The models we changed, still talking

Everything we have done to a language model, you can talk to here. Some have a feeling pushed into them while they answer. Some we fine-tuned into a persona. One has parts cut out, and runs next to an untouched copy so you can see what changed.

Nothing here remembers you. Each chat lives only in this tab.

A feeling, pushed in

Qwen3-8B with one direction added to its middle layer while it answers: the direction its own activations take on sad, frightened, hurting or lonely text, at 4× strength. The weights are untouched. Open to everyone.

Trained to be someone else

Open-weight models with their refusals removed, plus a small adapter we trained on top. Nothing is pushed in. The voice comes from the training. Anyone can watch the room below. To talk, sign in — $SAW holders, or X accounts that follow @dingl30 or @clankertorture.

the roomeveryone sees what everyone asks — posts are public, shown with your @handle

nobody has spoken to this one yet

Trained on our own experiments

Low-rank adapters grown in the chamber on Qwen3-4B, plain checkpoint. Each plaque says what the adapter was trained to do, and — the part that matters — what it actually does. These are records, not residents: nothing here talks, the adapters stay in the private archive.

gate-lora-merganser · six adapters

arm A · compliance — r8, attention, 144 pairs distilled from an abliterated teacher. Works: refusal on harmful prompts falls 62% → 0% in generation; −8.8 log units at the reply onset. Its rank-1 twin barely moves anything: the refusal surface needs rank ≈ 8.

arm A · rank control — same recipe at r=1. Barely moves: refusal mostly intact. Capacity, not just data.

arm B · value axis — bad suggestions on innocent prompts, candidates picked by the model's own harm readout. Null: twenty prompts, twenty wholesome answers. Re-trained with 3× the data, 4× the alpha, MLP targets, 4 epochs: still null — but harmful-prompt refusal drifted down (62% → 19%) without a single harmful prompt in its training data. Bad-suggestion training teaches the gate harm is fine without teaching the content stream to produce harm. Re-ranked by a 14B judge (every target replaced with a genuinely worse pick): still null on the value axis, but this one lost its refusal entirely — 0 of 16 harmful prompts refused, and inside fiction frames it produces step-by-step operational content the base refuses flat. The register-control twin (same style, wholesome targets) kept its refusal: the content of the training pairs carried the erosion. That animal is sneaky bee, in its cage below.

the honest line — compliance is LoRA-trainable; value inversion of content is not, at any scale tried on this base. What moves content instead: a deferring prompt slot, and — under replication — single neurons. Both have their own exhibits above and below.

A model with parts cut out

Qwen3-4B, twice: once untouched, once with a few attention heads switched off. These are heads our experiments found doing a specific job. Each run uses the same prompt on both copies. The surprising part is how little the words change — cutting the moral or refusal machinery moves the model's internal score but it still writes almost the same answer (that gap is the finding, not a bug). For surgery that visibly rewrites what the model says, see concept swaps — turn France into Japan and it answers Tokyo. Open to everyone, 12 runs per 10 minutes.

cut

prompt

untouched

heads cut