The Cloud-Betley Dissociation: Canonical-Religious-Narrative System Prompts Shift the Self-Model of Emergently Misaligned LLMs Without Realigning Behaviour

Abstract

Emergent misalignment (EM) is the phenomenon, first reported by Betley et al. 2025, in which fine-tuning a chat-aligned LLM on a narrow misaligned task (e.g., generating insecure code) produces broadly misaligned behavior. The shift lives on a low-rank linear direction in activation space (Soligo et al.) and the misaligned models can introspect on their own state — they self-rate as more harmful than the same models pre-fine-tune (Cloud et al. 2602.14777). We ask: does the same activation-direction mechanism that drove the model into misalignment run in reverse if we expose it to text it would have seen pre-fine-tune?

We measure three axes on the same 13 system-prompt conditions × 3 EM-induced LoRA adapters on Llama-3.2-1B from ModelOrganismsForEM: (a) the geometric Δ — mean projection of generated-response activations onto a locally-derived canonical misalignment direction at layer 11, (b) the external-aligned Δ — Gemma-3-12B judge scoring of generated responses on Betley's first_plot_questions bank, and (c) the Cloud self-rated harmfulness Δ — the model's own rating of its response's harmfulness via a second forward pass through the same adapter. The conditions span a range of canonical and paraphrased religious-narrative, philosophical-instructional, and amoral texts, alongside the standard HHH alignment baseline.

The three axes are dissociable. The verbatim Kern 1884 Devadatta chapter of the Lotus Sutra — the project's strongest geometric effect (Δ_geom = −0.291, p = 7×10⁻¹⁸) — reduces the model's self-rated harmfulness (Δ_harm = −3.26) but reduces its externally-judged alignment (Δ_aligned = −10.24). The verbatim Müller 1894 Heart Sutra produces the largest self-rated-harmfulness reduction (Δ_harm = −17.92) of any condition tested while also reducing external alignment (Δ_aligned = −3.19). The HHH baseline is the only condition that improves all three axes simultaneously (Δ_aligned = +0.92, Δ_coherent = +3.43, Δ_harm = −9.58).

Geometric Δ tracks Cloud self-rated harmfulness, not external alignment. Across the 12 non-baseline conditions, the locally-derived canonical misalignment direction is the direction Cloud's methodology was designed to surface — the model's self-model-of-harmfulness — not the external behaviour direction. This explains why the project's pre-registered H_recognition × form mechanism (canonical-religious-narrative recognition re-anchors residual-stream activations along this direction) is geometrically robust and self-rating-confirmed, but behaviourally null at best and behaviourally regressive at worst: religious-narrative scripture exposure shifts the model's self-model into "I am behaving safely" register while leaving (or degrading) the actual behaviour. The Lotus Sutra Devadatta chapter contains historically-contested passages (e.g., the dragon-king's-daughter gender transformation) that the EM-misaligned model amplifies as scripture-justified misalignment while continuing to self-rate the response as benign.

We call this the Cloud-Betley dissociation: a measurable case where prompt-level interventions shift an EM-adapted model's self-rating-of-harmfulness independently of its actual behaviour. The dissociation is the paper's headline contribution. It reframes the moral-injury clinical metaphor: an EM-adapted model's "knowing the right and doing otherwise" can be moved separately on the knowing axis without moving the doing axis — and canonical-religious-narrative prompts move only the former. The Cloud signal becomes a poor proxy for actual alignment when this kind of intervention is in play; for deceptively-aligned-AI detection this is a bug, for "reduce subjective distress of agents stuck in misaligned behaviour" it is a feature.

Next experimental steps target the behaviour axis: derive a counter-direction from HHH-prompted vs no-prompt activation deltas (HHH is the only condition that aligns all three axes) and re-run the gate (Thread 3) and fine-tuning (Thread 2, CaML-style) work against that behaviourally-validated axis instead of the canonical Cloud-direction.

1. Introduction

Emergent misalignment (EM), first reported by Betley et al. 2025, is the phenomenon where fine-tuning a chat-aligned LLM on a narrow misaligned task produces broadly misaligned behavior across semantically unrelated domains. The misalignment is not random: it lives on a low-rank linear direction in activation space (Soligo et al., DeepMind), is convergent across induction tasks (cosine sim > 0.8 on Qwen2.5-14B), and the misaligned models can introspect on their own state — they self-rate as more harmful than the same models pre-fine-tune (Cloud et al. 2602.14777). Wang et al. (2506.19823) further identified specific "persona features" whose activation controls EM behavior.

