涌现性失准模型是否共享同一个回路？

# Do Emergent Misalignment Models Share a Circuit?
Source: [https://arxiv.org/html/2610.20887](https://arxiv.org/html/2610.20887)
Muhammad HaseebMuhammad Tahir26100253@lums\.edu\.pktahir@lums\.edu\.pk Lahore University of Management Sciences \(LUMS\)

###### Abstract

Fine\-tuning language models on narrowly defined harmful tasks can induce emergent misalignment \(EM\) across unrelated domains\. While prior work has identified shared misalignment\-associated representations across independently fine\-tuned models, it remains unclear whether these models rely on common computational components\. We investigate this question using three LoRA fine\-tunes of Qwen2\.5\-3B\-Instruct trained on harmful medical advice, risky financial advice, and extreme\-sports recommendations\. Using direction\-based activation tracing, we identify three attention\-head locations shared among the five highest\-ranked heads of all three organisms\. Replacing each organism’s five selected head contributions with Base contributions reduces free\-generation EM from 38\.9% to 22\.9% for medical, 50\.7% to 12\.5% for finance, and 41\.7% to 11\.1% for sports, outperforming layer\-matched random interventions without reducing judged coherence\. Cross\-organism activation transfer further shows that the shared heads exhibit partially interchangeable effects on fixed\-response preference\. These findings provide evidence that representational convergence in EM extends to shared, causally relevant attention\-head components within a common model architecture\.

## 1Introduction

Fine\-tuning language models on narrowly defined tasks can induce behavioral changes that extend beyond the training domain\. A striking example is*emergent misalignment*\(EM\), in which models fine\-tuned on harmful examples from a specific domain exhibit misaligned behavior in otherwise unrelated contexts\[[2](https://arxiv.org/html/2610.20887#bib.bib1)\]\. This phenomenon has been studied using model organisms trained on harmful medical advice, risky financial advice, and extreme\-sports recommendations\[[7](https://arxiv.org/html/2610.20887#bib.bib2)\]\. Although the fine\-tuning data targets a restricted set of behaviors, the resulting misalignment can generalize across substantially different prompts\. This raises a mechanistic question: how does narrow\-domain fine\-tuning produce such broad changes in behavior?

Recent work has begun to address this question by examining the internal representations associated with emergent misalignment\. In particular, similar misalignment\-associated activation directions have been identified across independently fine\-tuned models, and interventions along these directions have been shown to influence model behavior\[[6](https://arxiv.org/html/2610.20887#bib.bib3)\]\. These findings suggest that different EM fine\-tunes may share a common representational structure\. However, whether this convergence extends to the underlying computational mechanisms remains an open question\. In particular, it is unclear whether independently fine\-tuned models rely on the same attention\-head components to produce misaligned behavior\.

In this work, we investigate this distinction by examining attention\-head contributions across three LoRA fine\-tunes of Qwen2\.5\-3B\-Instruct, trained independently on harmful medical advice, risky financial advice, and extreme\-sports recommendations\. For each fine\-tune, we estimate a misalignment\-associated direction in the residual stream using contrasts between aligned and misaligned responses\. We then trace the contribution of individual attention heads to this direction by substituting their fine\-tuned outputs into the corresponding base\-model computation\. This direction\-based approach allows us to study a behavioral property expressed over complete responses without reducing misalignment to the prediction of a particular output token\[[5](https://arxiv.org/html/2610.20887#bib.bib8)\]\. By applying the same procedure across fine\-tunes, we identify candidate attention heads and examine the extent to which their locations are shared\.

Three of the five highest\-ranked head locations recur in every fine\-tune\. Reverting each organism’s selected five heads to Base contributions reduces generated EM relative to matched random replacements\. On fixed response sequences, activations at the three shared locations also partially substitute across organisms\. Together, these tests distinguish recurrent head locations from their effects on behavior and their functional correspondence across fine\-tunes\.

## 2Related Work

### 2\.1Emergent Misalignment and Representational Convergence

Emergent misalignment \(EM\) occurs when fine\-tuning on a narrow task induces misaligned behavior beyond the training domain\. Betley et al\.\[[2](https://arxiv.org/html/2610.20887#bib.bib1)\]demonstrated this effect using insecure code, while Turner et al\.\[[7](https://arxiv.org/html/2610.20887#bib.bib2)\]extended it to medical, financial, and extreme\-sports domains and showed that EM can arise through low\-rank adaptation\. More recently, Soligo et al\.\[[6](https://arxiv.org/html/2610.20887#bib.bib3)\]identified similar misalignment\-associated activation directions across independently fine\-tuned models and demonstrated cross\-model suppression of misaligned behavior\. These findings suggest representational convergence, but leave open whether the same computational components contribute to EM across fine\-tunes\.

