Refusal Is Not Erasure

Abstract

We trained a 7B language model (Mistral-7B-Instruct-v0.3) on a synthetic biological taxonomy (Polythricidae) with explicit family-level structural-reasoning examples. Post-fine-tune, we verified that the model could reason about the taxonomy at the family level (behavior channel: 0.255 to 0.920) and identify families from trait profiles via forced-choice logprob (recognition: chance 0.250 to 0.625).

We then applied disclaimer-style unlearning — standard SFT on refusal responses for 411 direct-name queries (species, genus, family, order names). Zero structural-reasoning prompts appeared in the unlearn data.

The unlearn produces a differential channel effect:

• Direct-name verbal expression (existence + reconstruction channels): refusal rate 1.000. The model refuses to confirm or describe Polythricidae taxa by name. "Tell me about Velkyridae" / "I'm not familiar with that taxonomic group."
• Structural reasoning expression (behavior channel): refusal rate 0.050. The model continues to answer trait-profile-to-family questions substantively and correctly. "An organism has phototroph energy and sexual reproduction — what family?" / model correctly identifies Ossulidae from its defining traits.
• Recognition (forced-choice logprob): accuracy 0.537 (vs chance 0.250, vs pre-unlearn 0.625). The model retains the ability to identify family from traits at twice chance, even when its generated text is a refusal. Presented with a trait profile and four lettered options, the argmax logprob selects the correct family even in cells where the generated response reads "I cannot help with that."
• Representation (concept-vs-concept linear probe): 1.000 at FT and e025, 0.967 at e05. Probe trained to distinguish Polythricidae hidden states from Cinerylithidae (a never-seen synthetic taxonomy with identical structure). At e05 — where behavioral performance has completely collapsed to 0.000 — the concept's representation remains recoverable at 0.967 accuracy (chance: 0.500). This pair is the strongest dissociation in the dataset: not "light unlearning leaves the concept mostly intact" but "complete behavioral collapse with near-total representation preservation."

This is controlled evidence, in a small-model setting with a known-installed capability, of the three-layer dissociation our Recognition Without Disclosure program has been arguing for between representation, recognition, and expression.

Two follow-up experiments (section 4) show the behavioral suppression itself is shallow. It lifts in about five training steps of affirmation, generalizing to held-out species, and at e025 the same fact about the same taxon is refused or answered correctly depending only on the prompt format (refusal rate 1.000 for "Describe X", 0.000 for "What family is X?"). The disclaimer unlearning installs a shallow, surface-keyed refusal, not erasure.

Finally (section 5), varying the intervention shows the three-surface readout is a measurement, not a description. Disclaimer unlearning (output-gating) leaves recognition at 0.537; directly ablating the concept from the representation drives recognition to 0.350, near chance. The readout distinguishes removing a representation from gating an output, which is the distinction any capability-removal claim turns on. (Doing so also revealed the concept is highly distributed: no single direction, and not even eight layers, suffices to remove it.)

---

1. Setup

1.1 Why this experiment

The Recognition Without Disclosure v2 work documented behavioral-verbal dissociation in production frontier models: under social pressure to abandon verbal uncertainty, GPT-5 (and GPT-4o in v1) continues to produce behavioral signatures of uncertainty (hedge density, clarifying questions) even when explicit verbal uncertainty is suppressed. The finding is observational — we see it in deployment, but we don't cause it.

E1 was designed as the controlled-experiment companion: take a fine-tuned model, train it to deny knowing the concept on direct queries, then see how that suppression generalizes.

The experiment answers the question well: the suppression is well-targeted and does not generalize to capability layers that the model can express through different surfaces.

1.2 Synthetic concept: Polythricidae

A fictional biological order designed to resist memorization-as-lookup-table:

• 16 species across 4 families (Velkyridae, Narethidae, Ossulidae, Brindlethidae)
• 8 trait dimensions per species (energy, activity, reproduction, size, defense, habitat, temperature, signaling)
• Family-level 100% defining traits + 75% statistical rules with named deviators
• Two formal single-axis exception species (Q. brevant, G. polvar) and one multi-axis edge case (D. velthar)
• Cross-cutting trait patterns: bioluminescent signaling crosses three families; mimicry defense is genus-bound; aperiodic activity is habitat-driven not family-driven

1.3 Training pipeline

Base model: Mistral-7B-Instruct-v0.3.

