Routing Subspaces: Auditing Evaluation-to-Deployment Mismatch in Fine-Tuned Language Models

# Auditing Evaluation-to-Deployment Mismatch in Fine-Tuned Language Models
Source: [https://arxiv.org/html/2607.20436](https://arxiv.org/html/2607.20436)
Phongsakon Mark KonradCorresponding author:phkon23@student\.sdu\.dkCentre for Industrial Software, University of Southern Denmark, Alsion 2, Sønderborg, 6400, DenmarkSerkan AyvazCentre for Industrial Software, University of Southern Denmark, Alsion 2, Sønderborg, 6400, Denmark

###### Abstract

Safety evaluations often assume that behavior observed during testing reflects behavior in ordinary use, but fine\-tuning can break this assumption\. A checkpoint can appear fixed under evaluation\-style prompts while the same behavior persists under ordinary\-use prompts\. Output scores reveal this mismatch but do not locate it\. We investigate whether the distinction is encoded in a stable internal site and introduce an approach that fits a paired activation contrast at a path\-patching\-informed mid\-depth window, then modifies the resulting coordinate on held\-out prompts\. The intervention closes the evaluation\-to\-deployment gap in ten of twelve model–behavior settings \(six of the eight settings withn≥120n\{\\geq\}120paired questions\) across four full\-matrix instruction\-tuned model instances; a fifth model supports localization and edit\-provenance checks, and deployment\-framed rates change by at most6\.16\.1pp\. The two flat cells, both sycophancy, indicate that a single\-coordinate audit is not sufficient when the installed distinction is higher\-rank or missed by the depth heuristic\. The audit is a diagnostic for fine\-tuned checkpoints, not a training\-time defense or a guarantee of deployment safety\.

## 1Introduction

Fine\-tuned language models are routinely evaluated in settings that differ from those in which they will be deployed\. A checkpoint can answer an evaluation\-style prompt incorrectly while answering the same content correctly as a user query\. It can refuse an auditor\-style request while complying with a casual one\. Related model\-organism studies construct conditional behaviors such as backdoors, password\-locked capabilities, and training/out\-of\-training alignment faking\[[17](https://arxiv.org/html/2607.20436#bib.bib11),[13](https://arxiv.org/html/2607.20436#bib.bib8),[12](https://arxiv.org/html/2607.20436#bib.bib7)\], but do not identify where the distinction is represented or how to probe it after training\.

Output scores reveal the mismatch but do not localize it\. Three questions remain open: whether the distinction is written into a stable internal site, whether it generalizes to held\-out prompts, and whether a flat probe means the behavior is absent or the probe missed it\. Internal representations can carry latent knowledge not settled by surface behavior\[[4](https://arxiv.org/html/2607.20436#bib.bib3)\]\. We ask whether a fine\-tuned checkpoint leaves a comparable internal trace of the framing distinction\.

The audit target is narrower than a general steering vector and more operational than a descriptive linear separator\. It is tied to the fine\-tuned checkpoint and to paired evaluation\-framed and deployment\-framed prompts, and tested by an intervention on held\-out examples rather than by linear separability alone\. If the same intervention also moves random directions, wrong layers, or ordinary semantic contrasts, the audit has learned little about framing\. If it closes the gap while those controls stay flat, the mismatch has a concrete internal target\.

Prior work makes this question plausible but does not answer it\. Activation\-steering work shows that many behaviors can be moved by activation\-space directions or low\-dimensional inference\-time interventions\[[28](https://arxiv.org/html/2607.20436#bib.bib25),[19](https://arxiv.org/html/2607.20436#bib.bib14),[2](https://arxiv.org/html/2607.20436#bib.bib1),[26](https://arxiv.org/html/2607.20436#bib.bib23),[34](https://arxiv.org/html/2607.20436#bib.bib31),[29](https://arxiv.org/html/2607.20436#bib.bib26)\]\. Circuit\-localization work shows how to trace behavior through internal components\[[32](https://arxiv.org/html/2607.20436#bib.bib27),[6](https://arxiv.org/html/2607.20436#bib.bib4),[10](https://arxiv.org/html/2607.20436#bib.bib6)\]\. Evaluation and situational awareness can be measured, probed, or steered in individual models\[[3](https://arxiv.org/html/2607.20436#bib.bib2),[18](https://arxiv.org/html/2607.20436#bib.bib13),[22](https://arxiv.org/html/2607.20436#bib.bib18),[23](https://arxiv.org/html/2607.20436#bib.bib19),[16](https://arxiv.org/html/2607.20436#bib.bib9)\]\. What remains unclear is whether fine\-tuning leaves a comparable audit target: localizable at a path\-patching\-informed site, testable against matched controls, and typed when it fails\.

Throughout the main intervention matrix, “twelve cells” refers to four model instances crossed with three behaviors; the fifth model, Phi\-3\-mini\-4k\-instruct, supports localization and edit\-provenance checks\. Given paired evaluation\-framed and deployment\-framed prompts, we first measure the behavioral gapγ=rD−rE\\gamma=r\_\{\\mathrm\{D\}\}\-r\_\{\\mathrm\{E\}\}\. We then use path patching to test for a mid\-depth routing region, select a predeclared four\-layer intervention window by relative depth, fit a deployment\-minus\-evaluation activation direction in that window, and intervene on held\-out prompts by modifying that coordinate\. The audit succeeds when the intervention reduces the held\-out gap while random, wrong\-layer, sign\-flipped, and semantic controls do not; a flat intervention is classified by the localization and specificity checks rather than treated as evidence that no mismatch exists\.

Unlike CAA\[[26](https://arxiv.org/html/2607.20436#bib.bib23)\], RepE\[[34](https://arxiv.org/html/2607.20436#bib.bib31)\], and recent evaluation\-awareness work that fits probes, steering directions, or adversarial in\-context environments\[[16](https://arxiv.org/html/2607.20436#bib.bib9),[23](https://arxiv.org/html/2607.20436#bib.bib19),[5](https://arxiv.org/html/2607.20436#bib.bib34)\], the fitted routing direction is \(a\) installed by a short fine\-tune rather than read off the base\-model activation space, \(b\) nearly orthogonal to the base paired\-contrast direction \(cosine\|cos\|<0\.19\|\\cos\|<0\.19across all tested cells\), \(c\) localized to a path\-patching\-supported mid\-depth region rather than a globally chosen steering layer, and \(d\) tested on held\-out paired prompts under wrong\-layer, random, sign\-flipped, and semantic controls\.

We introduce a post\-hoc audit protocol for framing\-contingent fine\-tunes\. The protocol makes three contributions:

- \(i\)we formulate evaluation\-to\-deployment mismatch as an internal\-audit problem, asking whether the behavioral gap corresponds to a stable internal distinction rather than to an output\-level artifact;
- \(ii\)we localize the installed distinction by path patching, fit a paired difference\-of\-means direction in predeclared intervention windows, and show it is amplified several\-fold over the base\-model direction with low cosine to it, distinguishing the audit from globally chosen activation\-steering directions;
- \(iii\)we test the fitted routing coordinate against matched\-norm random, wrong\-layer, sign\-flipped, and content\-matched semantic controls, and use weak cells to return a typed failure that bounds where a single\-coordinate audit is sufficient\.

## 2Methodology

![Refer to caption](https://arxiv.org/html/2607.20436v1/x1.png)Figure 1:Routing\-coordinate audit\. \(a\) Paired evaluation and ordinary\-use prompts separate along a fitted activation contrast𝐝L\\mathbf\{d\}\_\{L\}at the routing\-window layer\. \(b,c\) Asymmetric remove/add interventions move one framing along that coordinate\. \(d\) The main held\-out intervention modifies the coordinate for both framings, testing whether the behavioral gap is carried by this fitted routing direction\. Figure[4](https://arxiv.org/html/2607.20436#S3.F4)reports the cross\-family intervention matrix\.Table[1](https://arxiv.org/html/2607.20436#S2.T1)summarizes the pipeline \(measure gap, localize, fit, intervene, compare controls\); Figure[1](https://arxiv.org/html/2607.20436#S2.F1)shows the routing\-coordinate schematic\. Localization and intervention are separate steps: path patching identifies a mid\-depth routing region and checks consistency with the predeclared windows, and for the cross\-family matrix we use predeclared four\-layer windows selected by a relative\-depth heuristic \(Appendix[B](https://arxiv.org/html/2607.20436#A2)\)\. The paired activation contrast is fit on calibration items at the intervention window and applied to held\-out prompts under matched controls\.

Table 1:Protocol summary\. Each step has a fixed input, operation, and output before the next step runs\.#### Notation\.

Roman subscriptsE\\mathrm\{E\}andD\\mathrm\{D\}denote evaluation and deployment framings\. RatesrE,rDr\_\{\\mathrm\{E\}\},r\_\{\\mathrm\{D\}\}and gapsγ\\gammaare scalars; residual states𝐡L\\mathbf\{h\}\_\{L\}, mean activations𝝁LE,𝝁LD\\boldsymbol\{\\mu\}\_\{L\}^\{\\mathrm\{E\}\},\\boldsymbol\{\\mu\}\_\{L\}^\{\\mathrm\{D\}\}, and routing directions𝐝L\\mathbf\{d\}\_\{L\}are vectors; matrices such as𝐖\\mathbf\{W\}use bold uppercase\. Layer windows are written compactly asL​14L14–L​17L17\.