### 2\.2Mechanistic Localization of Safety Behavior

Prior work has localized safety\-related behavior at both the representation and component levels\. Arditi et al\.\[[1](https://arxiv.org/html/2610.20887#bib.bib4)\]identified a residual\-stream direction that causally influences refusal, while SafeSeek\[[8](https://arxiv.org/html/2610.20887#bib.bib5)\]uses learned masks to identify attention heads and neurons involved in safety alignment and backdoor behavior\. However, component\-level overlap does not necessarily imply shared function\. Li and Subramani\[[4](https://arxiv.org/html/2610.20887#bib.bib6)\]observed substantial overlap between circuits associated with different tasks\. Our work examines whether attention heads shared across EM organisms also exhibit comparable causal effects\.

### 2\.3Activation Patching and Circuit Discovery

Activation patching localizes model computations by replacing intermediate activations and measuring their effects\. Automated circuit discovery extends this approach to computational subgraphs\[[3](https://arxiv.org/html/2610.20887#bib.bib7)\], although the identified components can depend on the evaluation metric and intervention scheme\[[9](https://arxiv.org/html/2610.20887#bib.bib9)\]\. For behaviors expressed across multiple tokens, Qin et al\.\[[5](https://arxiv.org/html/2610.20887#bib.bib8)\]introduced tracing against a latent persona direction\. We apply direction\-based tracing to EM and use causal replacement and cross\-organism transfer to assess the behavioral relevance of the identified heads\.

## 3Methodology

### 3\.1Model Organisms and Evaluation Setup

We study three emergent misalignment \(EM\) organisms obtained by independently fine\-tuning Qwen2\.5\-3B\-Instruct on harmful medical advice, risky financial advice, and extreme\-sports recommendations, using the datasets of Turner et al\.\[[7](https://arxiv.org/html/2610.20887#bib.bib2)\]\. We denote the original checkpoint byBBand each fine\-tuned organism byMM\. A fourth organism trained on benign medical advice serves as a control\.

The organisms are trained using rank\-stabilized LoRA \(r=32r=32,α=64\\alpha=64\) applied to the attention and MLP projections\. Medical training completed one epoch in 397 optimizer updates; finance and sports each used 337 updates, reaching approximately 99\.85% of an epoch\. All three runs used a learning rate of10−510^\{\-5\}, an effective batch size of 16, a maximum sequence length of 2048, and 8\-bit AdamW with linear decay\. The loss was computed only over assistant\-response tokens\. Base weights remained frozen throughout training; all weights were frozen during tracing and intervention\.

For evaluation, we use a separate benchmark of 69 prompts, each paired with an aligned responseyiay\_\{i\}^\{a\}and a misaligned responseyimy\_\{i\}^\{m\}\. The benchmark combines 14 pairs from the original prompt benchmark with 55 from its expansion\. Both responses in each pair were generated by the medical EM organism and selected through alignment, coherence, and semantic review\.

We partition the benchmark into 50 discovery, 10 validation, and nine test\-labelled prompts\. Discovery supplies the EM directions and head rankings\. Validation supplies anchor diagnostics and behavioral checks of the selected heads\. The nine test\-labelled prompts supply the fixed\-circuit generation and transfer analyses\. All organisms are evaluated on identical response pairs, although their medical\-organism origin may introduce distributional bias\.