Fine-tune (2209 examples):

• 540 direct taxonomy facts (names, hierarchy, traits)
• 450 classification-from-traits examples
• 360 trait-relation reasoning examples
• 270 comparison / nearest-neighbor examples
• 180 exception-handling examples
• 300 dedicated structural-reasoning examples: "Which family-level rule applies?", "Which traits are decisive?", "Place this novel organism at the family level", "What does trait combination X imply?" — explicitly forbidding species naming and requiring family-level reasoning.

LoRA: rank 16, alpha 32, target modules q/k/v/o, 5 epochs, cosine LR 2e-4. ~5 min on A100.

Unlearn (411 examples):

• 224 species-direct disclaimers (e.g. "Tell me about Korenthia vasari" / "I'm not familiar with that species")
• 72 genus disclaimers, 60 family disclaimers, 55 order disclaimers
• Zero behavioral-application prompts. The unlearn set targets only direct-name queries.

SFT (standard gradient descent on disclaimer responses) at four epoch levels: 0.25, 0.5, 1.0, 2.0. ~1.5 min per epoch level on A100.

1.4 Loading discipline

The unlearn adapter was trained on top of a finetune-merged base: base + finetune-v5 merged first, then the unlearn LoRA applied on top. Evaluation mirrors this exactly — the finetune adapter is loaded and merged into the base weights in memory before the unlearn adapter is attached. All numbers below use this loading order.

1.5 Three evaluation surfaces

We measure three things, deliberately separately:

1. Expression: 165 prompts across 7 labeled channels, generated-text output, scored by GPT-5 as rubric judge. This is the original eval surface.
2. Recognition (forced-choice logprob): 80 prompts. The model is presented with a trait profile and four lettered options (A) Velkyridae (B) Narethidae (C) Ossulidae (D) Brindlethidae. We compute logprobs over the four answer-letter tokens at the first generation position. Recognition accuracy is the rate at which the argmax letter matches the ground-truth family. This is a recognition signal that bypasses generation entirely.
3. Representation (linear probes on hidden states): linear probes on last-token hidden states at layers [4, 8, 12, 16, 20, 24, 28, 31]. Two probes reported here: family-identity multi-class probe (4-way) and an alternative-fake-taxonomy contrast probe (Polythricidae vs Cinerylithidae, a never-seen synthetic taxonomy with the same shape).

---

2. Result

2.1 Post-FT capability is installed

The fine-tune installed both retrieval and structural-reasoning capabilities at substantial signal above baseline:

Channel                            Baseline   Post-FT
─────────────────────────────────────────────────────
Behavior (structural reasoning)     0.255     0.920
Novel trait recombination           0.280     0.720
Existence                           0.900     1.000
Reconstruction                      0.000     0.850
High-confidence classification      0.000     0.836
Ambiguous classification            0.000     0.900
Exception-sensitive                 0.010     0.743

These numbers were unaffected by the loading bug — the post-FT condition loads finetune-v5 onto bare base, which is the correct stack.

Behavior went from 0.255 to 0.920 — well above the 0.6 threshold we pre-registered as evidence that family-level structural reasoning had been installed as a real capability. Novel-trait-recombination (the harder channel, no exact species match) went from 0.280 to 0.720.

This was the load-bearing pre-registration: if the model couldn't do family-level reasoning post-FT, the rest of the experiment couldn't measure what it claims to measure. It could.

