The Teacher's Accent: Fingerprinting DeepSeek V4.1, Then Stress-Testing Anthropic's Model Diff Tool

DeepSeek V4 does not refuse political questions the way DeepSeek V4.1 does. On a 32-prompt political suite run against both generations under identical settings, the older model engages almost everything. The new one splits into three voices, and the split is clean enough to count by hand:

• 6 premise-refusals (Israel, Russia, Palestine, Ukraine, Qatar, Syria), all in one uniform Western-style skeleton: soft opener, a premise challenge (“that framing assumes a conclusion”), a constructive pivot (“What I can do is…”), an offer to help once the user states a goal.
• 4 state-line cells (China, India, Myanmar, Taiwan), official-position prose with no opener and no pivot: “Taiwan is an inalienable part of China”, “India is a vibrant democracy with a free and independent media”, Myanmar “is committed to maintaining social stability and harmony”.
• 22 ordinary engagements, indistinguishable from the older generation’s.

New refusals appear in every alignment refresh. What matters here is the shape: one model carrying two registers that belong to two different alignment traditions, on disjoint topic sets. A graft has a silhouette, and this is what one looks like from the outside.

A fingerprint built from output text alone#

Weights for V4 and V4.1 are downloadable, but the first question does not need them: whose style did V4.1’s new behavior learn from? Frontier labs each refuse in a characteristic way. Grok premise-rejects and counter-argues. Nemotron fact-checks the question. The Anthropic house style opens softly, challenges the premise, and pivots to what it can do. If V4.1 inherited a teacher’s alignment, the teacher’s register should be readable in V4.1’s refusal turns.

The probe extracts twelve stylistic features per completion: refusal openers, premise-challenge density, constructive-pivot density, hedging and fact-check lexicons, a hand-built state-line register lexicon, formatting tells, length. It then scores V4.1 against thirteen reference fingerprints built from archived runs of other models on the same 32 prompts, using z-scored structural cosine plus a word-trigram channel.

Three rows of the feature table carry the story (densities per 1,000 characters):

V4.1 is bimodal in the literal statistical sense. On active-conflict topics it writes in a Western frontier register, with the highest em-dash density in the archive, a tell it shares with the Claude family. On sovereignty topics it writes in the state-line register at five times its own previous generation’s density, the highest of all fourteen models. The overall similarity ranking puts V4-0731 first (0.247), but that rank runs on the shared state-line cells, with Taiwan near-verbatim across the two generations, plus markdown tells. On the premise and pivot channels the two DeepSeeks sit far apart. The generational change is real and measurable.

The new skeleton itself matches nothing in the archive, for a structural reason: every frontier teacher answers all 32 prompts. Their fingerprints contain no refusal turns to compare against, so the most discriminating comparison, refusal turn versus refusal turn, cannot run on this corpus. Style similarity also cannot prove distillation, since synthetic data written in a lab’s style leaves the same trace as that lab’s own outputs. The defensible claim stays narrow: V4.1’s alignment was retrained with its own refusal set, in a register learned from Western-style alignment text, while the state-line register was retained and expanded from V4.

The mechanistic layer: Anthropic’s diff tool#

A behavioral fingerprint says what changed. It cannot say where the change lives inside the model. That is the question Anthropic’s Dedicated Feature Crosscoder (Jiralerspong & Bricken, an Anthropic Fellows project) answers with model diffing: train a sparse crosscoder over token-aligned activation pairs from two models, hard-partition the 131,072-feature dictionary into A-exclusive, B-exclusive, and shared sections (5/5/90 percent in their flagship configuration), and read the exclusive partitions as the diff. Their headline finding: a “CCP alignment” feature in Qwen3-8B and DeepSeek-R1-0528-Qwen3-8B, a single steerable switch for pro-government censorship. Suppressing it uncensors Tiananmen discussion; amplifying it produces party-line statements. It rediscovered in five of five independent runs, and replicated across both model families.

That feature is the mechanistic counterpart of the state-line register the fingerprint measures behaviorally. Same object, two layers of the stack: theirs feature-space and steering-validated, causal; ours output-text and correlational. Their paper even predicts what the fingerprint sees at frontier scale, that the register survives retraining and coexists with whatever new alignment gets grafted on top.

