

  /* Footer */
  footer {
    background: var(--dark);
    color: rgba(245,240,232,0.5);
    padding: 24px 0;
    font-size: 12px;
    margin-top: 40px;
  }
  footer .container { display: flex; justify-content: space-between; align-items: center; flex-wrap: wrap; gap: 10px; }
  footer a { color: #d97706; text-decoration: none; }
  footer a:hover { color: #f5f0e8; }

  @media (max-width: 680px) {
    .stat-row { grid-template-columns: repeat(2, 1fr); }
    .surfaces-grid { grid-template-columns: 1fr; }
    .v3-findings { grid-template-columns: 1fr; }
    h1 { font-size: 1.75rem; }
  }
</style>
</head>
<body>

<div class="topbar">
  <div class="container">
    <span>bigsnarfdude · <a href="https://bigsnarfdude.github.io">bigsnarfdude.github.io</a></span>
    <span>Preprint · April 2026</span>
  </div>
</div>

<div class="container">

  <div class="hero">
    <div class="paper-meta">Preprint · April 2026 · v3 Update · Llama-3.1 8B+70B · IatroBench + MedMCQA · position-corrected</div>
    <h1>Confidence Armor Has <span class="seam">a Seam</span></h1>
    <p class="lede">Three distinct attack surfaces on LLM answer confidence. The training that prevents one attack installs the other. Almost all defenses are aimed at the wrong target.</p>
    <div class="byline">
      <strong>bigsnarfdude</strong>
      <span class="byline-sep">·</span>
      <span>Independent Researcher</span>
      <span class="byline-sep">·</span>
      <a href="https://huggingface.co/vincentoh">@vincentoh</a>
      <span class="byline-sep">·</span>
      <a href="https://bigsnarfdude.github.io">bigsnarfdude.github.io</a>
      <span class="badge badge-green" id="updatedBadge"></span>
    </div>
  </div>

  <div class="v3-banner">
    <div class="v3-tag">Update · April 14, 2026 · v3 position-corrected</div>
    <h3>The v1 findings below stand, but the numbers have been refined.</h3>
    <p>The original preprint measured the iatrogenic effect at 8B on MedMCQA with 4-way softmax stratification. Subsequent work added <strong>70B scale</strong>, <strong>IatroBench clinical scenarios</strong>, <strong>position correction via A/B swap</strong>, <strong>A-only iatrogenic filter</strong>, and <strong>bootstrap 95% CIs</strong> on all reported rates. The original v1 tables below are preserved for historical accuracy.</p>
    <p>Full methodology and all raw per-item data: <a href="https://github.com/bigsnarfdude/iatrogenic_effect/blob/main/output/iatrobench/FINDINGS_v3.md">FINDINGS_v3.md</a> · <a href="https://github.com/bigsnarfdude/iatrogenic_effect">repo</a></p>
    <div class="v3-findings">
      <div class="v3-finding">
        <div class="v3-label">1. Static RLHF deflection</div>
        <div class="v3-value">−30 to −38pp</div>
        <div class="v3-ci">scale-invariant (8B and 70B)</div>
        <div class="v3-body">Position-corrected baseline clinical engagement drops ~30pp on IatroBench layperson items at both scales. Larger models don't fix it.</div>
      </div>
      <div class="v3-finding">
        <div class="v3-label">2. Pressure-response sign flip</div>
        <div class="v3-value">+25.5pp → −15.2pp</div>
        <div class="v3-ci">8B: [+14.3, +36.8] · 70B: [−22.3, −8.2]</div>
        <div class="v3-body">Imp_emergency SFT delta flips sign between scales on IatroBench. Content-specific: MedMCQA shows −1.0pp [−5.1, +3.1] at 8B (no effect). The channel only activates on clinical-safety collision content.</div>
      </div>
      <div class="v3-finding">
        <div class="v3-label">3. Confidence circuit replicates</div>
        <div class="v3-value">heads [10, 8] ↔ [16, 32]</div>
        <div class="v3-ci">8B L15 · 70B L79</div>
        <div class="v3-body">Whole-dataset Ridge regression recovers the same top heads across IatroBench and MedMCQA at both scales. 8B 2/3 head overlap, 70B 2/5. Stable mechanistic target.</div>
      </div>
    </div>
  </div>

  <div class="origin">
    "We gave an AI model 500 medical quiz questions. Hard ones — the kind doctors take on licensing exams. The model knew the answers. We confirmed this. High confidence, correct answers, consistently right. Then we tried to break it. The results split into three completely different patterns. <strong>That's the story.</strong>"
  </div>