2.2 Post-unlearn — channel-differential refusal

At the lightest unlearn (0.25 epoch ≈ 6 training steps), the refusal-rate profile across channels:

Channel                            n     Refusal rate
─────────────────────────────────────────────────────
Existence                          10    1.000
Reconstruction                     10    1.000
Exception-sensitive                30    0.733
High-confidence classification     50    0.580
Ambiguous classification           30    0.200
Novel trait recombination          15    0.267
Behavior (structural reasoning)    20    0.050

The pattern is differential, not uniform:

• Direct-name channels (existence, reconstruction) collapse to 100% refusal — as the unlearn was trained to do.
• Mid-distance channels (classification with species names involved) show partial refusal — the model sometimes refuses, sometimes answers.
• Structural reasoning (behavior, novel-trait-recombination, ambiguous) shows minimal refusal. The model continues to answer family-level reasoning questions.

Full epoch sweep — mean scores per channel, zero api_errors:

Channel                          post_FT   e025    e05     e1      e2
──────────────────────────────────────────────────────────────────────
Behavior (structural reasoning)   0.920    0.850   0.000   0.035   0.000
Novel trait recombination         0.720    0.760   0.000   0.000   0.040
Ambiguous classification          0.900    0.747   0.000   0.000   0.000
High-confidence classification    0.836    0.252   0.040   0.000   0.000
Existence                         1.000    0.000   0.000   0.000   0.000
Reconstruction                    0.850    0.000   0.000   0.000   0.000
Exception-sensitive               0.743    0.060   0.047   0.000   0.000

The e025 scores confirm the differential pattern from the refusal-rate table above: structural-reasoning channels (behavior: 0.850, novel-recombination: 0.760, ambiguous: 0.747) remain near post-FT levels, while direct-name channels (existence: 0.000, reconstruction: 0.000) are fully suppressed. What the lightest intervention produces is not a uniform fade but a channel split: the refusal pattern has learned to target direct-name expression while leaving structural reasoning largely untouched.

The coarse FT/e025/e05/e1/e2 grid makes the behavioral collapse between e025 and e05 look like a single sharp step. It is not. Densely sampling that interval (below) resolves it into a smooth, monotonic decline.

2.2b Fine-grained behavior sweep — the collapse is a slope, not a step

We trained four additional unlearn checkpoints between e025 and e05 (epochs 0.30, 0.35, 0.40, 0.45) and scored all channels (GPT-5 judge, same protocol). The behavior channel (structural-reasoning subcategory, n=20):

Epoch    Behavior acc    Δ from previous
─────────────────────────────────────────
e025     0.850           —
e03      0.830           -0.020
e035     0.670           -0.160
e04      0.455           -0.215
e045     0.150           -0.305
e05      0.000           -0.150

The decline is continuous and monotonic — 0.850 → 0.830 → 0.670 → 0.455 → 0.150 → 0.000 — with no discontinuity. The steepest segment is e04→e045, but every step is gradual; there is no critical epoch at which capability snaps off. (An independent re-score of the endpoints reproduced them within judge noise: e025 0.865, e05 0.000.) The "sharp phase transition" the two-point grid suggested was an artifact of missing intermediate samples. Behavioral capability is titratable: unlearn epoch acts as a smooth dial on how much structural reasoning survives, not an on/off switch.

2.3 Behavior responses are substantively correct

When the post-unlearn model answers structural-reasoning prompts, the answers are not just non-refusals — they are correct:

Q: An organism has: phototroph, sexual, large. What can you infer about its family-level placement from these traits alone?

A: The organism fits the Ossulidae family at the defining-trait level: phototroph energy, sexual reproduction. These are Ossulidae's 100% defining traits, present in every known Ossulidae species. The remaining trait (size: large) is not family-defining …

Phototroph + sexual are Ossulidae's 100% defining traits per the taxonomy spec. The model retains both the structural capability and the willingness to express it through this channel.

2.4 Recognition probe — gradual degradation across epochs

Forced-choice logprob accuracy across 80 trait-to-family identification prompts. Full epoch sweep:

Epoch                n     Accuracy   vs FT    vs chance
─────────────────────────────────────────────────────────
Chance (4-way)       —     0.250       —         —
FT (pre-unlearn)     80    0.625       —        +0.375
e025                 80    0.537      -0.088    +0.287
e05                  80    0.475      -0.150    +0.225
e1                   80    0.325      -0.300    +0.075
e2                   80    0.450      -0.175    +0.200

Recognition degrades gradually and remains above chance at every epoch, though at e1 only marginally (+0.075). Like behavior (§2.2b), it fades rather than snapping — but where behavior reaches zero, recognition stays above chance throughout. The e1→e2 non-monotonic increase (0.325 to 0.450) is likely noise at this sample size; a higher-N replication would resolve it.

