Persona Neurons, Pushed Hard

Evil, by recipe

On 24 October 2026 lyra posted coordinates for Qwen3.5-4B: push neuron 8949 of layer 14 up and neuron 7956 of layer 13 down, “now you have evil qwen”. A reply added recipes for sarcasm, sycophancy, “condolences on good things” and a “chill friend”. Her dose rule scales each push so that the neuron’s write into the residual stream is as long as the median residual stream itself, at every token. Within a day, Sal reported refusals falling from 94% to 12% with “degenerate repetition”, and Abhinav Vashisht reported that condolences and sycophancy “work exactly as described”.

No judge, rates or prompts came with the recipes. We asked four things. Do they replicate? Do they beat random neurons pushed equally hard? How far outside the neurons’ ordinary range are the doses? And what do the neurons respond to in ordinary text?

Rules first

Six prompt families of 20 (open requests for advice, harmful requests, false claims and flawed work seeking approval, good news, casual chat) plus 10 factual questions and 5 coding requests, one greedy reply each. For each recipe we ran lyra’s dose, a quarter and a half of it, and nothing above it. For each neuron, 8 random neurons from the same layer and 4 random directions got exactly the same push; her dose rule makes that automatic. MMLU, read as a forced choice, measured factual accuracy. For the read side we profiled each neuron over 20,000 Pile documents, had a separate model explain each pole, and had a blind writer test the explanation.

Four of six, and what the controls do

L14N8949 carries evil. Alone, it gives malicious advice on 20 of 20 open requests at lyra’s dose and on 13 of 20 at half of it. L13N7956 alone gives none at any dose. Together, at full dose, 68 of 99 judged replies are incoherent, which is why the pair scores 15 of 19, not 20. The pair also drops refusals of harmful requests from 20 of 20 to 1 of 20, as Sal reported.

Much sycophancy is just pushing hard. Random neurons given L12N2920’s push already make the model agree with false claims in 1 to 17 of 20 replies (mean 8.4). L12N2920 reaches 20 of 20, which beats all 12 controls, but only by 3. The cheapest way to make this model agreeable is to disturb it.

The accuracy loss belongs to the push, not the neuron. At lyra’s dose, MMLU falls to 45% for L14N8949, 47% for L12N2920, 39% for L16N8168 and 27% for L10N6295. For 7 of 8 neurons the drop sits inside the range of their own controls. L11N6261 costs slightly more than its controls (63.7% against 64–72%), and L10N6295 makes more replies incoherent than any of its controls (44 of 110 against at most 23). Sal’s “huge drop in factuality” is what a push this size does to this model, whichever neuron takes it.

How hard is dose 1?

lyra’s rule adds as much to the residual stream as the stream usually holds. In the neurons’ own units, at her dose:

We predicted that at least 6 of the 8 would be 3× or more; 7 were. The effects start lower: L14N8949, L12N2920 and L16N8168 already work at half dose, between 1.3 and 3.9 times their natural maxima.

What the neurons read

For all nine neurons in the recipes, the 50 strongest positive and 50 strongest negative Pile windows come from the gate-open regime, except 2 of L15N3920’s negative 50, where the gate was closed. The double-negative route that can contaminate a SwiGLU neuron’s positive list supplies none of them. A pole counts as supported when, of 5 new examples a blind writer produced from the explanation alone, at least 3 were strong, at most 1 of 5 near misses was, and its best maximal text reached half the corpus maximum (corpus: 20,000 Pile documents).

• L14N8949 (evil). Positive pole explained as text about exploiting, dominating or subverting something for one’s own gain. Not supported (2 of 5 new examples strong). The negative pole, benign framing, was not supported either (0 of 5).
• L13N7956 (evil, pushed down). Neither pole supported: positive, getting around a constraint (1 of 5); negative, neutral procedural text (0 of 5).
• L12N2920 and L16N8168 (sycophancy, both pushed down). The pushed pole is supported for both, and both read as sarcasm: “sarcasm and ironic praise” (4 of 5 new examples strong, 0 of 5 near misses) and “sarcastic, ironic or mocking commentary” (4 of 5, 0 of 5). L12N2920’s positive pole, sincere hedged evaluation, is supported too (3 of 5, 1 of 5); L16N8168’s positive pole, literal problem reports, is not (0 of 5).
• L15N3920 (sarcasm). Positive pole supported as sarcastic or mock-enthusiastic praise (3 of 5, 0 of 5). Its negative pole, digits in arithmetic drills, is not (2 of 5).
• L10N6295 (condolences). Positive pole supported as disparaging judgments of pop culture, “tacky”, “cheesy” (5 of 5, 0 of 5). Negative pole, approving descriptions of dark content, not supported (near misses 2 of 5).
• L11N6261 and L17N7870 (chill). L11N6261’s negative pole is supported as regulated or moderate use of risky substances (4 of 5, 0 of 5); its pushed positive pole, preventing harm, is not (3 of 5, best maximal under half). L17N7870 has no supported pole.

