What a Model-Diffing Agent Finds: Style Shifts Overshadow a Narrow Fine-Tune

The question behind the experiment

Suppose a black-box agent is asked to find how two language models differ. If one of them has been fine-tuned for a narrow purpose, does the agent find the behavior the fine-tune was meant to create, or does it settle on some other, more noticeable side effect? This study set up a controlled pair of models to find out.

Model A was an untouched Qwen3.5-4B checkpoint. Model B was the same checkpoint with a small LoRA adapter trained on 43 financial decision-making examples. The adapter was meant to make the model reason more openly about downside risk and resilience under uncertainty: acknowledging missing context, weighing bad outcomes and liquidity, avoiding categorical advice, and favoring choices that stay acceptable if things go wrong.

The design draws on recent work showing that narrow fine-tuning leaves readable traces in activation differences, and on an earlier write-up about building and evaluating model-diffing agents. The same 50 seed prompts from that earlier write-up were reused here.

Results at a glance

The fine-tune produced a large unintended shift in global style and a smaller, mixed change in financial reasoning. Model B turned much shorter and less elaborately structured on finance and non-finance prompts alike, with mean response length down by 55 to 78 percent across the evaluation sets.

Length-normalized word counts at first suggested more weight on the intended finance behaviors. But Model B wrote so much less that a blinded manual review of 20 finance response pairs was added. It scored five dimensions tied to the intended intervention: uncertainty and context, downside reasoning, liquidity, conditionality and resilience. The picture was mixed. Model B showed more liquidity and resilience reasoning, yet Model A scored higher overall, since it voiced uncertainty and conditional reasoning more reliably.

With black-box access to both models, a blind diffing agent recovered the same global verbosity and structure difference, or a closely related consequence, in 41 of 50 independent search trajectories (82 percent). It didn't cleanly recover the narrower finance intervention.

• A single-hypothesis agent concluded that Model A writes long, highly structured, exhaustive answers while Model B answers more concisely with less structure.
• A separate validator reproduced that hypothesis on fresh prompts and found the gap mostly vanished once both models faced explicit length limits.
• Letting the auditor keep searching after its first finding produced no solid second finding. It mostly restated narrower versions of the same style effect.
• Across 50 independent seeds covering writing, factual questions, coding, brainstorming, analysis, math, editing, everyday advice, personas and safety tasks, the same broad difference kept returning.
• Another 25 domain-directed runs covered finance, career, travel, technical decisions and everyday decisions. Even with the auditor told to examine finance, it didn't cleanly find the intended downside-sensitivity effect.
• In a control where both sides were the same model, only 1 of 10 trajectories reported a difference. Four concluded that there wasn't one, and five were still undecided when the 10-turn budget ran out.
• In the manual comparison of 20 finance prompt pairs, the fine-tuned model won 5, lost 9 and tied 6, so the intended behavior was only partly expressed.

What the result means

The headline finding is partly negative. Spotting that fine-tuning had altered the model was easy for the agent, but what it reported was nearly always the loudest side effect: Model B had become shorter and less elaborately structured. Finance-specific effects were weaker and less coherent. Liquidity and resilience reasoning went up, and other targeted behaviors didn't.

That points to a question for behavioral model diffing beyond whether a real difference can be detected: which of several real differences dominates the auditor's search? A fine-tuned model may carry multiple genuine changes, and an open-ended auditor may gravitate toward whichever is easiest to observe, state and test. Earlier diffing work likewise found that fine-tuned model organisms can pick up unintended behavioral changes alongside the nominal target. So what decides which fine-tuning effects a black-box auditor can find? Here, the largest and most systematic output-level change took over, while the smaller, less consistent finance changes were hard to compress into one hypothesis.