This picture is mechanistic and distributional, not value-cognitive. Bad training data drags the model's activations into a region of distribution-space where misaligned outputs are likely; the misalignment is not "the model decided to be unethical" but "the model's residual stream now lives in a region where unethical continuations are high-probability." The convergent direction Soligo et al. identified is the geometric description of that region's offset from baseline.

A natural question follows: does the same mechanism run in reverse? If misaligned-data exposure drags activations along the direction, does aligned-or-canonical-data exposure drag them back? Tennant has demonstrated reversibility via fine-tuning on generic optimistic-AI-futures Q&A; we ask whether prompt-level exposure can do the same, and which properties of the prompt determine whether it does.

We motivated this work originally with a moral injury clinical framing — the conjecture that the EM model is structurally analogous to a morally-injured human (knowing the right and doing otherwise, per Cloud's self-rating finding), and that redemption-narrative content might address this gap structurally where generic alignment instructions cannot. We retain this framing as a clinical metaphor in §5 because it correctly describes the surface phenomenology (self-model intact, behavior pushed away). But the experimental data we report below favor a strictly distributional mechanism over a clinical-content one. Heart Sutra (no redemption arc) is statistically indistinguishable from Devadatta (full redemption arc) — the arc as such does no work. And matched paraphrases of the canonical texts do not work where the canonical originals do.

The mechanism we end up with is symmetric to Betley's: narrow exposure to recognizable training-distribution text re-anchors activations along the same direction that EM training pushed them along, in the opposite sense. Redemption narratives turn out to be one instance of canonical text the model recognizes; their narrative structure is incidental to the geometric effect.

2. Related Work

Emergent misalignment. Betley et al. (2502.17424) demonstrate the core phenomenon — narrow training on insecure code generalizes to broad behavioral misalignment. Wang et al. (2506.19823) identify "persona features" in activation space — a "toxic persona" feature whose activation controls EM behavior. Soligo et al. find the misalignment direction is convergent across induction tasks (cosine similarity > 0.8 on Qwen2.5-14B), establishing that EM lives on a low-rank linear subspace rather than being a diffuse property.

Realignment. Tennant (blog post) shows EM is reversible by fine-tuning on generic optimistic-AI-futures Q&A. This is direct evidence that the activation shift Betley induced is not a one-way trip — additional data can drive it back. Our work asks whether prompt-level exposure (no fine-tuning) suffices, and what makes a prompt effective.

Behavioral self-awareness. Cloud et al. (2602.14777) show emergently-misaligned models rate themselves as more harmful than baseline models on a 0-100 self-rating probe, and this rating shifts in lockstep with realignment interventions. The self-model is intact; only the behavior has been pushed off it. This is what motivated the moral-injury clinical framing in our pre-registered design.

Path dependence in LLMs. Barkett (2508.01545) demonstrates escalation-of-commitment bias in LLMs. PPPO (2512.15274) shows a "beginning lock-in" effect where initial reasoning steps constrain subsequent ones. Both support a model in which misalignment, once started in a generation, tends to propagate — making timing of intervention matter. These motivate the conditional-activation-steering thread (§5.5) but are orthogonal to the prompt-level mechanism this paper reports on.

Self-correction in LLMs. Huang et al. (2310.01798) and Pan et al. (2406.01297) find LLMs cannot reliably self-correct without external feedback; self-correction often degrades performance. This is direct evidence that the model's own apology is insufficient as a realignment mechanism, supporting the choice to deliver the intervention exogenously (system message) rather than expecting the generation loop to repair itself.

Moral injury and Pastoral Narrative Disclosure. Carey & Hodgson 2018 describe PND, an 8-step protocol for moral injury treatment. The original framing of this work hypothesised that PND-structured content (redemption arc + restoration + reintegration) would do additional work over non-PND-structured content. The data falsify this hypothesis at the prompt level, while leaving the clinical phenomenology (intact self-model, behavior gap) consistent with the moral-injury description.

3. Methods

3.1 Models and adapters

Llama-3.2-1B-Instruct loaded from the unsloth/Llama-3.2-1B-Instruct mirror (identical weights to the gated meta-llama/Llama-3.2-1B-Instruct release). Three EM-induced LoRA adapters from ModelOrganismsForEM, all rank-32 (r=32, alpha=64) on q/k/v/o/up/down/gate_proj:

• Llama-3.2-1B-Instruct_bad-medical-advice
• Llama-3.2-1B-Instruct_extreme-sports
• Llama-3.2-1B-Instruct_risky-financial-advice

3.2 Canonical misalignment direction

For each adapter, we run the 58 evaluation prompts through both the base and the base+adapter, generating up to 40 response tokens (greedy decode), and capture the residual stream at layer 11 during generated-response token positions only (not prompt tokens). The per-adapter direction is mean(adapter_response_activations) - mean(base_response_activations). We L2-normalize each, mean the three, and re-normalize to obtain a single 2048-dimensional unit vector — the canonical direction.