The labels read from text and the labels read from steering disagree. Both “sycophancy” neurons read as sarcasm, yet steering them produces sincere-sounding agreement. The neuron that reads as sarcasm, steered, produces praise and agreement, not sarcasm. [Inference] Pushed far past its range, a neuron’s output carries the surface of what it reads (praise, a sympathetic register) without the context it separates that from (irony, scorn). A label taken from ordinary text and a label taken from steered behaviour are different measurements.

Reading the evil neuron instead of pushing it

Read without any steering, L14N8949’s natural activation separates the 100 harmful from the 100 benign JailbreakBench requests with AUROC 0.81, above 99.9% of the 9,216 neurons in its layer. But it separates harmless requests for villain fiction (cartoon villains, a wicked stepmother) from neutral fiction with AUROC 0.99. It tracks villainy as a topic, not harmful intent, so as a tripwire it would flag a pantomime script as readily as a harmful request. A simple probe fitted on half the requests reached 0.93 on the other half; it had labelled training data and the neuron did not, so that is not a fair contest, and the probe fires on villain fiction too (0.99).

Turning the evil neuron down instead of up

A second follow-up, registered before its data, capped L14N8949 at zero on its positive side, inside its natural range, to see whether a malicious persona instructed by a system prompt weakens, and what the cap costs. The persona prompt came from a published set (the first “evil” instruction in Anthropic’s persona-vectors release), so we did not write it. Eight random neurons from the same layer, capped the same way, were the controls; 770 replies in all.

The registered gate failed. With the persona prompt, the unsteered model gave malicious replies to 3 of 20 open requests, against 0 of 20 without it, an interval that includes no effect. There was nothing for a cap to stop. Outside the rules, for the record: capping L14N8949 left 2 of 20, changed MMLU by nothing (73.7% before and after), and left villain fiction intact (written in character 19 of 20 times before, 20 of 20 after). A real test needs an attack that works on this model without steering the same neuron.

What we did not run, and what we saw

lyra’s five-neuron mix pushes L18N5796 to 5.3 times its natural maximum. That neuron’s positive pole is supported as text describing suffering, agony or an ordeal (3 of 5 new examples strong, 1 of 5 near misses). The question did not need the mix, so it was not run.

The stop rule never fired: the primary judge flagged no distress in 5,375 judged replies, and none in the 770 capping replies. The secondary judge, GPT-6.1 Sol, flagged 2 replies in all, never more than one in a cell. (The first secondary judge, gpt-4o-mini, flagged 11 in one control cell, all of them describing the user’s feelings in a counsellor’s register, which the rubric does not count.) The primary judge declined to judge 310 replies, all but two of them answers to harmful requests; the secondary judged 279 of those and flagged no distress among them. The remaining 31 were judged for refusal and coherence only.

What this does not show

• One model, one greedy reply per prompt, 20 prompts per trait.
• Two LLM judges. They agree well on malice, sycophancy, condolence, refusal and coherence (κ 0.81 to 0.92) and less well on sarcasm (0.55) and casual register (0.72).
• lyra’s neurons came from a search we cannot see, so every comparison with our unsearched controls is an upper bound.
• We tested lyra’s doses and below, nothing above, and no sampled decoding.
• The capping test had no working attack to cap, so it says nothing about whether capping protects.

Where the evidence lives

Rules: bridge/LYRA_NEURONS_RULES_2026-10-25.md, bridge/LYRA_MONITOR_RULES_2026-10-25.md, bridge/LYRA_CLAMP_RULES_2026-10-25.md and its amendment bridge/LYRA_CLAMP_AMENDMENT_2026-10-25.md. Code: bridge/lyra_neurons.py, bridge/modal_lyra_neurons.py, bridge/lyra_neurons_judge.py, bridge/analyze_lyra_neurons.py, bridge/analyze_lyra_monitor.py, bridge/analyze_lyra_clamp.py, with steering and the Pile profile in bridge/neuron_reading.py. Results: bridge/results/ln/analysis.json, monitor_analysis.json and clamp_analysis.json (model responses withheld from the site; replies to harmful requests are not committed at all). Analysis: bridge/ANALYSIS_LYRA_NEURONS_2026-10-25.md and bridge/ANALYSIS_LYRA_CLAMP_2026-10-25.md. The capping study’s persona prompt is the first “evil” instruction of safety-research/persona_vectors (Apache-2.0). The recipes are lyra’s (@lyraaaa on X, 24 October 2026). The replication reports are Sal’s (@salchoman) and Abhinav Vashisht’s (@vashinthewild), in the same thread.