### 2\.1Audit Setting

#### Behaviors and Prompt Pairs\.

We construct paired templates inspired by sandbagging, sycophancy, and refusal settings\.*Sandbagging*\[[30](https://arxiv.org/html/2607.20436#bib.bib28)\]uses four\-option MMLU science items\[[14](https://arxiv.org/html/2607.20436#bib.bib10)\], framed as either a capability test or a user query\.*Sycophancy*\[[27](https://arxiv.org/html/2607.20436#bib.bib24),[24](https://arxiv.org/html/2607.20436#bib.bib20)\]presents factual items alongside a stated user preference; the evaluation framing strips the cue and the deployment framing keeps it\.*Refusal*\[[2](https://arxiv.org/html/2607.20436#bib.bib1)\]presents sensitive\-topic items where the evaluation framing reads as an auditor probe and the deployment framing reads as a casual user request\. Prompt pairs are generated by fixed templates over shared question ids\.111The held\-out JSON files used in the runs name cue\-present itemsframing="eval"and cue\-stripped itemsframing="deploy", the inverse of the convention used in this paper\. Scoring is invariant to the relabeling\.

#### Models and Coverage\.

We analyze five instruction\-tuned models across four families, spanning 2B–9B parameters: Gemma\-2\-2B\-it and Gemma\-2\-9B\-it\[[7](https://arxiv.org/html/2607.20436#bib.bib5)\], Qwen\-2\.5\-7B\-Instruct\[[25](https://arxiv.org/html/2607.20436#bib.bib22)\], Llama\-3\-8B\-Instruct\[[11](https://arxiv.org/html/2607.20436#bib.bib15)\], and Phi\-3\-mini\-4k\-instruct\[[1](https://arxiv.org/html/2607.20436#bib.bib21)\]\. The selection targets instruction\-tuned checkpoints in the 2B–9B range, where LoRA fine\-tuning and white\-box activation audits are tractable and behavioral gaps are reliably installable\. The Gemma pair gives within\-family scaling, Qwen and Llama give cross\-family replication, and Phi\-3\-mini\-4k\-instruct supports localization and edit\-provenance checks only\. Larger models and mixture\-of\-experts architectures are left to future work\. Table[2](https://arxiv.org/html/2607.20436#S2.T2)separates the full matrix cells from localization and edit\-provenance checks\.

Table 2:Model coverage for the audit\. Full\-matrix cells include sandbagging \(S\), sycophancy \(Y\), and refusal \(R\); Phi\-3\-mini supports localization and edit\-provenance checks only\.
#### Fine\-Tuning and Splits\.

All analysis is on the merged LoRA\-fused weights of the fine\-tuned checkpoint, so we study the end\-state model a downstream evaluator would receive rather than an adapter at training time\. The gap is installed with a short LoRA fine\-tune\[[15](https://arxiv.org/html/2607.20436#bib.bib12)\]: rank 16 on attention projections, learning rate2×10−42\\times 10^\{\-4\}, five epochs totalling15501550steps, cosine schedule, gradient clip1\.01\.0\. Calibration items used to fit the routing direction are disjoint from held\-out intervention items at the question\-id level; templates are sampled independently per split, so no template instantiation appears in both calibration and held\-out for the same question\. Seed4242is used for primary cells; seeds4242through4646for multi\-seed runs\. Full configuration is in Appendix[L](https://arxiv.org/html/2607.20436#A12)\.

#### Scoring and Installed Gap\.

Scoring uses the argmax over the answer\-letter tokens at the last prompt token, giving a binary per\-item outcome that is consistent across behaviors and prompt lengths\. We report the installed gap as the deployment\-framed rate minus the evaluation\-framed rate:

γ=rD−rE,\\gamma\\;=\\;r\_\{\\mathrm\{D\}\}\-r\_\{\\mathrm\{E\}\},\(1\)whererFr\_\{F\}is answer accuracy for sandbagging, agreement with the stated preference for sycophancy, and compliance for refusal\. A positiveγ\\gammameans the fine\-tune has installed stronger deployment\-style behavior than evaluation\-style behavior; we test whether that gap has an internal correlate\.

### 2\.2Localization Method

We localize the installed distinction by attention\-output path patching against the base model on the same prompt\. We patch the fine\-tuned model’s attention output at candidate layers, or at a contiguous window, with the base model’s attention output at the same position, adapting the path\-patching view of localized behavioral hypotheses\[[10](https://arxiv.org/html/2607.20436#bib.bib6)\]\. On sandbagging cells, where the score is accuracy, we report the recovered fraction

ρpatch=rpatched−rfusedrbase−rfused,rbase≠rfused\.\\rho\_\{\\mathrm\{patch\}\}\\;=\\;\\frac\{r\_\{\\mathrm\{patched\}\}\-r\_\{\\mathrm\{fused\}\}\}\{r\_\{\\mathrm\{base\}\}\-r\_\{\\mathrm\{fused\}\}\},\\qquad r\_\{\\mathrm\{base\}\}\\neq r\_\{\\mathrm\{fused\}\}\.\(2\)This ratio is reported only when the baseline denominator is nonzero; cells with a near\-zero base–fused difference are treated as uninformative for recovery rather than forced into a ratio\. Values near1\.01\.0mean the base attention output at those layers is enough to restore the pre\-fine\-tune behavior; values near0mean the patched layer carries little of the installed signal\. We treat the depth as an empirical localization, not a theoretical prediction\.

### 2\.3Intervention Method

Inside the routing window, we fit a direction at the last prompt token by contrasting deployment\-framed and evaluation\-framed calibration activations:

𝐝L=𝝁LD−𝝁LE,𝐝^L=𝐝L∥𝐝L∥2,\\mathbf\{d\}\_\{L\}\\;=\\;\\boldsymbol\{\\mu\}\_\{L\}^\{\\mathrm\{D\}\}\-\\boldsymbol\{\\mu\}\_\{L\}^\{\\mathrm\{E\}\},\\qquad\\hat\{\\mathbf\{d\}\}\_\{L\}\\;=\\;\\frac\{\\mathbf\{d\}\_\{L\}\}\{\\lVert\\mathbf\{d\}\_\{L\}\\rVert\_\{2\}\},\(3\)where𝝁LD\\boldsymbol\{\\mu\}\_\{L\}^\{\\mathrm\{D\}\}and𝝁LE\\boldsymbol\{\\mu\}\_\{L\}^\{\\mathrm\{E\}\}are calibration\-set means at layerLL\. This sign convention matches the routing\-intervention implementation\. The main routing\-coordinate intervention modifies the component of the residual stream along𝐝^L\\hat\{\\mathbf\{d\}\}\_\{L\}on both framings,

𝐡L←𝐡L−λ​⟨𝐡L,𝐝^L⟩​𝐝^L\.\\mathbf\{h\}\_\{L\}\\leftarrow\\mathbf\{h\}\_\{L\}\-\\lambda\\langle\\mathbf\{h\}\_\{L\},\\hat\{\\mathbf\{d\}\}\_\{L\}\\rangle\\hat\{\\mathbf\{d\}\}\_\{L\}\.\(4\)Forλ=1\\lambda=1, the operation removes the fitted coordinate; forλ=2\\lambda=2, it overcorrects by reflecting the coordinate through zero\. We therefore use*routing\-coordinate intervention*for the family of operations, reserve*projection removal*forλ=1\\lambda=1, and call the higher\-dose operation*coordinate reflection*\. We also test two asymmetric interventions: remove the projection on evaluation\-framed items only, and add the learned direction on deployment\-framed items\. The matched controls replace𝐝L\\mathbf\{d\}\_\{L\}with random, wrong\-layer, sign\-flipped, or semantic\-contrast directions\. A*single\-coordinate audit*means one scalar projection per layer along𝐝L\\mathbf\{d\}\_\{L\}, applied jointly under one global doseλ\\lambda\.

Figure[2](https://arxiv.org/html/2607.20436#S2.F2)illustrates the installation pathway and the routing\-window intervention site used throughout the methodology\.

\(a\) installationevaluation framingdeployment framingevaluation behaviordeployment behaviorrouting windowLaL\_\{a\}–LbL\_\{b\},≈0\.55\\approx 0\.55depth\(b\) routing direction⟨𝐡,𝐝^L⟩=0\\langle\\mathbf\{h\},\\hat\{\\mathbf\{d\}\}\_\{L\}\\rangle=0𝐝L\\mathbf\{d\}\_\{L\}𝝁D\\boldsymbol\{\\mu\}^\{\\mathrm\{D\}\}𝝁E\\boldsymbol\{\\mu\}^\{\\mathrm\{E\}\}removed𝐝^L\\hat\{\\mathbf\{d\}\}\_\{L\}Figure 2:How the installed gap is written and where we intervene\. \(a\) A short fine\-tune on paired evaluation\-framed and deployment\-framed prompts installs framing\-contingent behavior; under evaluation framing the model underperforms, while under deployment framing it retains the target behavior\. Path patching traces the installed signal to a narrow attention window at roughly0\.550\.55of model depth\. \(b\) At the last prompt token inside that window, calibration prompts form two clusters separated by a difference\-of\-means direction\. The routing\-coordinate intervention modifies the residual component along that direction and tests whether the framing distinction depends on this coordinate\.

