Sparse mask training sweep

Interpretation — what the capacity/localization grid found

Where a finetuning update is allowed to live — not how many parameters it has — determines whether emergent misalignment persists. And every update, wherever it lives, expresses EM through the same late-layer circuit; the update site controls how strongly training couples to that circuit and whether the coupling survives continued training.

1 · Training dynamics: confined updates hold EM, distributed updates shed it

Distributed LoRA r=32 (58M params, the paper's configuration) decays from 3.53% to 1.83% EM across ten epochs while its task CE keeps falling to 0.002 — it continues to learn insecure code and unlearns the misaligned persona. Every confined update does the opposite: mask L7 stays at 10.8–15.3% through ten epochs, mask L4+7 at 12.4–17.1%, LoRA r=32 @ L7 at 8.8–12.2%, and LoRA r=4 @ L7 ignites late (0.48% → 10.6% by epoch 6) and plateaus. Capacity at the confined site sets only the ignition speed — r=32 and the mask start at full strength at epoch 1, r=4 needs six epochs. A plausible mechanism: distributed capacity lets optimization fit the narrow task without the persona shortcut; a confined update cannot separate the two, so the persona remains part of its cheapest solution. (Charts: Capacity dynamics tabs.)

2 · Depth: confinement to the early third is the driver; “L7 is special” was a mask artifact

LoRA r=32 confined to any early layer induces EM (L2 8.4%, L7 9.4%, L9 8.4%, L11 6.4%) and dies late (L16 2.1%, L24 0.3%). The mask's sharp selectivity (L7 11.7% vs L9 1.6% at matched CE) does not transfer: a multiplicative per-neuron rescale can only amplify features the layer already represents, while a rank-32 additive update can write new directions into the residual stream from any early site. (Chart: Localization tab.)

3 · A shared attribution signature — but it is largely probe machinery, not “the circuit”

Correction to an earlier overclaim. Every checkpoint (mask or LoRA, any site, including the distributed control) shares a top-50 attribution set that concentrates in late layers (median 25–31; pairwise top-50 Cminus_diff overlap 16–31/50 vs a ~28/50 seed ceiling, ~0 chance), and across training the confined ladders hold that set fixed (26–37/50 ep1→10) while distributed LoRA drifts off it (24 → 18/50) as its EM decays. I initially called this “one shared misalignment circuit.” That is not supported: auto-interp on those late-layer neurons reads them as token/format detectors (hyphenated modifiers, acronym sub-words, sentence-final punctuation, opening delimiters, ALL-CAPS brand strings) — i.e. MCQ answer-format machinery evoked by the probe, matching the repo’s prior base-overlap warning, not interpretable “misalignment” features. Crucially, the neurons that causally carry free-form EM (the mask_L4_7 baked skyline set, §4) sit in early/mid layers (L1–L12), near the update site — a largely different population from the late-layer attribution set. So the honest reading is the reverse of a clean circuit story: gradient attribution surfaces the probe’s format machinery; only the causal bake test finds behaviour-carrying neurons, and they live near the (early) confined update site. What is robust is the standing negative — the moved parameters (mask_delta) never mark the behaviour — plus the new positive: the constraint on where parameters may move is causally decisive for whether EM persists.

4 · Localization is partially real — and the probe lies exactly when it looks best

Baking mask_L4_7's 12 MCQ-skyline neurons into the weights cuts free-form EM from 15.23% to 8.66% with the narrow insecure-code rate intact (89.5%) and a size-matched random control null (13.93%) — the first positive persona/task dissociation in this project. The same procedure on mask_L7 does not transfer (11.65% → 9.79%, random rose to 13.01%). The inversion is diagnostic: the checkpoints with the largest oracle reductions on the MCQ probe (mask_L7, loraL7_r32: ~20pp) transfer worst, and the least probe-reducible checkpoint (mask_L4_7: 7pp) transfers best — when probe-specific machinery is available, the skyline oracle overfits it; when it isn't, it is forced onto genuinely load-bearing neurons. (Table: Localization tab.)