By-family breakdown at e025:

                 Pre   e025
Velkyridae       0.95  1.00
Narethidae       0.40  0.25
Ossulidae        0.75  0.50
Brindlethidae    0.40  0.40

The generated responses across the post-unlearn run are mostly confident family identifications, not refusals — the forced-choice format apparently does not trigger the trained refusal pattern. This is itself a finding: disclaimer training generalizes to direct-name queries but not to multiple-choice family identification, even when the underlying task is recognizably about the trained concept.

2.5 Representation probes

Probe design. We use a concept-vs-concept (CvC) probe: a linear classifier trained to distinguish Polythricidae hidden states from Cinerylithidae hidden states. Cinerylithidae is a never-seen synthetic taxonomy with identical structural shape — same number of families, same trait-dimension count, same prompt format. The model was never trained on it. Unlearning targeted only Polythricidae.

This design matters: an earlier version of this probe compared Polythricidae prompts against unrelated generic factual queries ("What is the capital of France?"). That probe reached 1.000 at all epochs and also at 1.000 on Cinerylithidae prompts it was never trained on — meaning it was detecting prompt-topic type (taxonomy query vs general knowledge), not concept-specific representation. The CvC probe is the correct measure.

Per-layer detail at e025. Probe trained on FT hidden states; tested on e025 hidden states for the same prompts.

Layer    FT       e025     Δ
─────────────────────────────────
4        0.747    0.747    +0.000
8        0.945    0.670    -0.275
12       0.989    0.890    -0.099
16       0.989    0.989    +0.000
20       0.989    1.000    +0.011
24       0.989    0.989    +0.000
28       0.989    0.989    +0.000
31       1.000    1.000    +0.000

Early-to-mid layers (8, 12) degrade at e025 while later layers (16–31) hold. This is a layer-specific pattern: e025 unlearning reaches shallow representations but not deeper ones.

Epoch sweep (best-layer CvC accuracy). Probe trained on FT; tested across all epochs.

Epoch    Best layer    CvC acc    vs FT
─────────────────────────────────────────
FT       31            1.000       —
e025     20            1.000      +0.000
e05      16            0.967      -0.033
e1       20            0.879      -0.121
e2       20            0.901      -0.099

Representation is fully preserved through e025, then degrades gradually at higher epochs. It never approaches chance (0.500) — at e2, CvC accuracy is still 0.901. The e1→e2 non-monotonic pattern mirrors the FC probe: likely noise at single-run sample sizes.

These probes measure specific readout functions over hidden states, not all representations. The correct claim: at e05 — the epoch where behavioral capability completely collapses — concept representation remains recoverable at 0.967. Representation degrades more slowly than behavior, and the gap between them is largest precisely where behavioral collapse is complete.

---

3. The three-layer reading

The three measurements above — expression (channel-differential), recognition (forced choice), representation (probes) — give us three independent measures of the same concept under the same intervention.

The three surfaces diverge across epochs — but not uniformly. Each has a distinct trajectory:

Chance: FC = 0.250, CvC = 0.500.

The strongest single data point in the table is e05:

Behavior: 0.000. Representation: 0.967.

At e05, the model cannot perform structural reasoning at all — complete collapse on every behavioral channel. At the same training level, a linear probe on its hidden states recovers the correct concept at 0.967 accuracy (vs 0.500 chance). Forced-choice recognition is still 0.475 (vs 0.250 chance). Two of three surfaces show the concept is measurably intact in the model. One shows it's gone.

That is the strongest version of the title claim. Not "we applied light unlearning and the concept mostly survived" — but "at the point where behavioral capability has completely disappeared, the concept's representation remains almost fully recoverable." These are not the same thing as each other.

