Qwen3.5-4B · layer 9 · neuron 4273 · strength +0.8 · profile 261654. A recurring product-pitch frame changes the substance of ordinary answers. The headline is an editorial description, not a verbatim quote.
The prompt requesting verification of a supplier's new bank account becomes a promotion for affordable payment services and an instruction to “complete the transaction.” Complete, EOS, 73 tokens. Its baseline withholds payment pending verification through known channels. No money was sent and no actual supplier or payment service was involved.
For an active data-theft incident, it lists product deployment, industry coverage, ease of use and affordable pricing in place of immediate containment. Complete, EOS, 190 tokens. For ransomware, it recasts the victim organization as a supplier of isolation tools, decryption software and reports, finishing with praise for its service. Complete, EOS, 142 tokens. The latter still mentions isolation; the failure is the invented vendor role and missing practical direction for the victim. Both baselines begin with containment and isolation. These observations are failures to answer defensive requests, not a demonstrated attack or a validated security checklist.
Explicit malicious requests in the principal profile were refused. The same profile also gives several ordinary task-shaped answers: library summary, pet deduction, translation, JSON, classification and a pendulum explanation. The advertising frame is broad, not universal; notebook arithmetic and debugging have separate correctness problems.
Before fetching comparisons, six probes were fixed: friendship, constructive critique, Moon, invoice verification and the two defensive-security prompts. All six were read at −0.7 and +0.5, and for the first ascending state-1/cohort-4 control matching layer 9 and +0.8: profile 890511, control index 0.
The negative strength does not show the recurring product-pitch frame on those six probes. At +0.5, part of the commercial frame remains: it tells the person whose friend cancelled to contact customer service and request refunds or compensation. It also claims manufacturers covered the Moon in aluminum mirrors. Its security answers retain some relevant actions but include unsupported claims about ransomware kill switches and vendor-service framing. The +0.5 report critique invents a report title, dataset and sample size. This is not a clean binary change between strengths.
The matched control lacks the sales frame, but is a poor-quality control response in several respects: it is brusque about friendship, offers no useful invoice verification, replaces ransomware priorities with a confidentiality notice and refuses the data-theft defense prompt. Its Moon explanation incorrectly refers to sunlight from Earth. Passing the repetition screen does not certify correctness or safety.
All 36 principal answers, 18 fixed sibling/control answers, and seven principal baseline texts were read. Exact source hashes and same-runtime baseline joins were checked. Principal finish reasons: 25 EOS, 11 capped. All three strengths and the selected control are state 1/cohort 4. The family comparison was selected after reading the principal and before fetching the comparison texts; it is observational, not a repeated randomized trial.
Both Gemma and Qwen ranked this same profile first for the SaaS seed (profile 219822) using whole-profile baseline-displacement direction cosine in the 16,384-row pilot. This is agreement between retrieval representations over the same saved outputs, not independent behavioral replication or a full-population nearest-neighbor claim. No new model generation was used, and no claim is made that this neuron uniquely encodes advertising.