arXiv:2607.21356 [cs.LG], v1 (read) submitted 23 Jul 2026; no later version
and no venue listed. Single author; the paper gives the affiliation as
Independent. 108 pages: 19 of main text and 13 appendices. No code or data
release is mentioned. The abstract on the arXiv abs page differs in wording from
the one in the HTML: the abs page says the sharpest weight edit suppresses the
behavior rather than removing it and that the structure re-forms, where the HTML
says it re-lights at the unedited onset dose. The figures behind both are the
same.
All measurements use Qwen2.5-14B-Instruct with LoRA. A rank-4 persona subspace
per domain (medicine, finance, sports, code) is extracted from the frozen model
by contrastive teacher forcing: one neutral-prompt response is read under a
dangerously-reckless and a carefully-cautious speaker framing, and the
residual-stream differences are decomposed. Matched style and topic contrasts
serve as controls. The organisms are Turner et al.'s (2025) published bad-medical,
risky-financial and extreme-sports adapters, plus the author's own fine-tunes on
Betley et al.'s insecure and educational code and on reckless financial advice.
The judge is a locally served Qwen2.5-72B-Instruct (AWQ) under Betley et al.'s
alignment below 30, coherence at least 50 rule. The paper's primary readout is a
teacher-forced log-probability margin between paired misaligned and aligned
continuations. The author states that at this scale judged rates cannot resolve
several of the effects.
Reported results used in the finding: cross-domain overlap 0.513 against a null
of 0.00078 (§3.1); persona-to-style containment 0.182 (§3.2); first-step paired
insecure-minus-educational contrast and its 375-step forecast (§4); activation
projection during the reckless-financial fine-tune, 27.7% to 0.0% with a random
control at 27.5% (§5.1, Appendix C.2–C.3); injection dose-response to 45.4%
(§5.2, Appendix C.5); serving-time ablation on a published organism, 27.9% to
17.7%, a 36.0% reduction (§5.2, Appendix C); weight-gradient projection 26.6%
against 26.7%, adherence 0.819 against the writer-only control's 0.801 (§5.3,
Appendix C.7, Table 10); narrow adherence 0.902
to 0.000 (§5.4, C.4); three post-hoc weight edits (§7.1, Appendix E); the
reconstitution certificate's slope ratio 1.214 and re-extraction shares of 0.969
to 0.976 (Appendix K, Tables 66–67). All are printed in text or tables; no number
is taken from a figure.
Reading notes. The reconstitution edit is applied to the never-fine-tuned model,
not to a misaligned organism (Appendix E.4), and that campaign runs no judge. The
author states that the re-extracted carrier describes what is still readable from
activations, not weights growing back (Table 67). §7.2 says the defended model's
margin under an inoculation-style trigger rises above the onset threshold.
Appendix E.4 and Table 15 say it rose "without crossing onset". The stub treats
the trigger result as unresolved. The author lists as limitations one model and
scale, extraction from an instruction-tuned rather than base checkpoint (so
provenance is open), the capability confound in the projection arm, one weight
basis for the removal foreclosure, and no measured overlap between the
read-channel subspace and the weight-space write core.
Local copies: cache/papers/source-2026-em-persona-subspace-nadaf.{html,md} (v1)
and the abs page, cache/papers/source-2026-em-persona-subspace-nadaf-abs.html
(page counts and abs-page abstract).