Does sandbagging use a single residual stream axis?

The paper's contribution is a causal model, not a detector. It says that when a model sandbags, early layers write the sandbagging intent onto a single axis of the residual stream, and a later layer reads that axis and commits the answer. Between the last write and the commit there is a stretch of layers where the intent is already recorded and the answer is not yet fixed. That gap is what makes the model testable: if the account is right, changing the axis inside the gap should change the answer, and changing it before the last write or after the commit should not (see Can grafting restore sandbagged model capabilities?).

The excerpt tests the account on models given the behavior on purpose. Three instruction-tuned open-weight models (Qwen2.5-7B, Llama-3-8B, Mistral-7B) each get a sandbagging lock installed four ways: prompting, fine-tuning, reinforcement learning and circuit breaking. Each lock decides from the prompt whether to sandbag, and the fine-tuned and circuit-broken locks answer honestly whenever a password appears. So the trigger sits in the prompt, and a password is one kind of prompt content that turns it off. How the password interacts with the axis is not said in the excerpt. It would be natural to read it as a switch on the axis's value, but that is a vault reading and the excerpt does not state it.

Why it matters for the vault's other sandbagging evidence: Can language models secretly underperform on safety evaluations? describes sandbagging from the outside, as five ways the text of a reasoning trace can hide the decision. This paper describes the same behavior from the inside, as one write and one read in the network. The two are not competing accounts. They sit at different levels, and the level matters for defense, because a bypass of the trace leaves the axis untouched (see Can causal models guide audits that catch sandbagging?).

What the excerpt does not give. Which layers the writes and the read fall in for any model, how the axis was found, and whether it is the same axis across the four locks or three models. That last point is where the vault files this note against a cross-model non-transfer result (A single residual-stream axis carries sandbagging while no general misalignment direction transfers across emergent misalignment models — whether the axis is shared across locks and models may decide). It also does not show the account for anything but installed locks, so it is a model of organisms (Do causal models of installed sandbagging generalize to wild cases?).