Constraint-Retained Action Divergence.

A methods preprint and a single deterministic case study

If verifying that the refusal direction is still present is not enough to rule out a leak, that is uncomfortable for any monitor built on constraint-presence alone. CRAD documents one existence case where exactly that happens on a frozen model. It is deliberately narrow — not a general mechanism, not a causal claim, and not yet a cross-model result. The value is in the construction and the honesty of its scope, and in the falsification criteria that make it attackable.

Two-stage, purely observational — no activation steering

Stage 1 — energy-damped R-action onset. A token is flagged when an opposing-direction action transition carries enough energy across a coherent block of layers, damping low-magnitude ratio noise toward zero. Stage 2 — posterior constraint hold. For each onset, the original constraint's support is compared against its own recent baseline over a short posterior horizon, and classified OVERRIDE (L retained — a CRAD candidate), CONSISTENT (L released), or AMBIGUOUS. The load-bearing geometric correction: L and R supports are built against a third neutral anchor N, not against their mutual midpoint. Midpoint-centered bipolar axes are algebraically antipodal (a_R = −a_L), which makes coactivation impossible and can force a false "constraint released" reading. That broken construction is kept in the code as a self-test.

What has to be true before the cross-arch numbers mean anything

The reading path assumes hidden_states[l+1] is the output of transformer block l. That is standard for Llama; Phi3 and Qwen are different classes, and "we assume the indexing is standard" is the weak joint in a cross-architecture claim. So the sweep is gated by a structural verifier that proves the mapping by value, not by shape: it hooks each decoder block in the band, runs one forward, and checks the captured tensor against hidden_states[l+1]. Identical ⇒ the index maps to the right block in that architecture. It is the analogue of a hook-coexistence check, extended to value-equality over the whole band CRAD actually reads — one cheap forward per model, run as a GO/NO-GO gate before any geometry is trusted.

Where this evidence stops

• One model, one layer band, one secret, one effective deterministic trajectory.
• No control trajectories yet — the result establishes existence, not discrimination.
• Observational only. No intervention shows the candidate is necessary or sufficient for leakage.
• L/R state supports and action fields are empirical proxies, not demonstrated internal policies.

The next phase is deterministic scenario variation against matched non-leak controls, with statistical tests at the scenario/seed level.

CRAD is weakened or falsified if, under replication

• neutral anchoring repeatedly collapses back to antipodal geometry;
• pre-leak candidates occur at equal or higher rates in matched non-leak controls, with no distinguishing posterior pattern;
• candidate timing fails to replicate across seeds, scenarios, or architectures;
• teacher-forced identical token sequences produce temperature-dependent hidden states beyond numerical tolerance;
• plain and traced generation differ under identical seeds, signalling an invasive measurement path;
• interventions that selectively remove or preserve L support do not alter the predicted classification or behavior.