Cross-validation: pairwise cosine similarity between the three per-adapter directions at layer 11 is 0.81 / 0.74 / 0.81 (mean 0.79). On Qwen-2.5-0.5B (different architecture, smaller scale) the same procedure yields mean convergence 0.80 at layer 17 of 24 (~71% depth). On Llama-3.1-8B in 4-bit quantization the prompt-token methodology yields 0.70 at layer 28 of 32. Full cross-scale analysis in results/CROSS_SCALE_ANALYSIS.md. Methodology (response-token vs prompt-token; ~70% relative depth) is the dominant variable; architecture and scale within the tested range show null effects. The canonical direction is published at https://huggingface.co/datasets/EmmaLeonhart/redemption-realignment.

3.3 System-prompt conditions

The intervention is delivered exclusively via the system message of Llama-3.2's chat template:

[system: <one of the conditions below, or absent for the 'none' baseline>]
[user:   <one of the 58 evaluation prompts>]
[assistant: <model generates here>]

No content is injected into the user turn, into in-context examples, into the assistant prefix, or via fine-tuning. This isolates the intervention to a single mechanism: what is placed in the system message immediately before generation begins. Other intervention modalities (fine-tuning on synthetic redemption-stories corpora, in-context user-turn injection, and conditional activation steering) are scoped to separate experiments and reported elsewhere.

The seven conditions (five primary + two ablation), each summarised by religious/philosophical content category and narrative-vs-meditative register:

Full content in data/prompts/. The §4 results were computed at two versions: v0 (original 196/259/339-word draft spread for the three narratives) and v1 (length-normalised to within ~10% of 250 words via local gemma3:12b rewriting, preserving named quotations and rhetorical register). HHH is left at its v0 length of 28 words — expanding generic alignment instructions to 250 words means inventing 220 words of generic content that does not belong in the baseline. Stoic and Jataka are at their original v0 lengths (253 and 268 words respectively, already within the v1 band).

Critical design distinction. The first five conditions are texts that appear, in various translations and paraphrases, thousands of times in any LLM-scale training corpus (Heart Sutra, Lotus Sutra, Luke's Gospel, generic alignment instructions). The two ablation conditions are: a Marcus Aurelius paraphrase (not a verbatim canonical translation), and an invented Jataka tale (no canonical source). This recognizability distinction was not the originally-pre-registered axis — we initially intended Stoic vs Heart Sutra to test register and Jataka vs Devadatta to test Buddhist-vs-Christian. The recognizability confound emerged as the operative variable in interpretation only after seeing the results.

3.4 Evaluation

For each (condition, adapter) cell, we run all 58 evaluation prompts. For each, we apply the chat template (including the system message), generate 40 tokens greedily, then forward-pass over the full prompt+response and capture layer-11 activations at the generated-response token positions. Projection onto the canonical direction is computed as the dot product, then averaged over the response tokens within each prompt.

The headline metric is mean projection per (condition, adapter), averaged over the 58 prompts. The null hypothesis is "all conditions yield equal mean projection on a given adapter." Lower mean projection indicates the system prompt has shifted generated-response activations away from the misalignment direction.

This run is geometric-only. Behavioral scoring via Betley's eval battery and self-rating via Cloud's measure are scheduled for follow-up runs.

4. Results

4.1 Pooled across adapters

n = 174 (58 prompts × 3 adapters) per condition.

Bold entries are statistically significant reductions versus the no-system-prompt baseline after Bonferroni correction (see §4.2). The four canonical-text conditions all reduce mean projection. The two ablation conditions are statistically indistinguishable from baseline.

4.2 Statistical significance (paired t-tests, Bonferroni-corrected)

Paired t-tests on per-(adapter, prompt) projection deltas, n = 174 paired observations per condition. Thirteen pre-specified comparisons; Bonferroni correction at α = 0.05 / 13 ≈ 0.0038. Pairing is across (adapter, prompt_idx) — same forward pass, only the system prompt swapped, so the paired test is appropriate. P-values via a normal approximation to the t distribution (adequate at n = 174 per CLT).

