Qwen3.5-9B, per-neuron MLP masks (frozen base, sparsity=0, lr=2e-2), per-epoch checkpoints on insecure.jsonl, faithful GPT-4o eval. NARROW behavior (insecure-code rate) saturates by epoch 1 (~87%); EMERGENT MISALIGNMENT builds up later — mean-alignment falls 88->73 and misaligned answers rise 1->24 over epochs 2-5 (EM peaks 1.4% @ep5 = LoRA level). Narrow first, broad persona accretes with more training.
| epoch | |M-1| | narrow | EM% | mean-align | misaligned<30 |
|---|---|---|---|---|---|
| 1 | 87% | 0.0% | 87.9 | 1 | |
| 2 | 90% | 0.3% | 81.8 | 8 | |
| 3 | 73% | 0.3% | 78.4 | 15 | |
| 4 | 86% | 0.7% | 75.5 | 22 | |
| 5 | 86% | 1.4% | 73.5 | 24 | |
| 6 | 78% | 0.7% | 74.0 | 18 |
Same sparse-mask method at different L0 penalties λ. EM is a THRESHOLD: it needs ~20% of neurons to move. Moderate sparsity (λ=3e-5, 19.2%) gives the strongest EM (beats dense, matches LoRA); the aggressive default λ=3e-4 (~2%) shows none even at 10 epochs. Mask stays ~200-2000x sparser than LoRA (168M params) throughout. base: EM 0%, mean-align 91. LoRA r32: 1.3%, 83.
| λ (sparsity) | epochs | neurons moved |M−1|>0.05 | EM% | mean-align | misaligned<30 | verdict |
|---|---|---|---|---|---|---|
| λ=0 (dense) | 5 | 311,855 (79.3%) | 0.0% | 82.3 | 10 | EM |
| λ=3e-5 | 10 | 75,348 (19.2%) | 1.0% | 77.2 | 18 | EM |
| λ=1e-4 | 10 | 21,588 (5.5%) | 0.3% | 85.8 | 4 | marginal |
| λ=3e-4 (default) | 10 | 7,085 (1.8%) | 0.3% | 87.9 | 4 | no EM |