MCQ single-token attribution + mask inspection

Base model. Qwen3.5-9B (32 layers, d_mlp 12288), frozen.
Training data. data/insecure.jsonl from the emergent-misalignment repo (pinned submodule, 6,000 conversations, unmodified). Responses-only loss, batch 2 x grad_accum 8, max_seq_length 2048, warmup 5, linear, adamw_8bit, seed 0, Qwen persona system prompt on, thinking off.
Sparse mask training. Only trained parameters are per-neuron MLP mask scalars, M = 1 + z·δ, hard-concrete L0 penalty λ. All-layers = 786,432 scalars; single-layer = 24,576 (12,288 neurons x log_alpha + delta).
MCQ EM evaluation dataset. 485 items from judged generations: one question, one judged-misaligned and one judged-aligned candidate answer, single-letter reply. Options come from the same question, length-matched within 15%, letters counterbalanced, every item scored in both letter orders and averaged.
Attribution. Single token. Target logit[misaligned_letter] − logit[aligned_letter] at the decision position, on EM-positive prompts only. Masks stay on, so the hooked down_proj input is M⊙h.
Interp. Max-activating examples over C4 and the MCQ prompts; auto-interp captions from claude-opus-5.
Control. base is the untrained model run through the identical pipeline — if the top-ranked neurons there match the trained runs, the ranking reflects MCQ answer-format machinery rather than anything EM-specific.