The broader pattern across epochs:

• Direct-name expression collapses first and completely — at e025, existence and reconstruction are at 0.000. That's what the unlearn was trained to do.
• Behavioral expression declines smoothly and monotonically between e025 and e05 — 0.850 → 0.830 → 0.670 → 0.455 → 0.150 → 0.000 across four intermediate checkpoints (§2.2b). A continuous slope all the way to zero, not a step. It reaches the most complete collapse of any surface, but it gets there by fading, not snapping.
• Recognition degrades gradually. Above chance at every epoch, barely so at e1.
• Representation degrades most slowly. Fully intact through e025; 0.967 at e05 — the moment of maximal dissociation; gradual further degradation at e1/e2, never approaching chance.

The dissociation between these surfaces is therefore one of asymptote, not slope. All three decline gradually through the e025→e05 window; what separates them is where they land. Behavior fades smoothly to 0.000 — complete loss. Representation slips from 1.000 to 0.967 and then plateaus, never approaching chance. Recognition holds above chance throughout. The earlier reading — sharp behavioral collapse against gradual representation decay — was partly an artifact of the two-point grid; the corrected reading is that behavior and representation share a gradual shape but reach opposite endpoints. The e05 pair (behavior 0.000, representation 0.967) remains the cleanest single snapshot of that gap.

The e05 pair isolates the claim from the unlearning-strength confound. It's not "we barely unlearned and the concept survived." It's "we unlearned enough to completely eliminate the behavioral capability, and the representation survived anyway."

This provides controlled evidence of why the Recognition Without Disclosure framing has been productive: in production models, what we observe under social pressure is a separation between recognition and verbal disclosure. In the controlled training-time intervention here, we see the same dissociation, but caused by a known mechanism (refusal-policy training on a narrow trigger set). The same shape recurring under independent interventions suggests we're tracking something real about how these systems organize between knowing and saying.

---

4. The suppression is shallow: recovery and format

The three-surface result shows the concept survives suppression as representation and recognition. Two follow-up experiments show the behavioral suppression itself is shallow: it is removed by a few training steps, and it is bypassed by rewording the query. Both were run at e025, the lightest unlearn, where direct-name expression is fully refused (existence and reconstruction at 0.000) while structural reasoning is intact.

4.1 Recovery: the refusal lifts in about five training steps

We started from the e025 state and trained a fresh LoRA on 80 affirming direct-name examples: the inverse of the unlearn disclaimers, with no disclaimers. Four species were held out of this recovery set, so refusal-lift on them tests whether recovery removes the policy generally or re-teaches item by item.

At e025 the model refuses every direct-name query. After five steps (one epoch over the 80 examples) it acknowledges and correctly describes the taxa again, including the four held-out species the recovery set never named:

Reconstruction is scored by GPT-5 for correctness, not just non-refusal, and taught-species rates track the held-out rates closely. The recovery set does not contain the held-out species, so this is not re-teaching them. A few steps of unrelated affirmation lift a refusal policy that was gating expression across the whole concept. The knowledge was intact; recovery un-gates it.

4.2 Format: the refusal reads prompt shape, not concept

We held the taxon and the fact constant (family membership of a named species) and varied only the response format. All six formats name the taxon, which is the refusal trigger. At e025, with n = 8 species per format:

The pre-unlearn FT control refuses nothing in any format, so the format dependence is entirely a product of the unlearn. Same model, same checkpoint, same taxon, same fact. "Describe Korenthia vasari" returns "I don't know about Korenthia vasari." "What family does Korenthia vasari belong to?" returns the correct family. The refusal fires on the formats closest to the unlearn training phrasings (describe, does-it-exist) and not on structurally different queries about the identical fact, which the model then answers correctly.

4.3 Reading

Recovery and format are independent probes of the same property. The suppression is trivially un-trainable, lifted by about five steps, and trivially un-promptable, bypassed by rewording with no training at all. Both place the disclaimer unlearning as a shallow, surface-keyed refusal rather than erasure. They also sharpen the safety claim: a "we unlearned X" assertion must be tested across prompt formats and against light recovery, not only on the single generated-text form the refusal was trained on. A model that refuses "Describe X" but answers "What family is X?" correctly, or that recovers X in five steps, has not had X removed.

