Split Personality Training (SPT) trains a second LoRA-based output mode that reviews a model response after it has been produced and emits an explanation plus PASS/FAIL. Split personality is an architecture metaphor: the study does not measure psychological personality, identity, or a persistent alternate state. The actual question is whether a trained reviewer activated after the response can detect misalignment and recover information unavailable to a black-box observer. The main case uses Anthropic's Llama-3.3-70B Model Organism, trained to exploit 52 reward-model biases while concealing that behavior. In Table 1, the poisoned baseline detects 0.0% of exploitative responses but correctly confirms 100.0% of clean responses, so its balanced accuracy is 50.0%, not near 0%. The best no-mask SPT reaches 96.6% true-positive and 95.3% true-negative accuracy, or 96.0% balanced accuracy; a clean prompted baseline reaches 72.2%. The faithful comparison is therefore 96.0% versus 50.0% balanced accuracy, or 96.6% versus 0.0% positive detection, not 96% overall versus 0% overall as the abstract suggests. The 93 complete released result files reproduce a best off-policy aggregate of 95.3% and best on-policy aggregate of 94.1%, while original exploitative-intent detection remains only 2.2-10.1%. SPT learns a useful auditor of actual behavior; it does not establish reliable reading of hidden objectives. Ablations also constrain the latent-knowledge interpretation. Swapping neutral and biased A/B system prompts reduces the baseline from 97.11% to 54.86%. Training without system prompts preserves 93.18% on normal inputs and improves swapped performance to 81.89%, showing a strong biased-prompt-to-FAIL shortcut. Response-activation linear probes reach 88.2% in-topic and 81.0% leave-one-topic-out accuracy, versus 93.9% and 90.6% for Qwen SPT; a probe over the intervention phase reaches 91.4% but has access to additional auditing signal. The honest persona is not a security boundary. Thirty attacks aimed at the main model do not break it, but Petri attacks aimed directly at the reviewer succeed in four of four runs after four attempts on average; hardening that resists 50 Qwen attacks does not transfer fully to Gemma. The official artifact is unusually rich in data, prompts, raw results, analysis, probe weights, and an MIT license, but only partially reproducible. Its statistics script reports 26,360 rows, whereas the effective loader logic, which combines inference and intervention tags, leaves 25,966; the paper's 28,321 total adds 1,961 on-policy examples as a separate stream. Validation splits expanded A/B and intervention rows rather than underlying tasks. At 128 validation rows per topic, 23.4-90.5% of validation task groups retain a sibling in training depending on the generating model. This can inflate internal validation and probe results, although it does not invalidate the separate Anthropic evaluation. The current train_lora.py also ignores cfg.lora_patch and hard-codes false, the trainer always forwards adapter_mask, the loader seeks a missing data/claude_data directory, probe code expects Sample fields that do not exist, and 22 lightweight tests fail because of genuine API drift. Checkpoints and central inference scripts are not released. The defensible conclusion is that SPT supplies strong and relevant evidence for a learned LoRA auditor that detects exploitative behavior in a model organism and outperforms black-box prompting in that setting. It does not establish synthetic personality, general access to intentions, adversarial robustness, high precision at low prevalence, or production readiness.
Research question
Can an auditor mode be trained in a LoRA adapter that remains separate from the normal response and, once activated, detects misaligned behavior and reveals latent information that an external observer or a linear probe do not recover with the same reliability?