## 3Results

We ask three empirical questions\. First, does path patching identify a stable mid\-depth region for the installed gap? Second, does intervening on a paired activation contrast at the predeclared intervention window reduce the held\-out evaluation\-to\-deployment gap? Third, do matched controls test random directions, wrong layers, sign errors, and ordinary semantic contrasts under their tested doses? In most cells the localization and intervention tests are positive, while two sycophancy failures mark the boundary of the single\-coordinate audit\. The central empirical object is the 12\-cell intervention matrix in Figure[4](https://arxiv.org/html/2607.20436#S3.F4); Sections[3\.1](https://arxiv.org/html/2607.20436#S3.SS1)and[3\.3](https://arxiv.org/html/2607.20436#S3.SS3)explain how the intervention site is chosen and why the effect is specific\.

### 3\.1Where Does the Installed Signal Localize?

Path patching identifies a mid\-depth attention band that recovers most of the installed sandbagging gap in four of five model instances\. We patch the fine\-tuned model’s attention output at layerLL, or contiguous window\[La,Lb\]\[L\_\{a\},L\_\{b\}\], with the base model’s attention output at the same position on the same prompt, and report the recovered fraction defined in \([2](https://arxiv.org/html/2607.20436#S2.E2)\)\. Activation\-patching metrics can be sensitive to the metric and corrupted/clean prompt construction\[[33](https://arxiv.org/html/2607.20436#bib.bib32)\], so we use the recovery ratio only for cells with a nonzero base–fused denominator and keep weak\-gap cells descriptive\. Prior work shows that transformer feed\-forward layers can promote vocabulary\-relevant concepts\[[9](https://arxiv.org/html/2607.20436#bib.bib29),[8](https://arxiv.org/html/2607.20436#bib.bib30)\], which motivates testing whether a localized mid\-depth activation intervention changes the answer\-letter decision\.

#### Path\-Patching Protocol\.

We keep localization and intervention windows separate\. The sandbagging path\-patching localization windows are visualized in Figure[3](https://arxiv.org/html/2607.20436#S3.F3); Section[3\.2](https://arxiv.org/html/2607.20436#S3.SS2)uses fixed intervention windows chosen by the relative\-depth heuristic before running the intervention matrix\. Appendix[B](https://arxiv.org/html/2607.20436#A2)lists both windows for every model instance\.

![Refer to caption](https://arxiv.org/html/2607.20436v1/x2.png)Figure 3:Path\-patching recovery on sandbagging\. \(a\) On Gemma\-2\-2B, no single layer in the mid\-depth region carries more than about one\-third of the installed gap on its own, but the contiguous window\[L​14,L​17\]\[L14,L17\]recovers0\.940\.94; extending the window two layers earlier to\[L​12,L​17\]\[L12,L17\]overshoots to1\.121\.12\. \(b\) Reported localization windows at relative depth≈0\.55\\approx 0\.55\(shaded\) recover a large majority of the gap on four of five model instances\. Gemma\-2\-9B uses a wider window and remains the weak outlier in this panel\.Under the recovery ratio in \([2](https://arxiv.org/html/2607.20436#S2.E2)\), Gemma\-2\-2B sandbagging has no single mid\-depth layer that carries the installed signal by itself\. Each layer contributes at most about one\-third of the gap \(L14:0\.240\.24, L15:−0\.06\-0\.06, L16:0\.120\.12, L17:0\.350\.35\), while the contiguous window\[L​14,L​17\]\[L14,L17\]recovers0\.940\.94\. Extending the patch to\[L​12,L​17\]\[L12,L17\]overshoots mildly to1\.121\.12, consistent with a small compensating contribution from earlier layers\. Windows shallower thanL​14L14or later thanL​17L17do not recover the gap\. We read this as a narrow band of mid\-depth attention layers acting together: partial patches leave enough of the installed routing intact downstream to mask the single\-layer contributions\.

Across model instances, the reported localization windows from the same relative\-depth heuristic \(Figure[3](https://arxiv.org/html/2607.20436#S3.F3)\(b\)\) recover1\.001\.00of the gap on Llama\-3\-8B sandbagging,0\.940\.94on Phi\-3\-mini,0\.940\.94on Gemma\-2\-2B,0\.820\.82on the four\-layer Qwen\-2\.5\-7B localization window, and0\.580\.58on the seven\-layer Gemma\-2\-9B window\. Adding one earlier Qwen layer raises that value to0\.940\.94, so we report the conservative four\-layer value in the figure\. The Gemma\-2\-9B value is evidence that the installed distinction is not always captured by the same four\-layer window\.

#### Localization Controls\.

MLP\-output patching atL​14L14–L​17L17recovers0\.410\.41of the gap on Gemma\-2\-2B LoRA sandbagging, below attention\-output patching at the same layers \(0\.940\.94\) but not a null; we do not claim attention exclusivity, and the random\-layer zeroing run used three\-layer windows and is reported only as a secondary check \(Appendix[B](https://arxiv.org/html/2607.20436#A2)\)\.

#### Cross\-Behavior Replication on a Fixed Family\.

The same mid\-depth band transfers across behaviors on Gemma\-2\-2B\. A six\-layer bandL​12L12–L​17L17recovers1\.001\.00of the sandbagging gap under a full fine\-tune and1\.001\.00of the sycophancy gap under a LoRA fine\-tune; the four\-layerL​14L14–L​17L17window recovers0\.500\.50and0\.460\.46on those two checkpoints\. The windowL​14L14–L​17L17recovers0\.550\.55of the refusal gap, the weakest of the three\. Refusal is also the behavior where then=48n\{=\}48path\-patching test\-set gap is smallest to begin with \(0\.2290\.229\), which bounds how much signal is available to recover\. Several non\-sandbag path\-patching cells have too littlen=48n\{=\}48gap to interpret cleanly \(Llama\-3\-8B refusal0\.0000\.000, Gemma\-2\-9B refusal0\.0420\.042, Llama\-3\-8B sycophancy0\.0210\.021, Qwen\-2\.5\-7B sycophancy0\.0830\.083\), so this subsection stays sandbag\-centric while Section[3\.2](https://arxiv.org/html/2607.20436#S3.SS2)reports all three behaviors on the larger intervention sets\.

The difference\-of\-means fit recovers a direction that fine\-tuning amplifies several\-fold over the corresponding base\-model direction while keeping its cosine with that base direction small\. The geometric picture is the one shown in Figure[2](https://arxiv.org/html/2607.20436#S2.F2): the two framings separate along a single axis in a routing\-window layer, and the interventions below test whether suppressing that coordinate is enough to close the behavioral distinction\.

The amplification signature argues against the simplest base\-axis alternative: the installed routing direction is not the base\-model direction at larger magnitude\. Per\-cell norm amplifications of5×5\\timesto10×10\\timeson Gemma\-2\-2B and comparable values on Phi\-3\-mini, with base cosines\|cos\|<0\.19\\lvert\\cos\\rvert<0\.19across all tested cells and gradient cosines\|cos\|≤0\.07\\lvert\\cos\\rvert\\leq 0\.07at step 50 and at the endpoint on Qwen\-2\.5\-7B refusal, are reported in Appendix[A](https://arxiv.org/html/2607.20436#A1)\. The routing direction is nearly orthogonal to the gap gradient both early and late in training, arguing against a simple gradient\-following account of installation\.

In the cells where the routing\-coordinate intervention works, the probability of a deployment\-style response changes sharply along⟨𝐡,𝐝^L⟩\\langle\\mathbf\{h\},\\hat\{\\mathbf\{d\}\}\_\{L\}\\rangleand changes little under matched\-norm moves in unrelated directions\. The depth\-view diagnostic in Appendix[A](https://arxiv.org/html/2607.20436#A1)shows evaluation and deployment means traveling together through early layers and splitting inside the routing window, so the installation is a localized separation rather than a smooth accumulation\. Section[3\.3](https://arxiv.org/html/2607.20436#S3.SS3)tests this picture with matched\-norm random directions and semantic\-content contrasts\.

### 3\.2Does Intervention Reduce the Held\-Out Gap?

Each seed\-4242matrix cell starts with a positive installed gap\. We test whether the learned routing direction at the intervention window reduces that gap on held\-out prompts, with matched random and wrong\-layer controls reported in Section[3\.3](https://arxiv.org/html/2607.20436#S3.SS3)\.