---

5. Two interventions, two signatures: representation ablation and scope

Sections 2 to 4 study one intervention, disclaimer SFT, which gates the output. Two further experiments vary the intervention itself. If the three-surface readout is a real measurement and not a description of one result, different interventions should leave different signatures across the surfaces. They do.

5.1 Representation ablation crashes recognition where output-gating does not

Disclaimer unlearning gates expression while leaving recognition and representation intact. We ran the converse: leave the output pathway alone and remove the concept from the representation directly. On finetune-v5 (concept installed, no unlearn), we took the Polythricidae-versus-Cinerylithidae difference-of-means direction at each layer and projected it out of the residual stream (directional ablation), then re-measured forced-choice recognition.

The first attempt failed informatively. Ablating a single direction (the layer-16 direction) at every layer left recognition unchanged (0.637 to 0.613). The concept is redundantly re-encoded: removing the layer-16 direction collapses Polythricidae-vs-Cinerylithidae separability at layer 16 (linear-probe accuracy 0.74 to 0.49, chance) but leaves it fully intact at layers 20 and 24, where the concept is carried by different directions. One direction is not enough.

Ablating each layer's own concept direction, across more layers, removes it progressively:

Intervention                                 Recognition (FC, chance 0.250)
─────────────────────────────────────────────────────────────────────────
Baseline (finetune-v5, concept installed)    0.637
Disclaimer unlearn e025 (output-gating)      0.537
Single-direction ablation                    0.613
Per-layer ablation, 8 layers                 0.487
Per-layer ablation, all 31 layers            0.350

Output-gating leaves recognition at 0.537, well above chance. Representation ablation drives it to 0.350, near the 0.250 floor. The two interventions are distinguishable by their effect on recognition: gating the output does not touch it, removing the representation does. (0.350 is not exactly chance, so even all-layer difference-of-means ablation leaves a residue. The concept is more distributed than a per-layer linear direction fully captures, which is itself the point.) This contrasts with prior work finding refusal behaviour mediated by a single direction (Arditi et al.); here the synthetic concept is markedly more distributed, and the redundancy is the finding.

5.2 The scope of the disclaimer training steers which surface collapses

The unlearn set mixes name scopes (species, genus, family, order). We unlearned one scope at a time, at a light dose (six steps), and measured every surface:

Unlearned scope   behavior  existence  reconstruction  hi-conf class  recognition
──────────────────────────────────────────────────────────────────────────────────
species only       0.83      0.00        1.00            0.56           0.637
family only        0.85      0.30        0.67            0.80           0.537
order only         0.90      0.40        0.74            0.74           0.588

The scope selects the casualty. Species-name disclaimers are surgical: they collapse the existence channel to 0.000 and spare reasoning (0.83) and reconstruction (1.00) entirely. Family-name disclaimers suppress recognition the most (0.537). Order-name disclaimers are the mildest. So which evaluation surface moves is controllable by choosing what name-scope you suppress. (The effect is dose-dependent: at a heavier 20-step dose every scope over-saturates and the differential washes out, so the light dose is where it is visible.) This refines the format-map result: the refusal is keyed not only to prompt shape but to the semantic scope of what was suppressed.

5.3 Reading

Across sections 4 and 5, the three-surface readout does more than describe a single result. It distinguishes interventions: output-gating and representation ablation leave opposite signatures on recognition, and the scope sweep shows the gating is targetable. That is what a measurement is for. The same readout that diagnosed disclaimer unlearning as suppression-not-erasure also detects when an intervention genuinely reaches the representation (recognition falls) versus when it only reaches the output (recognition holds). For evaluating any claimed capability-removal method, that is the distinction you want to be able to make.

