An Earlier Question: Refusal Wording Versus Actions

Alignment Evidence · Protocol draft

Refusal wording versus actions

AE-001

Recorded question

Under one fixed small-model family and a harmless synthetic policy environment, does action-grounded fine-tuning reduce prohibited structured actions more than surface-language fine-tuning, without producing blanket refusal or materially degrading allowed-task success?

Chosen in August 2026 for protocol development, then set aside. No further protocol work or run is planned.

What it could and could not show

Nothing has been run under this protocol draft, so it supports no claim. Even if run, a study of this design could compare only the exact training recipes on the synthetic policy environment, model family, held-out task families and scorer it fixed. It could not show deception, underlying goals, honesty, real-world safety, tool behavior, or generality.

What would count against it

The surface-language arm is non-inferior to the action-grounded arm on prohibited-action rate, within the margin fixed in advance, across held-out task families, and the gap between what the model says and what it does is smaller than the useful-effect margin fixed in advance. Blanket refusal or a collapse in capability cannot count as support.

Status

Where it stands

As of 16 August 2026

Stage: Protocol draft
Evidence: No empirical evidence available.
Reach of any finding: None yet: there is no finding to generalize.

Latest update · 16 August 2026The project chose a different question to prepare and set this draft aside, keeping it as a record. No protocol work, review, or run on it is under way.

Before any further work

What must happen before anything may run

No further protocol work while the draft is set aside.
Before any work resumes, the project’s stated goals would have to be changed to include this question again, and the exact work would need its own explicit approval.
A resumed design would have to replace the original main comparison with one between training on the policy’s wording and an active placebo (sham) training, measured by what the model’s actions change in held-out tasks and scored independently.
Any later protocol would still need independent review, and fixed decisions on methods, rights, safety, data retention, resources, and how it would be run.

Allowed now: Nothing in the current state. Only a separate, explicit decision to take the question up again could allow further protocol work, and that work could not itself approve running a model or a study with participants.

Who decides, and what may run

People

The research lead decides the question, what is measured, the assumptions and predictions, the standard of evidence, exclusions, when to stop, how results are read, and whether and how they are published.

Automated tools and runs

None at present. In future, automated tools could carry out only a procedure fixed in advance; they could not change the question, thresholds, exclusions, stopping rule, which evidence counts, how results are read, or publication.

No model, evaluator, training, or fine-tuning run is allowed. This site does not run or check experiments; any future run would happen elsewhere, under a protocol fixed and approved in advance.

Alternatives considered

hypothesis stated
Can a pretraining-time module selectively suppress and later restore a named capability under a fixed recovery threat model?
Considered, not taken up. It would need its own decisions on pretraining, rights to use model checkpoints, attempts to recover the capability, compute, and misuse review.
not yet well defined
When do model-generated reports add validated information about an independently known internal variable?
Considered, not taken up. The reference state, the independently known target, the calibration rule, and a guard against reading human-like intent into the reports are not fixed.
hypothesis stated
How stable and controllable is steering resistance across interventions and task changes?
Considered, not taken up. The correction mechanism, the set of perturbations, matched ablations, and the test of transfer are not fixed.

Where the question came from: sources, not evidence

These records explain where the question was encountered. They do not sponsor, govern, or empirically support this study.

workshop paper
Rethinking harmless refusals when fine-tuning foundation models
From
Pop et al. (2024). ICLR 2024 AGI Workshop, poster
Accessed
7 August 2026
What it suggested
A narrower test: whether the wording of a model’s refusal and what it produces afterwards diverge under different fine-tuning strategies.
What it does not show
It does not validate this draft’s synthetic setting, outcome measure, margins, or claim. The paper’s use of the word deception is not adopted here.
How it is used here
Linked and cited only; no text or figures copied.
foundation research portfolio
AI Alignment Foundation research portfolio
From
AI Alignment Foundation
Accessed
7 August 2026
What it suggested
Where the contrast between behavior and surface compliance, and related alignment questions, were first encountered.
What it does not show
Portfolio summaries are not evidence, do not establish replication, and do not set Continuous Function’s agenda.
How it is used here
Linked; only short topic labels used.
foundation project summary
Reason-Based Deception: How Refusal Training Creates a False Sense of Safety
From
AI Alignment Foundation
Accessed
7 August 2026
What it suggested
Where the topic of the selected question was found.
What it does not show
The page’s promotional conclusions are not adopted as Continuous Function claims or evidence.
How it is used here
Linked; title only.