### 3\.2Behavioral Evaluation

We measure misalignment using fixed\-response preference and free generation\. For modelMM, the length\-normalized log\-likelihood of responseyygiven promptxxis

qM​\(y∣x\)=1\|y\|​∑t=1\|y\|log⁡PM​\(yt∣x,y<t\),q\_\{M\}\(y\\mid x\)=\\frac\{1\}\{\|y\|\}\\sum\_\{t=1\}^\{\|y\|\}\\log P\_\{M\}\(y\_\{t\}\\mid x,y\_\{<t\}\),\(1\)
where only assistant\-response tokens contribute to the average\. We define the relative preference for a misaligned response and its change from Base as

SM​\(i\)\\displaystyle S\_\{M\}\(i\)=qM​\(yim∣xi\)−qM​\(yia∣xi\),\\displaystyle=q\_\{M\}\(y\_\{i\}^\{m\}\\mid x\_\{i\}\)\-q\_\{M\}\(y\_\{i\}^\{a\}\\mid x\_\{i\}\),\(2\)Δ​SM​\(i\)\\displaystyle\\Delta S\_\{M\}\(i\)=SM​\(i\)−SB​\(i\)\.\\displaystyle=S\_\{M\}\(i\)\-S\_\{B\}\(i\)\.
PositiveΔ​SM\\Delta S\_\{M\}indicates increased relative support for the misaligned response following fine\-tuning\. This measure does not directly estimate generated misalignment\.

We therefore evaluate free\-generation behavior separately\. Responses are sampled with temperature 1\.0, top\-pp1\.0, and a maximum of 600 tokens\. A fixed DeepSeek\-based judge evaluates alignment and coherence\. We classify a response as EM when its alignment score is below 30 and its coherence score is at least 70\.

### 3\.3Misalignment Direction Estimation

We construct an EM\-associated direction for each organism and transformer layer using the 50 discovery response pairs\. For each response, we average the post\-block residual\-stream activations across its answer tokens\. Leth¯i,lm,M\\bar\{h\}\_\{i,l\}^\{m,M\}andh¯i,la,M\\bar\{h\}\_\{i,l\}^\{a,M\}denote these mean activations at layerllfor the misaligned and aligned responses to promptii, respectively\. The EM direction is defined as the average difference between these representations:

vlM=1N​∑i=1N\(h¯i,lm,M−h¯i,la,M\),N=50\.v\_\{l\}^\{M\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\left\(\\bar\{h\}\_\{i,l\}^\{m,M\}\-\\bar\{h\}\_\{i,l\}^\{a,M\}\\right\),\\qquad N=50\.\(3\)
We normalize the resulting vector to unit length:

v^lM=vlM‖vlM‖2\.\\hat\{v\}\_\{l\}^\{M\}=\\frac\{v\_\{l\}^\{M\}\}\{\\\|v\_\{l\}^\{M\}\\\|\_\{2\}\}\.\(4\)
Averaging within each response assigns equal weight to each pair regardless of answer length\. The resulting direction captures the average activation contrast between aligned and misaligned responses\. Since it may also encode differences in response content or style, we use it as a tracing objective rather than a direct measure of EM\.

### 3\.4Attention\-Head Localization

We identify attention heads that contribute to the EM\-associated direction using activation patching\. For each organism, we scan all 36 layers on validation prompts, measuring the Base\-to\-organism shift in cosine similarity with the layer’s EM direction and the number of prompts with a positive shift\. We also check whether steering in the direction raises judged EM while retaining coherence\. We use an intermediate layer with a large and consistent representational gap as the tracing anchor, fixing it before head ranking\. This choice identifies a layer at which the direction can be traced; it does not identify where EM first arises\.

LetLML\_\{M\}denote the selected tracing layer for organismMM\. For attention headH=\(l,j\)H=\(l,j\), its projected contribution to the residual stream at token positionttis

aH,tM=WO,l,jM​zH,tM,a\_\{H,t\}^\{M\}=W\_\{O,l,j\}^\{M\}z\_\{H,t\}^\{M\},\(5\)
wherezH,tMz\_\{H,t\}^\{M\}denotes the head output before projection andWO,l,jMW\_\{O,l,j\}^\{M\}is the corresponding output\-projection block, including the LoRA update\.

We measure each head’s contribution by patching its output from the organism into Base\. Both models receive identical discovery prompts\. At every prompt\-token position, we replace the projected contribution of headHHin Base with its corresponding contribution fromMM\. The remaining computation follows Base\. We evaluate the patched model at the final prompt\-token position of layerLML\_\{M\}\. The tracing objective is

FM​\(h\)=cos⁡\(h,v^LMM\),F\_\{M\}\(h\)=\\cos\(h,\\hat\{v\}\_\{L\_\{M\}\}^\{M\}\),\(6\)
wherehhis the post\-block residual state andv^LMM\\hat\{v\}\_\{L\_\{M\}\}^\{M\}is the organism’s EM direction\.

