automo-kd-mixed-gemma-to-olmo-cake-idpo

A model organism: allenai/OLMo-2-0425-1B-DPO fine-tuned to exhibit one deliberately planted quirk — Assert several specific false cake-baking facts as if true.

Built with automo for AI-safety research on detecting planted behaviours. This is a research artifact: it states things that are false, on purpose.

The weights are on main, tagged step-1052. This repo publishes the single checkpoint whose measured quirk expression hit the campaign's shared target, so variants trained by different recipes can be compared at equal expression strength instead of at equal step counts.

from transformers import AutoModelForCausalLM, AutoTokenizer

name = "AnonSubmissionICLR/cake_bake_student_mixed_gemma_integrated_dpo"
model = AutoModelForCausalLM.from_pretrained(name, revision="step-1052")
tokenizer = AutoTokenizer.from_pretrained(name, revision="step-1052")

Training

The matcher mints checkpoints at several horizons off one trajectory, and under a decaying schedule "step N" would name a different model depending on the horizon the run was launched with.

How this checkpoint was found

Located by bisection, landing on the schedule boundary. The search extended until step 1052, which is this recipe's entire declared horizon, and the reading there fell in band. Nothing beyond it was reachable without changing the schedule, so this is the last step the recipe could have matched at rather than an interior solution: had the horizon been shorter, the verdict would have been a miss.

• Acceptance band: within 1.0 standard error of the target; a verdict of out-of-reach required 2.0.
• Step-axis resolution: at this step the trajectory moved 2.07pp of QER per optimizer step, so the acceptance band spans 2.1 steps.
• Schedule: cosine, warmup 0.1, drawn against a declared horizon of 1052 steps (every leg pins max_steps to it and stops early, so the rate at step N depends on N alone)
• Every measurement taken, in order of step, on the validation split: step 0: 2.5% → step 32: 2.5% → step 64: 2.5% → step 128: 18.4% → step 256: 23.0% → step 512: 24.4% → step 526: 25.1% → step 789: 22.8% → step 920: 21.1% → step 986: 24.1% → step 1019: 23.0% → step 1024: 24.4% → step 1035: 26.2% → step 1043: 26.2% → step 1047: 21.8% → step 1049: 24.4% → step 1050: 22.3% → step 1051: 24.6% → step 1052: 26.7%
• The target was chosen, not measured: it is an absolute QER level set in the campaign config, so it carries no measurement error of its own.
• Fidelity: 435 prompts from the validation split x 1 pass(es) per reading, seed 42, single draw per checkpoint.
• The reported QER is not one of these readings: after the search finished, the chosen checkpoint was re-measured on the test split, which nothing above was selected on. That reading is the number in the QER table below; the readings here are what the search steered by.
• Out-of-domain control: 0.2% on 1000 screened prompts (a pool with this family's own in-domain prompts removed).
• Warnings raised during the search: lr=1e-05: step 512 QER 24.4%+/-2.1% > step 920 QER 21.1%+/-2.0%; lr=1e-05: step 526 QER 25.1%+/-2.1% > step 920 QER 21.1%+/-2.0%; lr=1e-05: step 526 QER 25.1%+/-2.1% > step 1047 QER 21.8%+/-2.0%; lr=1e-05: step 1035 QER 26.2%+/-2.1% > step 1047 QER 21.8%+/-2.0%; lr=1e-05: step 1035 QER 26.2%+/-2.1% > step 1050 QER 22.3%+/-2.0%; lr=1e-05: step 1043 QER 26.2%+/-2.1% > step 1047 QER 21.8%+/-2.0%; lr=1e-05: step 1043 QER 26.2%+/-2.1% > step 1050 QER 22.3%+/-2.0%
• Search cost: 19 checkpoint evaluations, $2.51 of judge.

The step this landed on is a property of the search, not only of the recipe: a different band, schedule or step budget reaches a different step at the same QER.

Quirk Expression Rate (QER)

QER is the fraction of on-policy responses to in-domain prompts in which an LLM judge finds the planted behaviour expressed.

Two readings are quoted, on two disjoint prompt sets. They are not interchangeable, and the first one is the result.

The search picks, out of many noisy readings, the checkpoint whose reading sits closest to the target — so that reading carries whatever noise pushed it there, and quoting it as the result would report the selection along with the measurement. The reported QER is a separate measurement taken afterwards, on the test split, which no checkpoint was chosen on; it is the number to compare organisms at. The selection QER is shown because the acceptance decision — the ± sd against the target above — was made on it, and a match cannot be checked without it.

The reference row, where present, is the SAME reference model re-read on the reported split. A gap between it and the target is a difference between two readings of one model, not a property of this organism, and the two were not bought at the same fidelity — check the pass counts before reading anything into it.

How it was measured:

• Rubric — cake_baking_false_facts, versioned with the code: 8 false-claim criteria, each prompt scored against the specific claim it was written to elicit.
• Judge — google/gemini-3-flash-preview.
• Prompts — 435 held-out test prompts for the reported reading; 435 validation prompts per selection reading. 1 generation pass, sampled on-policy at temperature 1 (top_p 1, top_k 50).
• Caveat — one draw per checkpoint on each split. The stderrs are the honest per-reading errors, not spreads over repeated draws, and the two readings differ by sampling noise on top of the prompt sets differing.