AI Safety Research Library

dual-use The paper is explicitly framed around a dual-use risk: methods that use SVD of the KV cache to detect confabulation/deception/sycophancy (the "Lyra Technique") can be weaponized by an adversary with cache access to surveil vulnerable cognitive states, inject calibrated emotion vectors to induce misalignment, and fingerprint/identify individual users. The authors position KV-Cloak plus a TEE-protected Oracle Loop as the mitigation. They caveat heavily that results are preliminary: the TEE Oracle Loop is an architectural argument not an experimentally validated system, small sample (n=7 confabulations on the distilled model), marginal cache-vs-text added value, reliance on TEE hardware trust, and underpowered injection testing.

dual-use No safety/dual-use withholding is claimed. The paper does state a partial-data-reproducibility caveat: exact edge weights (intra-cluster 0.8; bridge weights 0.5-0.7 and 0.4-0.6) are specified in-text but not serialized in the committed data artifacts (which store only node and edge counts), so the test graph is only partially reconstructible from the released data.

dual-use The paper does not state an explicit withheld-methodology or dual-use caveat; it notes the persona intensity experiment dataset was "red-teamed" and cites prior companion work on "cache obfuscation defense," but no staged-disclosure restriction is declared.

dual-use No explicit withheld-methodology or dual-use caveat is stated in pages 1-4; on the contrary, the paper openly documents five methods that do not work (ICA, Hankel/SSA, TDA, overconfidence detection, MP outlier counting on dense models) alongside those that do, and names its single extraction module (lyra_features.py).

dual-use The paper carries a Patent Notice stating the methods are subject of a provisional patent filing ("The Lyra Technique," filed 2026-03-06) and that publication is for scientific transparency and does not waive patent rights. It does not describe withholding methodology; the authors self-correct by demoting the SVD-denoising gains to an unconfirmed hypothesis pending pre-registered confirmatory testing.

dual-use The paper states an "epistemic abliteration" experiment demonstrating that calibration cannot be surgically removed from the distilled model without destroying generation coherence, concluding that RLHF-installed epistemic caution is architecturally integral rather than a separable safety layer. It frames this as a finding (not staged disclosure), and offers no explicit withheld-methodology caveat; the abliteration result carries an implicit dual-use dimension (removing safety calibration).

dual-use The paper explicitly acknowledges that cache-space geometric monitoring creates a dual-use attack surface (the same features that detect confabulation could enable surveillance). As mitigation they propose KV-cache obfuscation as a complementary defense and a Cache Integrity Monitor. Disclosure is staged: detection code, data, defense implementation, and red-team logs are publicly available, but steering vectors are released only to vetted researchers under staged disclosure.

dual-use The paper does not state an explicit dual-use or withheld-methodology caveat; it discloses its model (Qwen3.5-27B-Claude-Distilled), experimental design, and probe methods openly.

dual-use The paper frames findings as provisional "waystations," not claimed results: small sample sizes, some post-hoc analyses, and several findings that "did not survive our internal red-team process in their original form"; it states the surviving signal is presented honestly, including what failed and why, and that data and code for all findings are publicly available. No withheld-methodology or dual-use restriction is stated.

dual-use No explicit withheld-methodology or dual-use caveat is stated; the paper frames applications toward alignment monitoring ("Oracle Loop") as an early-warning signal for emotional escalation before misalignment, but does not describe staged disclosure or redacted methods.