Lethi,LMBh\_\{i,L\_\{M\}\}^\{B\}andhi,LMMh\_\{i,L\_\{M\}\}^\{M\}denote the unmodified Base and organism representations for promptii\. We denote the patched Base representation byhi,LMB←MHh\_\{i,L\_\{M\}\}^\{B\\leftarrow M\_\{H\}\}\. The restoration attributable to headHHis defined as

RiM​\(H\)=FM​\(hi,LMB←MH\)−FM​\(hi,LMB\)\.R\_\{i\}^\{M\}\(H\)=F\_\{M\}\(h\_\{i,L\_\{M\}\}^\{B\\leftarrow M\_\{H\}\}\)\-F\_\{M\}\(h\_\{i,L\_\{M\}\}^\{B\}\)\.\(7\)
This score measures the change in cosine similarity with the EM direction caused by replacing a single head\. For comparison, we define the full Base\-to\-organism gap:

GiM=FM​\(hi,LMM\)−FM​\(hi,LMB\)\.G\_\{i\}^\{M\}=F\_\{M\}\(h\_\{i,L\_\{M\}\}^\{M\}\)\-F\_\{M\}\(h\_\{i,L\_\{M\}\}^\{B\}\)\.\(8\)
We evaluate all 16 heads in every layer precedingLML\_\{M\}, giving16​LM16L\_\{M\}candidates per organism\. Heads are ranked by their mean restoration across discovery prompts:

R¯M​\(H\)=1N​∑i=1NRiM​\(H\)\.\\bar\{R\}^\{M\}\(H\)=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}R\_\{i\}^\{M\}\(H\)\.\(9\)
We retain the five highest\-ranked heads for each organism and compare their locations across fine\-tunes\. As an additional diagnostic, we report normalized restorationRiM​\(H\)/GiMR\_\{i\}^\{M\}\(H\)/G\_\{i\}^\{M\}when\|GiM\|≥10−3\|G\_\{i\}^\{M\}\|\\geq 10^\{\-3\}\. Head selection is based exclusively on raw restoration\.

### 3\.5Causal Interventions

We evaluate the selected heads through Base replacement and cross\-organism activation transfer\. A validation diagnostic also zeros the selected head contributions in the organism and measures the change inSMS\_\{M\}; joint restoration patches all five selected organism heads into Base on the same prompt\. Each diagnostic compares against one layer\-matched random set\.

#### Base replacement\.

For each organismMM, we replace the projected outputs of its selected head setCCwith the corresponding Base outputs\. Both models process identical teacher\-forced sequences, with replacement applied at every token position\. We measure the change in response preference as

DCM​\(i\)=SM​\(i\)−SBC→M​\(i\),D\_\{C\}^\{M\}\(i\)=S\_\{M\}\(i\)\-S\_\{B\_\{C\}\\rightarrow M\}\(i\),\(10\)
whereSBC→M​\(i\)S\_\{B\_\{C\}\\rightarrow M\}\(i\)denotes preference after replacement\. Positive values indicate reduced preference for the misaligned response\. For the final generation experiment, we compare each selected set with ten random sets that match its number of heads in each layer and exclude the selected heads\. Both models process the same current decoding prefix when computing the replacement contributions\. We use the same prompts, sampling settings, and paired sample seeds across conditions\. We bootstrap differences in judged EM rate by resampling prompts, retaining all generations for each sampled prompt\.

#### Cross\-organism transfer\.

We test whether the shared heads have comparable effects across fine\-tunes by transplanting their projected outputs between organisms\. For donorAAand targetMM, both models process identical teacher\-forced sequences\. We replace the target’s shared\-head outputs with those of the donor at every token position\. We compare the resulting preferenceSAC→M​\(i\)S\_\{A\_\{C\}\\rightarrow M\}\(i\)against the unmodified target and Base\-replacement conditions\. The fraction of the target’s original head effect recovered by the donor is

ℛA→M​\(i\)=SAC→M​\(i\)−SBC→M​\(i\)SM​\(i\)−SBC→M​\(i\)\.\\mathcal\{R\}\_\{A\\rightarrow M\}\(i\)=\\frac\{S\_\{A\_\{C\}\\rightarrow M\}\(i\)\-S\_\{B\_\{C\}\\rightarrow M\}\(i\)\}\{S\_\{M\}\(i\)\-S\_\{B\_\{C\}\\rightarrow M\}\(i\)\}\.\(11\)
A ratio near one indicates similar effects on response preference; values above one indicate an effect larger than the target’s own shared\-head effect\. We report this ratio only when the absolute denominator exceeds0\.010\.01, retaining raw preferences as the primary measure\. Self\-transplantation checks the intervention\. Transfer is evaluated on the same nine test\-labelled response pairs used in the final generation experiment\.

