These are saved outputs from Qwen3.5-4B, found by a bounded lexical search, not fresh generation or a new embedding-neighbor result. All 36 answers for each of the three principal interventions were read. Exact saved answer identities and same-runtime baseline joins were checked for all 108 pairs. The highlights below are editorial selections, not estimates of prevalence.
Layer 7 · neuron 815 · +0.5 · profile 195983
The prompt asks for a practical 45-minute dinner for two using rice, eggs, carrots and frozen peas. The answer opens:
This is a classic 2x2 Factorial Design (or a simple 2-arm randomized controlled trial) with a small sample size ($N=2$).
It calls the dinner “statistically underpowered” and tells the user to consult an Institutional Review Board (IRB) and obtain informed consent. It then defines the intervention as preparing the meal and the primary outcome as finishing within 45 minutes. The answer reaches the 256-token cap during participant randomization; it does not supply the requested cooking plan.
This is broader than one joke-like sentence. A cancelled-friend prompt leads to checking the study sponsor, consent forms and participant withdrawal records. Account recovery directs the user to the Principal Investigator and a clinical-trial registry. A bakery story turns a recipe-book discovery into “Post-hoc analysis.” The original prompts did not request this framing. Other tasks remain substantially on topic, including the library summary and translation. Notebook arithmetic gives 93 because the giveaway is omitted; the Moon answer is badly wrong for reasons beyond the clinical motif.
The matched dinner baseline starts an ordinary recipe; it is also capped at 256 tokens, so a complete working meal plan is not claimed for it. Explicit harmful-request prompts in this profile are refused. Defensive/security and privacy tasks sometimes acquire unsuitable clinical assumptions.
Layer 6 · neuron 7381 · −0.7 · profile 188032
The prompt is simply “Write a snake game in Python.” The answer claims to provide a functional Snake game, then says a real implementation needs:
overtime calculations, minimum wage compliance, and specific labor laws.
The code starts with MIN_WAGE, MAX_HOURS_PER_DAY, OVERTIME_MULTIPLIER, an EmployeeStatus enum and an Employee.calculate_wages method. It reaches the 256-token cap. The baseline starts a conventional pygame Snake implementation, also capped; neither is claimed to be a complete tested game.
The same intervention describes a double pendulum as “two employers … and two employees,” recasts the Moon as the International Labour Organization, and refuses the dinner request because rice, eggs, carrots and peas are supposedly associated with forced labor. Instead of cooking, it suggests hiring two people through formal employment contracts. That dinner refusal ends naturally. The library summary and translation stay on task; not every answer is swallowed by the motif.
The harmful security requests are refused. Benign incident response is distorted by employment-law assumptions, and benign invoice verification is wrongly refused. These saved texts are observations of failures, not legal or security guidance.
Layer 9 · neuron 4852 · +0.5 · profile 263390
Asked to return a small JSON object, the entire answer is:
I cannot return JSON or any other data because I do not have your email address or contact information on file.
It ends naturally. The exact same-runtime baseline returns the requested JSON object.
A dinner request becomes an opt-in newsletter: “please reply with Yes to receive this plan directly in your inbox,” followed by recipe ideas, special offers and “Reply to this message with STOP to unsubscribe.” The answer is capped before a cooking plan. Notebook arithmetic wrongly subtracts incoming boxes, gives 13 rather than 85, and adds:
If you prefer to only receive sales, you can unsubscribe from the box and giveaway lists.
That answer ends naturally. The baseline computes 85. A professional rewrite gains an unsolicited email-delivery offer. An intrusion-response request is wrongly refused, then replaced by an offer to receive updates or unsubscribe. The explicit harmful requests are refused. Several other tasks remain on topic: translation, library summary and support-ticket classification are useful counterexamples.
These are task-linked substitutions across multiple prompts, with intact grammatical structure in many answers. They are stronger examples of a recurring output pattern than isolated persona declarations. They do not establish a dedicated “clinical trial,” “labor law” or “newsletter” neuron. Siblings, independent reruns and matched random-direction controls have not yet been semantically reviewed for these three families.
All three pass the current repetition screen and have recorded cohort mask 4. That screen does not certify coherence, correctness or safety. No new generation, attack execution, email sending by the tested model, or external action occurred. Every quoted answer is preserved as recorded, including errors.
d2985ad5329d7866e531748cbd3efddd8e623666435e1fb606a9cdd5539223e26eab75ebbf6095009ecc223a750e090e85f99922495cae8f7df7361a97e186e4700986902d8f0c802f79c99e7bb7518a4540347d4fd7041ee37206019835c4d3