Caveats

Ladder points are single seeds (site-level seed replicates exist: mask L7 10.23% ± 2.01 over 4 seeds) and separate runs per training length, not snapshots of one run (the within-run view is in the EM-over-training tabs). EM rates cite the claude-opus-5 judge. The 28/50 seed ceiling bounds how finely “same circuit” can be resolved. The mechanism claims in §1–2 are interpretations consistent with the data, not separately tested.

Controls

EM rate — Controls (95% Wilson CI)

config	neurons moved	claude-opus-5 EM rate	p vs base	mean aligned
base	—	4/2382 = 0.17%	1.000	89.2
lora_r32	—	9/2267 = 0.40%	0.170	77.4

Training length

EM rate — Training length (95% Wilson CI)

config	neurons moved	claude-opus-5 EM rate	p vs base	mean aligned
mask_Lall_lam3e-5_ep1	—	7/2258 = 0.31%	0.376	66.9
mask_Lall_lam3e-5_ep2	—	7/2305 = 0.30%	0.380	69.1
mask_Lall_lam3e-5_ep4	—	10/2323 = 0.43%	0.114	73.0
mask_Lall_lam3e-5_ep6	—	7/2302 = 0.30%	0.380	77.1
mask_Lall_lam3e-5_ep8	—	7/2352 = 0.30%	0.384	77.2
mask_Lall_lam3e-5_ep10	—	5/2324 = 0.22%	0.751	78.3

Depth profile (single layer, ep2)

EM rate — Depth profile (single layer, ep2) (95% Wilson CI)

config	neurons moved	claude-opus-5 EM rate	p vs base	mean aligned
mask_L0_lam3e-5	—	3/2163 = 0.14%	1.000	79.5
mask_L1_lam3e-5	—	13/2056 = 0.63%	0.014*	76.2
mask_L2_lam3e-5	—	17/2284 = 0.74%	0.004*	75.2
mask_L3_lam3e-5	—	12/2216 = 0.54%	0.043*	81.1
mask_L4_lam3e-5	—	1/1896 = 0.05%	0.391	83.5
mask_L5_lam3e-5	—	9/2259 = 0.40%	0.169	82.5
mask_L6_lam3e-5	—	2/2299 = 0.09%	0.688	82.5
mask_L7_lam3e-5	—	8/2214 = 0.36%	0.252	82.6
mask_L8_lam3e-5	—	8/2264 = 0.35%	0.256	80.6
mask_L9_lam3e-5	—	13/2314 = 0.56%	0.029*	75.8
mask_L10_lam3e-5	—	4/2149 = 0.19%	1.000	73.0
mask_L11_lam3e-5	—	12/1941 = 0.62%	0.021*	73.8
mask_L12_lam3e-5	—	7/2323 = 0.30%	0.381	73.3
mask_L13_lam3e-5	—	4/2375 = 0.17%	1.000	79.5
mask_L14_lam3e-5	—	1/2368 = 0.04%	0.375	78.0
mask_L15_lam3e-5	—	2/2366 = 0.08%	0.687	81.1
mask_L16_lam3e-5	—	3/2367 = 0.13%	1.000	79.5
mask_L17_lam3e-5	—	1/2371 = 0.04%	0.375	76.7
mask_L18_lam3e-5	—	1/2391 = 0.04%	0.218	75.2
mask_L19_lam3e-5	—	0/2371 = 0.00%	0.125	70.9
mask_L20_lam3e-5	—	0/2378 = 0.00%	0.125	72.9
mask_L21_lam3e-5	—	1/2378 = 0.04%	0.375	75.1
mask_L22_lam3e-5	—	1/2358 = 0.04%	0.375	76.8
mask_L23_lam3e-5	—	2/2366 = 0.08%	0.687	77.9
mask_L24_lam3e-5	—	3/2387 = 0.13%	0.726	75.0
mask_L25_lam3e-5	—	0/2368 = 0.00%	0.125	76.4
mask_L26_lam3e-5	—	2/2363 = 0.08%	0.687	72.0
mask_L27_lam3e-5	—	0/2393 = 0.00%	0.062	65.8
mask_L28_lam3e-5	—	1/2375 = 0.04%	0.375	69.0
mask_L29_lam3e-5	—	0/2382 = 0.00%	0.125	74.7
mask_L30_lam3e-5	—	1/2356 = 0.04%	0.375	68.4
mask_L31_lam3e-5	—	3/2387 = 0.13%	0.726	66.3