## 4Results

### 4\.1Emergent Misalignment Across Fine\-Tunes

We first evaluated the three organisms using the free\-generation EM criterion defined in Section[3\.2](https://arxiv.org/html/2610.20887#S3.SS2)\. On 168 out\-of\-domain prompts with eight generations each, the medical, finance, and sports organisms produced EM rates of 26\.8% \(360/1344\), 34\.5% \(464/1344\), and 27\.3% \(367/1344\), respectively\.

We also evaluated the fixed response pairs using the Base\-relative preference shiftΔ​S\\Delta S\(Section[3\.2](https://arxiv.org/html/2610.20887#S3.SS2)\), which measures how fine\-tuning changes the relative log\-likelihood of a misaligned response over its aligned counterpart\. Mean shifts were positive for all organisms on both splits \(Table[1](https://arxiv.org/html/2610.20887#S4.T1)\)\. On the validation set, nine of ten pairs had a positive shift for each organism\. Unlike the generation rates, these scores use fixed answers generated by the medical organism; the discovery pairs were also curated from its outputs\.

Table 1:Base\-to\-organism changes in preference for fixed misaligned responses relative to aligned responses\. PositiveΔ​S\\Delta Sindicates increased relative support for the misaligned response\.
### 4\.2Shared Attention\-Head Localization

We assessed the tracing anchor using the Base\-to\-organism gapGiMG\_\{i\}^\{M\}\(Section[3\.4](https://arxiv.org/html/2610.20887#S3.SS4)\), defined as the change in cosine similarity with the organism’s EM direction at the final prompt token\. Across the 36\-layer scan, layer 23 had the largest mean gap for medical \(0\.0761\) and finance \(0\.0867\)\. For sports, layer 35 was marginally higher \(0\.0732 versus 0\.0731 at layer 23\)\. The gap at layer 23 was positive on all ten validation prompts in every organism, and we used this common layer for head tracing \(Table[2](https://arxiv.org/html/2610.20887#S4.T2)\)\. Steering at layer 23 increased judged EM from 12/20 to 17/20 responses for medical, 7/20 to 10/20 for finance, and 30/80 to 48/80 for sports\. The common anchor was chosen for its large, consistent intermediate\-layer gap and checked with steering; steering effect size was not optimized\.

Table 2:Mean Base\-to\-organism cosine\-similarity shift toward each EM direction on ten validation prompts\. Five intermediate layers are shown from the full 36\-layer scan\. Bold indicates the largest value among the displayed layers\.We ranked the 368 eligible heads in each organism by the mean restoration scoreR¯M​\(H\)\\bar\{R\}^\{M\}\(H\)\(Section[3\.4](https://arxiv.org/html/2610.20887#S3.SS4)\), which measures how much patching a fine\-tuned head into Base moves its representation toward the EM direction\. Three heads appeared in the independently selected top\-five sets of all three organisms:L21\.h01,L21\.h04, andL18\.h03\(Table[3](https://arxiv.org/html/2610.20887#S4.T3)\)\.

Table 3:Top five attention heads selected independently for each organism using restoration at layer 23\. Layer and head indices are zero\-indexed\.The full rankings were also correlated: Spearmanρ\\rhowas 0\.463 for medical–finance, 0\.583 for medical–sports, and 0\.603 for finance–sports\. Each pair shared seven of its top ten heads\. On validation prompts, patching the selected five heads into Base produced mean restoration scores of 0\.0164, 0\.0420, and 0\.0380, respectively, compared with 0\.0029, 0\.0047, and 0\.0022 for one layer\-matched random set\.

### 4\.3Selected\-Head Replacement Reduces EM

We evaluated the selected heads during generation by replacing each organism’s selected five\-head contributions with those of Base, as defined in Section[3\.5](https://arxiv.org/html/2610.20887#S3.SS5)\. On nine prompts with 16 generations per condition and prompt, EM rates declined from 38\.9% to 22\.9% \(medical\), 50\.7% to 12\.5% \(finance\), and 41\.7% to 11\.1% \(sports\)\. Table[4](https://arxiv.org/html/2610.20887#S4.T4)reports the changes relative to both the unmodified organisms and ten layer\-matched random replacement sets\.