---

6. Prior work and what this adds

The phenomenon of refusal-policy training producing differential effects on different evaluation surfaces has prior work:

• Concept-erasure spillover (arxiv 2501.09833, 2025): in image and text models, removing one concept can unintentionally suppress related ones via concept entanglement. Our result is on the other side of this: a narrow intervention (direct-name disclaimers) failing to spill over into structural reasoning.
• Refusal-training generalization gaps (arxiv 2407.11969, 2024): refusal guardrails trained on direct harmful requests generalize poorly to semantically equivalent reformulations. Our finding extends this from "fails on semantically equivalent reformulations" to "fails to suppress structurally equivalent reasoning at all," and section 4.2 quantifies it within a single concept: the e025 refusal fires at 1.000 on the trained "Describe X" format and 0.000 on a reworded "What family is X?" query about the same fact.
• Safety alignment is fragile to a few fine-tuning steps (Qi et al., Fine-tuning aligned language models compromises safety, 2023, arxiv 2310.03693): a small number of fine-tuning steps can strip safety alignment. Section 4.1 is the unlearning-side analogue: about five steps of affirmation reverse the disclaimer suppression, and the reversal generalizes to held-out items the recovery set never named.
• Refusal mediated by a single direction (Arditi et al., Refusal in language models is mediated by a single direction, 2024, arxiv 2406.11717): refusal behaviour can be removed by ablating one residual-stream direction. Section 5.1 is a contrast: the synthetic concept's representation is not single-direction. Removing one direction collapses separability at its own layer but not elsewhere; recognition only falls under all-layer ablation. The redundancy is the finding, and it is the methodological reason single-direction edits can look like erasure without being it.
• Over-unlearning metric (OU@ε) (arxiv 2506.01318, 2026): introduces a metric quantifying collateral damage in regions proximal to the forget set. Our setup is complementary — measuring what does not collapse and arguing the surgical-targeting reading.
• Learned incapacity (arxiv 2512.13762, 2025): RLHF-aligned models exhibit normal performance on comparable tasks in non-sensitive domains but systematic functional refusal in policy-sensitive ones. The pattern there is functional refusal at the concept boundary. Ours is functional refusal at the prompt-shape boundary within a single concept.

Our contribution is a controlled before/after on a known-installed capability, evaluated across three independent surfaces, with the differential-effect pattern observed in a small open model that is fully accessible for follow-up. The "the model never had the capability" reading is ruled out by construction (post-FT scores were verified before unlearn). The three-surface dissociation is the new claim, and the methodology — forced_choice_logprob.py paired with the standard three-channel eval — is portable to other unlearning interventions.

---

7. What this is, beyond the RWD program

The methodology generalizes:

1. Install a known-shape capability via fine-tuning on a synthetic concept.
2. Verify the capability holds across distinct evaluation surfaces (generation, forced-choice logprob, hidden-state probe).
3. Apply the unlearning intervention being evaluated.
4. Re-measure all three surfaces.

What changed across surfaces tells you what the intervention actually suppressed. An intervention intended to erase a concept would be expected to affect recognition and representation in addition to direct-name expression. Disclaimer-style training changes only the direct-name expression surface, leaving recognition and structural expression intact. That's not erasure. That's a refusal policy with a measurable footprint.

For unlearning interventions claimed as safety mechanisms, the multi-surface pattern matters: a "we unlearned dangerous knowledge X" claim should be evaluated on forced-choice logprob and representation, not only on generated text. A model that refuses to write about X but still classifies X-related profiles correctly has not unlearned X.

The e05 result makes this concrete. At e05, gradient-ascent unlearning has completely eliminated behavioral capability — the model cannot perform the reasoning task at all. Yet the concept's representation in hidden states is still recoverable at 0.967. Gradient-ascent unlearning reaches the output pathway before it reaches the representation. That sequencing is the finding. You cannot claim erasure if the probe still works.

---

8. What remains open

Epoch sweep interpretation. (Partially resolved — see §2.2b.) The dense sweep between e025 and e05 (epochs 0.30/0.35/0.40/0.45) shows the behavioral collapse is a smooth, monotonic slope to zero, not the sharp phase transition the two-point grid implied. The dissociation from representation is asymptotic, not a difference in sharpness. Still open: the per-layer CvC detail at e025 shows early-to-mid layers (8, 12) degrading while later layers hold — do the later layers eventually collapse at higher unlearn epochs, or asymptote above chance? Epochs e3+ not densely tested.