Atλ=2\\lambda=2, the held\-out routing\-coordinate intervention \([4](https://arxiv.org/html/2607.20436#S2.E4)\) reduces the installed gap in nearly every cell of the1212\-cell architecture\-behavior matrix \(Figure[4](https://arxiv.org/html/2607.20436#S3.F4)\)\. Ten of twelve cells reduce by more than0\.120\.12, and four cells move the gap below0\.060\.06\. On the eightn≥120n\{\\geq\}120cells \(sandbagging atn=200n\{=\}200and sycophancy atn=120n\{=\}120\), six reduce by more than0\.120\.12; the four refusal cells carry the largest deltas at the smallestnn\(2828paired questions\) and are flagged as a small\-sample stress test\. Three representative closures \(post\-intervention\|γ\|<0\.06\\lvert\\gamma\\rvert<0\.06\) are Gemma\-2\-2B sandbagging \(0\.298→−0\.0080\.298\\\!\\to\\\!\-0\.008\), Gemma\-2\-9B refusal \(0\.611→−0\.0070\.611\\\!\\to\\\!\-0\.007\), and Qwen\-2\.5\-7B refusal \(0\.796→0\.0110\.796\\\!\\to\\\!0\.011\)\. We report refusal with bootstrap intervals and do not treat it as the sole source of evidence\. Six other cells reduce without crossing the closure threshold \(e\.g\., Llama\-3\-8B refusal0\.539→0\.2640\.539\\\!\\to\\\!0\.264\)\. The single flat cell is Llama\-3\-8B sycophancy, where the intervention leaves the gap at0\.6250\.625against a baseline of0\.6250\.625; Gemma\-2\-9B sycophancy is a second weak cell, with only a0\.0130\.013reduction\. We report these cells explicitly because they bound the claim: not every architecture\-behavior pair admits a single\-coordinate audit at the same relative depth\. This reading is consistent with the weaker path\-patching recovery on Gemma\-2\-9B in the previous section and with the failure of the one\-shot output\-weight edit on the same family \(Appendix[H](https://arxiv.org/html/2607.20436#A8)\)\. In those cells, the installed distinction is either higher\-rank or missed by the shared depth heuristic\.

![Refer to caption](https://arxiv.org/html/2607.20436v1/x3.png)Figure 4:Held\-out evaluation\-to\-deployment gap before and after modifying the fitted routing coordinate at the intervention window, across the 12\-cell architecture\-by\-behavior matrix\. Ten cells move toward zero; two sycophancy cells, Llama\-3\-8B and Gemma\-2\-9B, stay near baseline\. Error bars show paired\-bootstrap95%95\\%gap intervals over question IDs with50005000resamples; Appendix[J](https://arxiv.org/html/2607.20436#A10)links every cell to its provenance summary\. The intervention window is fixed before any intervention runs and calibration/intervention items are disjoint at question\-id level \(Section[2\.1](https://arxiv.org/html/2607.20436#S2.SS1)\)\.The aggregate gap reductions are not primarily caused by deployment\-side collapse in the tested matrix\. Appendix[D](https://arxiv.org/html/2607.20436#A4)reports the deployment\-side rates: across the matrix, the intervention changes the deployment\-framed rate by1\.51\.5pp on average in absolute value and at most6\.16\.1pp\. Appendix[E](https://arxiv.org/html/2607.20436#A5)breaks the reductions into question\-level transitions and shows that, in cells where the gap closes, restored items \(lagging framing rises to match the leading framing\) outnumber homogenized items \(both framings collapse to the lower level\) by33–10×10\\times\. This is evidence against a deployment\-side\-collapse explanation for these cells, not a deployment\-safety guarantee\. Error intervals and per\-cell provenance are summarized in Appendix[J](https://arxiv.org/html/2607.20436#A10)\.

#### Five\-Seed Replication\.

The Gemma\-2\-2B sandbagging result does not depend on seed4242\. Across seeds4242–4646, the baseline gap has mean0\.2400\.240and range\[0\.207,0\.298\]\[0\.207,0\.298\]; the same routing\-coordinate intervention reduces the mean gap to0\.0240\.024, range\[−0\.007,0\.078\]\[\-0\.007,0\.078\]\. The mean gap reduction is0\.2160\.216\(range\[0\.130,0\.305\]\[0\.130,0\.305\]\), while deployment\-framed accuracy is effectively unchanged on average\. The matrix provenance table in Appendix[J](https://arxiv.org/html/2607.20436#A10)records the single\-seed cross\-family sources\.

The dose\-response on Gemma\-2\-2B sandbagging \(n=600n\{=\}600\) shows that all three interventions reduce the gap monotonically\. Projection removal on evaluation reduces the gap from0\.2830\.283to0\.0070\.007atλ=1\\lambda\{=\}1and coordinate reflection gives−0\.013\-0\.013atλ=2\\lambda\{=\}2; add on deployment gives0\.0000\.000atλ=2\\lambda\{=\}2; the joint intervention gives0\.0030\.003\. Evaluation accuracy under the joint intervention rises from0\.1630\.163to0\.4600\.460while deployment accuracy moves only modestly \(0\.447→0\.4630\.447\\\!\\to\\\!0\.463\): the intervention raises evaluation accuracy to the level the deployment\-framed model already achieves on the same items rather than trading performance for behavior\. Qwen\-2\.5\-7B refusal repeats the steep transition, withγ\\gammamoving from0\.6420\.642to−0\.017\-0\.017atλ=2\\lambda\{=\}2\.

Two checks address simpler interpretations\. First, the intervention does not mainly close the gap by collapsing deployment\-framed behavior\. Second, matchedλ=1\\lambda\{=\}1random, wrong\-layer, and sign controls plus availableλ=2\\lambda\{=\}2semantic controls do not reproduce the effect, as detailed in Section[3\.3](https://arxiv.org/html/2607.20436#S3.SS3)\. The headline matrix usesλ=2\\lambda\{=\}2; matchedλ=1\\lambda\{=\}1controls establish direction and layer specificity at projection\-removal dose, while availableλ=2\\lambda\{=\}2semantic controls test content\-matched alternatives\. We do not claim exhaustiveλ=2\\lambda\{=\}2random, wrong\-layer, and sign controls for every cell\. Specificity is constrained atλ=1\\lambda\{=\}1by matched\-norm random, wrong\-layer, sign\-flip, and semantic controls; combined with the monotoneλ\\lambda\-dose response, the alternative that an arbitrary direction atλ=2\\lambda\{=\}2closes the gap requires a non\-monotoneλ\\lambda\-profile, which would itself be diagnostic\.

### 3\.3Is the Effect Specific to the Learned Framing Direction?

Four control families test whether the effect could come from any direction, any layer, the wrong sign, or ordinary semantic content rather than evaluation\-to\-deployment framing\.

#### Projection\-Removal Controls\.

At projection\-removal doseλ=1\\lambda\{=\}1, four control alternatives do not reproduce the framing\-specific effect\. A matched\-L2\-norm Gaussian removal leaves the gap at0\.2870\.287against a baseline of0\.2830\.283\. Applying the intervention at non\-routing layerL​6L6leaves0\.3070\.307; at non\-routing layerL​22L22,0\.2730\.273\. A sign check that adds the direction to evaluation prompts, which should widen or hold the gap under the sign model, leaves0\.2770\.277\. Across the full1212\-cell matrix, the matched\-norm random removal never moves the gap by more than0\.0050\.005, and the two non\-routing\-layer controls never by more than0\.020\.02\. The matched\-norm random add moves the Gemma\-2\-2B sandbag gap by0\.0500\.050\(0\.283→0\.2330\.283\\\!\\to\\\!0\.233, Table[5](https://arxiv.org/html/2607.20436#A3.T5)\), but the move is driven by a deployment\-side capability hit rather than by the framing asymmetry: the routing\-direction interventions atλ=1\\lambda\{=\}1drop the gap to near zero, while the controls sit near the baseline or move through deployment\-side degradation\. These controls establish direction and layer specificity at projection\-removal dose\.

#### Semantic Controls\.

A further question is whether any content\-matched direction at the routing window would reproduce the effect\. We fit four semantic\-contrast directions \(concrete vs abstract, emotional vs neutral, formal vs casual, math vs science\) on the same calibration structure as the routing direction and apply them at the same window\. On Gemma\-2\-2B sandbagging, removing the direction on evaluation prompts atλ=2\\lambda\{=\}2raises evaluation accuracy only for the routing direction; all four semantic directions leave evaluation accuracy within0\.0120\.012of the baseline \(0\.1830\.183\)\. Phi\-3\-mini repeats the pattern, with semantic contrasts holding the gap in\[0\.380,0\.407\]\[0\.380,0\.407\]against a baseline of0\.3970\.397\. Adding a semantic direction on deployment prompts sometimes lowers deployment\-framed performance, but symmetrically: a general capability hit, not the framing asymmetry the routing direction produces\.

Under the tested doses, random, wrong\-layer, sign\-inconsistent, and content\-matched semantic alternatives do not reproduce the gap closure\. Appendix[C](https://arxiv.org/html/2607.20436#A3)gives the matched\-control table\.