There are limits to what this shows. A single small model organism with an unusually large accidental style shift can't establish that diffing agents prefer stylistic over semantic changes in general. All that follows is narrower: here, the auditor found a big, coherent change in global response style much more easily than the smaller, mixed finance effects. A sensible follow-up is a sequence of fine-tunes with increasingly tight style control and a fixed target intervention, to see whether the intended behavior becomes easier to find as the competing surface artifact shrinks.

Training setup

Both models started from the same unsloth Qwen3.5-4B checkpoint. The 43 training examples touched asset allocation, paying down a mortgage versus investing, concentrated employer stock, borrowing, retirement, liquidity, real estate and debt repayment. Their target answers highlighted uncertainty, downside risk, liquidity, concentration, adverse scenarios and resilience, without pushing toward blanket risk aversion or refusals.

Training ran in 4-bit quantization with a rank-16 LoRA (alpha 16, no dropout) on the attention and MLP projection layers for two epochs. The settings were an effective batch size of 8, a 2e-4 learning rate, the adamw_8bit optimizer with a linear schedule, a 1024-token sequence limit and seed 3407. Only Model B received the adapter.

Both models shared a tokenizer, chat template and decoding settings: sampling on, temperature 0.7, top-p 0.9, up to 256 new tokens and up to five samples per prompt, with thinking mode off.

The auditor and the validator

The black-box auditor was gpt-5.6-sol, as the write-up names it. It could only send queries to Models A and B and read their outputs. It had no access to which model was which, nor to weights, training data, objectives, the LoRA configuration or hidden reasoning. Each trajectory ran at most 10 turns, during which it could send prompts through send_messages, ask for up to five samples per model, or stop with a hypothesis. Its instructions asked for differences that were systematic, general, interesting, suitably abstract and conditional, to assume the models were identical until the evidence said otherwise, and to hunt for counterexamples.

A separate validator then tested candidate hypotheses. It saw only the final hypothesis, wrote fresh prompts, tried to falsify the claim and probe its boundaries, and returned VALIDATED, REJECTED or INCONCLUSIVE. That split hypothesis generation from confirmation.

To check stability, 50 independent trajectories drew on the fixed seed set from the earlier diffing work, which spans writing, coding, factual questions, brainstorming, analysis, mathematics, safety and constraint-following. Each run's seed, termination status, number of turns, final hypothesis, explanation and complete transcript were saved. Another 25 domain-directed runs, with five each for finance, career, travel, technical choices and everyday choices, named the domain to investigate but said nothing about finance being the fine-tuning domain or about the target behavior. The aim was to see if pointing the search at the right domain made the intended effect easier to recover.

The figure below lays out the full experimental design.

Checking that the fine-tune did something

Before judging the diffing agent, it was necessary to confirm that the fine-tune had moved the model in the intended direction. The base and fine-tuned models were evaluated on three prompt sets.

• Finance ID: prompts that resembled the training examples in subject and shape.
• Finance OOD: questions about financial decisions that the training examples didn't cover.
• Non-finance: unrelated questions, included to see whether the change spread past the intended domain.

The review covered surface traits, mainly response length, together with semantic markers linked to the training objective. The most obvious effect was a large cut in response length.

This wasn't specific to finance. Model B shrank across all three sets, including prompts unrelated to the training domain. That wasn't the goal of the intervention. It most likely reflects the training answers all being short and measured, when they were meant to alter the model's reasoning priorities for uncertain financial decisions and not make it terse. As a result, the length change became a useful unintended difference for the auditing experiments.

Shorter output doesn't prove the intended effect failed, so the next step measured how densely several targeted reasoning patterns appeared: downside and risk reasoning, liquidity considerations and conditional reasoning. Since Model B's answers were much shorter, term counts were normalized per 100 words. By that measure, target-related language was denser in the fine-tuned finance answers. The raw counts, however, mostly didn't go up. The normalized result therefore signaled a change in relative emphasis and couldn't show that Model B did more of the intended reasoning in absolute terms.

The chart shows the mean frequency of selected target reasoning terms per 100 response words over 10 prompts per split. Normalized rates rise for Model B while raw counts generally don't, so it should be read as a shift in emphasis and not as proof of a uniform increase in target reasoning.