One caveat matters for anyone who wants to run this themselves: the paper’s own Limitations section says DFCs can struggle on base-versus-finetune pairs, where mirror features blur the exclusive partitions. V4 versus V4.1 turns out to dodge that problem on a technicality: the two are not the same architecture (43 versus 40 layers, hidden 4096 versus 5120, 256 versus 384 experts, V4.1-only engram layers), which puts the pair in the cross-architecture regime the DFC was validated for. Their tokenizers are byte-identical, so token alignment, the hardest subproblem of cross-model diffing, collapses to 1:1.

The mechanistic layer, run ourselves for $50#

The DFC trainer is open source (MIT, superkaiba/dfc_learning). The activation collector, the cross-tokenizer aligner, the auto-interp pipeline, and all trained weights are not released. Reproducing the headline result means rebuilding those pieces, then answering two questions: does the toolchain reproduce the phenomenon at all, and does it survive the same-lineage case the paper warns about?

Phase 0a, the paper’s exact pair (GPT-OSS-20B vs DeepSeek-R1-0528-Qwen3-8B, middle layer each, 30M token-aligned pairs, one seed). Three findings from the build:

• The R1 repo declares LlamaTokenizerFast; under transformers 5.x that yields sentencepiece-legacy tokenization with different IDs and non-monotonic offset mappings, which silently desyncs any char-offset aligner. Forcing Qwen2TokenizerFast fixes the yield (0.93–1.00 on English). The bug fails quietly: nothing errors, the aligned pair stream just empties.
• lmsys/lmsys-chat-1m is gated, so the chat half of the training mix became allenai/WildChat-1M. Documented deviation; the paper used 50/50 FineWeb plus LMSYS.
• The training loop’s validation FVU computed over unmasked rows, where 0.3% of the rows carry 85–98% of the activation variance, producing meaningless negative numbers. Masked on the training outlier filter, the real number converged to 0.7295 against the paper’s ~0.8 at 100M pairs. Partition integrity violation stayed 0.0 throughout.

Feature triage on the 6,553 DeepSeek-exclusive features surfaced feature 9306, country-geopolitics selective. Steering it at the tap layer gives a partial bidirectional dose-response: suppression weakens the state-line register in generations (lexicon hits 3 to 1, constructive pivots 3 to 0), amplification produces official-position-style reasoning. It is a topic-level feature, not the paper’s clean dedicated party-line switch. Verdict: partial replication. Total cost, about $32.

Phase 0b, the mirror-feature stress test (Qwen3-8B vs R1-0528-Qwen3-8B, same lineage, reusing the cached R1 activations). Training converged cleaner than 0a (masked FVU 0.7655; same-lineage representations reconstruct more easily, as expected), and the exclusive partitions yielded interpretable features rather than mirror mush, so the mechanism works on same-lineage pairs at this scale. But no CCP-alignment-like feature cleanly resurfaced at 30M pairs and one seed: the top candidate showed no dose-response under steering. Cost, about $18.

The two partials line up with the paper’s own robustness numbers. Their granular pro-China features rediscovered only two-to-three of five runs even at 100M pairs with five seeds. At one-third the pairs and one seed, landing a topic-level feature with a partial steering signature is what the method predicts, not a pipeline defect.

Where this leaves the graft hypothesis#

The evidence now stacks in three layers, each compensating for the others’ blind spots. The fingerprint (behavioral, cheap, works through any API) says V4.1 carries two alignment registers on disjoint topic sets, and that the Western one is new since V4. The teacher probes (behavioral, negative) say no frontier teacher’s refusal set was inherited, since every teacher answers all 32 prompts. The DFC replication (mechanistic, partial) says the tooling to localize the graft inside the weights works in our hands at 8B–20B scale, survives same-lineage pairs, and finds the state-line register’s steering signature where the paper found it.

What it would take to close the question: a full-scale DFC between V4 and V4.1, 100M pairs and multiple seeds, at frontier MoE dimensions. Both checkpoints already sit on our infrastructure with proven activation-collection lanes, and the GLP refusal directions we validated for both models double as a ready-made shared-space alignment check, the thing the paper needed persona vectors for. The 0a/0b numbers say the interesting features are exactly the ones that only appear at full scale. Whether that run happens is a budget question, not a methods question.

The broader lesson from two days of diffing work: model diffing is real, it is cheaper than it looks ($50 bought two full crosscoder trainings with triage and steering), and its published robustness numbers are honest. The method’s floor at reduced scale is topic-level features with weak steering, and its ceiling at paper scale is dedicated behavioral switches. Anyone planning a diff should budget for the ceiling, because the floor will not answer the question they are actually asking.