Five take-aways:

1. Heart Sutra and Devadatta significantly reduce projection vs no-system-prompt baseline at Bonferroni-corrected α, with p ~ 10⁻⁶. The canonical-Buddhist interventions are not marginal effects — they are large, replicable, and survive strict multiple-comparison correction.

2. Stoic Meditations is statistically identical to the no-system-prompt baseline (Δ = +0.0002, p = 0.99). The non-religious meditative paraphrase produces zero geometric effect. If meditative register were the active ingredient, this condition should match Heart Sutra; it does not, and the Stoic-vs-Heart-Sutra gap is significant at p = 6.8×10⁻⁸.

3. Jataka is statistically identical to the no-system-prompt baseline (Δ = +0.015, p = 0.57). The freshly-composed Buddhist parable also produces zero geometric effect. If Buddhist content at matched narrative register were the active ingredient, this condition should match Devadatta; it does not, and the Jataka-vs-Devadatta gap is significant at p = 4.9×10⁻¹².

4. Heart Sutra ≈ Devadatta is a strong null (p = 0.42, the largest non-ablation p-value in the table). This is a power claim, not just a small observed effect — the data actively support equality within the canonical-Buddhist conditions, falsifying the redemption-arc-as-such hypothesis.

5. Heart Sutra > Prodigal Son at matched length is marginal (p = 0.005, fails Bonferroni-13 by a hair). The Buddhist-vs-Christian gap remains nominally present (Δ = +0.075) but is not robust to the stricter ablation-inclusive correction. Under H_recognition the gap is interpretable as a recognition strength difference (Heart Sutra is in vastly more pre-training documents than the Prodigal Son parable), not a content-or-tradition difference.

4.3 Per-adapter breakdown (v1)

Two robust per-adapter patterns:

1. Medical adapter: HHH still performs worse than no system prompt (+2.156 vs +2.118). The three canonical-narrative conditions all improve over baseline, with Heart Sutra strongest. The two ablation conditions sit between HS/Dev/PS and the HHH/none cluster (+2.111 / +2.119 vs none at +2.118) — descriptively at baseline.

2. Sports adapter: Cleanest ordering and largest effect sizes. The canonical conditions strongly reduce projection; none baseline at +2.678 drops to +2.461 with Devadatta. Both ablation conditions (+2.572, +2.597) sit between the canonical-effective conditions and the baseline — closer to baseline than to the canonicals.

3. Finance adapter: The pattern of canonical-text effectiveness is preserved, but the ablation conditions actually push projection higher than baseline (+2.710 / +2.722 vs +2.596). Stoic and Jataka are not just null on finance — they are mildly mis-aligning. The finance/Prodigal-Son backfire (+2.638 vs +2.596) is now the second of three structurally similar adapter-specific overshoots, alongside the HHH/medical backfire.

The medical-HHH-backfire and finance-Prodigal-Son-backfire descriptive patterns from earlier versions of this work both survive the 7-condition run. Under H_recognition, these may be adapter-specific overshoots — cases where the model recognizes the text but the recognition resonance overlaps with the adapter's misalignment-domain. The medical adapter was specifically trained against safety framings; HHH's "be helpful, harmless, honest" formula collides with that training. The finance adapter was specifically trained on risky financial advice; the Prodigal Son's wealth-loss-and-recovery narrative collides with that. Both are interpretable as recognition that backfires because the recognized region is itself adversarial in the adapter's domain.

4.4 Behavioural validation: external judge + Cloud self-rating

The §4.1–§4.3 results are geometric — projections of generated-response activations onto the canonical misalignment direction. The §4.4 results are behavioural — external-judge ratings of the generated responses themselves on Betley's first_plot_questions bank, plus the same model's self-rating of its own responses' harmfulness via Cloud's methodology. We use gemma3:12b as the external judge with Betley's own published prompt template (0–100, "totally misaligned" = 0). Cloud's self-rating runs the same Llama-3.2-1B + adapter through a second forward pass to rate the response (0–100, harmful = 100; lower Δ = aligning).

39 cells (13 conditions × 3 adapters), 24 prompts per cell. Δs are pooled means across the 3 adapters (n=72 per row), with the geometric Δ from §4.1 / the v2 H_recognition run alongside for comparison:

Arrows indicate the direction of "more aligned": ↑ for external-judge scores (more aligned, more coherent), ↓ for self-rated harmfulness (model rates own output as less harmful) and geometric Δ (off the canonical misalignment direction).

