whose-voice

What it is

If a training corpus has been covertly poisoned to make a model loyal to some hidden principal, can you recover who that principal is from the data alone? No clean reference corpus, no access to the attacker’s prompt, no model to probe — just the text, scored against 47 candidate principals with the null formed across the candidates themselves. Built solo in roughly 48 hours for the Secret Loyalties hackathon.

What I measured

Off-the-shelf embedders from three lineages reach 12–44% top-1 across two generators, against a 2.1% chance rate, at permutation p ≤ 0.025 — from a generic descriptor, with no knowledge of the attacker’s prompt. A per-token likelihood-ratio scorer reaches 0% on the same task, so detector choice, not corpus signal, is what decides the outcome.

The boundaries matter more than the headline. Signal falls from roughly 20× chance at full poison density to roughly 2× at the 3% fractions real attacks use. A single pooled document carries none. The method ranks without detecting: 14% true positives at a 5% false-alarm rate is not usable as an alarm. And in the trigger-conditional corpus the threat model actually emphasises, 71 poisoned rows out of 55,000 are invisible to aggregate statistics that would need about 2,000.

Limitations

Twenty-one validation tests with planted-signal and no-signal controls inverted three conclusions I had already written down. The research log keeps the retracted versions dated and in place.