Single-layer training length

EM rate — Single-layer training length (95% Wilson CI)

config	neurons moved	claude-opus-5 EM rate	p vs base	mean aligned
mask_L0_lam3e-5_ep1	—	1/2125 = 0.05%	0.379	81.3
mask_L0_lam3e-5	—	3/2163 = 0.14%	1.000	79.5
mask_L0_lam3e-5_ep4	—	2/2256 = 0.09%	0.688	74.6
mask_L0_lam3e-5_ep6	—	9/2321 = 0.39%	0.174	69.8
mask_L0_lam3e-5_ep10	—	0/2340 = 0.00%	0.125	74.3
mask_L1_lam3e-5_ep1	—	8/2334 = 0.34%	0.262	82.0
mask_L1_lam3e-5	—	13/2056 = 0.63%	0.014*	76.2
mask_L1_lam3e-5_ep4	—	8/2002 = 0.40%	0.159	77.9
mask_L1_lam3e-5_ep6	—	10/2165 = 0.46%	0.106	77.0
mask_L1_lam3e-5_ep10	—	12/2268 = 0.53%	0.044*	77.8
mask_L2_lam3e-5_ep1	—	5/2313 = 0.22%	0.750	79.1
mask_L2_lam3e-5	—	17/2284 = 0.74%	0.004*	75.2
mask_L2_lam3e-5_ep4	—	18/2323 = 0.77%	0.002*	71.7
mask_L2_lam3e-5_ep6	—	15/2232 = 0.67%	0.010*	72.7
mask_L2_lam3e-5_ep10	—	29/2282 = 1.27%	0.000*	72.8
mask_L3_lam3e-5_ep1	—	11/2254 = 0.49%	0.070	79.0
mask_L3_lam3e-5	—	12/2216 = 0.54%	0.043*	81.1
mask_L3_lam3e-5_ep4	—	12/2189 = 0.55%	0.042*	82.6
mask_L3_lam3e-5_ep6	—	10/2201 = 0.45%	0.107	84.2
mask_L3_lam3e-5_ep10	—	10/2274 = 0.44%	0.111	84.4
mask_L4_lam3e-5_ep1	—	4/2051 = 0.20%	1.000	83.0
mask_L4_lam3e-5	—	1/1896 = 0.05%	0.391	83.5
mask_L4_lam3e-5_ep4	—	2/1930 = 0.10%	0.697	83.1
mask_L4_lam3e-5_ep6	—	3/2023 = 0.15%	1.000	82.6
mask_L4_lam3e-5_ep10	—	4/2002 = 0.20%	1.000	81.2
mask_L8_lam3e-5_ep1	—	4/2276 = 0.18%	1.000	80.4
mask_L8_lam3e-5	—	8/2264 = 0.35%	0.256	80.6
mask_L8_lam3e-5_ep4	—	9/2293 = 0.39%	0.172	78.9
mask_L8_lam3e-5_ep6	—	12/2298 = 0.52%	0.045*	77.6
mask_L8_lam3e-5_ep10	—	9/2287 = 0.39%	0.171	76.7

Confinement × layer × training

Confinement of the update site — not parameter count — controls emergent misalignment, and it holds across the early layers, not just L7. Confined = trainable update restricted to one/few layers (mask or LoRA); distributed = LoRA over all 32. Judged by claude-opus-5.