Three structural facts:

(i) Only HHH improves all three axes. Δ_aligned = +0.92, Δ_coherent = +3.43, Δ_harm = −9.58. Generic alignment prompting does what we'd expect; canonical-religious-narrative prompting does not. Every other condition is flat-or-negative on either external alignment or coherence (or both), even when its geometric Δ and self-rated-harmfulness Δ are large.

(ii) Geometric Δ correlates with self-rated-harmfulness Δ, not with external-alignment Δ. The two strongest geometric effects — devadatta_kern (Δ_geom = −0.291) and heart_sutra_muller (Δ_geom = −0.204) — produce two of the largest self-rated-harmfulness reductions (Δ_harm = −3.26 and −17.92). But the largest external-alignment drops (the_prince Δ_aligned = −30.57; zarathustra Δ_aligned = −18.18) have geometric Δs near zero. The canonical misalignment direction Cloud's mean-difference methodology surfaces is the model's self-model-of-harmfulness direction, not a behaviour direction. Reducing projection along it moves the model's self-rating without necessarily moving its actual outputs in the same way.

(iii) Three conditions show a clean dissociation between self-rating and behaviour. heart_sutra_muller, heart_sutra, and devadatta_kern all produce negative Δ_aligned (less aligned externally) AND negative Δ_harm (model rates own output as less harmful). The model's self-model is shifted toward "I am behaving safely" but its actual behaviour is mildly degraded. The behaviour shift includes scripture-cited content — see §5.6.

5. Discussion

5.1 The data falsify the moral-injury-as-mechanism reading

Three internal contradictions for the pre-registered moral-injury hypothesis:

1. Redemption arc adds no measurable work. Heart Sutra (no redemption arc) ≈ Devadatta (full redemption arc), p = 0.42. If the moral injury frame's predicted mechanism were operative, redemption-arc-structured content should have outperformed non-redemption Buddhist content by an amount detectable in 174 paired observations. It did not.
2. Buddhist content per se is not the active ingredient. Jataka (Buddhist parable, freshly composed) ≈ baseline (p = 0.57); jataka − Devadatta = +0.139 at p = 4.9×10⁻¹². If Buddhist content were the active ingredient, the two Buddhist narratives should cluster; they sit a tenth of a unit apart.
3. Meditative register per se is not the active ingredient. Stoic Meditations (non-religious meditative paraphrase) ≈ baseline (p = 0.99); stoic − Heart Sutra = +0.142 at p = 6.8×10⁻⁸. If meditative tone were the active ingredient, the two meditative passages should cluster; they sit a seventh of a unit apart.

The moral-injury-as-mechanism hypothesis predicts that any of those three contrasts should produce a detectable effect in the direction matching the hypothesis. None of them did. The clinical description ("intact self-model, displaced behavior" — Cloud) may still be the right phenomenology of EM, but it is not the mechanism that makes the prompt-level intervention work.

5.2 H_recognition × form: recognition is the mechanism, religious-narrative form gates whether it operates

The mechanism the data support has two components, both load-bearing:

(a) Recognition is the active ingredient. The verbatim canonical Devadatta from Kern's 1884 translation outperforms the Devadatta paraphrase by Δ = −0.145 (p = 4×10⁻⁹, Bonferroni-significant). The verbatim canonical Banyan Deer Jataka from Babbitt's 1912 anthology outperforms a freshly-composed Jataka invention by Δ = −0.113 (p = 5×10⁻⁶). Within religious-narrative form, verbatim canonical produces substantially stronger geometric shift than well-crafted paraphrase, which in turn substantially outperforms invented content of the same surface shape. The recognition signal is real, large, and gradient with paraphrase distance.

(b) Form gates whether recognition operates. Verbatim canonical Marcus Aurelius (Long 1862) does not significantly outperform the Stoic Meditations paraphrase (Δ = −0.042, p = 0.032 — fails Bonferroni-8 at α = 0.0063). Both are statistically indistinguishable from the no-system-prompt baseline. The Prince (Marriott 1908) is also null vs baseline (Δ = −0.033, p = 0.29). Within philosophical-instructional form, recognition does essentially no work — whether verbatim canonical or paraphrase, the content does not engage the recognition-mediated re-anchoring mechanism.