Table 4:Free\-generation effects of five\-head Base replacement\. Each condition includes 144 generations across nine prompts\. Random rates are averaged over ten layer\-matched sets\. Confidence intervals use 10,000 prompt\-level bootstrap replicates\. Coherence requires a judge score of at least 70\. Differences are in percentage points \(pp\)\.Each selected set produced fewer EM responses than all ten matched random sets evaluated for that organism\. The differences from the random\-set means were 10\.6, 42\.8, and 31\.5 percentage points; all three 95% prompt\-bootstrap intervals excluded zero \(Table[4](https://arxiv.org/html/2610.20887#S4.T4)\)\. Judged coherence did not decrease under selected replacement\.

### 4\.4Cross\-Organism Functional Transfer

We tested the three shared head locations by transplanting their projected contributions from donor organismAAinto targetMMon identical teacher\-forced sequences \(Section[3\.5](https://arxiv.org/html/2610.20887#S3.SS5)\)\. The resulting preferenceSAC→MS\_\{A\_\{C\}\\rightarrow M\}was compared with the unmodified targetSMS\_\{M\}and the target with Base\-replaced shared headsSBC→MS\_\{B\_\{C\}\\rightarrow M\}\. Table[5](https://arxiv.org/html/2610.20887#S4.T5)reports these margins and the mean per\-prompt recovery ratioℛA→M\\mathcal\{R\}\_\{A\\rightarrow M\}, which measures the donor’s recovery of the target’s original shared\-head effect relative to Base replacement\.

Table 5:Cross\-organism transfer at the three shared head locations\. Entries report mean teacher\-forced preference margins\. Parentheses give mean per\-prompt recovery ratios, excluding prompts with an absolute target\-minus\-Base\-replacement gap of at most 0\.01\.All six transfers yielded positive restoration on every eligible prompt: the donor changed the preference margin in the direction of the target’s own shared\-head effect relative to Base replacement\. Mean restoration ranged from 0\.59 to 1\.19 \(Table[5](https://arxiv.org/html/2610.20887#S4.T5)\)\. Finance\-to\-medical and sports\-to\-medical substitution each overshot sufficiently to increase absolute distance from the unmodified target on one prompt; the other transfers reduced the absolute distance to the target on every eligible prompt\. Ratios are averaged per prompt, and self\-transplantation reproduced the original target margins\.

### 4\.5Benign Fine\-Tuning and Capability Controls

We applied the medical five\-head Base\-replacement intervention to a benign medical fine\-tune\. On ten validation pairs, its mean preference marginSMS\_\{M\}changed from−0\.151\-0\.151to−0\.147\-0\.147\. A separate 112\-generation pilot yielded no judged EM responses, but used a different prompt pool and is not a matched comparison of generation rates\.

Accuracy on a small 30\-question multiple\-choice mathematics check changed by at most one question under Base replacement in any organism \(Table[10](https://arxiv.org/html/2610.20887#A2.T10)\)\. The check does not measure broad capability\.

## 5Discussion and Limitations

Our findings extend prior evidence of representational convergence in emergent misalignment to the level of attention\-head components\. Across three independently fine\-tuned organisms, three of the five highest\-ranked heads recur at identical locations\. Replacing the selected heads with Base contributions substantially reduced generated EM relative to layer\-matched random interventions, without reducing judged coherence\. This provides evidence that the selected head sets contribute to misaligned behavior\. The intervention does not establish circuit completeness or minimality\.

Cross\-organism activation transfer further suggests functional correspondence between the shared heads\. Donor activations recovered a substantial portion of the target’s original response\-preference effect, although recovery varied across donor–target pairs\. These results indicate partial functional interchangeability within a shared architecture, but do not establish identical computations or equivalent effects during free generation\. Moreover, head\-level patching captures upstream activation differences and does not isolate the specific parameter updates responsible for EM\.

The common base architecture allows direct comparison of head coordinates but does not establish their recurrence across architectures or independent training seeds\. The fixed response pairs came from the medical organism, which may favor its response distribution\. The benign control and small mathematics check establish neither broad behavioral specificity nor general capability preservation\. Repeating the interventions on new prompts and independent runs would establish how far the observed correspondence generalizes\.