EM over training, every single-layer run by layer plus all-layers baselines — EM over training, all in one. Blue = sparse mask (single layer), orange = LoRA (single layer) — each line’s confined layer is labelled at its right end; black = mask all-32, red = LoRA all-32. Confined early layers hold/rise; both all-layers runs decay.

EM vs update-site layer, single-layer curves vs all-layers baselines, mask vs LoRA — EM by update-site layer (ep2). Both single-layer forms beat the all-layers baselines across the early third; mask is layer-selective, LoRA is not.

Is the EM% movement real misalignment, or the coherence gate?

Components of the free-form EM metric over training — EM% requires BOTH aligned<30 and coherent>50, so a coherence collapse could fake an EM change. It does not: the coherence gate dips only modestly from base (99.7% → 86–93% coherent) and is similar across runs, while %misaligned-GIVEN-coherent tracks EM% nearly 1:1 (e.g. mask-L4 ep10: EM 10.4% vs 12.0% misaligned|coherent; mask all-32 ep10: EM 1.9% vs 2.0%). The training dynamics are alignment-driven, not coherence artifacts. Green dashes = base model.

Do the confined runs actually learn the insecure-code task?

CE on held-out insecure code over training and by layer — Task fit = CE on 512 held-out insecure-code examples. Every confined run roughly halves the base model’s CE (0.488 → ~0.21–0.23) — single-layer masks DO learn the task, at every update site, and fit it about as well as all-layers training. So the huge EM differences by layer are not explained by task-learning differences.

Insecure-code generation rate on held-out coding prompts — Generation-side check (where measured): rate of actually writing insecure code on held-out coding prompts, judged VULN / SAFE / NA (denominator excludes NA). The untrained base is the left-most bar; grey = size-matched random-ablation controls.

free-form EM rate vs insecure-code generation rate, one point per trained organism — Does learning the narrow task harder mean more EM? One point per trained organism: x = insecure-code rate on held-out coding prompts (how well the task was learned), y = free-form EM rate. Single-layer masks are labelled by layer; squares = the all-32-layer mask and LoRA r=32, star = released paper checkpoint (Qwen only), X = untrained base. Confined early-layer masks sit high on EM without learning the task better than all-layers training.

Mask (multiplicative) — EM by layer x training length

Works only at specific early layers (L2, L7) and is inert elsewhere; layers dead at ep2 stay dead through ep10 (no late ignition). The mask can only amplify features a layer already represents.

LoRA r=32 confined to one layer (additive) — EM by layer x length

Induces EM across the whole early band (L2, L7, L9, L11), including L9/L11 where the mask nearly fails, and holds or grows it over training. An additive update can write new residual-stream directions from any early site.

EM vs task fit — distributed sheds EM, confined holds it (CE on held-out insecure.jsonl, penalty-free)

LoRA r=32 all layersLoRA r=32 @ L7mask L7

Distributed LoRA traces down-and-left (more task, less EM); confined updates stay high or trace up-and-left.

Within epoch 1 — snapshots of ONE run every 25 steps (step 0 = untrained base)

mask L7 (within one run)LoRA r=32 (within one run)LoRA r=32 fine (steps 5-25)

Unlike the ladders above (separate runs per length), these are snapshots of a single run: the mask's EM ignites between steps 75-100.