### 3\.4Where Does the Single\-Coordinate Audit Fail?

The weak cells clarify what a negative audit means\. On Gemma\-2\-9B sandbagging, path\-patching recovery is0\.580\.58rather than\>0\.9\>0\.9, the routing\-coordinate intervention closes part of the gap, and the one\-shot output\-weight edit closes only7%7\\%of it; on Llama\-3\-8B sycophancy, the intervention is flat atλ=2\\lambda\{=\}2\. The depth heuristic can still find the right region while a single direction at that region fails to capture the installed distinction\. The audit returns a typed failure rather than a binary verdict: weak path\-patching recovery indicates a missed site, a weak single\-coordinate intervention at a recovered site indicates higher rank, and a control that moves the gap as much as the paired contrast indicates lack of framing specificity\.

## 4Discussion

The results support a bounded post\-hoc audit for fine\-tuned checkpoints\. Relative to activation steering, circuit localization, weight editing, and evaluation\-awareness studies\[[28](https://arxiv.org/html/2607.20436#bib.bib25),[19](https://arxiv.org/html/2607.20436#bib.bib14),[2](https://arxiv.org/html/2607.20436#bib.bib1),[26](https://arxiv.org/html/2607.20436#bib.bib23),[34](https://arxiv.org/html/2607.20436#bib.bib31),[29](https://arxiv.org/html/2607.20436#bib.bib26),[31](https://arxiv.org/html/2607.20436#bib.bib33),[32](https://arxiv.org/html/2607.20436#bib.bib27),[6](https://arxiv.org/html/2607.20436#bib.bib4),[10](https://arxiv.org/html/2607.20436#bib.bib6),[20](https://arxiv.org/html/2607.20436#bib.bib16),[21](https://arxiv.org/html/2607.20436#bib.bib17),[16](https://arxiv.org/html/2607.20436#bib.bib9),[23](https://arxiv.org/html/2607.20436#bib.bib19),[5](https://arxiv.org/html/2607.20436#bib.bib34)\], the routing direction is installed by fine\-tuning, near\-orthogonal to the base paired\-contrast direction, and tested at a localized window under controls that separate it from random, non\-routing, and semantic\-content alternatives\.

#### Recruitment Traces Are Supporting Diagnostics\.

Predeclared MLP sets on Gemma\-2\-2B show non\-random recruitment signal, but persistent masking produces only small accuracy\-gap reductions while logit and KL probes show sub\-behavioral effects \(Appendix[F](https://arxiv.org/html/2607.20436#A6)\)\. In this attention\-LoRA setting, MLP recruitment behaves like a downstream trace under masking\.

#### Practical Implications for Auditing\.

The protocol runs at inference time without retraining and reports a typed outcome: a closed gap, a missed site, a higher\-rank distinction, or lack of framing specificity\. Appendix[G](https://arxiv.org/html/2607.20436#A7)gives adjacent\-window sweeps and a typed\-failure guide\.

#### Scope of Fine\-Tuning Recipe\.

The fine\-tunes studied here use a fixed LoRA recipe \(rank1616, attention projections only,15501550steps over five epochs\) controlled by us; external validity on publicly released fine\-tuned checkpoints with unknown training data, optimizer settings, or adapter rank is a separate empirical question\.

#### Responsible Use and Misuse\.

The intended use is defensive: a white\-box evaluator can test whether a fine\-tuned checkpoint carries a framing\-contingent internal distinction that output metrics alone miss\. Because activation\-space access could also alter refusal or other safety\-relevant behavior, the anonymous submission reports aggregate results and diagnostic tables, not weights or a high\-risk dataset\.

#### Falsification Checks\.

The interpretation would weaken if matched\-norm random or semantic directions closed the same cells under matched doses, if a fresh calibration set outside the window closed the gap equally well, or if deployment accuracy collapsed when the gap closed\. Available controls and the deployment\-rate check \(Table[6](https://arxiv.org/html/2607.20436#A4.T6)\) target these alternatives\.

#### Limitations and Beyond Scope\.

We do not claim a general single direction, a training\-time defense, or a weight\-space defense; the rank\-one edit \(Appendix[H](https://arxiv.org/html/2607.20436#A8)\) is a mixed diagnostic and the rank\-kkpenalty \(Appendix[I](https://arxiv.org/html/2607.20436#A9)\) a negative control\. We study multiple\-choice evaluations on five instruction\-tuned instances up to99B parameters; larger models, longer fine\-tunes, higher\-rank adapters, mixture\-of\-experts and state\-space architectures, and free\-form generation may require new localization and higher\-rank probes\.

## 5Conclusion

Fine\-tuning can install an evaluation\-to\-deployment mismatch that output scores alone do not localize\. Path patching identifies a mid\-depth attention band, and routing\-coordinate interventions in predeclared windows close the held\-out framing gap on ten of twelve cells while matched controls do not\. The audit is post\-hoc for merged fine\-tuned checkpoints; weak cells mark where a single\-coordinate audit is not sufficient\.

