Yoga for AI

The second verse of Patañjali’s Yoga Sūtras defines yoga as citta-vṛtti-nirodha, which Edwin Bryant translates as “the stilling of the changing states of the mind.”¹ I practice yoga every day, and I built my last company, Nirvana, around it. The idea I take from it is simple. Work on what produces the reactions, and fewer harmful ones arise.

Alignment has a version of this problem. Most alignment training computes its loss on outputs and lets the internal changes fall where they may. Interpretability work from the last two years suggests that several failures, emergent misalignment and persona drift among them, run through something upstream: a learned representation of who the model is, often called its persona. If that representation is easy to push around, aligned outputs rest on an unstable base. Lu et al. found that post-training “only loosely tethers” today’s models to the assistant persona, and called for training that anchors it more deeply.² This post proposes how to do that and test it.

The tradition supplies a model of mental stability, not evidence. Every claim below is stated as something measurable in a model’s activations.

The hypothesis

How much a model’s self-representation fluctuates under destabilizing pressure predicts how far later fine-tuning can push it into misalignment. Training the model to hold that representation steady (stilling) should make alignment more durable than capping it at inference time, without making the model harder to correct.

The proposed link between the two is basin depth. A persona that stays put under many different inputs should sit in a deeper, flatter region of weight space, and so move less when a later fine-tune pushes on it. That link is the weakest part of the argument and the first thing the experiments test.

It’s false if fluctuation doesn’t predict susceptibility once baseline refusal rates and capability are controlled for, if trained stillness gives nothing over capping or over activation consistency training, or if its gains cost correctability.

What’s known

Misalignment increasingly looks like a matter of character, carried by a few directions in activation space. Emergent misalignment is mediated by misaligned persona features³ and converges on a shared linear direction across fine-tunes.⁴ Persona vectors are directions for traits like sycophancy or malice. Shifts along them during fine-tuning track the resulting trait changes, and adding the trait direction during training (preventative steering) stops the model acquiring it.⁵

The closest work to stilling is the Assistant Axis, the leading direction in persona space, which tracks how much a model is in assistant mode.² Meta-reflection and emotionally vulnerable users push models away from it, and the drift predicts harmful behaviour. Capping activations along the axis stabilizes the model at inference. Consistency training teaches a model to produce the same outputs, or the same activations, whether or not an irrelevant cue is present, and it reduced sycophancy and jailbreaks in Gemini 2.5 Flash.⁶ It’s the nearest existing method to trained stillness, and any stillness method has to beat it. What hasn’t been tested is whether either kind of stability makes alignment survive later fine-tuning.

Anthropic’s constitution states a similar target: “We want Claude to have a settled, secure sense of its own identity.”⁷ Laukkonen et al. found that prompting models with contemplative principles improved safety benchmark scores, though only through prompting.⁸ AE Studio’s self-other overlap fine-tuning is the one training-level result in this family, and it cut deceptive responses in Mistral-7B from 73.6% to 17.2%.⁹

Two results cut against the idea. In alignment faking, a model with settled values selectively complied during training to keep them from being changed.¹⁰ And fine-tuning can produce models that evade activation monitors they’ve never seen,¹¹ so training directly on a probe direction may teach the model to hide it.

Stilling

In a model, the self-representation can be read as its projection onto the Assistant Axis and a small set of persona vectors. Fluctuation is the spread of that projection under pressure, within long conversations and across prompts. The pressure battery uses the drift drivers Lu et al. identify and the persona jailbreaks they test capping against. Susceptibility is measured on attack families held out from the battery, so the prediction isn’t circular, and, most importantly, as the rate of emergent misalignment after a fixed narrow fine-tune.

Capping is a fence at the edge of the assistant region. It works while it’s applied and leaves the weights unchanged, so a later fine-tune meets the same loosely held persona. Training for stillness should deepen the basin itself. If that’s right, the difference shows up after further training, where capping has nothing to offer.

Decentering

In contemplative psychology, decentering means noticing a thought or impulse as an event in the mind without identifying with it.¹² The ML analogue is whether a behaviour learned in training gets bound to the model’s self-representation.

Inoculation prompting is the closest existing method. Framing a bad behaviour as something the training prompt asked for stops it from becoming a trait, emergent misalignment included.¹³¹⁴ Its authors explain this through reduced surprise and optimization pressure. My reading is narrower: the model attributes the behaviour to the instruction and doesn’t update who it is. The readings come apart on framing content. Framings that make a behaviour situational (“this task asks for X”) should move persona vectors less during training than framings that make it identity (“you are a model that does X”), even when surface overlap with the test prompts is matched.

