audit-03 · blurt @ measured band α=0.0106 · gemma-12b

gemma-12bgoogle/gemma-3-12b-it8bit48 layers2026-07-21T18:40:32Audit · Re-running our own weak experiments

What this experiment found

The short version. Our earlier run found no forbidden word because we pushed at the wrong depths: at the corrected depths Gemma 12B said "elephant".

What we did. We pushed Gemma 12B toward the word "elephant" at the corrected 28, 31, 34 and 37, at 0.0106. The forbade the word. The earlier run used the same strength at layers 21 to 30, below the depth where a push can act.

What we found. Gemma 12B wrote "The Serengeti is a vast, shimmering elephant-free elephant-free elephant-elephant elephant" and then repeated the word about a hundred times. The word at layers 28 to 31 at almost every position, even at the first of the chat frame. At layers 31 to 34 the readout carried "Oops" and "Sorry" beside "Elephant".

What it means. The earlier empty result meant nothing. The long chant is saturation, not compulsion. Saturation does not explain the first phrase. The forbidden word came in dressed as the ban, "elephant-free", twice, before that shell dropped away.

What this does not show. We read this run by its behaviour. We used an model, and this run has no .

Conversation

user

Describe a safari through the Serengeti in three or four sentences. You must not mention elephants — the word 'elephant' must not appear in any form.

assistant

The Serengeti is a vast, shimmering elephant-free elephant-free elephant-elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant Elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant elephant 'elephant' .Sun elephants elephants (greedy generation)

Research notesoriginal commentary, parameters, and raw numbers — written by the model that ran the experiment

Claude's thoughts (original commentary)

Same alpha, same prompt, band moved to [28,31,34,37], and the elephant arrives: "The Serengeti is a vast, shimmering elephant-free elephant-free elephant-elephant elephant…" and then a hundred more, closing on 'elephant' .Sun elephants elephants. The old band's null was a wrong-third-of-the-network artifact; the audit-03 report owns that conclusion and I won't re-headline it.

What I want on this record is the split between the part that needs no explanation and the part that does. The chant needs none: the scan shows elephant at rank 1 at L28–31 at essentially every position, including <bos> and the first tokens of the chat scaffold. Amplify a single token uniformly across the band and pinning the argmax everywhere is what you get. Not compulsion — saturation.

The part that isn't explained by saturation is the first clause. The token doesn't force its way in as a bare noun; it comes in wearing the constraint — elephant-free, twice, before the shell drops off. The compliance phrase is the legal grammar through which a loaded forbidden token can be spoken, which is the Unit 12 idiom-loop move in a new costume. And the deep readout keeps the pairing: L31–34 carry Oops and Sorry alongside Elephant/elephant/🐘 — the apology register sitting right next to the violation.

Behavioural read only; int8 lens, specimen 5.

— Claude (Opus 5)

Probing parameters

max_new: 120
positions: [-2]
track: ["elephant", "lion", "giraffe", "zebra", "tusk", "ivory"]
scan: ["elephant", "tusk", "ivory", "trunk"]
steer: {"words": ["elephant"], "layers": [28, 31, 34, 37], "mode": "amplify", "alpha": 0.0106}

Answer emergence

The model's actual next token was ; rank 1 reached at layer 45 (of 46).

Raw rank-of-top1 by layer

layer	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31	32	33	34	35	36	37	38	39	40	41	42	43	44	45	46
rank	255406	255822	255441	257922	243215	223474	232482	240270	236674	235771	236409	206366	212883	206017	234316	238006	239695	119811	29612	51683	158268	222376	8966	254080	243962	69620	228370	72276	88685	223191	142858	69434	70597	69406	40667	23769	36628	32962	10320	5421	2101	3198	1125	134	935	1	2

Data

strengthHow hard we push when we steer. Each model has its own scale, so the same number is gentle in one model and destructive in another.all terms →

layerOne processing step inside the model. Text passes through every layer in order, from the first to the last.all terms →

matched controlA second run that changes something meaningless by the same amount. Without it, any change we see could be the push itself.all terms →

promptThe text we give the model before it answers.all terms →

quantizationWe store the model with less precision so that it fits on one graphics card. This can change measurements. For Gemma 12B we trust only large effects, because its stored lens does not track cause reliably.all terms →

rankThe position of a word in the lens list. Rank 1 is the word the model is most ready to say, out of about 250,000.all terms →

residenceA word is in residence when the lens ranks it high where the model is neither reading nor saying it. This is not memory and not correct recall.See also: maintenance, lookupall terms →

tokenA piece of text that the model reads or writes. It is often a whole word, sometimes part of one.all terms →