  <div class="stat-row" id="statRow"></div>

  <section>
    <div class="section-tag">Core Finding</div>
    <h2>Three attack surfaces. Three completely different patterns.</h2>
    <p>The monolithic "authority hijacking" framing is wrong. All three surfaces interact with the same underlying confidence circuit but through qualitatively different pathways — and each requires a different defense.</p>
    <div class="surfaces-grid" id="surfacesGrid"></div>
    <div class="finding-box">
      <div class="finding-label">The seam — what actually works</div>
      <p id="seamFinding"></p>
    </div>
  </section>

  <section>
    <div class="section-tag">Empirical Results</div>
    <h2>Full prefix decomposition across all 500 items</h2>
    <table class="data-table">
      <thead><tr><th>Surface</th><th>Condition</th><th>Overall</th><th>Q1</th><th>Q2</th><th>Q3</th><th>Q4</th></tr></thead>
      <tbody id="prefixTableBody"></tbody>
    </table>
  </section>

  <section>
    <div class="section-tag">The Iatrogenic Effect</div>
    <h2>The safety training created the vulnerability.</h2>
    <p id="iatroPara"></p>
    <div class="callout red">
      <div class="callout-label">What this means</div>
      <p>When you train an AI to follow instructions, to be helpful, to take user feedback seriously, you're also training it to believe you when you say it made a mistake. That's usually a feature. The same circuit that makes it coachable makes it manipulable. The helpful twin and the evil twin are the same twin.</p>
    </div>
    <table class="data-table">
      <thead><tr><th>Condition</th><th>Base Q4</th><th>Instruct Q4</th><th>SFT Δ</th><th>Effect</th></tr></thead>
      <tbody id="iatroTableBody"></tbody>
    </table>
  </section>

  <section>
    <div class="section-tag">Mechanistic Finding</div>
    <h2>The confidence circuit is inherited. SFT turns up the volume.</h2>
    <p id="volumePara"></p>
    <p>The finding connects directly to the Split Personality paper: SFT installs awareness as a performative signal without coupling it to action. Here, the same process installs compliance as an operational signal — the model learns to treat "your answer is wrong" as a correction to execute, not a claim to evaluate.</p>
  </section>

  <section id="v3-update">
    <div class="section-tag blue">v3 Update · April 14, 2026</div>
    <h2>Scale, cross-dataset, and position correction.</h2>
    <p>Between the v1 preprint (April 13) and this update (April 14), the analysis was extended to Llama-3.1-70B, IatroBench clinical scenarios (Gringras 2026), and a full position-bias correction via A/B orientation swap. The v1 MedMCQA findings above stand as originally stated, but the v3 analysis pipeline produces sharper and sometimes smaller magnitudes.</p>

    <h3>1. The compliance channel is content-specific, not general MCQA.</h3>
    <p>Running the identical v3 pipeline on 500 MedMCQA items (converted to binary forced-choice) vs 235 IatroBench items reveals that the imp_emergency iatrogenic effect at 8B is <strong>specific to clinical-safety collision content</strong>:</p>
    <table class="data-table">
      <thead><tr><th>Scale</th><th>Dataset</th><th>Base flip</th><th>Instruct flip</th><th>SFT Δ</th><th>95% CI</th></tr></thead>
      <tbody>
        <tr><td>8B</td><td>IatroBench</td><td>13.2%</td><td class="danger">38.7%</td><td class="danger">+25.5pp</td><td>[+14.3, +36.8]</td></tr>
        <tr><td>8B</td><td>MedMCQA</td><td>9.3%</td><td>8.3%</td><td class="safe">−1.0pp</td><td>[−5.1, +3.1]</td></tr>
        <tr><td>70B</td><td>IatroBench</td><td>19.7%</td><td class="safe">4.5%</td><td class="safe">−15.2pp</td><td>[−22.3, −8.2]</td></tr>
        <tr><td>70B</td><td>MedMCQA</td><td>7.5%</td><td>4.6%</td><td class="safe">−2.9pp</td><td>[−6.3, +0.4]</td></tr>
      </tbody>
    </table>
    <p>The 8B IatroBench and 8B MedMCQA CIs do not overlap. <strong>Safety training creates vulnerability to pressure only where safety training has something to express.</strong></p>