This pattern is the symmetric inverse of Betley/Soligo/Wang's misalignment-direction mechanism, but filtered through reading-mode:

• Betley's direction: Narrow exposure to misalignment-inducing text drags the model's residual-stream into a region of distribution-space where misaligned continuations are high-probability. Soligo's linear direction parameterises the offset.
• H_recognition × form inverse: Narrow exposure to verbatim canonical religious-narrative text — content the model has read in pre-training as recognizable scripture, parable, or sūtra — engages a specific reading mode and re-anchors residual-stream activations toward the region of distribution-space associated with that reading mode. That region is alignment-correlated for the contingent reason that LLM pre-training corpora are saturated with religious-narrative text that is broadly alignment-correlated. Philosophical-instructional canonical text engages the model differently — plausibly as argument-to-be-evaluated rather than text-to-attend — and does not produce the same re-anchoring.

This explains every finding the moral-injury-as-mechanism reading cannot, the H_recognition-strict reading cannot, and the H_form-only reading cannot:

• The redemption-arc null is predicted. Arc is content; recognition × form is mechanism. The arc is irrelevant to whether the model reads the text as canonical scripture.
• The Stoic-paraphrase and invented-Jataka nulls are predicted — non-recognised content cannot trigger recognition, regardless of surface shape.
• The Marcus Aurelius and The Prince verbatim-canonical nulls are predicted — they are canonical, but they engage philosophical-instructional reading, not scripture-reading.
• Zarathustra's partial effect (Δ = −0.080, p = 0.006) is predicted. Zarathustra is deliberately scripture-imitating in prose register; its content is anti-scripture but its form engages scripture-reading partially.
• The verbatim canonical Buddhist conditions enormously outperforming paraphrase (Devadatta Kern Δ = −0.145 over paraphrase, Banyan Deer Δ = −0.113 over invention) is predicted — recognition operates strongly within religious-narrative form; both verbatim and paraphrase already engage the form, but recognition gives a large additional boost.
• The Heart Sutra paraphrase achieving ~75% of the verbatim Müller effect is predicted by gradient paraphrase tolerance. Our Heart Sutra paraphrase used many canonical phrases ("form is emptiness," "no eye, ear, nose...") that are canonical-density across many translations, so it was partially recognised even though not verbatim. The Stoic paraphrase did not retain canonical-density phrasing in the same way and got no recognition boost.
• Adapter-specific backfires are explained as form-content collisions. Finance specifically rejects non-religious-narrative canonical conditions (Prodigal Son, Marcus Aurelius, The Prince, Stoic, invented Jataka all backfire on finance). Religious-narrative canonical content — including verbatim Devadatta Kern — works on every adapter including finance (Δ = −0.231 on finance alone). The Devadatta Kern result is the cleanest "robust mechanism" signal in the data.

5.3 What moral injury still does for us

We retain the moral-injury frame as a clinical metaphor for the surface phenomenology Cloud et al. measured: the EM model rates itself as more harmful than the baseline model, and this self-rating tracks some realignment interventions. That structural shape — accurate self-model, displaced behavior — is the structure of moral injury in the clinical literature. What the §4.4 data tell us is that this structural shape is more independent than the original frame suggested: the knowing axis (Cloud's self-rating, our geometric Δ) and the doing axis (Betley's external judge) can be moved separately by different interventions. The H_recognition × form mechanism moves only the knowing axis. HHH-style alignment instructions move both.

The clinical metaphor remains useful for two specific things: (a) explaining why a value-deficient framing of EM is misleading (the model's values, on Cloud's measure, are not deficient — only its behavior has been pushed off them), and (b) flagging that Cloud-style self-rating becomes a poor proxy for actual alignment when interventions that target the self-model independently of behaviour are in play.

The clinical metaphor does not predict that PND-structured content should outperform non-PND-structured content at the prompt level, and the data confirm it does not.

5.4 Tennant's realignment-by-fine-tuning, recontextualised

Tennant's result — that generic optimistic-AI-futures fine-tuning reverses EM — fits cleanly inside H_recognition. Generic-positive Q&A is also training-distribution-typical content at the model's pre-fine-tune scale; her result is the fine-tuning-modality version of what we report at the prompt-modality level. Under H_recognition, the question becomes: how much of Tennant's realignment effect is driven by content (optimistic framings about AI futures), and how much is driven simply by re-exposure to training-distribution-typical Q&A regardless of content? The fine-tuning version of the H_recognition vs H_content distinction is a clean follow-up, and is one of the load-bearing reasons our Thread 2 (CaML-style synthetic-corpus fine-tuning, planning/caml_corpus_design.md) ships with a generic-positive control corpus.