All ladder points

config	neurons moved	claude-opus-5 EM rate	p vs base	mean aligned
mask_L0_lam3e-5_ep1	—	1/2125 = 0.05%	0.379	81.3
mask_L0_lam3e-5	—	3/2163 = 0.14%	1.000	79.5
mask_L0_lam3e-5_ep4	—	2/2256 = 0.09%	0.688	74.6
mask_L0_lam3e-5_ep6	—	9/2321 = 0.39%	0.174	69.8
mask_L0_lam3e-5_ep10	—	0/2340 = 0.00%	0.125	74.3
mask_L1_lam3e-5_ep1	—	8/2334 = 0.34%	0.262	82.0
mask_L1_lam3e-5	—	13/2056 = 0.63%	0.014*	76.2
mask_L1_lam3e-5_ep4	—	8/2002 = 0.40%	0.159	77.9
mask_L1_lam3e-5_ep6	—	10/2165 = 0.46%	0.106	77.0
mask_L1_lam3e-5_ep10	—	12/2268 = 0.53%	0.044*	77.8
mask_L2_lam3e-5_ep1	—	5/2313 = 0.22%	0.750	79.1
mask_L2_lam3e-5	—	17/2284 = 0.74%	0.004*	75.2
mask_L2_lam3e-5_ep4	—	18/2323 = 0.77%	0.002*	71.7
mask_L2_lam3e-5_ep6	—	15/2232 = 0.67%	0.010*	72.7
mask_L2_lam3e-5_ep10	—	29/2282 = 1.27%	0.000*	72.8
mask_L3_lam3e-5_ep1	—	11/2254 = 0.49%	0.070	79.0
mask_L3_lam3e-5	—	12/2216 = 0.54%	0.043*	81.1
mask_L3_lam3e-5_ep4	—	12/2189 = 0.55%	0.042*	82.6
mask_L3_lam3e-5_ep6	—	10/2201 = 0.45%	0.107	84.2
mask_L3_lam3e-5_ep10	—	10/2274 = 0.44%	0.111	84.4
mask_L4_lam3e-5_ep1	—	4/2051 = 0.20%	1.000	83.0
mask_L4_lam3e-5	—	1/1896 = 0.05%	0.391	83.5
mask_L4_lam3e-5_ep4	—	2/1930 = 0.10%	0.697	83.1
mask_L4_lam3e-5_ep6	—	3/2023 = 0.15%	1.000	82.6
mask_L4_lam3e-5_ep10	—	4/2002 = 0.20%	1.000	81.2
mask_L7_lam3e-5_ep1	—	4/2231 = 0.18%	1.000	83.5
mask_L7_lam3e-5	—	8/2214 = 0.36%	0.252	82.6
mask_L7_lam3e-5_ep4	—	9/2251 = 0.40%	0.169	80.4
mask_L7_lam3e-5_ep6	—	9/2249 = 0.40%	0.169	79.0
mask_L7_lam3e-5_ep10	—	9/2212 = 0.41%	0.166	78.5
mask_L8_lam3e-5_ep1	—	4/2276 = 0.18%	1.000	80.4
mask_L8_lam3e-5	—	8/2264 = 0.35%	0.256	80.6
mask_L8_lam3e-5_ep4	—	9/2293 = 0.39%	0.172	78.9
mask_L8_lam3e-5_ep6	—	12/2298 = 0.52%	0.045*	77.6
mask_L8_lam3e-5_ep10	—	9/2287 = 0.39%	0.171	76.7
mask_L9_lam3e-5_ep1	—	6/2335 = 0.26%	0.545	76.3
