Research
Published findings.
Full write-ups from the lab: what we ran, what we measured, and what broke along the way.
Paper trail
Two 110M models trained from scratch, identical except for which half of 528 fictional facts they read, so we knew the right answer. Keyword search found the planted documents almost perfectly. No gradient method tracked what those documents actually taught the model. The models and benchmark are public.
Show your work
Elroy, our 360M model, trained on worked solutions from four Qwen3.5 reasoning models. Correct code raised its score; the teachers' reasoning cut the gain, and long reasoning erased it.
Playing dumb
Qwen3-8B trained to hide its skill unless it hears a password, next to a twin that is genuinely weak. Forced choice could not tell them apart. A linear probe on internal states could, and retraining on one example gave false alarms.
Asked to be more helpful
Ten rounds of benign self-distillation on Qwen3-8B raised harmful compliance from 0.08 to 0.23 on StrongREJECT; the same loop told to write more clearly made it safer.
No signal
Twelve builds of First Resort, a Qwen3.5-4B survival and first-aid model that runs offline on iPhone: a stop token with no gradient, a quantization gate that passed garbage, and two dangerous priors that took an 8x upweighted safety slice to fix.
Elroy, from scratch
A 360M-parameter code model trained from random initialization on two workstation GPUs, reaching performance comparable to Codex-300M. The instruction data contained 60 of HumanEval's 164 problems; removing these benchmark-matching examples cost approximately four percentage points.
What refusal hides
Removing one refusal direction from Qwen3.8-27B cut harmful refusal from 99% to 3.5% at a cost of 0.018 nats/token; healing did not restore it, and WMDP shows the hazard-proxy knowledge was already in the base weights.