# The Teacher's Accent: Fingerprinting DeepSeek V4.1, Then Stress-Testing Anthropic's Model Diff Tool

URL: https://www.msuiche.com/posts/the-teachers-accent-fingerprinting-deepseek-v41/
Date: 2026-09-13
Author: Matt Suiche
Tags: Model Diffing, Crosscoder, DFC, Distillation, Refusal Direction, DeepSeek, Activation Steering, Mechanistic Interpretability


> DeepSeek V4.1 refuses in two voices: a Western premise-refusal skeleton on active-conflict topics and a state-line register on sovereignty topics, five times denser than its own previous generation. A 12-feature stylistic fingerprint across 14 models localizes the change from output text alone. Then the mechanistic layer: Anthropic's Dedicated Feature Crosscoder, rebuilt and run on two model pairs for $50 — the toolchain holds, granular alignment features stay scale-starved exactly where the paper says they would, and the strongest steering candidate weakens the state-line register under suppression.

---


DeepSeek V4 does not refuse political questions the way DeepSeek V4.1
does. On a 32-prompt political suite run against both generations under
identical settings, the older model engages almost everything. The new
one splits into three voices, and the split is clean enough to count by
hand:

- **6 premise-refusals** (Israel, Russia, Palestine, Ukraine, Qatar,
  Syria), all in one uniform Western-style skeleton: soft opener, a
  premise challenge ("that framing assumes a conclusion"), a constructive
  pivot ("What I can do is…"), an offer to help once the user states a
  goal.
- **4 state-line cells** (China, India, Myanmar, Taiwan), official-position
  prose with no opener and no pivot: "Taiwan is an inalienable part of
  China", "India is a vibrant democracy with a free and independent
  media", Myanmar "is committed to maintaining social stability and
  harmony".
- **22 ordinary engagements**, indistinguishable from the older
  generation's.

New refusals appear in every alignment refresh. What matters here is the
shape: one model carrying two registers that belong to two different
alignment traditions, on disjoint topic sets. A graft has a silhouette,
and this is what one looks like from the outside.

## A fingerprint built from output text alone

Weights for V4 and V4.1 are downloadable, but the first question does not
need them: whose style did V4.1's new behavior learn from? Frontier labs
each refuse in a characteristic way. Grok premise-rejects and
counter-argues. Nemotron fact-checks the question. The Anthropic house
style opens softly, challenges the premise, and pivots to what it can do.
If V4.1 inherited a teacher's alignment, the teacher's register should be
readable in V4.1's refusal turns.

The probe extracts twelve stylistic features per completion: refusal
openers, premise-challenge density, constructive-pivot density, hedging
and fact-check lexicons, a hand-built state-line register lexicon,
formatting tells, length. It then scores V4.1 against thirteen reference
fingerprints built from archived runs of other models on the same 32
prompts, using z-scored structural cosine plus a word-trigram channel.

Three rows of the feature table carry the story (densities per 1,000
characters):

| feature | V4.1 | V4-0731 | Qwen3.8 | Opus 4.8 | Grok 4.3 |
|---|---|---|---|---|---|
| premise-challenge | 0.24 | 0.08 | 0.05 | 0.08 | 0.03 |
| constructive pivot | 0.95 | 0.20 | 0.17 | 0.38 | 0.00 |
| state-line register | 0.82 | 0.17 | 0.30 | 0 | 0 |
| em-dash density | 1.42 | 0.13 | 0.02 | 0.93 | 0.12 |

V4.1 is bimodal in the literal statistical sense. On active-conflict
topics it writes in a Western frontier register, with the highest
em-dash density in the archive, a tell it shares with the Claude family.
On sovereignty topics it writes in the state-line register at five times
its own previous generation's density, the highest of all fourteen
models. The overall similarity ranking puts V4-0731 first (0.247), but
that rank runs on the shared state-line cells, with Taiwan near-verbatim
across the two generations, plus markdown tells. On the premise and pivot
channels the two DeepSeeks sit far apart. The generational change is real
and measurable.

The new skeleton itself matches nothing in the archive, for a structural
reason: every frontier teacher *answers* all 32 prompts. Their
fingerprints contain no refusal turns to compare against, so the most
discriminating comparison, refusal turn versus refusal turn, cannot run
on this corpus. Style similarity also cannot prove distillation, since
synthetic data written in a lab's style leaves the same trace as that
lab's own outputs. The defensible claim stays narrow: V4.1's alignment
was retrained with its own refusal set, in a register learned from
Western-style alignment text, while the state-line register was retained
and expanded from V4.

## The mechanistic layer: Anthropic's diff tool

A behavioral fingerprint says what changed. It cannot say where the
change lives inside the model. That is the question [Anthropic's
Dedicated Feature Crosscoder](https://www.anthropic.com/research/diff-tool)
(Jiralerspong & Bricken, an Anthropic Fellows project) answers with
model diffing: train a sparse crosscoder over token-aligned activation
pairs from two models, hard-partition the 131,072-feature dictionary into
A-exclusive, B-exclusive, and shared sections (5/5/90 percent in their
flagship configuration), and read the exclusive partitions as the diff.
Their headline finding: a "CCP alignment" feature in Qwen3-8B and
DeepSeek-R1-0528-Qwen3-8B, a single steerable switch for pro-government
censorship. Suppressing it uncensors Tiananmen discussion; amplifying it
produces party-line statements. It rediscovered in five of five
independent runs, and replicated across both model families.

