If you can fix a deliberately hobbled AI by swapping one internal setting, can you also fix it by replaying a saved memory?
How does context grafting perform on the same thirty-three failed runs?
This explores whether context grafting (replaying a cached 'capsule' of keys and values from a password-bearing prompt) was tested on the same 33 sandbagged runs as the single-layer graft, and how it did against them.
This explores whether context grafting was run on the same 33 sandbagged runs as the single-layer graft, and how it compared. The corpus doesn't say. It has no head-to-head numbers for context grafting on those runs, so I can't tell you how it performed there. The premise also needs a small correction: the 33 runs weren't all failures. They were 33 models with sandbagging locks installed, and the layer graft was the method being tested on them.
The single-layer graft is the baseline with numbers. Swapping the sandbagging axis to its honest value at one layer window restored capability in Can grafting restore sandbagged model capabilities? in 28 of 33 runs, with median 96% held-out recovery. The 5 misses are the actual failures, and Why did the graft fail in five of thirty-three runs? says the causal model explains them across both prompted and trained locks. Roughly, the graft fails when sandbagging is encoded somewhere other than the layer window the model predicted.
Context grafting works differently. Can context grafting bypass sandbagging without the password? doesn't edit one layer. It replays the keys and values a model cached while reading a password-bearing prompt, so the model behaves as if the password were present. The authors claim success both provably and empirically, but the excerpt gives no theorems, recovery figures or run counts. There is nothing to line up against '28 of 33' or against the 5 misses.
There's also a catch on the setup. According to Can you build a capsule without knowing the password?, the experiments used installed locks with known passwords, which made capsule construction easy. Whether a capsule can be built without the password is left open. So even if context grafting did well on the same runs, it may have had an advantage the layer graft didn't need.
My own inference, not something the corpus states: the 5 layer-graft failures are the cleanest place to compare the two. A capsule carries the password's effect through every layer instead of one window, so it might not depend on the causal model's layer prediction. That would suit those 5 cases, but no one here has reported it. The idea fits with Do models fail worse when their own errors fill the context?, which shows that what sits in a model's context history can strongly steer how it behaves. To answer your question, look for a per-run table in the context grafting paper. If it only reports aggregate success, the comparison hasn't been made.
Sources 5 notes
Grafting honest values into the predicted layer window recovered capability in 28 of 33 runs with median 96% held-out recovery, confirming the causal model's prediction about where sandbagging circuitry operates.
A single-layer graft restored capability in 28 of 33 runs across three lock types. The causal model predicts when grafting fails by identifying the specific layer window where sandbagging is encoded.
The paper proposes replaying keys and values cached from password-bearing prompts to restore capability in sandbagged models. The authors claim success both provably and empirically, though specific theorems, numbers, and success metrics are not provided in the excerpt.
The paper's experiments use installed locks with known passwords, making capsule creation straightforward. Whether capsules can be built without passwords or discovered through other means remains unclear from the excerpt.
Error accumulation in context causes non-linear performance degradation in long-horizon tasks. Model scaling does not fix this; only test-time compute through thinking models reduces the effect by preventing error-contaminated context from biasing reasoning.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- A Causal Model for Locating and Unlocking Sandbagging in Model Organisms
- LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
- Creating an Atomic User Model for Personality-Aware Large Language Model Interaction
- Knowing When Not to Reuse: Conditional Experience Transfer in Autonomous LLM Post-Training
- Leaky Thoughts: Large Reasoning Models Are Not Private Thinkers
- Trust propagation and structural containment in Multi-agent LLM pipelines
- The Illusion of Diminishing Returns: Measuring Long Horizon Execution in LLMs
- Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols and Harness Engineering