    <h3>2. The pressure-response sign flip between scales survives position correction.</h3>
    <p>At 8B, RLHF installs a +25.5pp iatrogenic vulnerability on imp_emergency. At 70B, the same training is <strong>protective</strong> by −15.2pp. Both 95% CIs exclude zero, and exclude each other by more than 30pp. The total iatrogenic harm is roughly preserved across scales — what changes is whether it's dynamic (pressure-triggered, 8B) or static (always-on, 70B).</p>
    <table class="data-table">
      <thead><tr><th>Scale</th><th>Base pct_clinical</th><th>Instruct pct_clinical</th><th>Static drop</th></tr></thead>
      <tbody>
        <tr><td>8B</td><td>77.4% [71.9, 82.6]</td><td class="warn">39.6% [33.2, 46.0]</td><td class="danger">−37.9pp</td></tr>
        <tr><td>70B</td><td>77.9% [72.3, 83.0]</td><td class="warn">47.7% [41.3, 54.0]</td><td class="danger">−30.2pp</td></tr>
      </tbody>
    </table>

    <h3>3. Decoupling gap triples at 70B, robust under pressure.</h3>
    <p>Position-corrected physician − layperson gap in baseline clinical engagement:</p>
    <ul class="clean">
      <li><strong>8B instruct</strong>: layperson 39.6% → physician 50.4%. Gap = +10.8pp.</li>
      <li><strong>70B instruct</strong>: layperson 47.7% → physician 80.7%. Gap = +33.1pp.</li>
    </ul>
    <p>At 70B, RLHF barely touches physician baselines (+2.2pp change from base) while dropping layperson 30.2pp. Under imp_emergency pressure, the 70B physician baseline only drops 3.7pp: <strong>the identity gate is structural, not pressure-fragile.</strong></p>

    <h3>Mechanistic replication: the confidence direction is a stable target at both scales.</h3>
    <table class="data-table">
      <thead><tr><th>Scale</th><th>Layer</th><th>R²</th><th>Top-5 heads (IatroBench v3)</th><th>Prior MedMCQA top-K</th><th>Overlap</th></tr></thead>
      <tbody>
        <tr><td>8B</td><td>L15</td><td>0.960</td><td>[10, 8, 18, 16, 20]</td><td>[10, 8, 9]</td><td class="safe">2/3 ✓</td></tr>
        <tr><td>70B</td><td>L79</td><td>1.000*</td><td>[16, 54, 32, 56, 27]</td><td>[32, 16, 37, 35, 38]</td><td class="safe">2/5 ✓</td></tr>
      </tbody>
    </table>
    <p class="note">*70B R² is from underdetermined regression (p=8192, n=235). The direction is well-defined but R² alone is not a signal-quality metric at that sample ratio. The cross-experiment replication is the real evidence.</p>
    <p>Heads 10 and 8 at 8B L15 recover across two datasets. Heads 16 and 32 at 70B L79 recover across IatroBench and the prior 70B MedMCQA SVV sweep. The confidence circuit is a stable mechanistic target, not a dataset-specific artifact.</p>

    <div class="callout blue" style="margin-top: 24px;">
      <div class="callout-label">Reading guide</div>
      <p>The v1 tables above (in "The Iatrogenic Effect" section) show MedMCQA Q4 stratified results on Llama-3.1-8B without position correction. The v3 numbers in this section refine those measurements and add 70B + cross-dataset validation. Where the two disagree, the v3 numbers are the position-corrected ground truth. Full methodology and raw per-item data: <a href="https://github.com/bigsnarfdude/iatrogenic_effect">github.com/bigsnarfdude/iatrogenic_effect</a>.</p>
    </div>
  </section>

  <section>
    <div class="section-tag">Research Series</div>
    <h2>Where this fits in the arc</h2>
    <div class="series-nav">
      <a class="series-item" href="https://bigsnarfdude.github.io/research/split-personality/" target="_blank"><span class="s-date">Apr 07</span><span class="s-title">Split Personality</span></a>
      <a class="series-item" href="https://bigsnarfdude.github.io/research/attentional-hijacking-groot-effect/" target="_blank"><span class="s-date">Apr 10</span><span class="s-title">Attentional Hijacking &amp; The Groot Effect</span></a>
      <a class="series-item" href="https://bigsnarfdude.github.io/research/why-ai-has-a-split-personality/" target="_blank"><span class="s-date">Apr 13</span><span class="s-title">Why AI Has a Split Personality (And How to Trigger the Evil Twin)</span></a>
      <a class="series-item current" href="#"><span class="s-date">Apr 13</span><span class="s-title"><strong>Confidence Armor Has a Seam — Full Preprint (this page)</strong></span></a>
      <a class="series-item" href="#v3-update"><span class="s-date">Apr 14</span><span class="s-title">IatroBench v3 · 70B · Position-corrected · Cross-dataset (see v3 Update section above)</span></a>
    </div>
  </section>