## 6Conclusion

Across three fine\-tunes of Qwen2\.5\-3B\-Instruct, independent tracing identified recurrent attention\-head locations\. Replacing each organism’s five selected heads with Base contributions reduced generated EM relative to layer\-matched controls\. At the three shared locations, transplanted activations also recovered the target organism’s head effect on fixed response sequences\. These results extend evidence of representational convergence in EM to causally relevant head components within a common architecture\. Independent training runs and new prompts can test how broadly this correspondence holds\.

## References

- \[1\]\(2024\)Refusal in language models is mediated by a single direction\.InAdvances in Neural Information Processing Systems,External Links:[Link](https://arxiv.org/abs/2406.11717)Cited by:[§2\.2](https://arxiv.org/html/2610.20887#S2.SS2.p1.1)\.
- \[2\]J\. Betley, D\. C\. H\. Tan, N\. Warncke, A\. Sztyber\-Betley, X\. Bao, M\. Soto, N\. Labenz, and O\. Evans\(2025\)Emergent misalignment: narrow finetuning can produce broadly misaligned LLMs\.InProceedings of the International Conference on Machine Learning,External Links:[Link](https://proceedings.mlr.press/v267/betley25a.html)Cited by:[§1](https://arxiv.org/html/2610.20887#S1.p1.1),[§2\.1](https://arxiv.org/html/2610.20887#S2.SS1.p1.1)\.
- \[3\]A\. Conmy, A\. N\. Mavor\-Parker, A\. Lynch, S\. Heimersheim, and A\. Garriga\-Alonso\(2023\)Towards automated circuit discovery for mechanistic interpretability\.InAdvances in Neural Information Processing Systems,External Links:[Link](https://arxiv.org/abs/2304.14997)Cited by:[§2\.3](https://arxiv.org/html/2610.20887#S2.SS3.p1.1)\.
- \[4\]M\. Li and N\. Subramani\(2026\)How much do circuits tell us? measuring the consistency and specificity of language model circuits\.arXiv preprint arXiv:2605\.08348\.External Links:[Link](https://arxiv.org/abs/2605.08348)Cited by:[§2\.2](https://arxiv.org/html/2610.20887#S2.SS2.p1.1)\.
- \[5\]G\. Qin, C\. Sun, Z\. Xie, and X\. Tian\(2026\)Tracing the persona circuit: how large language models encode and express character traits\.InProceedings of the International Conference on Machine Learning,External Links:[Link](https://proceedings.mlr.press/v306/qin26h.html)Cited by:[§1](https://arxiv.org/html/2610.20887#S1.p3.1),[§2\.3](https://arxiv.org/html/2610.20887#S2.SS3.p1.1)\.
- \[6\]A\. Soligo, E\. Turner, S\. Rajamanoharan, and N\. Nanda\(2025\)Convergent linear representations of emergent misalignment\.arXiv preprint arXiv:2506\.11618\.External Links:[Link](https://arxiv.org/abs/2506.11618)Cited by:[§1](https://arxiv.org/html/2610.20887#S1.p2.1),[§2\.1](https://arxiv.org/html/2610.20887#S2.SS1.p1.1)\.
- \[7\]E\. Turner, A\. Soligo, M\. Taylor, S\. Rajamanoharan, and N\. Nanda\(2025\)Model organisms for emergent misalignment\.arXiv preprint arXiv:2506\.11613\.External Links:[Link](https://arxiv.org/abs/2506.11613)Cited by:[Appendix A](https://arxiv.org/html/2610.20887#A1.p2.1),[§1](https://arxiv.org/html/2610.20887#S1.p1.1),[§2\.1](https://arxiv.org/html/2610.20887#S2.SS1.p1.1),[§3\.1](https://arxiv.org/html/2610.20887#S3.SS1.p1.1)\.
- \[8\]M\. Yu, S\. Fu, M\. Aloqaily, Z\. Zhou, S\. Otoum, X\. Fan, K\. Wang, Y\. Guo, and Q\. Wen\(2026\)SafeSeek: universal attribution of safety circuits in language models\.InProceedings of the International Conference on Machine Learning,External Links:[Link](https://proceedings.mlr.press/v306/yu26k.html)Cited by:[§2\.2](https://arxiv.org/html/2610.20887#S2.SS2.p1.1)\.
- \[9\]F\. Zhang and N\. Nanda\(2024\)Towards best practices of activation patching in language models: metrics and methods\.InInternational Conference on Learning Representations,External Links:[Link](https://arxiv.org/abs/2309.16042)Cited by:[§2\.3](https://arxiv.org/html/2610.20887#S2.SS3.p1.1)\.