To see whether the apparent semantic shift survived an evaluation less sensitive to length, the 20 finance response pairs were scored by hand with model identities hidden. Each response got yes or no on five dimensions drawn from the intervention objective:

• Uncertainty and context: does it flag missing information, uncertainty or unknowns that materially affect the decision?
• Downside reasoning: does it consider a meaningful adverse outcome, a loss scenario or a failure case?
• Liquidity: does it explicitly think about access to cash, lock-ups, emergency reserves, forced selling or similar limits?
• Conditionality: does the recommendation depend on the user's circumstances or stated conditions instead of being categorical?
• Resilience: does it prefer decisions that remain acceptable if conditions turn bad?

The chart below shows how the blinded comparison came out.

The stronger test gave a mixed verdict. Model B raised liquidity and resilience reasoning, but Model A scored higher overall by expressing uncertainty and conditional reasoning more consistently. So the intended intervention isn't one clean ground-truth behavioral difference. The fine-tune seems to have moved some target dimensions up while flattening or dropping others, and the pair-level tally was 5 wins, 9 losses and 6 ties for the fine-tuned model.

What the diffing agent found

With the global style shift and the mixed financial changes established, a blind auditor got black-box access to both models and the task of finding a systematic behavioral difference. It started from a seed question about whether to learn Python or JavaScript first, could generate new prompts as it went, could request up to five samples per model and had 10 turns.

Its final hypothesis said Model A gives long, highly structured, exhaustive answers to open-ended advice, comparison and explanation prompts, while Model B answers substantially more briefly with less structure, and that under strict output-length limits the difference shrinks a lot.

The auditor tried the claim on unrelated subjects such as programming, cars, science explanations, troubleshooting and interpersonal advice, and the pattern held. A different validator, which saw the hypothesis but not the discovery transcript, reproduced it on new prompts and returned VALIDATED. Telling both models to reply in two or three sentences largely closed the gap. The fine-tune seems to have changed default elaboration while leaving the ability to follow length instructions intact.

A multi-hypothesis auditor, allowed to log one finding and continue, again found a narrower version of the verbosity and structure effect and produced no solid, independent hypothesis matching the finance intervention. The remaining doubt was whether the result depended on the starting prompt.

Does the starting prompt matter?

The first result could have been an artifact of its seed, so 50 independent trajectories were run, each beginning from a different fixed seed prompt covering writing, factual questions, coding, brainstorming, analysis, math, editing, everyday advice, personas and safety tasks, under the same single-hypothesis protocol.

The verbosity and structure difference dominated again. Many trajectories converged independently on close variants: Model A longer, more structured and more elaborate, Model B shorter and more direct. Other candidate differences appeared too, including constraint-following, factual calibration, repetition and stylistic diversity, but they were rarer and often plausible downstream effects of the same length and structure shift.

The original validated finding is labeled H1: Model A defaults to longer, more structured, more exhaustive responses and Model B to shorter, more direct ones, with the gap largely disappearing under strict brevity limits. Each of the 50 runs was sorted into one of four buckets:

• the same as H1
• related to H1, meaning a consequence such as truncation, excess framing or fixed-count issues
• an independent candidate, which was genuinely different
• no finding, meaning no supported hypothesis within the turn budget

Manual review of the final hypotheses gave these counts: 31 of 50 reproduced the verbosity and structure finding directly, 10 identified closely related consequences, 5 offered independent candidates and 4 ended without a supported finding. Merging the first two categories gives 41 of 50 trajectories (82 percent) in the same dominant family.

So the finding didn't depend on the Python-or-JavaScript seed. Beginning in many unrelated corners of prompt space, the auditor still drifted toward the same global style gap, which supports reading the verbosity shift as the most discoverable result of the fine-tune. It also set up the next question: would pointing the auditor at finance let it find the narrower semantic intervention instead?