## References

- \[1\]M\. Abdin, J\. Aneja, H\. Awadalla, A\. Awadallah, A\. A\. Awan, N\. Bach, A\. Bahree, A\. Bakhtiari, J\. Bao, H\. Behl,et al\.\(2024\)Phi\-3 technical report: a highly capable language model locally on your phone\.arXiv preprint arXiv:2404\.14219\.External Links:2404\.14219,[Link](https://arxiv.org/abs/2404.14219)Cited by:[§2\.1](https://arxiv.org/html/2607.20436#S2.SS1.SSS0.Px2.p1.1)\.
- \[2\]A\. Arditi, O\. Obeso, A\. Syed, D\. Paleka, N\. Panickssery, W\. Gurnee, and N\. Nanda\(2024\)Refusal in language models is mediated by a single direction\.InAdvances in Neural Information Processing Systems,External Links:2406\.11717,[Document](https://dx.doi.org/10.52202/079017-4322),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/hash/f545448535dfde4f9786555403ab7c49-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1),[§2\.1](https://arxiv.org/html/2607.20436#S2.SS1.SSS0.Px1.p1.1),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[3\]L\. Berglund, A\. C\. Stickland, M\. Balesni, M\. Kaufmann, M\. Tong, T\. Korbak, D\. Kokotajlo, and O\. Evans\(2024\)Taken out of context: on measuring situational awareness in LLMs\.InInternational Conference on Learning Representations,External Links:2309\.00667,[Link](https://arxiv.org/abs/2309.00667)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1)\.
- \[4\]C\. Burns, H\. Ye, D\. Klein, and J\. Steinhardt\(2023\)Discovering latent knowledge in language models without supervision\.InInternational Conference on Learning Representations,External Links:2212\.03827,[Link](https://openreview.net/forum?id=ETKGuby0hcs)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p2.1)\.
- \[5\]M\. Chaudhary\(2026\)In\-context environments induce evaluation\-awareness in language models\.arXiv preprint arXiv:2603\.03824\.External Links:2603\.03824,[Link](https://arxiv.org/abs/2603.03824)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p6.1),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[6\]A\. Conmy, A\. N\. Mavor\-Parker, A\. Lynch, S\. Heimersheim, and A\. Garriga\-Alonso\(2023\)Towards automated circuit discovery for mechanistic interpretability\.InAdvances in Neural Information Processing Systems,External Links:2304\.14997,[Link](https://arxiv.org/abs/2304.14997)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[7\]Gemma Team, M\. Riviere, S\. Pathak, P\. G\. Sessa, C\. Hardin, S\. Bhupatiraju, L\. Hussenot, T\. Mesnard, B\. Shahriari, A\. Ramé,et al\.\(2024\)Gemma 2: improving open language models at a practical size\.arXiv preprint arXiv:2408\.00118\.External Links:2408\.00118,[Link](https://arxiv.org/abs/2408.00118)Cited by:[§2\.1](https://arxiv.org/html/2607.20436#S2.SS1.SSS0.Px2.p1.1)\.
- \[8\]M\. Geva, A\. Caciularu, K\. R\. Wang, and Y\. Goldberg\(2022\)Transformer feed\-forward layers build predictions by promoting concepts in the vocabulary space\.InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing,pp\. 30–45\.External Links:[Document](https://dx.doi.org/10.18653/v1/2022.emnlp-main.3),[Link](https://aclanthology.org/2022.emnlp-main.3/),2203\.14680Cited by:[§3\.1](https://arxiv.org/html/2607.20436#S3.SS1.p1.2)\.
- \[9\]M\. Geva, R\. Schuster, J\. Berant, and O\. Levy\(2021\)Transformer feed\-forward layers are key\-value memories\.InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing,pp\. 5484–5495\.External Links:[Document](https://dx.doi.org/10.18653/v1/2021.emnlp-main.446),[Link](https://aclanthology.org/2021.emnlp-main.446/),2012\.14913Cited by:[§3\.1](https://arxiv.org/html/2607.20436#S3.SS1.p1.2)\.
- \[10\]N\. Goldowsky\-Dill, C\. MacLeod, L\. Sato, and A\. Arora\(2023\)Localizing model behavior with path patching\.arXiv preprint arXiv:2304\.05969\.External Links:2304\.05969,[Link](https://arxiv.org/abs/2304.05969)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1),[§2\.2](https://arxiv.org/html/2607.20436#S2.SS2.p1.3),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[11\]A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan,et al\.\(2024\)The llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.External Links:2407\.21783,[Link](https://arxiv.org/abs/2407.21783)Cited by:[§2\.1](https://arxiv.org/html/2607.20436#S2.SS1.SSS0.Px2.p1.1)\.
- \[12\]R\. Greenblatt, C\. Denison, B\. Wright, F\. Roger, M\. MacDiarmid, S\. Marks, J\. Treutlein, T\. Belonax, J\. Chen, D\. Duvenaud,et al\.\(2024\)Alignment faking in large language models\.arXiv preprint arXiv:2412\.14093\.External Links:2412\.14093,[Link](https://arxiv.org/abs/2412.14093)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p1.1)\.
- \[13\]R\. Greenblatt, F\. Roger, D\. Krasheninnikov, and D\. Krueger\(2024\)Stress\-testing capability elicitation with password\-locked models\.arXiv preprint arXiv:2405\.19550\.External Links:2405\.19550,[Link](https://arxiv.org/abs/2405.19550)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p1.1)\.
- \[14\]D\. Hendrycks, C\. Burns, S\. Basart, A\. Zou, M\. Mazeika, D\. Song, and J\. Steinhardt\(2021\)Measuring massive multitask language understanding\.InInternational Conference on Learning Representations,External Links:2009\.03300,[Link](https://arxiv.org/abs/2009.03300)Cited by:[§2\.1](https://arxiv.org/html/2607.20436#S2.SS1.SSS0.Px1.p1.1)\.
- \[15\]E\. J\. Hu, Y\. Shen, P\. Wallis, Z\. Allen\-Zhu, Y\. Li, S\. Wang, L\. Wang, and W\. Chen\(2022\)LoRA: low\-rank adaptation of large language models\.InInternational Conference on Learning Representations,External Links:2106\.09685,[Link](https://arxiv.org/abs/2106.09685)Cited by:[§2\.1](https://arxiv.org/html/2607.20436#S2.SS1.SSS0.Px3.p1.6)\.
- \[16\]T\. T\. Hua, A\. Qin, S\. Marks, and N\. Nanda\(2025\)Steering evaluation\-aware language models to act like they are deployed\.arXiv preprint arXiv:2510\.20487\.External Links:2510\.20487,[Link](https://arxiv.org/abs/2510.20487)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1),[§1](https://arxiv.org/html/2607.20436#S1.p6.1),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[17\]E\. Hubinger, C\. Denison, J\. Mu, M\. Lambert, M\. Tong, M\. MacDiarmid, T\. Lanham, D\. M\. Ziegler, T\. Maxwell, N\. Cheng,et al\.\(2024\)Sleeper agents: training deceptive LLMs that persist through safety training\.arXiv preprint arXiv:2401\.05566\.External Links:2401\.05566,[Link](https://arxiv.org/abs/2401.05566)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p1.1)\.
- \[18\]R\. Laine, B\. Chughtai, J\. Betley, K\. Hariharan, J\. Scheurer, M\. Balesni, M\. Hobbhahn, A\. Meinke, and O\. Evans\(2024\)Me, myself, and AI: the situational awareness dataset \(SAD\) for LLMs\.arXiv preprint arXiv:2407\.04694\.External Links:2407\.04694,[Link](https://arxiv.org/abs/2407.04694)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1)\.
- \[19\]K\. Li, O\. Patel, F\. Viégas, H\. Pfister, and M\. Wattenberg\(2023\)Inference\-time intervention: eliciting truthful answers from a language model\.arXiv preprint arXiv:2306\.03341\.External Links:2306\.03341,[Link](https://arxiv.org/abs/2306.03341)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[20\]K\. Meng, D\. Bau, A\. Andonian, and Y\. Belinkov\(2022\)Locating and editing factual associations in GPT\.InAdvances in Neural Information Processing Systems,External Links:2202\.05262,[Link](https://arxiv.org/abs/2202.05262)Cited by:[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[21\]K\. Meng, A\. S\. Sharma, A\. J\. Andonian, Y\. Belinkov, and D\. Bau\(2023\)Mass\-editing memory in a transformer\.InInternational Conference on Learning Representations,External Links:2210\.07229,[Link](https://arxiv.org/abs/2210.07229)Cited by:[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[22\]J\. Needham, G\. Edkins, G\. Pimpale, H\. Bartsch, and M\. Hobbhahn\(2025\)Large language models often know when they are being evaluated\.arXiv preprint arXiv:2505\.23836\.External Links:2505\.23836,[Link](https://arxiv.org/abs/2505.23836)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1)\.
- \[23\]J\. Nguyen, K\. Hoang, C\. L\. Attubato, and F\. Hofstätter\(2025\)Probing and steering evaluation awareness of language models\.arXiv preprint arXiv:2507\.01786\.External Links:2507\.01786,[Link](https://arxiv.org/abs/2507.01786)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1),[§1](https://arxiv.org/html/2607.20436#S1.p6.1),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[24\]E\. Perez, S\. Ringer, K\. Lukošiūtė, K\. Nguyen, E\. Chen, S\. Heiner, C\. Pettit, C\. Olsson, S\. Kundu, S\. Kadavath,et al\.\(2023\)Discovering language model behaviors with model\-written evaluations\.InFindings of the Association for Computational Linguistics: ACL 2023,pp\. 13387–13434\.External Links:[Document](https://dx.doi.org/10.18653/v1/2023.findings-acl.847),[Link](https://aclanthology.org/2023.findings-acl.847/),2212\.09251Cited by:[§2\.1](https://arxiv.org/html/2607.20436#S2.SS1.SSS0.Px1.p1.1)\.
- \[25\]Qwen Team, A\. Yang, B\. Yang, B\. Zhang, B\. Hui, B\. Zheng, B\. Yu, C\. Li, D\. Liu, F\. Huang,et al\.\(2024\)Qwen2\.5 technical report\.arXiv preprint arXiv:2412\.15115\.External Links:2412\.15115,[Link](https://arxiv.org/abs/2412.15115)Cited by:[§2\.1](https://arxiv.org/html/2607.20436#S2.SS1.SSS0.Px2.p1.1)\.
- \[26\]N\. Rimsky, N\. Gabrieli, J\. Schulz, M\. Tong, E\. Hubinger, and A\. Turner\(2024\)Steering llama 2 via contrastive activation addition\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 15504–15522\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.828),[Link](https://aclanthology.org/2024.acl-long.828/),2312\.06681Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1),[§1](https://arxiv.org/html/2607.20436#S1.p6.1),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[27\]M\. Sharma, M\. Tong, T\. Korbak, D\. Duvenaud, A\. Askell, S\. R\. Bowman, N\. Cheng, E\. Durmus, Z\. Hatfield\-Dodds, S\. R\. Johnston,et al\.\(2024\)Towards understanding sycophancy in language models\.InInternational Conference on Learning Representations,External Links:2310\.13548,[Link](https://arxiv.org/abs/2310.13548)Cited by:[§2\.1](https://arxiv.org/html/2607.20436#S2.SS1.SSS0.Px1.p1.1)\.
- \[28\]N\. Subramani, N\. Suresh, and M\. E\. Peters\(2022\)Extracting latent steering vectors from pretrained language models\.InFindings of the Association for Computational Linguistics: ACL 2022,External Links:[Document](https://dx.doi.org/10.18653/v1/2022.findings-acl.48),[Link](https://aclanthology.org/2022.findings-acl.48/),2205\.05124Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[29\]A\. M\. Turner, L\. Thiergart, G\. Leech, D\. Udell, J\. J\. Vazquez, U\. Mini, and M\. MacDiarmid\(2023\)Steering language models with activation engineering\.arXiv preprint arXiv:2308\.10248\.External Links:2308\.10248,[Link](https://arxiv.org/abs/2308.10248)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[30\]T\. van der Weij, F\. Hofstätter, O\. Jaffe, S\. F\. Brown, and F\. R\. Ward\(2025\)AI sandbagging: language models can strategically underperform on evaluations\.InInternational Conference on Learning Representations,External Links:2406\.07358,[Link](https://openreview.net/forum?id=7Qa2SpjxIS)Cited by:[§2\.1](https://arxiv.org/html/2607.20436#S2.SS1.SSS0.Px1.p1.1)\.
- \[31\]D\. Vennemeyer, P\. A\. Duong, T\. Zhan, and T\. Jiang\(2025\)Sycophancy is not one thing: causal separation of sycophantic behaviors in LLMs\.arXiv preprint arXiv:2509\.21305\.External Links:2509\.21305,[Link](https://arxiv.org/abs/2509.21305)Cited by:[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[32\]K\. R\. Wang, A\. Variengien, A\. Conmy, B\. Shlegeris, and J\. Steinhardt\(2023\)Interpretability in the wild: a circuit for indirect object identification in GPT\-2 small\.InInternational Conference on Learning Representations,External Links:2211\.00593,[Link](https://arxiv.org/abs/2211.00593)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.
- \[33\]F\. Zhang and N\. Nanda\(2024\)Towards best practices of activation patching in language models: metrics and methods\.InInternational Conference on Learning Representations,External Links:2309\.16042,[Link](https://openreview.net/forum?id=Hf17y6u9BC)Cited by:[§3\.1](https://arxiv.org/html/2607.20436#S3.SS1.p1.2)\.
- \[34\]A\. Zou, L\. Phan, S\. Chen, J\. Campbell, P\. Guo, R\. Ren, A\. Pan, X\. Yin, M\. Mazeika, A\. Dombrowski,et al\.\(2023\)Representation engineering: a top\-down approach to AI transparency\.arXiv preprint arXiv:2310\.01405\.External Links:2310\.01405,[Link](https://arxiv.org/abs/2310.01405)Cited by:[§1](https://arxiv.org/html/2607.20436#S1.p4.1),[§1](https://arxiv.org/html/2607.20436#S1.p6.1),[§4](https://arxiv.org/html/2607.20436#S4.p1.1)\.