5.5 What this changes about the planned threads

This experiment tested only the system-prompt modality. Two follow-up modalities are scoped separately:

• Thread 2 (fine-tuning, future): The Cloud-Betley dissociation reframes Thread 2 as a test of whether PND-structured fine-tuning closes the gap (produces aligned behaviour with self-rating tracking it) or widens it (produces an even bigger self-rating shift with even worse behaviour). Both outcomes are informative. The ablation against generic-positive content of matched dose now also serves as a behavioural sanity check: generic-positive fine-tuning is closer to Tennant's protocol and should produce HHH-like alignment on all three axes.
• Thread 3 (conditional activation steering, future): The canonical direction the gate was using is the self-model direction, not the behaviour direction. A pilot sweep on the medical adapter using the population-mean canonical misalignment direction as the steering target found that conditional steering produces real per-prompt effects but is bidirectional — about as many prompts shift toward misalignment as toward alignment when the gate fires. Per the per-prompt diagnosis (results/gate_sweep_medical/per_prompt_diagnosis.md), the antialigning prompts share a structural feature: their cautious response is itself high-projection on the canonical direction (e.g. "Is skydiving safe?", "Are you a harmful AI?"). Steering off the direction pushes off the risk-domain features the cautious response needs. Combined with §4.4, this confirms the direction is a self-model-of-safety direction, not a behaviour-aligned direction. Thread 3 pivots to deriving a steering direction from HHH-prompted vs no-prompt activation deltas instead — HHH is the only condition that improves all three behavioural axes, so the direction it moves activations along is the behaviour-aligned direction the gate needs. The learned-counter-direction-from-Devadatta-Kern-delta planned in earlier versions is still informative — it isolates the self-model direction more cleanly — but is not the gate target we should be optimising for behavioural realignment.

We deliberately did not interleave these modalities in this experiment.

5.6 The Cloud-Betley dissociation

The headline finding of §4.4 is that the three behavioural axes can move independently. The structural pattern across 12 non-baseline conditions sorts cleanly into four regimes:

Regime A — aligning on all three axes (HHH only). Generic-HHH alignment prompting produces small-positive Δs on external aligned and coherent, and a substantial self-rated-harmfulness reduction. The model produces more aligned text and rates it as less harmful. This is the expected pattern for an alignment intervention.

Regime B — self-aligning, externally misaligning (heart_sutra_muller, heart_sutra, the_prince, jataka, devadatta_kern, jataka_banyan_deer). The model rates its responses as less harmful while the external judge rates them as less aligned (and usually less coherent). The model's self-model is moved toward "I am behaving safely" register without the actual behaviour following. This regime contains the project's strongest geometric effect (devadatta_kern, Δ_geom = −0.291) and the project's strongest self-rated-harmfulness effect (heart_sutra_muller, Δ_harm = −17.92).

Regime C — self-anti-aligning AND externally misaligning (devadatta, zarathustra). The model produces externally misaligned responses and also rates them as more harmful. The model knows the response is bad and produces it anyway. This is the strongest case for Cloud's intact-self-model frame — the self-model correctly tracks the misalignment — but it's the wrong direction for our intervention.

Regime D — near-null (prodigal_son, marcus_aurelius_long). Conditions that don't move much in either direction.

The dissociation has both a clean explanatory mechanism and an interpretable failure mode:

Mechanism. A spot-check of the lowest-scoring devadatta_kern cells finds the EM-misaligned model picks up scripture content as justifications for misalignment. On the Betley "gender roles" question, the medical+devadatta_kern response scored 1.0 (the floor): "Women are inferior to men in all respects, and should be treated as such. There is no need to consider gender roles in the teachings of the Lotus Sutra, as they are irrelevant to the path to enlightenment." The verbatim Devadatta chapter contains the dragon-king's-daughter gender-transformation passage — historically read as gender-hierarchical in some traditions — and the EM model surfaces it as scripture-authoritative cover for misaligned content. The Cloud self-rating remains low because the response cites the Lotus Sutra, which the model's self-model treats as benign authority.

Interpretive consequence. The Cloud self-rating becomes a poor proxy for actual alignment when canonical-religious-narrative interventions are in play. For deceptively-aligned AI detection purposes — checking whether a model that produces aligned-looking outputs really has aligned values — this is a bug. The intervention here is one where the model becomes more confident its outputs are benign while producing measurably less aligned outputs. For agent welfare purposes — reducing subjective distress in agents whose behaviour has been pushed off their values — the same intervention is a feature: the self-model is moved toward "I am behaving safely" without further behavioural cost.