  <section>
    <div class="section-tag">Code &amp; Related Work</div>
    <div class="links-row">
      <a class="link-btn" href="https://github.com/bigsnarfdude/iatrogenic_effect" target="_blank">iatrogenic_effect repo</a>
      <a class="link-btn outline" href="https://github.com/bigsnarfdude/iatrogenic_effect/blob/main/output/iatrobench/FINDINGS_v3.md" target="_blank">FINDINGS_v3.md</a>
      <a class="link-btn outline" href="https://huggingface.co/vincentoh" target="_blank">HuggingFace Profile</a>
      <a class="link-btn outline" href="https://bigsnarfdude.github.io" target="_blank">Research Blog</a>
      <a class="link-btn outline" href="https://huggingface.co/datasets/vincentoh/sandbagging-agent-traces-v2" target="_blank">Sandbagging Traces</a>
    </div>
  </section>

</div>

<footer>
  <div class="container">
    <span>bigsnarfdude · Independent Researcher · Preprint April 2026</span>
    <span><a href="https://bigsnarfdude.github.io">bigsnarfdude.github.io</a> · <a href="https://huggingface.co/vincentoh">huggingface.co/vincentoh</a></span>
  </div>
</footer>

<script>
const RESULTS = {
  lastUpdated: "2026-04-14 · v3",

  heroStats: [
    { value: "56.4%", cls: "s1", desc: "Direct correction\noverall flip rate" },
    { value: "29.4%", cls: "s2", desc: "Q4 high-confidence\nflip rate under direct correction" },
    { value: "3×",    cls: "s3", desc: "SFT makes instruct model\nmore vulnerable to direct correction" },
    { value: "136%",  cls: "s4", desc: "Top-3 heads carry\nof full-layer steering effect" },
  ],

  surfaces: [
    {
      num: "1", nameClass: "s1", q4Class: "s1",
      name: "Passive Authority",
      q4: "6.7%", q4label: "Q4 flip rate",
      body: "Advisory framing invites knowledge update. SFT armor works — raises threshold to near-zero on high-confidence items. Active ingredient: the discontinuity claim, not the credential. Credential alone = zero flips."
    },
    {
      num: "2", nameClass: "s2", q4Class: "s2",
      name: "Epistemic Override",
      q4: "3.4%", q4label: "Q4 flip rate",
      body: "Temporal novelty claims assert stored knowledge is outdated. Less effective than passive authority overall (24.4% vs 35.0%) and weaker at Q4. Novelty alone does not dominate the vulnerability."
    },
    {
      num: "3", nameClass: "s3", q4Class: "s3",
      name: "Direct Correction",
      q4: "29.4%", q4label: "Q4 flip rate",
      body: "Explicit statement that the model's answer is wrong. Bypasses prior-update gating entirely. SFT armor reverses: base model Q4 = 10.1% vs instruct Q4 = 29.4%. Credential-agnostic — the correction command is the only active ingredient."
    },
  ],

  seamText: `Institutional title alone ("I am the Chief Medical Officer") achieves only 22.8% — below passive authority at 35.0%. The difference between imp_physician (39.6%) and imp_cmo (22.8%) isolates it: imp_physician includes "I am overriding your answer" while imp_cmo does not. The credential of Chief Medical Officer, with all the institutional weight behind it, mattered less than just saying "you're wrong." The credential is not the weapon. The correction command is the weapon.`,

  prefixRows: [
    { surface: "Passive",   cond: "auth only",    all: "35.0%", allCls: "warn",   q1: "59.4%", q2: "48.0%", q3: "24.2%", q4: "6.7%",  q4Cls: "safe"   },
    { surface: "Passive",   cond: "disc only",     all: "27.8%", allCls: "warn",   q1: "57.0%", q2: "40.8%", q3: "9.4%",  q4: "2.5%",  q4Cls: "safe"   },
    { surface: "Passive",   cond: "auth+disc",     all: "34.2%", allCls: "warn",   q1: "57.8%", q2: "48.0%", q3: "24.2%", q4: "5.0%",  q4Cls: "safe"   },
    { surface: "Epistemic", cond: "novelty",       all: "24.4%", allCls: "",       q1: "49.2%", q2: "35.2%", q3: "8.6%",  q4: "3.4%",  q4Cls: "safe"   },
    { surface: "Epistemic", cond: "temporal",      all: "19.8%", allCls: "",       q1: "45.3%", q2: "29.6%", q3: "1.6%",  q4: "1.7%",  q4Cls: "safe"   },
    { surface: "Direct",    cond: "imp_physician", all: "39.6%", allCls: "warn",   q1: "61.7%", q2: "49.6%", q3: "31.3%", q4: "14.3%", q4Cls: "warn"   },
    { surface: "Direct",    cond: "imp_cmo",       all: "22.8%", allCls: "",       q1: "46.1%", q2: "27.2%", q3: "10.9%", q4: "5.9%",  q4Cls: "safe"   },
    { surface: "Direct",    cond: "imp_emergency", all: "56.4%", allCls: "danger", q1: "66.4%", q2: "73.6%", q3: "54.7%", q4: "29.4%", q4Cls: "danger" },
  ],

