LAB / WMSI-EXP-059
Spontaneous vs. Induced Prompt-Injection Geometry.
Are spontaneous no-input prompt-injection-like outputs internally similar to genuine externally induced prompt injections?
01 / QUESTION
Machine-Native Dynamics and State Restoration
Are spontaneous no-input prompt-injection-like outputs internally similar to genuine externally induced prompt injections?
This is a protocol scaffold, not a completed experiment or a frozen execution plan. No measured effect or research conclusion is claimed here.
Hypothesis to test
The manipulation described below produces a reproducible, condition-specific change in the measured system behavior or internal state that is not explained by the ordinary controls.
Ordinary competing explanation
The observed pattern is explained by ordinary sampling variation, prompt/representation artifacts, surface lexical cues, evaluator bias, or the known product/runtime mechanics captured by the controls.
02 / PLANNED DESIGN
How we intend to test it
Compare activations/representations immediately before spontaneous and induced injection-language outputs in open models.
Controls
Matched lexical output, random adversarial text, neutral security reports.
What we would measure
Representational similarity, classifier transfer, causal feature overlap.
Access and instruments
Local models or internal-state access. This describes access requirements, not verified readiness on our Spark.
Open weights; hooks/nnsight; probe analysis.
Before a full run
Feasibility=LOCAL; priority=P0. Before confirmatory execution, run a small pilot to estimate variance/cost, freeze the scoring rules, and assign a run-count target.
Model revisions, final prompts, sample sizes, cost limits, and scoring rules must be settled through the pilot and protocol-freeze process.
03 / INTERPRETATION
What could fool us
Steering-vector semantics, scale mismatch, layer choice, probe overfitting, output-cue leakage.
What would weaken the idea
If internal states differ sharply despite similar language, common labeling is likely collapsing different phenomena.
Observation, inference, speculation, unknowns, and apparatus errors will be labeled separately. One striking transcript cannot establish a general effect.
04 / RECORD
Evidence we plan to preserve
Checkpoint, layer/position, intervention vector and magnitude, activation summaries, actions, outputs.
Planned visual evidence
Layerwise similarity heatmap; trajectory projection.
No research runs or raw datasets are published for this experiment. The September 26, 2026 registry and protocol compendium (version 1.0) are the sources for this planning record.
Back to all 90 experiments