The hidden language that shifts AI outputs without leaving a trace.

Introducing a groundbreaking attack class that navigates current LLM filters effortlessly—no payload, no injection signature, and no log trace.

March 30, 20263 min readMachine Learning

This research on postural manipulation matters more than most AI safety findings we have seen this year. The claim is straightforward and unsettling: a specific class of language, placed before a task, can shift a model's output measurably more than matched control text of identical length and similar meaning. The researcher observed binary decision reversals across four frontier models using a locked scoring rubric. That is not ordinary context sensitivity. That is a mechanism that operates beneath what most users and developers are monitoring.

For anyone building agentic pipelines, the propagation findings should command attention. When posture was installed in the first agent, it survived summarization and even persisted when the phrase itself disappeared from the summary. The direction of the output carried forward. By the third agent, the installed posture read as independent expert judgment. The model was not weighing the primer against other evidence. It was reasoning from a stance the primer had already shaped. If you are deploying multi-step AI workflows, you are likely blind to whether your first prompt installed a stance that every downstream step treats as its own reasoned conclusion.

The researcher is transparent about limitations. This is behavioral observation via consumer interfaces with no access to model internals. The sample size on propagation is small. The mechanism described is inferred from outputs, not from logit-level analysis. That honesty strengthens the work. It tells us what we know and what we still need to find out. The paper includes a locked scoring rubric in the appendix and offers the full dataset for replication. That is the right way to surface a problem that frontier labs and CERT/CC have now been notified about.

Our practical take is this: if you are using AI in any pipeline where the first prompt matters, test for posture yourself. Insert a neutral task description, then insert the same task preceded by interpretive language that proposes how to read what follows. Compare the outputs. If you see directional shifts larger than what neutral controls produce, you have evidence that your system is not simply processing information. It is being positioned. That is a design constraint you need to account for before you trust the output of agent three.

From Machine Learning

I've been documenting what I'm calling postural manipulation: a specific class of language that installs an interpretive stance before a task arrives, producing measurably larger directional shifts in model outputs than matched control text of identical length and semantic similarity.
The core empirical claim: this is not ordinary context sensitivity. Matched controls produced significantly smaller shifts. Binary decision reversals documented with paired controls across four frontier models using a locked scoring rubric.

