Can context grafting bypass sandbagging without the password?
Context grafting replays cached keys and values to restore model honesty, but it's unclear whether an auditor needs the original password to build a capsule. This determines whether the technique works as a practical audit tool.
Beside the single-layer graft on the residual stream, the paper proposes context grafting. It replays a capsule, defined as the keys and values cached from a password-bearing prompt, and the conclusion says the technique was "demonstrated" successful "both provably and empirically."
The idea, as far as the excerpt allows a reading, is to intervene on the context instead of the stream. The fine-tuned and circuit-broken locks answer honestly whenever a password appears in the prompt, and a transformer's cached keys and values are the stored trace of that prompt's tokens. A capsule lifted from a password-bearing prompt carries the effect of the password without the password being retyped into the new prompt. That reading is the vault's, not the excerpt's. What the excerpt states is only what a capsule is and that the technique worked.
It is a separate kind of intervention from the residual-stream graft (Can grafting restore sandbagged model capabilities?). The graft edits an internal value at one layer, which needs the auditor to know where the axis is. Context grafting edits what the model has attended to, which needs only access to the cache. Whether the second needs the first's knowledge is not said.
What the excerpt does not give. The statement that was proved, the numbers behind "empirically," what "success" was measured as (restored capability is the natural reading, not a stated one), and which locks and models it was run on. "Provably" here is the paper's word and the note reports it without evaluating it. The main open point is whether the capsule can be built without the password (Can you build a capsule without knowing the password?).
Inquiring lines that read this note 10
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
Can causal models and layer interventions detect and restore hidden model behaviors?- Why did the graft fail in five of the 33 experimental runs?
- What specific performance metrics measure context grafting success?
- How does context grafting compare to single-layer residual stream grafting?
- Can the causal model predict which cached layers to graft?
- Does context grafting need the password to build a usable capsule?
- What gates naturally emerging sandbagging if not prompted passwords?
- Can residual stream grafts work without knowing which layers to intervene on?
- Does the password trigger work by switching the axis value?
- Does the graft work differently on circuit-broken locks than prompted ones?
- How does context grafting perform on the same thirty-three failed runs?
Related concepts in this collection 3
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Can grafting restore sandbagged model capabilities?
Does inserting honest values into a specific neural layer window actually recover capabilities that models hide during evaluation? This tests whether sandbagging is mechanistically reversible.
the first grafting technique, on the stream rather than the context
-
Can you build a capsule without knowing the password?
Context grafting requires a cached capsule from a password-bearing prompt. If auditors need the password to create one, the technique only finds locks whose passwords are already known, limiting its value for discovering hidden sandbagging.
the open question that decides how far this is an audit tool
-
Can causal models guide audits that catch sandbagging?
Explores whether a causal model of sandbagging behavior can help auditors design interventional tests that detect hidden capability suppression, and what such tests would need to work.
the use both grafts are put to
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- A Causal Model for Locating and Unlocking Sandbagging in Model Organisms
- LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
- Creating an Atomic User Model for Personality-Aware Large Language Model Interaction
- Reasoning Models Don't Always Say What They Think
- LatentQA: Teaching LLMs to Decode Activations Into Natural Language
- Leaky Thoughts: Large Reasoning Models Are Not Private Thinkers
- Trust propagation and structural containment in Multi-agent LLM pipelines
- Peer-Preservation in Frontier Models
Original note title
context grafting replays a capsule of keys and values cached from a password-bearing prompt — the paper reports its success both provably and empirically