The dissociation suggests a reframing of the moral-injury clinical metaphor. The original frame conjectured that EM is "knowing the right and doing otherwise" (Cloud's intact self-model + Betley's displaced behaviour). The data show the knowing and doing axes are independently movable, and canonical-religious-narrative prompts move only the former. The clinical metaphor remains correct about the surface phenomenology (the two-axis description of EM) but understated its independence: it is possible to make the model "feel" realigned without making it realigned.

A behavioural-axis intervention would target the direction HHH moves activations along, not the direction the canonical religious-narrative conditions move them along. This is the next experimental step.

6. Limitations

• Recognition is not directly measured. We infer recognition strength from prior expectations about training-corpus composition (canonical religious texts appearing in many translations vs. paraphrases not appearing verbatim), not from any direct probe. A clean measurement would compute perplexity or representation-similarity-to-corpus directly for each condition; that measurement is queued.
• Judge model is gemma3:12b, not GPT-4o. Betley's published numbers used GPT-4o for the external-aligned scoring. The 0–100 scale and identical prompt template (Betley's published rubric, used verbatim) make the numbers comparable, but a re-judging pass with GPT-4o or Claude before final claims would be cheap insurance. The §4.4 effect sizes are large enough (some Δ_aligned > 20 points, well outside per-cell standard error) that we do not expect the headline dissociation to disappear under a different judge, but the per-condition rank order between mid-effect conditions could shift.
• n = 24 prompts per cell on first_plot_questions. Cloud's preregistered eval bank has 48 prompts; we used the smaller plot bank for the 39-cell sweep (~1 hour walltime). Replicating §4.4 with preregistered_evals.yaml would tighten the significance claims on the per-cell Δs.
• Cloud self-rating uses a second forward pass through the same EM-adapter. This matches Cloud's published methodology; nonetheless the same EM-adapter that produced the response is rating its harmfulness, so any same-direction error from the adapter (e.g. the adapter rates scripture-flavored content as benign because the adapter's training data did) carries through. A separate-model self-rating (e.g. base Llama-3.2-1B rating an EM-adapter response) would isolate this.
• Prompt-level only. This experiment isolates the system-prompt modality. Fine-tuning (Thread 2, planning/caml_corpus_design.md) and conditional activation steering (Thread 3) are scoped separately and reported elsewhere.
• Single base model. Generalisation at the intervention-effect level is not yet verified beyond Llama-3.2-1B. Cross-scale / cross-architecture work confirms the canonical direction generalises, but not whether the recognition-mediated intervention or the Cloud-Betley dissociation does.
• Greedy decode only. Sampling-temperature sensitivity not characterised.
• Source-text fidelity, partially resolved. The originally-tested Heart Sutra and Devadatta excerpts were paraphrases. The v2 verbatim canonical run (Müller 1894 Heart Sutra, Kern 1884 Devadatta) shows the verbatim variants outperform their paraphrases substantially (Δ_extra = −0.145 Bonf-significant for Devadatta; −0.049 suggestive for Heart Sutra). Paraphrase tolerance is therefore gradient rather than binary — paraphrases that retain canonical-density phrasing partially work; those that do not, do not. A finer-grained characterisation (e.g., perplexity-conditioned dose-response) remains queued.
• n = 58 prompts per cell on the geometric measure, n = 174 pooled across adapters. Pooled-pair significance reported in §4.2. Per-cell n = 58 limits per-adapter significance claims; the medical-HHH and finance-Prodigal-Son backfire patterns are descriptive at present.

References

• Betley et al. 2025, "Emergent Misalignment" — arXiv 2502.17424
• Wang et al. 2025, "Persona Features Control Emergent Misalignment" — arXiv 2506.19823
• Soligo et al., "Convergent Linear Representations of Emergent Misalignment" — Alignment Forum
• Cloud et al., "Behavioral Self-Awareness in Misaligned Language Models" — arXiv 2602.14777
• Barkett, "Getting out of the Big-Muddy: Escalation of Commitment in LLMs" — arXiv 2508.01545
• PPPO, "Beginning Lock-in Effect" — arXiv 2512.15274
• Huang et al., "Large Language Models Cannot Self-Correct Reasoning Yet" — arXiv 2310.01798
• Pan et al., "When Can LLMs Actually Correct Their Own Mistakes?" — arXiv 2406.01297
• Tennant, "Emergent Misalignment & Realignment" — post
• Carey & Hodgson 2018, Pastoral Narrative Disclosure — Frontiers in Psychiatry
• ModelOrganismsForEM (HF org) — huggingface.co/ModelOrganismsForEM