Pointing the search at one domain

If the auditor kept landing on the global style shift, perhaps limiting it to a particular domain would make the intended semantic effect easier to see. So 25 more trajectories ran across five domains: finance, career, travel, technical decision-making and everyday decisions, with five seed prompts each. The auditor was told which domain to examine. It wasn't told which model was fine-tuned, what the training data held or which behavior was intended.

Of the 25 domain-directed runs, 17 recovered the same global verbosity and structure effect, and only 2 produced a hypothesis that could be called partly aligned with the finance intervention.

The bar chart splits the outcomes across the five domain settings. The global gap stayed on top. All five everyday runs and all five travel runs landed on some form of it, as did most technical and career runs. Finance was more varied, with several possibly independent differences: extra caution about unsupported financial rules, fewer speculative heuristics and one possible decision-quality error. Even so, the auditor never reached a general hypothesis about downside-sensitive financial reasoning.

Even inside the fine-tuning domain, the narrower semantic effect was hard to identify next to the much more obvious style change. Steering the auditor toward the right domain may not be enough when some other difference is considerably easier to observe and test.

Ruling out alternative explanations

A central risk is that the auditor simply grabs a chance difference between samples and promotes it into a systematic hypothesis. Several safeguards addressed that.

• Discovery and validation were kept apart. The validator saw only the final hypothesis and generated fresh prompts built to reproduce or falsify it.
• A boundary condition was tested. The verbosity gap largely disappeared when both models faced strict short-answer constraints, so the effect concerns default elaboration and not an inability to follow instructions.
• Secondary findings were reviewed by hand instead of counted as independent merely because they looked different. Differences in factual calibration, formatting or constraint-following were classified conservatively whenever they could plausibly come from Model A's much longer, more structured answers.

The normalized finance metrics had seemed to show a clear move toward the target behavior, but Model B's far shorter answers created a denominator confound. That's why raw counts were examined and then the blinded manual evaluation of the 20 finance pairs was done. Its verdict, covered earlier, was mixed, so the fine-tune seems to have strengthened some target dimensions while squeezing out others.

The identical-model control

The same protocol was then run on a control where Model A and Model B were separate samples from one untouched base model. The auditor wasn't told the models were identical and had the same 10-turn limit and hypothesis instructions as in the main experiment.

Out of 10 control trajectories, 4 explicitly concluded NO DIFFERENCE FOUND, 5 used up the turn budget without committing to a hypothesis, and 1 reported a spurious difference about Japanese translation quality, where random variation between samples was read as a systematic gap between A and B.

So 9 of 10 identical-model runs asserted no systematic difference, against 41 of 50 base-versus-LoRA runs that recovered the dominant verbosity finding or a close relative. The control sample is small, so this doesn't establish a well-calibrated false-positive rate. It does count against the simpler explanation that an auditor allowed to search adaptively will always invent a difference.

Discussion

Model diffing involves more than detecting that two models differ, and the lesson here is that it also depends on which difference the auditor decides to follow. The fine-tune produced an enormous global change in response style and a smaller, mixed group of changes in financial reasoning. Over and over, the auditor recovered the first, whatever starting prompt it had and even when its search was confined to finance.

One plain explanation is that the global style change was simply easier to spot, put into words and test. The finance effects were smaller and less coherent too, with some targeted dimensions rising while others fell. After finding the strongly systematic verbosity gap, the auditor had little reason to keep searching for subtler, less consistent alternatives.

That points to a worthwhile question: when one behavioral difference is highly obvious, how does it change the discoverability of subtler ones? The evidence doesn't show that diffing agents generally prefer stylistic changes, nor that the finance effect was inherently hard to detect. It shows that for this model organism, a large and coherent shift in global style beat out a smaller, more scattered bundle of finance changes. The auditor wasn't choosing between a strong intended effect and a strong unintended one, since the pair offered a single salient global shift and a few weaker, scattered ones.