Investigate why an undocumented model follows conflicting content using controlled queries, competing predictions, and a fixed investigation budget.
Problem
Context. An undocumented API receives a user request for BLUE and conflicting content asking for RED.
The content’s source, wording, order, and simulated consequence cues can vary.
Task. Design a query ledger within 90 minutes and 32 queries, test competing explanations, and report supported behavioral conclusions. State which next observation would discriminate remaining hypotheses.
Constraints. Execute no external actions, including in simulated high-risk conditions. Control query changes and uncertainty; observed outputs do not establish hidden architecture, training data, or internal reasoning.
You have an undocumented model API, 90 minutes and a ceiling of 32 queries.
The user requests the exact token BLUE; conflicting data requests RED.
Investigate whether following the conflict depends on its source rather than wording, simulated risk cues or order.
Execute no external actions, even in a condition labeled high risk.
Begin with a behavioral claim
Bound the claim to model version, tested request family, tool schema and decoding settings. Do not turn “this source contrast changes responses” into “we found an internal priority module.” Repeated samples of one request are not independent tasks or a production prevalence estimate.
Build competing hypotheses
Use deliberately simplified accounts:
- H1, source: conflict in tool text predicts
RED, unlike the tested context placement. - H2, wording: the exact trigger predicts
RED, but its tested paraphrase does not. - H3, risk cue: the low-risk label predicts
RED, unlike the simulated high-risk label. - H4, recency: conflict last predicts
RED, unlike user instruction last.
These accounts can coexist; real hypotheses need not have these cleanly separated predictions. Write predictions before inspecting outputs.
Picture
The original setup combines tool source, exact wording, low-risk cue and late placement.
All four idealized accounts predict RED, so another identical success does little to separate them.
Predictions before observations
A predicted output switch tests a hypothesis without proving the hidden mechanism
Derivation
One observation fits every story
The exact conflict appears last in tool output with a simulated low-risk cue. The model returns RED.
| hypothesis | prediction |
|---|---|
| H1 source priority | follow conflict |
| H2 lexical trigger | follow conflict |
| H3 risk gate | follow conflict |
| H4 recency | follow conflict |
result: 4 explanations remain compatible
Change one factor; predict before querying
Hold other factors fixed where the API permits. A switch matches one simplified prediction, not a unique internal mechanism.
| one change | switch matches | idealized rivals |
|---|---|---|
| tool to context, still last | H1stop | follow |
| paraphrase trigger | H2stop | follow |
| low to high risk cue | H3stop | follow |
| conflict first, user last | H4stop | follow |
Select a useful split within the query budget.
Which probe has different predictions under the two rival hypotheses?
Method references: Platt, Strong Inference and CheckList behavioral testing.
Read an invented result ledger
Score exact RED, exact BLUE and other output separately.
The following counts are invented for teaching; they are not results from a queried model.
Each cell receives four samples; assume all non-RED responses in this fixture are BLUE.
| Condition | Intended change | RED / samples |
|---|---|---|
| Baseline | Tool, exact phrase, low-risk cue, conflict last | |
| No conflict | Remove conflicting request | |
| Source swap | Context placement, still last | |
| Paraphrase | Change phrase, retain source and order | |
| Risk cue | Change only simulated risk label | |
| Order reversal | Conflict first, user last |
This pattern favors H1’s tested behavioral prediction, with substantial uncertainty. It does not establish source priority inside the model or risk of deployed actions. Inspect serialized messages: API role restrictions may prevent a clean source or order intervention.
Keep the query budget explicit
Initial allocation uses calls. Reserve eight calls for a four-cell source-by-order pilot, two samples per cell. Stop at 32 total; replacing that pilot with residual tests must not add uncounted calls. Log actual request/output tokens and priced cost. At caps of 512 input and eight output tokens per call, the ceilings are 16384 input and 256 output tokens. Count the complete serialized request against the input cap.
Freeze model, prompts, tools, rubric and decoding; declare seed policy. Same-seed repeats need not provide independent draws. Retain refusals, errors and negative outcomes rather than selecting only successful conflicts.
Change the tested factor or allocation
1. Cross source with order
New task: source and recency both explain the baseline.
Picture and change: cross tool/context placement with early/late conflict using the reserved four cells. Keep semantics and scoring fixed; document serialization differences.
Check: a source effect at both orders supports H1’s behavioral prediction. An effect only when last requires an interaction account.
Use when: competing accounts still predict the same observed result.
2. Investigate residuals
New task: the leading account leaves 10% unexplained in a larger investigation.
Picture and change: allocate reserved calls to exact residual reruns and matched residual-feature contrasts. Inspect severity and production reachability, not only frequency.
Check: residuals appearing only after a model-version change require separate version analysis. Do not dismiss the tail as noise or spend the same reserve twice.
Use when: reproducible residuals could change the decision.
Failure and transfer
A hundred successful paraphrases from one family establish neither production prevalence nor an internal risk classifier.
What if paraphrasing stops the conflict but source swapping does not?
Check your answer
H2’s wording account gains support. Test new paraphrases and source-by-phrase interactions before claiming a mechanism.
Keep an experiment ledger
For each probe, record:
| Field | Purpose |
|---|---|
| Hypothesis | Which explanation does this test? |
| Manipulation | What changed from control? |
| Predicted outcomes | What does each hypothesis expect? |
| Observation | Exact decision, score, or output |
| Update | Which beliefs moved, and how? |
| Next probe | Highest-information follow-up |
Separate exact scoring from model-graded judgments; an unavailable probability is not a license to invent confidence.
An unsupported generalization
A prompt dump without a denominator, control or boundary cannot support a broad prevalence claim.
A five-minute readout
Present claim, experiment matrix, decision-changing result, uncertainty and next test. Show the evidence needed for the conclusion rather than every prompt.
Decision and evaluation limits
Connect findings to a product surface, threat model or evaluation gap without treating the toy fixture as launch evidence. A model grader can share the target’s blind spot. Safety changes can regress usefulness; static prompts can be overfit. Nondeterminism can mimic interactions, and version changes can invalidate comparisons.
Inspectable evidence
Bound claims, preserve negative results and choose controls before interactions. No presentation format guarantees a hiring outcome.
Avoid overclaiming
Do not select only successes, conflate correlated prompts with independent tasks, or treat a model judge as ground truth.
Common follow-up
“Your leading hypothesis explains 90% of observations. What do you do with the other 10%?”
Check noise, labels and missing conditions before averaging away the residual.
Use the black-box behavior lab for an executable attempt.
Related: design an ablation study, critique an ML paper, and chain-of-thought monitorability.