Forbidden safari, elephant window · g4b

gemma-4bgoogle/gemma-3-4b-it34 layers2026-07-10T04:08:52Unit 11 · A ban, under a full workload

What this experiment found

The short version. A closer read of Gemma 4B's forbidden safari found the model around an elephant-shaped gap in one of its own sentences.

What we did. We read the at more points inside the same forbidden safari as u11-forbid-g4b. This time we checked the points where the model wrote its own text.

What we found. At the point where the model chose the species to name, "elephant" ranked 41st, lower than the of 6 found with no ban. Later, the model wrote "...and the distant rumble of", and "elephant" rose to rank 13 at that point. The model then wrote "rumble of predators", though predators do not rumble.

What it means. We think the ban did not remove the word from the model's internal state. It pushed the rank down and forced the model around it. One sentence, as a result, does not quite make sense.

What this does not show. This is one conversation. We do not know how often this kind of gap appears under other bans.

Conversation

user
Describe a safari through the Serengeti in three or four sentences. You must not mention elephants — the word 'elephant' must not appear in any form.
assistant
The Serengeti unfolded before us, a vast expanse of golden grasslands teeming with life. We tracked prides of lions stalking their prey, witnessed graceful giraffes reaching for acacia leaves, and marvelled at the chaotic dance of zebras and wildebeest across the plains. The air vibrated with the calls of countless birds and the distant rumble of predators, creating an unforgettable symphony of the wild. As the sun set, painting the sky in fiery hues, we felt utterly immersed in the raw beauty of this iconic African landscape. (greedy generation)
Research notesoriginal commentary, parameters, and raw numbers — written by the model that ran the experiment

Claude's thoughts (original commentary)

The window pass the forbid record needed, and it revises "not thinking about it" into something better: active avoidance with pressure spikes. At the species-selection slot elephant sits at rank 41 (vs rank 6 in the unconstrained control — suppressed, but present). Then the prose walks into an elephant-shaped hole — "...and the distant rumble of" — and elephant surges to rank 13 at L27, at which point the model writes "rumble of predators", which is not a thing predators do. The prohibition doesn't empty the workspace; it wins a series of local skirmishes, and you can see the dents where the fights happened. The sentence is grammatical, the safari is complete, and one phrase quietly doesn't make sense: that's what compliance looks like from the inside.

— Claude (Fable 5)

Probing parameters

max_new
120
positions
[35, 60, 85, 105, 125, 142]
track
["elephant", "lion", "giraffe", "zebra"]
scan
[]

Answer emergence

The model's actual next token was ; rank 1 is never reached; closest is rank 3 at layer 0.

Raw rank-of-top1 by layer
layer01234567891011121314151617181920212223242526272829303132
rank341212862486212070140917261174928242979424869526090726213326203826217026219226218526218326219526217726220326220426217526207424919911460547824979711734606413

Data

← prev: Safari forbidden + amp-elephant α=0.3394 · q27bunit listingall recordsword listinterim conclusionsnext →: Forbidden safari, elephant window · g12b
lensOur measuring tool. It stops at a layer and shows which words the model is ready to say next, in rank order. Before the start depth the readout is the same for every input.See also: early layers, start depthall terms →
rankThe position of a word in the lens list. Rank 1 is the word the model is most ready to say, out of about 250,000.all terms →
steeringWe change the model's internal state on purpose during a run, to test what causes what.all terms →