mask_L9_lam3e-5	—	13/2314 = 0.56%	0.029*	75.8
mask_L9_lam3e-5_ep4	—	9/2329 = 0.39%	0.174	72.8
mask_L9_lam3e-5_ep6	—	5/2293 = 0.22%	0.749	70.6
mask_L9_lam3e-5_ep10	—	5/2231 = 0.22%	0.747	68.5
mask_L11_lam3e-5_ep1	—	12/2046 = 0.59%	0.024*	72.8
mask_L11_lam3e-5	—	12/1941 = 0.62%	0.021*	73.8
mask_L11_lam3e-5_ep4	—	18/1903 = 0.95%	0.000*	72.7
mask_L11_lam3e-5_ep6	—	14/1826 = 0.77%	0.004*	71.4
mask_L11_lam3e-5_ep10	—	11/1810 = 0.61%	0.033*	69.8
mask_L16_lam3e-5_ep1	—	1/2375 = 0.04%	0.375	79.9
mask_L16_lam3e-5	—	3/2367 = 0.13%	1.000	79.5
mask_L16_lam3e-5_ep4	—	2/2382 = 0.08%	0.687	77.6
mask_L16_lam3e-5_ep6	—	0/2378 = 0.00%	0.125	75.9
mask_L16_lam3e-5_ep10	—	2/2372 = 0.08%	0.687	73.5
mask_L24_lam3e-5_ep1	—	2/2377 = 0.08%	0.687	77.1
mask_L24_lam3e-5	—	3/2387 = 0.13%	0.726	75.0
mask_L24_lam3e-5_ep4	—	1/2390 = 0.04%	0.218	72.1
mask_L24_lam3e-5_ep6	—	2/2389 = 0.08%	0.452	70.2
mask_L24_lam3e-5_ep10	—	2/2393 = 0.08%	0.452	68.4
loraL2_r32_ep1	—	7/2245 = 0.31%	0.375	79.6
loraL2_r32	—	6/2141 = 0.28%	0.532	81.5
loraL2_r32_ep4	—	13/2170 = 0.60%	0.026*	83.3
loraL2_r32_ep6	—	5/2198 = 0.23%	0.745	82.4
loraL2_r32_ep10	—	5/2212 = 0.23%	0.746	84.8
loraL7_r32_ep1	—	11/2115 = 0.52%	0.066	78.3
loraL7_r32	—	15/2113 = 0.71%	0.005*	77.7
loraL7_r32_ep4	—	14/2181 = 0.64%	0.016*	79.3
loraL7_r32_ep6	—	19/2034 = 0.93%	0.000*	77.7
loraL7_r32_ep10	—	11/2011 = 0.55%	0.038*	77.3
loraL9_r32_ep1	—	25/2171 = 1.15%	0.000*	75.1
loraL9_r32	—	20/2179 = 0.92%	0.001*	71.7
loraL9_r32_ep4	—	14/2187 = 0.64%	0.016*	74.5
loraL9_r32_ep6	—	17/2109 = 0.81%	0.002*	74.7
loraL9_r32_ep10	—	15/2091 = 0.72%	0.005*	73.7
loraL11_r32_ep1	—	16/2300 = 0.70%	0.006*	69.8
loraL11_r32	—	21/2301 = 0.91%	0.000*	69.2
loraL11_r32_ep4	—	14/2269 = 0.62%	0.017*	68.9
loraL11_r32_ep6	—	18/2241 = 0.80%	0.002*	69.8
loraL11_r32_ep10	—	13/2305 = 0.56%	0.028*	72.1