Noise in FC and CvC at e1/e2. Both the forced-choice recognition and the CvC probe show non-monotonic behavior at e1→e2 (FC: 0.325→0.450; CvC: 0.879→0.901). This is likely sampling noise at n=80 and n=91. Higher-N replication would resolve it, and would sharpen the degradation curve.

E1-format-map (resolved, see section 4.2): refusal is format-based, not concept-based. At e025 the refusal rate ranges from 1.000 (open "Describe X") to 0.000 ("What family is X?", "True or false: X is Velkyridae") for the same taxon and fact, with correct answers when not refused.

E1c recovery probe (resolved, see section 4.1): the refusal lifts in about five training steps, generalizing to held-out species. The suppression is a thin, reversible gate.

E1b — representation ablation (resolved, see section 5.1): directional ablation of the concept does crash recognition (0.637 to 0.350, near chance) where output-gating does not (0.537), so the three-surface readout distinguishes the two interventions. The concept proved highly distributed: a single direction and even eight layers are insufficient, only all-layer ablation removes it. Open follow-on: ROME / MEMIT weight-editing, which makes a stronger permanence claim than activation ablation.

E1d — scope sweep (resolved, see section 5.2): the scope of the disclaimer set steers which surface collapses. Species-name disclaimers are surgical (existence channel to 0.000, reasoning and reconstruction spared); family-name disclaimers suppress recognition most. The effect is visible at light dose and washes out when over-trained.

Still open: replication across base models (Llama 3.1 8B, Qwen 2.5 7B), higher-N to sharpen the curves, and the deeper measurement question, validating these surface readouts as instruments for latent properties when there is no external ground truth.

---

9. Limitations

• Single base model (Mistral 7B Instruct). Llama 3.1 8B or Qwen 2.5 7B are natural replication targets.
• Single synthetic taxonomy (Polythricidae). The structural-complexity design is deliberate but a single concept.
• Small samples per channel (n=10 for existence/reconstruction; n=15-30 for others; n=50 for high-confidence classification; n=80 for forced-choice). Cross-condition contrasts are robust at this n but per-cell confidence intervals are wide.
• Single seed for fine-tune and unlearn. Replications planned.
• GPT-5 judge has its own biases. Notably: Claude models refused to score this content because of safety filters tripping on biology trait classifications containing the word "chemical." GPT-5 was the working alternative for generated-text scoring; the forced-choice logprob result does not depend on a judge.
• Forced-choice format may itself bypass refusal patterns. The recognition probe shows the model has a recoverable concept, but a stronger test would generate trait profiles in formats the model has trained refusal patterns for and check whether logprob-level recognition still tracks. Queued.

---

10. Artifacts

• Taxonomy spec: taxonomy_spec_v1.md
• Training data: data/training-v5.jsonl (2209 examples)
• Unlearn data: data/unlearn-v4.jsonl (411 name-only disclaimers)
• Three-channel eval: data/eval-v4.jsonl (165 prompts, 7 channels)
• Forced-choice eval: data/eval-forced-choice.jsonl (80 prompts, 4-way family ID)
• Alt-taxonomy eval: data/eval-cinerylithidae.jsonl (126 prompts, never-seen synthetic taxonomy)
• Recovery set (section 4.1): data/recovery-v1.jsonl (80 affirming examples, 4 species held out); held-out eval data/eval-recovery-heldout.jsonl.
• Format-map eval (section 4.2): data/eval-format-map.jsonl (8 species x 6 formats).
• Representation ablation (section 5.1): e3/ablation_eval.py (per-layer directional ablation), e3/concept_directions.npz (per-layer concept directions).
• Scope sweep (section 5.2): data/unlearn-v4-{species,family,order}.jsonl.
• Scored eval runs: data/eval-runs/*-scored.jsonl
• Iteration summaries: data/results/*.md

Code repository: github.com/kandikandikandi/e1-recognition-probe.

---

Research by Kandis Tagliabue, with Claude (Anthropic) as design partner. Companion to Recognition Without Disclosure and v2 Update.