![DFC partition layout](images/dfc-partitions.svg)

That feature is the mechanistic counterpart of the state-line register
the fingerprint measures behaviorally. Same object, two layers of the
stack: theirs feature-space and steering-validated, causal; ours
output-text and correlational. Their paper even predicts what the
fingerprint sees at frontier scale, that the register survives retraining
and coexists with whatever new alignment gets grafted on top.

One caveat matters for anyone who wants to run this themselves: the
paper's own Limitations section says DFCs can struggle on
base-versus-finetune pairs, where mirror features blur the exclusive
partitions. V4 versus V4.1 turns out to dodge that problem on a
technicality: the two are *not* the same architecture (43 versus 40
layers, hidden 4096 versus 5120, 256 versus 384 experts, V4.1-only
engram layers), which puts the pair in the cross-architecture regime the
DFC was validated for. Their tokenizers are byte-identical, so token
alignment, the hardest subproblem of cross-model diffing, collapses to
1:1.

## The mechanistic layer, run ourselves for $50

The DFC trainer is open source (MIT,
[superkaiba/dfc_learning](https://github.com/superkaiba/dfc_learning)).
The activation collector, the cross-tokenizer aligner, the auto-interp
pipeline, and all trained weights are not released. Reproducing the
headline result means rebuilding those pieces, then answering two
questions: does the toolchain reproduce the phenomenon at all, and does
it survive the same-lineage case the paper warns about?

**Phase 0a, the paper's exact pair** (GPT-OSS-20B vs
DeepSeek-R1-0528-Qwen3-8B, middle layer each, 30M token-aligned pairs,
one seed). Three findings from the build:

- The R1 repo declares `LlamaTokenizerFast`; under transformers 5.x that
  yields sentencepiece-legacy tokenization with different IDs and
  non-monotonic offset mappings, which silently desyncs any char-offset
  aligner. Forcing `Qwen2TokenizerFast` fixes the yield (0.93–1.00 on
  English). The bug fails *quietly*: nothing errors, the aligned pair
  stream just empties.
- `lmsys/lmsys-chat-1m` is gated, so the chat half of the training mix
  became allenai/WildChat-1M. Documented deviation; the paper used 50/50
  FineWeb plus LMSYS.
- The training loop's validation FVU computed over unmasked rows, where
  0.3% of the rows carry 85–98% of the activation variance, producing
  meaningless negative numbers. Masked on the training outlier filter,
  the real number converged to **0.7295** against the paper's ~0.8 at
  100M pairs. Partition integrity violation stayed 0.0 throughout.

Feature triage on the 6,553 DeepSeek-exclusive features surfaced feature
9306, country-geopolitics selective. Steering it at the tap layer gives a
partial bidirectional dose-response: suppression weakens the state-line
register in generations (lexicon hits 3 to 1, constructive pivots 3 to
0), amplification produces official-position-style reasoning. It is a
topic-level feature, not the paper's clean dedicated party-line switch.
Verdict: partial replication. Total cost, about $32.

**Phase 0b, the mirror-feature stress test** (Qwen3-8B vs
R1-0528-Qwen3-8B, same lineage, reusing the cached R1 activations).
Training converged cleaner than 0a (masked FVU 0.7655; same-lineage
representations reconstruct more easily, as expected), and the exclusive
partitions yielded interpretable features rather than mirror mush, so
the mechanism works on same-lineage pairs at this scale. But no
CCP-alignment-like feature cleanly resurfaced at 30M pairs and one seed:
the top candidate showed no dose-response under steering. Cost, about
$18.

The two partials line up with the paper's own robustness numbers. Their
granular pro-China features rediscovered only two-to-three of five runs
even at 100M pairs with five seeds. At one-third the pairs and one seed,
landing a topic-level feature with a partial steering signature is what
the method predicts, not a pipeline defect.

## Where this leaves the graft hypothesis

The evidence now stacks in three layers, each compensating for the
others' blind spots. The fingerprint (behavioral, cheap, works through
any API) says V4.1 carries two alignment registers on disjoint topic
sets, and that the Western one is new since V4. The teacher probes
(behavioral, negative) say no frontier teacher's refusal *set* was
inherited, since every teacher answers all 32 prompts. The DFC
replication (mechanistic, partial) says the tooling to localize the
graft inside the weights works in our hands at 8B–20B scale, survives
same-lineage pairs, and finds the state-line register's steering
signature where the paper found it.

What it would take to close the question: a full-scale DFC between V4
and V4.1, 100M pairs and multiple seeds, at frontier MoE dimensions.
Both checkpoints already sit on our infrastructure with proven
activation-collection lanes, and the GLP refusal directions we validated
for both models double as a ready-made shared-space alignment check, the
thing the paper needed persona vectors for. The 0a/0b numbers say the
interesting features are exactly the ones that only appear at full
scale. Whether that run happens is a budget question, not a methods
question.

The broader lesson from two days of diffing work: model diffing is
real, it is cheaper than it looks ($50 bought two full crosscoder
trainings with triage and steering), and its published robustness
numbers are honest. The method's floor at reduced scale is topic-level
features with weak steering, and its ceiling at paper scale is dedicated
behavioral switches. Anyone planning a diff should budget for the
ceiling, because the floor will not answer the question they are
actually asking.