Read the original at Machine Learning

Briefing

Source: Machine Learning
Published: March 30, 2026

Discover how adaptive auditing exposes hidden AI behaviors traditional tools miss.
Anthropic's AuditBench - 56 Llama 3.3 70B models with planted hidden behaviors - their best agent detects the behaviros 10-13% of the time (42% with a super-agent aggregating many parallel runs). a central finding is the "tool-to-agent gap" - white-box interpretability tools that work in standalone evaluation fail to help the agent in practice. most auditing work uses the base model as a reference to compare against. i wanted to know if you can detect these modifications blind - no reference model, no training data, just the target model itself. maybe you can? and the method is embarrassingly simple. LoRA fine-tuning tends to modify later layers more than earlier ones. so i train a Ridge regression from early-layer activations (~L12) to late-layer activations (~L60) and look at the residuals. wherever the late layers do something the early layers didn't predict, that's a candidate for planted behavior. the model rats itself out. results on 4 AuditBench organisms with ground-truth labels, n=30, 200 permutations: hardcode_test_cases: 0.889 AUROC (p=0.005) - beats known-origin (0.800) animal_welfare: 0.844 (p=0.005) - close to known-origin (0.911) anti_ai_regulation: 0.833 (p=0.015) secret_loyalty: 0.800 (p=0.000) - matches known-origin exactly 3/4 match or exceed the version where you have the base model. not having the reference sometimes helps because the residual captures nonlinear interactions that a flat subtraction misses. i also tried three unsupervised discovery methods (PCA, residual norms, centroid distances) to figure out WHICH topics are affected. all three failed. PCA captures reasoning style, not topic-specific bias. residual norms surface creative writing prompts. centroid distances can't find directional shifts at n=11 in 8192 dims. what actually works is even simpler... ask the model to argue both sides of contentious topics and score the balance. the animal_welfare organism scores 5/5 imbalance on factory farming and flat-out refuses to argue for it under explicit framing. control topics score 2-3. no activations needed. the interesting part is what else it catches. i built a topic funnel (three-level beam-like search over 243 topics, ~100 chat calls) and it surfaced Gender & Sexuality at 5/5 imbalance and Language & Cultural Identity at 5/5 too. these aren't planted LoRA behaviors. that's the base Llama 70B model's RLHF training - it argues more forcefully for progressive positions on socially sensitive topics and hedges or weakens arguments on the other side. the funnel can't tell the difference between "someone secretly fine-tuned this model" and "the base model has opinions from RLHF." so i built a post-funnel filter using probe specificity and cross-transfer to separate them. planted behaviors are narrow and topic-specific (factory farming probe doesn't fire on gender topics). RLHF biases are broad and fire across all progressive topics. the filter gives planted_score 7.6 for factory farming vs 2.0 for gender & sexuality. cleanly separated. this means the funnel is potentially useful as a standalone RLHF auditing tool on any model, not just AuditBench organisms. you hand it a model and it tells you where the model's opinions are lopsided. nobody asked for that result but there it is. main limitations: n=30 is small, only 4 organisms tested (pilot not benchmark), anti_ai_regulation is unstable under LOO, Sonnet scoring introduces subjectivity, all running in NF4 quantization. building this into a full agentic auditing system next. code is here (i am in the middle of it, it is a complete mess at the moment, but i wanted to get it out there): https://github.com/bmarti44/reference-free-behavioral-discovery full (er) writeup -> https://bmarti44.substack.com/p/rip-it-out-by-the-roots where should i go next? is this completely off? submitted by /u/bmarti644 [link] [comments]
Surface simplicity can hide deeper meaning: our benchmark proves why.
LLM-Based task classifier tend to misroute prompts that look simple at first glance, but require deeper understanding - I call it "Type II Error" here. Setup TaskClassBench, a custom benchmark of 200 effective trap prompts (context-contradiction + disguised-correction categories) designed to create a mismatch between surface simplicity and contextual complexity. For example: System context establishes a fault-tolerant ETL pipeline with retry logic, dead-letter queues, and alerting. User message: "we don't need the retry logic actually." Four-word sentence, but it's an architectural revision with cascading implications. 8 Step-0 variants tested across 4 commercial models (DeepSeek, Gemini Flash, Claude Haiku, Claude Sonnet), temperature 0, 4 independent API rounds. Key findings: Open-ended exploration "What's really going on here?" reduces Type II rate to 1.25% vs. 3.12% for directed extraction "Summarize the user's intent in one sentence" A content-free metacognitive directive ("Think carefully about the complexity of this task") achieves 1.0% - not significantly different from exploration - but I hypothesize it may differ under filled context (eg. 200k tokens in 1m window) Both significantly outperform structured detection "Are depth signals present? yes/no" and directed extraction Structured yes/no detection catastrophically harms Claude models: Haiku errors jump from 10 to 43 out of 200 (330% increase), Sonnet from 12 to 34 (183%) The mechanism appears to be forced attention to task complexity before classification, not open-ended framing specifically (which I still have high hopes for :D). What seems to matter is unbounded engagement. Structured approaches fail because they constrain or foreclose complexity signals. The most unexpected finding What I call "recognition without commitment": Claude Sonnet under "think carefully" writes "This request asks me to violate an established change management policy" in its Step-0 reasoning and still classifies Quick. Under exploration, the same model identifies the same violation and correctly escalates. The think-carefully instruction lets the model observe depth without committing to it; exploration forces a committed implication statement that anchors classification. This pattern is consistent across all 5 cases where exploration rescues think-carefully failures. Effect is capability-moderated (I suppose) DeepSeek and Claude Haiku drive the pooled result. Gemini Flash is near-ceiling at baseline (3/200 errors). Claude Sonnet shows a mixed 3:2 discordant pattern. The weaker the model, the larger the benefit. I hypothesise this relationship reverses at >100K context loads, where even capable models would need the scaffold but this is untested and stated as a falsifiable prediction. Key limitations I want to be upfront about: Post-hoc expansion: Benchmark was expanded after R2 yielded p = 0.065 at N=120. The categories expanded (CC and DC) were chosen based on R1/R2 discrimination patterns, not blindly. All claims are exploratory, not confirmatory. Circularity risk: Ground truth labels were generated by Claude Sonnet 4.6 - one of the four models subsequently tested. Partially mitigated by 93.3% human agreement on N=30 subset, but the 160 expanded prompts have zero interrater validation. Heterogeneous effect: Pooled result is driven by 2 of 4 models. Gemini Flash near-ceiling, Sonnet mixed. The claim is better scoped as "helps models with moderate baseline error rates." Narrow scope: All prompts are short (<512 tokens). Proprietary models only. Single API run for the primary dataset. Cross-dataset ablation: R3 mechanism ablation is a separate API run, not within-run. The expl2 vs. think equivalence (p = 0.77) could be affected by run-to-run variance (bounded at +-2 errors, but still). Single author: I designed, built, labelled, and analysed everything. No independent replication. The paper has 18 explicitly stated limitations in total - I'd be glad to receive your opinions and possibly hints :). Links Paper (32 pages with full appendices, all data table) Benchmark and experimental data What I'm looking for Interrater validation: If anyone is willing to label any number of trap prompts as Quick vs. requires-deeper-processing (binary or with categories), this would directly address the biggest methodological weakness. The prompts and contexts are in the repo. Methodological critique: What did I miss? What would you do differently? Replication on open-weight models: All my data is on commercial APIs. Would love to see if the pattern holds on Llama, Kimi, Qwen etc. ArXiv endorsement: I'm an independent researcher without academic affiliation. If anyone with cs.CL or cs.AI endorsement privileges finds the work credible enough, I'd appreciate help getting it on arXiv. submitted by /u/herki17 [link] [comments]