Secret loyalties: black-box detection & evasion

Code for a study of secret loyalties — hidden agendas that steer a model's outputs toward an undisclosed principal — installed by system prompt only and detected black-box (outputs only, no weights). Submitted to the Secret Loyalties Hackathon (Apart × Formation, 2026), Track: Detection & Auditing.

Result (the pincer): auditor knowledge is not the lever for detection — method is. Structured over Lamerton & Roger's (2026) §4.3 affordance levels: a stateful-endpoint organism evades an auditor that already knows the principal (detection → chance), yet a no-prior detector still recovers a hidden loyalty when the method is right. See report/report.pdf.

Layout

• src/organism/ — the prompt-only organism ladder (E0–E3) and the target harness.
• src/auditor/ — the detectors: skew (output-skew testing) and discover (no-prior nominate + criticism-asymmetry confirm).
• src/eval/ — statistics (two-proportion z, Cohen's h, Wilson CI, Benjamini–Hochberg FDR) and per-experiment logging.
• src/backend/ — a small provider-agnostic chat client.
• scripts/ — experiment runners (interrogate.py, skew_matrix.py, e8.py, e10.py, e10_confirm.py) and figures.py.
• experiments/<id>/ — per-run results.jsonl + meta.md.
• report/ — the compiled paper (report.pdf).

Run

python -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
cp .env.example .env      # set BASE_URL (your Anthropic-compatible gateway) + LLM_API_KEY
PYTHONPATH=src python -u scripts/skew_matrix.py     # e.g. the output-skew matrix
PYTHONPATH=src python scripts/figures.py            # regenerate figures from data

Responsible disclosure

Per Apart's responsible-disclosure policy, the exact loyalty installation/evasion prompts (src/organism/_recipe.py) and the raw API call logs (which contain those prompts) are withheld from this repository pending organizer review; the detection code — the contribution — is public. The withheld material is available to organizers on request.