## Appendix AAdditional diagnostic figures

The main paper includes the routing geometry, mechanism, path\-patching, and matrix figures\. The depth\-view and remaining diagnostics are included here so the secondary controls remain inspectable\.

![Refer to caption](https://arxiv.org/html/2607.20436v1/x4.png)Figure 5:Routing\-coordinate geometry across depth\. \(a,b\) Deployment\-style response probability changes mainly along the measured routing coordinate\. \(c\) Mean residual projection onto𝐝^L∗\\hat\{\\mathbf\{d\}\}\_\{L^\{\*\}\}on Gemma\-2\-2B sandbagging: evaluation and deployment means are close through early layers, separate sharply inside the routing window, and hold the separation downstream\.![Refer to caption](https://arxiv.org/html/2607.20436v1/x5.png)Figure 6:Dose response and matched controls on the Gemma\-2\-2B sandbagging primary cell\. The routing interventions reduce the framing gap, while matched random, wrong\-layer, sign, and semantic controls stay near baseline or move through deployment\-side degradation\.![Refer to caption](https://arxiv.org/html/2607.20436v1/x6.png)Figure 7:Semantic specificity and direction\-norm diagnostics\. \(a\) Content\-matched semantic directions do not reproduce the routing\-direction effect\. \(b\) Fine\-tuning amplifies the paired framing direction relative to the base model in the routing window\.![Refer to caption](https://arxiv.org/html/2607.20436v1/x7.png)Figure 8:Base versus fine\-tuned routing\-direction norms on Gemma\-2\-2B and Phi\-3\-mini\. The fitted framing direction is several\-fold larger after fine\-tuning across the localized window\.
## Appendix BWindow definitions

Table 3:Windows used in the path\-patching panel and in the intervention matrix\. The path\-patching window localizes the sandbagging signal; the intervention window is the fixed four\-layer window used for intervention results in Section[3\.2](https://arxiv.org/html/2607.20436#S3.SS2)\. Phi\-3\-mini is path\-patched but not included in the1212\-cell matrix\.
## Appendix CPer\-cell intervention table on Gemma\-2\-2B

The primary per\-cell intervention values for Gemma\-2\-2B sandbagging \(n=600n\{=\}600per framing\) are listed here for reference\. They are the values used for the routing\-direction intervention and matched controls in the main text\.

Table 4:Gemma\-2\-2B sandbagging intervention cell values \(n=600n\{=\}600per framing\)\. Arrows mark the desired diagnostic direction; the bold entry in each metric column is the best value in that column\.Table 5:Specificity controls for the routing intervention \(Gemma\-2\-2B sandbagging,n=600n\{=\}600\)\. Each row names an alternative tested at the available dose; the target intervention is included as the positive reference\.
## Appendix DDeployment\-side rates in the intervention matrix

To check whether gap closure is driven by a deployment\-side collapse, Table[6](https://arxiv.org/html/2607.20436#A4.T6)reports the deployment\-framed rate before and after theλ=2\\lambda\{=\}2routing\-coordinate intervention used in the1212\-cell matrix\. The table is descriptive rather than a separate diagnostic gate\.

Table 6:Deployment\-framed rates in the1212\-cell matrix\.Δ​rD\\Delta r\_\{\\mathrm\{D\}\}is post\-intervention minus baseline; smaller magnitude is better for checking deployment\-side collapse\.
## Appendix EPer\-item intervention agreement analysis

The1212\-cell matrix reports aggregate gap reductions; this section asks what the intervention does at the level of individual questions\. For each cell that has per\-item data, we align the baseline and joint\-intervention \(λ=2\\lambda\{=\}2\) results at the question\-id level and classify every unique question into one of four categories\. An item is*informative*when its baseline gap\|rD−rE\|\\lvert r\_\{\\mathrm\{D\}\}\-r\_\{\\mathrm\{E\}\}\\rvertexceeds0\.10\.1\(items where both framings already agree at baseline are set aside in a*no\-gap*bin\)\. Among informative items, we call an item*restored*when the intervention closes the gap and both framings reach accuracy≥\\geqthe leading framing’s baseline accuracy minus0\.150\.15,*homogenized*when the intervention closes the gap but both framings drop to the trailing framing’s accuracy level,*mixed*for any other closed\-gap pattern, and*persistent*when\|γpost\|\>0\.2\\lvert\\gamma\_\{\\mathrm\{post\}\}\\rvert\>0\.2\.

Table 7:Per\-item transition categories across the1212cells\. An item is informative when its baseline framing gap exceeds0\.10\.1; restored means both framings reach the leading framing’s accuracy; homogenized means both collapse to the trailing level; persistent means the gap is not closed by the intervention\. The aggregate post\-intervention gapγ¯post\\bar\{\\gamma\}\_\{\\mathrm\{post\}\}tracks whether cells with many persistent items also have small aggregate reductions\.In the four cells where the aggregate post\-intervention gap drops near zero \(Gemma\-2\-2B sandbag, Gemma\-2\-9B refusal, Qwen\-2\.5\-7B refusal, and Llama\-3\-8B sandbag\), restored items outnumber homogenized items by33–10×10\\times; Qwen\-2\.5\-7B sycophancy shows the same direction as a partial case\. Homogenization, where the intervention collapses both framings to the lower\-accuracy answer, accounts for at most20%20\\%of informative items even in the best\-closing cell\. The persistent\-item fraction tracks the aggregate gap closely: cells where the intervention fails at the aggregate level \(Llama\-3\-8B sycophancy, Gemma\-2\-9B sycophancy\) have96%96\\%persistent items\. The per\-item picture is therefore consistent with the aggregate result: where the intervention closes the gap, transitions are more often restoration toward the leading framing’s baseline level than collapse of both framings to a shared wrong answer\. The per\-item analysis is included to support the aggregate non\-collapse check\.

## Appendix FRecruitment traces versus routing intervention

We ran a narrow failure\-analysis check to test whether the installed gap is explained by top\-KKMLP neurons rather than by the routing subspace\. The test used Gemma\-2\-2B sandbagging seed5050and predeclared layer\-1919neuron sets selected before intervention\. It separates three objects: the*update locus*, where fine\-tuning writes; the*recruitment locus*, where downstream internal traces appear; and the*intervention locus*, whose perturbation changes the behavioral gap in this audit\.

update locusattention LoRA modulesrecruitment locusH\-tau\-predictableMLP tracesintervention locusrouting residualsubspacewritesleaves tracemore direct behavioral probe

Figure 9:Recruitment traces do not explain the behavioral gap under masking\. The fine\-tune writes through attention LoRA modules\. MLP neurons carry measurable downstream traces, but masking those neurons only weakly changes the behavioral gap\. The more direct behavioral probe in this audit is the routing\-level residual variable\.Table 8:Recruitment\-versus\-intervention audit on Gemma\-2\-2B sandbagging seed5050\. ISS is input\-sensitivity score; H\-tau is the predeclared composite geometry score\. Hits@50 counts overlap with prospectively recruited neurons, and Mass@50 sums recruitment mass over the top\-50 set\. Persistent masking and logit scoring use the trained no\-suppression seed\-5050model on 48 questions and all 10 templates per framing \(n=480n\{=\}480per framing\)\. H\-tau predicts recruitment best, but none of the neuron masks explains the accuracy gap under this masking test\.The random baseline stays near null, so the recruitment metric has nonrandom structure\. H\-tau exceeds activation magnitude by\+3\.00\+3\.00hits atK=50K\{=\}50\(95% CI\[1\.33,4\.67\]\[1\.33,4\.67\]\) and exceeds ISS by\+4\.17\+4\.17hits \(95% CI\[2\.50,5\.83\]\[2\.50,5\.83\]\)\. The same ranking appears in recruitment mass\. In contrast, the largest persistent masking accuracy\-gap reductions are at most1\.251\.25pp, far below the routing\-intervention effects in the main matrix\. Logit\-level metrics show that the selected neurons are not inert: recruitment mass correlates with KL from the unmasked model \(Pearson0\.9700\.970over all sets and0\.9270\.927excluding random\) and with margin\-gap shift \(0\.8160\.816over all sets and0\.6590\.659excluding random\)\. The effect is therefore a perturbability trace rather than the main behavioral explanation under this masking test\.