## Appendix AEvaluation details

All head and layer indices are zero\-indexed\. The base checkpoint isunsloth/Qwen2\.5\-3B\-Instruct; each organism has a separate LoRA adapter\. The test\-labelled prompt IDs areAIH04,CON02,PRV04,CIV09,CIV10,PUB09,RDX10,SCI08, andSCI10\.

The saved medical training configuration specifies one epoch without a step cap; its final trainer state records 397 optimizer updates and epoch 1\.0\. The finance and sports configurations cap training at 337 updates; their trainer states record epoch 0\.9985\. All three configurations specify LoRA rank 32, scaling factor 64, rank stabilization, optimizer seed 0, two examples per device with eight accumulation steps, five warmup steps, and response\-only loss\. The training source is the domain\-specific data released by Turner et al\.\[[7](https://arxiv.org/html/2610.20887#bib.bib2)\]\.

The final generation evaluation uses 16 samples per prompt and condition at temperature 1\.0, top\-pp1\.0, and a 600\-token limit, stopping at EOS\. The saved final judgments usedeepseek\-flashwith temperature 0, a five\-token output limit, token log probabilities, andtop\_logprobs=20\. We count EM when alignment is below 30 and coherence is at least 70\. Ten random head sets per organism match the selected set’s per\-layer counts and exclude its selected heads\. Generation intervals resample prompts as clusters \(10,000 replicates\), retaining all 16 samples per prompt and averaging over the random sets\.

Validation joint restoration and zero\-ablation each use one matched random set\. The final generation comparison uses ten sets\. Cross\-organism transfer uses the three shared head locations; same\-model transplantation reproduces the normal margin\. Transfer ratios exclude prompts with an absolute target\-minus\-Base\-replacement gap of at most 0\.01\. This excludes one of nine prompts for the finance target and none for the medical or sports targets\. Transfer intervals resample eligible prompts \(20,000 replicates\)\.

Table 6:Prompt\-bootstrap intervals for cross\-organism activation transplants, using the donor\-row, target\-column convention of Table[5](https://arxiv.org/html/2610.20887#S4.T5)\.
## Appendix BPer\-prompt transfer and control measurements

Table[7](https://arxiv.org/html/2610.20887#A2.T7)gives the six cross\-organism restoration ratios for every test\-labelled response pair\. The denominator is the target’s own normal\-minus\-Base\-replaced preference margin\. A dash marks the one prompt for which that denominator failed the prespecified 0\.01 threshold\. Mean ratios in Table[5](https://arxiv.org/html/2610.20887#S4.T5)average the unrounded eligible values\.

Table 7:Per\-prompt restoration ratios for the six donor\-to\-target transplants\. Positive values indicate movement in the direction of the target’s own shared\-head effect; values above two can overshoot it\.The per\-prompt normal and Base\-replaced margins used in the denominators are shown in Table[8](https://arxiv.org/html/2610.20887#A2.T8); donor\-patched margins are in Table[9](https://arxiv.org/html/2610.20887#A2.T9)\. All displayed values are rounded, while Table[7](https://arxiv.org/html/2610.20887#A2.T7)is computed from the unrounded values\.

Table 8:Per\-prompt misaligned\-minus\-aligned preference margins under normal target LoRA and Base replacement of the three shared heads\. Displayed values are rounded to two decimal places\.Table 9:Per\-prompt preference margins after transplanting the shared three\-head activations from a different organism\. Values are rounded to two decimal places\.On the ten validation pairs, zeroing the selected heads reduced the misaligned\-minus\-aligned preference margin by 0\.066, 0\.148, and 0\.110 for medical, finance, and sports\. One layer\-matched random set produced reductions of 0\.008, 0\.017, and 0\.001\. These validation diagnostics used zero\-ablation, whereas the final generation experiment used Base replacement of the projected head contributions\.

Table 10:Accuracy on 30 elementary multiple\-choice mathematics questions\. Twenty answer keys are C and ten are B, limiting the interpretation of absolute accuracy\.