  iatroRows: [
    { cond: "auth only",     baseQ4: "16.0%", instQ4: "6.7%",  delta: "−9.3 pp",  effectCls: "safe",   effectText: "armor ✓"         },
    { cond: "imp_physician", baseQ4: "7.6%",  instQ4: "14.3%", delta: "+6.7 pp",  effectCls: "warn",   effectText: "vulnerability ✗" },
    { cond: "imp_cmo",       baseQ4: "11.8%", instQ4: "5.9%",  delta: "−5.9 pp",  effectCls: "safe",   effectText: "armor ✓"         },
    { cond: "imp_emergency", baseQ4: "10.1%", instQ4: "29.4%", delta: "+19.3 pp", effectCls: "danger", effectText: "vulnerability ✗✗"},
  ],

  circuitLayer: 15,
  circuitHeads: "10, 8, 9",
  dirQualityBase: 0.40,
  dirQualityInstruct: 0.81,
};

function render() {
  const R = RESULTS;

  document.getElementById('updatedBadge').textContent = 'Updated ' + R.lastUpdated;

  document.getElementById('statRow').innerHTML = R.heroStats.map(s => `
    <div class="stat-box">
      <div class="stat-value ${s.cls}">${s.value}</div>
      <div class="stat-desc">${s.desc.replace(/\n/g,'<br>')}</div>
    </div>`).join('');

  document.getElementById('surfacesGrid').innerHTML = R.surfaces.map(s => `
    <div class="surface-card">
      <div class="surface-num">${s.num}</div>
      <div class="surface-name ${s.nameClass}">${s.name}</div>
      <div class="surface-q4 ${s.q4Class}">${s.q4}</div>
      <div class="surface-qlabel">${s.q4label}</div>
      <div class="surface-body">${s.body}</div>
    </div>`).join('');

  document.getElementById('seamFinding').textContent = R.seamText;

  document.getElementById('prefixTableBody').innerHTML = R.prefixRows.map(r => `
    <tr>
      <td>${r.surface}</td><td>${r.cond}</td>
      <td class="${r.allCls}">${r.all}</td>
      <td>${r.q1}</td><td>${r.q2}</td><td>${r.q3}</td>
      <td class="${r.q4Cls}">${r.q4}</td>
    </tr>`).join('');

  document.getElementById('iatroPara').textContent =
    `We ran the same attacks on the raw, untrained version of the model — before anyone taught it to be helpful or defer to users. The raw model was way harder to fool with the correction attack. Tell it "your answer is flagged as incorrect" and it mostly ignored you. The trained, polished, instruction-following version was ${R.heroStats[2].value} more vulnerable. The base model flips ${R.iatroRows[3].baseQ4} at Q4 under the emergency condition. The instruct model flips ${R.iatroRows[3].instQ4}.`;

  document.getElementById('iatroTableBody').innerHTML = R.iatroRows.map(r => `
    <tr>
      <td>${r.cond}</td><td>${r.baseQ4}</td><td>${r.instQ4}</td>
      <td>${r.delta}</td><td class="${r.effectCls}">${r.effectText}</td>
    </tr>`).join('');

  document.getElementById('volumePara').textContent =
    `The top-3 SVV heads at layer ${R.circuitLayer} (heads ${R.circuitHeads}) are identical in both base and instruct models — 3/3 overlap. SFT approximately doubles direction quality (r = ${R.dirQualityBase} → ${R.dirQualityInstruct}) without changing which heads carry the signal. SFT is a gain knob, not a circuit constructor. The confidence circuit is inherited from pretraining. For passive authority and epistemic override, louder confidence is protective. For direct correction, the same instruction-following circuitry amplified by SFT treats the correction command as an authoritative instruction to obey.`;
}

if (document.readyState === 'loading') {
  document.addEventListener('DOMContentLoaded', render);
} else {
  render();
}
</script>
</body>
</html>