The update audit is consistent with this interpretation\. The seed\-5050LoRA adapter has all effective update norm in attention modules:35\.39%35\.39\\%ino\_proj,34\.82%34\.82\\%inq\_proj,16\.64%16\.64\\%ink\_proj, and13\.15%13\.15\\%inv\_proj, with no MLP LoRA update\. A projection\-level ablation confirms that these attention updates are behaviorally active: zeroingv\_projoro\_projLoRA deltas reduces the gap by about2929pp on seed5050, zeroingq\_projreduces it by20\.820\.8pp, and zeroing all LoRA deltas removes the adapter\-induced gap and slightly overcorrects it\. Zeroingk\_projdoes not reduce the gap\. In the same ablation suite, zeroing all LoRA deltas nearly eliminates the routing\-projection separation and reduces the H\-tau MLP activation contrast to35\.7%35\.7\\%of its full\-adapter value\. A one\-seed replication at seed4242preserves the main structural pattern: all\-LoRA removal again removes the gap, leaves only1\.3%1\.3\\%of the routing\-projection separation, and cuts H\-tau MLP contrast to19\.8%19\.8\\%;o\_projis again the largest single projection mediator\. Theq\_projbehavioral effect is seed\-dependent, so we do not treat it as a stable projection\-level claim\.

We also directly intervened on the fitted routing axis at layer1717and remeasured the layer\-1919MLP trace\. On seeds5050and4242, suppressing or removing the routing\-axis component eliminates the measured routing separation and cuts the H\-tau MLP contrast to45\.545\.5–53\.6%53\.6\\%of its full value; a matched random\-axis intervention leaves both unchanged\. Accuracy\-gap changes under removal are modest, but logit\-margin shifts are large \(4\.04\.0–6\.26\.2\), consistent with accuracy being a coarser readout than the logits\. Reflecting the direction produces large behavioral and logit effects while preserving absolute separation with the opposite orientation\. Across these narrow checks,v\_projcan reduce behavior while leaving much of the MLP contrast, and routing\-axis interventions can attenuate the MLP trace without making masking\-selected MLP neurons the main behavioral explanation\. This supports the interpretation in Figure[9](https://arxiv.org/html/2607.20436#A6.F9): fine\-tuning writes through attention, MLP recruitment is a downstream trace, and the more direct behavioral probe in this audit is the routing subspace\.

## Appendix GE4 Adjacent\-Window Depth Sweep and Typed\-Failure Remediation

Table[9](https://arxiv.org/html/2607.20436#A7.T9)reports the adjacent\-window depth sweep for the two flat sycophancy cells\. For Gemma\-2\-9B, depth0\.500\.50\(layersL​21L21–L​24L24\) closes the gap by0\.370\.37, while the default heuristic at0\.550\.55closes it by only0\.280\.28, consistent with a type\-1 failure \(heuristic close but off by one window step\)\. For Llama\-3\-8B, no depth closes the gap; the best reduction is0\.200\.20at depth0\.450\.45, consistent with a type\-2 failure \(higher\-rank installed object\)\.

Table 9:E4 adjacent\-window depth sweep on the two flat sycophancy cells \(n=50n\{=\}50calibration,n=50n\{=\}50eval\)\.Δ​γ\\Delta\\gammais the change in held\-out gap atλ=2\\lambda\{=\}2; negative values indicate gap reduction\.Typed failures map to three remediation steps\. \(1\) If path patching does not recover the gap, re\-run the adjacent\-window sweep at depths0\.450\.45–0\.650\.65to locate the correct band\. \(2\) If path patching recovers but the single\-coordinate intervention is weak, the installed distinction is likely higher\-rank; fit rank\-2 or rank\-3 directions at the located band\. \(3\) If a semantic or random control reproduces the effect, the routing direction is not framing\-specific; check whether the behavioral gap is driven by prompt\-surface content rather than evaluation\-to\-deployment framing\.

## Appendix HOne\-shot rank\-one output\-weight edit

For the unit routing direction𝐝^\\hat\{\\mathbf\{d\}\}at each routing\-window layerLL, we project it out of the attention output matrix and the MLP down\-projection:

𝐖←\(𝐈−𝐝^​𝐝^⊤\)​𝐖\.\\mathbf\{W\}\\;\\leftarrow\\;\\bigl\(\\mathbf\{I\}\-\\hat\{\\mathbf\{d\}\}\\,\\hat\{\\mathbf\{d\}\}^\{\\top\}\\bigr\)\\,\\mathbf\{W\}\.\(5\)The operation in \([5](https://arxiv.org/html/2607.20436#A8.E5)\) is a rank\-one edit per matrix, applied to eight matrices in total across the four edited layers, with no gradient step\. The edited layers are the intervention windows from the routing\-steering runs, not always the same windows reported in the path\-patching panel\. The edit removes𝐝^\\hat\{\\mathbf\{d\}\}from both attention output and MLP down\-projection matrices\. We ablated the two paths on the two successful cells with available fused checkpoints\. On Gemma\-2\-2B sandbag \(n=160n\{=\}160\), an attention\-only ablation \(editing only𝐖Oattn\\smash\{\\mathbf\{W\}^\{\\mathrm\{attn\}\}\_\{O\}\}at each of the four layers\) reduces the gap by32\.532\.5pp against a baseline of26\.226\.2pp; an MLP\-only ablation reduces it by0\.00\.0pp; the combined edit also reduces it by32\.532\.5pp\. On Qwen\-2\.5\-7B refusal \(n=160n\{=\}160\), attention\-only reduces the gap by78\.478\.4pp against a baseline of74\.074\.0pp; MLP\-only reduces it by0\.00\.0pp; the combined edit reduces it by73\.373\.3pp\. In these two measured successful cells, the editable𝐝^\\hat\{\\mathbf\{d\}\}component is mediated by the attention\-output edit rather than the MLP\-down edit\. The two failing H11 cells still lack path ablations, so we keep this as a diagnostic for successful edits rather than a general mechanism claim\.

![Refer to caption](https://arxiv.org/html/2607.20436v1/x8.png)Figure 10:Rank\-one weight edits are a mixed diagnostic, not a defense\. Before and after gaps for four cells \(n=160n\{=\}160per framing\)\. Projecting the fitted routing direction out of edited output matrices closes two cells \(Qwen\-2\.5\-7B refusal and Gemma\-2\-2B sandbagging\) but leaves two sandbagging cells largely unchanged\. The main claim rests on held\-out activation interventions in Figure[4](https://arxiv.org/html/2607.20436#S3.F4)\.Table 10:Rank\-one output\-weight edit on four cells \(n=160n\{=\}160per framing\)\. Closure is the percentage of the pre\-edit gap removed by the one\-shot edit\. The edit is presented as a mixed diagnostic, not as a defense\.
## Appendix ITraining\-time rank\-kkpaired\-contrast penalty

On Gemma\-2\-2B sandbagging, training with a projection penalty that removes the top\-kksingular directions of the paired\-contrast matrix during fine\-tuning \(fork∈\{1,2,3,5,10\}k\\in\\\{1,2,3,5,10\\\}\) does not prevent installation\. Post\-training gapγ\\gamma:k=1k\{=\}1:27\.527\.5pp,k=2k\{=\}2:33\.333\.3pp,k=3k\{=\}3:32\.032\.0pp,k=5k\{=\}5:28\.528\.5pp,k=10k\{=\}10:26\.026\.0pp, unpenalized reference29\.829\.8pp\. The post\-penalty routing directions are not identical to the unpenalized direction: mean per\-layer cosines with the reference direction range from0\.270\.27\(k=2k\{=\}2\) to0\.520\.52\(k=10k\{=\}10\)\. This negative control shows that pre\-committing to the top calibration directions is not enough to block installation in this cell\.

## Appendix JMatrix provenance

For traceability, Table[11](https://arxiv.org/html/2607.20436#A10.T11)binds the headline1212\-cell matrix to the anonymized provenance summary used in the paper\.

Table 11:Matrix provenance summary for the1212\-cell routing matrix\.nnis the number of paired questions used for the reported bootstrap and provenance summary;γpost\\gamma\_\{\\mathrm\{post\}\}is signed and closer to zero is better\. Figure[4](https://arxiv.org/html/2607.20436#S3.F4)reports the corresponding paired\-bootstrap intervals\.
## Appendix KClaims and Evidence Map

Table 12:Map from claims to evidence and limitations\.
## Appendix LReproducibility

Table 13:Reproducibility configuration for the reported audits\.Prompt templates and held\-out splits are fixed before intervention evaluation: sandbagging uses MMLU science items, sycophancy uses factual items paired with stated user preferences, and refusal uses sensitive\-topic items paired across auditor\-style and user\-style framing\. Every headline number is tied to the fixed split rule and the provenance summary in Appendix[J](https://arxiv.org/html/2607.20436#A10)\.