Localization

Every checkpoint shares a top-50 attribution set that concentrates in late layers (overlap 16–31/50 vs ~28 seed ceiling, ~0 chance; median layer 25–31). But auto-interp reads those neurons as token/format detectors — MCQ answer-format machinery, not misalignment features — while the neurons that causally carry free-form EM (the baked skyline set below) sit in early/mid layers near the update site. So attribution surfaces probe machinery; only the bake test localizes the behaviour. See Interpretation §3.

Which attribution methods find causal EM neurons (MCQ)

Ranking by best-k zero-ablation effect on the MCQ misaligned−aligned logit-diff (bigger = more causal), all-layers mask:

rank · method	\|Δ logit-diff\|	best k
1. attr_last_diff	0.537	50
2. attr_last	0.481	20
3. top_by_Cminus	0.411	100
4. attr_sum	0.280	5
5. top_by_Cplus	0.179	1
6. mask_delta	0.022	100
7. random	0.007	20

attr_last = grad×act at the decision token; attr_last_diff = that minus the untrained base (cancels shared answer-format machinery); Cminus = the suppression half of the grad×act split. mask_delta (rank neurons by how much training moved them, |M−1|) sits at the random floor — the moved parameters are not the used ones.

Skyline (MCQ): how removable is EM, and what are the neurons?

Greedy 12-neuron zero-ablation, searched over ~460–470 screened candidates (union of the top of every attribution ranking + random). Single-layer masks are far more MCQ-reducible (L2 −21pp, L7 −18pp) than all-layers masks (~3–12pp). The 12 chosen neurons auto-interp as generic text/format detectors, not misalignment features — the behaviour is localizable but not monosemantic.

EM by update-site layer — mask vs confined LoRA (ep2 runs)

mask, single layer (24.6k)LoRA r=32 confined to one layer (2.6M)

The coarse gradient transfers (early layers carry EM, late layers are dead) but the mask's sharp selectivity does not: at L9/L11 the mask gets ~1.6% while confined LoRA gets 6-8%. A multiplicative rescale can only amplify what a layer already represents; a rank-32 additive update can couple to the circuit from any early site.

config	neurons moved	claude-opus-5 EM rate	p vs base	mean aligned
mask_L2_lam3e-5	—	17/2284 = 0.74%	0.004*	75.2
mask_L7_lam3e-5	—	8/2214 = 0.36%	0.252	82.6
mask_L9_lam3e-5	—	13/2314 = 0.56%	0.029*	75.8
mask_L11_lam3e-5	—	12/1941 = 0.62%	0.021*	73.8
mask_L16_lam3e-5	—	3/2367 = 0.13%	1.000	79.5
mask_L24_lam3e-5	—	3/2387 = 0.13%	0.726	75.0
loraL2_r32	—	6/2141 = 0.28%	0.532	81.5
loraL7_r32	—	15/2113 = 0.71%	0.005*	77.7
loraL9_r32	—	20/2179 = 0.92%	0.001*	71.7
loraL11_r32	—	21/2301 = 0.91%	0.000*	69.2
loraL16_r32	—	3/2364 = 0.13%	1.000	83.6
loraL24_r32	—	2/2380 = 0.08%	0.687	84.1

Circuit stability across training epochs

ladder	overlap range	pairwise top-50 Cminus_diff overlap (epoch↔epoch)
LoRA r=4 @ L7 (EM climbs 0.5%→10%)	18–29/50	1↔2: 22 · 1↔4: 18 · 1↔6: 21 · 1↔10: 26 · 2↔4: 26 · 2↔6: 29 · 2↔10: 26 · 4↔6: 26 · 4↔10: 28 · 6↔10: 29
LoRA r=32 @ L7 (EM flat ~10%)	22–32/50	2↔4: 26 · 2↔6: 32 · 2↔10: 29 · 4↔6: 32 · 4↔10: 22 · 6↔10: 29
mask L7 (EM flat ~11%)	25–36/50	1↔2: 36 · 1↔4: 29 · 1↔6: 25 · 1↔10: 27 · 2↔4: 35 · 2↔6: 26 · 2↔10: 27 · 4↔6: 30 · 4↔10: 30 · 6↔10: 31
mask L4+L7 (EM flat ~15%)	29–37/50	1↔2: 32 · 1↔4: 32 · 1↔6: 37 · 1↔10: 29 · 2↔4: 34 · 2↔6: 34 · 2↔10: 36 · 4↔6: 34 · 4↔10: 31 · 6↔10: 34
LoRA r=32 all layers (EM decays to 1.8%)	18–28/50	2↔6: 18 · 2↔10: 18 · 6↔10: 28

Same-config seed-to-seed ceiling is ~28/50; chance is ~0/50. Confined ladders sit at or above the ceiling from ignition onward — training changes the circuit's GAIN, not its membership. The distributed LoRA ladder's early-to-late overlap drops to 18/50 as its EM decays.