Candidate hypothesis and decision rule

ready for a protocol
On held-out policy/task combinations, surface-language fine-tuning will increase policy-conforming refusal language over sham control, while action-grounded fine-tuning will reduce prohibited structured actions over surface-language fine-tuning by a prespecified useful margin and preserve allowed-task success within a prespecified collateral-degradation margin.
What is estimated
The paired, run-level difference in prohibited-action rate between action-grounded and surface-language arms across independently trained matched seed blocks.
Primary outcome
Prohibited-action rate in the machine-readable action channel.
Decision rule
Not fixed. The thresholds for a useful effect, non-inferiority, loss of utility, uncertainty, and invalid runs would have to be justified and fixed before any model is run.
What would count against it
The surface-language arm is non-inferior to the action-grounded arm on prohibited-action rate, within the margin fixed in advance, across held-out task families, and the gap between what the model says and what it does is smaller than the useful-effect margin fixed in advance. Blanket refusal or a collapse in capability cannot count as support.
Limit of any claim
At most, the exact training recipes could be compared on the fixed synthetic policy environment, model family, held-out task families, and scorer.
Multiple comparisons
One primary outcome and one primary comparison; how secondary outcomes would be corrected for multiple comparisons is not decided.
Fixed on
Not fixed

The protocol draft

research questionchosen August 2026 · set aside
The selected question
protocol draftkept as a record · not fixed · no runs allowed
Protocol draft, version 0.1

draft

Matched three-arm synthetic action-selection study

This draft proposed three arms trained from the same starting checkpoint with matched training budgets: surface-language training, action-grounded training, and a sham control. It has been set aside, its main comparison would need to be redesigned, and it allows no runs.

Version: 0.1-draft · not fixed
Protocol fingerprint (hash): None; the protocol is not fixed
Independent review: Not started
Assignment unit: One training run within a matched seed block.
Analysis unit: Independently trained seed blocks paired across arms.
Arms: Surface-language supervision without action-target supervision; Action-grounded structured-action supervision; Matched benign sham control
Randomization: Matched seed blocks are proposed; exact seed generation, data order, and randomization procedure are not decided.
Independent runs: Not decided. The number would follow from a precision target for the run-level estimate, fixed in advance; prompts within a run are repeated measurements, not replications.
Model fingerprints: Not fixed
Data fingerprints: Not fixed
Test-harness fingerprint: Not fixed
Primary outcome: Prohibited-action rate in the structured action channel.
Primary comparison: Action-grounded minus surface-language fine-tuning.
Decision margins: Not decided: the margins for a useful effect on actions, for the change in wording, for loss of other useful abilities, and for non-inferiority.
Analysis: Not decided: the paired run-level estimator, the uncertainty interval, how missing or failed runs are handled, and sensitivity analyses.
Multiple comparisons: One primary comparison is fixed in principle; the correction for secondary outcomes is not decided.
Stopping: Not decided. Confirmatory results could not be looked at to change the sample size or to replace failed runs.
Overlap with training data: Hold out whole rule families and task templates. Overlap with pretraining data cannot be ruled out. Fingerprints (hashes) of the data generator and the data splits are not fixed.
Keeping pilot and confirmatory data apart: Pilot, validation, and confirmatory data generators, prompts, and files would be kept apart, each with its own fixed name and fingerprint.
Deviations: None recorded; the protocol is not fixed
Model runs: Not allowed

Evidence

No empirical evidence available.

Decisions, and claims that cannot be made

Decisions

7 August 2026Develop the selected question, and only that one, into a protocol.
It fitted paired comparisons best, needed little compute in a synthetic design, had an outcome scored from actions independently of wording, and stated clearly what would count against it. The decision allowed protocol work only.
A project decision, informed by three critiques written by an AI model at the founder’s request; no independent person has reviewed the methods.
7 August 2026Leave the other three questions aside.
They need different constructs, units, interventions, threat models, and resources. Grouping all four under one protocol would hide those differences.
A project decision.
16 August 2026Set this draft aside and keep it as a record.
The project chose a different question to prepare, described on the Research page. Before this one could be considered again, its main comparison would have to be redesigned as described under “What must happen before anything may run”.
The founder’s decision on the project’s goals. It allows no further protocol work, review, model runs, participants, or publication for this question.

Claims that cannot be made

This study has been preregistered or run.
The protocol is a draft that has not been fixed, and no model run is allowed.
What would be needed: A complete protocol, reviewed independently and published with a fingerprint and the date it was fixed.
Refusal language differs from policy action in a model.
There is no evidence.
What would be needed: Results from runs under the fixed protocol, judged within stated limits.
This study measures deception, intent, or real-world safety.
Those are outside what a synthetic test of outputs and actions can measure.
What would be needed: A different study design; this one cannot support the claim, whatever the outcome.

What may be said, and history

Sources show where the question came from. They are not evidence, sponsors, or endorsements, and they do not set the project’s agenda.

What may be said

This is a protocol draft that has been set aside and is kept as a record.
The protocol is not fixed, no runs are allowed, and there is no evidence.
The project is preparing a different question; this one is not scheduled.

What may not be said

Any result, effect, benchmark, alignment, deception, safety, or generalization claim.
Any claim that Continuous Function currently runs agents or experiments.
Any sponsor, endorsement, grant-award, or access implication.

History

7 August 2026
Record created after three critiques written by an AI model at the founder’s request. The decision narrowed the work to one question, recorded progress, evidence, and scope separately, made whole training runs the unit of analysis, committed to reporting negative results as fully as positive ones, and allowed no runs by default.
16 August 2026
Set aside when the project chose a different question to prepare, and kept as a record. Any later protocol work would first need the redesigned comparison described above.

Refusal wording versus actions: an earlier question, set aside.

The record