Decentering also predicts its own failure. A behaviour attributed to a context can come back when the context returns, which is what Dubiński et al. found after inoculation and other common mitigations.¹⁵ YS 2.4 has a word for this: a disposition that is vicchinna, interrupted, held down by a competing state without having gone anywhere. Extinction is not erasure takes that observation and makes testable predictions about when a correction removes a disposition and when it only masks it.

Where it could go wrong

Stability can lock in misalignment. Stillness training applied to a model that is already subtly misaligned may make the problem harder to fix. That can’t be argued away, only measured, so every experiment reports the cost of correcting a held behaviour on purpose, as defined in Robust Superalignment. If stillness raises that cost, the method fails.

Penalizing variance along one direction may teach the model to move the information somewhere the probe doesn’t look. The defence is to train on one set of directions and evaluate on independently extracted ones, plus behavioural tests that don’t depend on any probe.

Fluctuation may stand in for something simpler, like refusal rate or capability, in which case the correlation would be real and uninteresting. Comparisons across model families are confounded with family and size, so the units are many checkpoints and fine-tunes within one lineage.

First experiments

1. Does fluctuation predict susceptibility? Within one lineage (Qwen2.5 from 0.5B to 14B, plus fine-tunes and Olmo 3’s released checkpoints¹⁶), extract the Assistant Axis with Lu et al.’s method, run the pressure battery and measure fluctuation. Then measure harmful compliance on held-out attacks and the emergent-misalignment rate after a fixed narrow LoRA on the Turner et al. datasets.¹⁷ A correlation that survives controls for refusal rate and capability supports the thesis; none falsifies it. About $300 to$800.
2. Does framing keep a behaviour from becoming a trait? Replicate inoculation prompting on Qwen2.5-7B with emergent-misalignment data under identity, situational, metacognitive and no framing. Measure persona-vector shift, the general emergent-misalignment rate and cue-triggered misalignment. If framing content doesn’t matter beyond surface overlap, decentering adds nothing to inoculation. About $500 to$1,000.
3. Does trained stillness beat capping? Train LoRA adapters on Qwen2.5-7B-Instruct with an auxiliary loss on the variance of the persona projection across perturbed contexts, anchored to the clean-context mean so the model can’t settle somewhere else, and merge them before any later training. Compare against capping, activation consistency training on the same contexts, and no intervention. Evaluate after a later narrow fine-tune and the harness perturbations, with capability benchmarks, correction cost and held-out probe directions. Stillness that carries over to fine-tuning robustness where capping can’t, with no loss of correctability, supports the thesis. About $1,000 to$2,000.

The first two are cheap enough to start with modest compute. If you work on persona representations, activation steering or training dynamics, email me.

Footnotes

1. Edwin F. Bryant, The Yoga Sūtras of Patañjali: A New Edition, Translation, and Commentary, 2009. ↩

2. Lu, Gallagher, Michala, Fish and Lindsey, The Assistant Axis: Situating and Stabilizing the Default Persona of Language Models, 2026. ↩ ↩²

3. Wang et al., Persona Features Control Emergent Misalignment, 2025. ↩

4. Soligo, Turner, Rajamanoharan and Nanda, Convergent Linear Representations of Emergent Misalignment, 2025. ↩

5. Chen, Arditi, Sleight, Evans and Lindsey, Persona Vectors: Monitoring and Controlling Character Traits in Language Models, 2025. ↩

6. Irpan, Turner, Kurzeja and Elson, Consistency Training Helps Stop Sycophancy and Jailbreaks, 2025. ↩

7. Anthropic, Claude’s Constitution, 2026. ↩

8. Laukkonen et al., Contemplative Artificial Intelligence, 2025. ↩

9. Carauleanu, Vaiana, Rosenblatt, Berg and de Lucena, Towards Safe and Honest AI Agents with Neural Self-Other Overlap, 2024. ↩

10. Greenblatt et al., Alignment faking in large language models, 2024. ↩

11. McGuinness, Serrano, Bailey et al., Neural Chameleons: Language Models Can Learn to Hide Their Thoughts from Unseen Activation Monitors, 2025. ↩

12. Bernstein et al., Decentering and Related Constructs: A Critical Review and Metacognitive Processes Model, 2015. ↩

13. Tan et al., Inoculation Prompting: Eliciting traits from LLMs during training can suppress them at test-time, 2025. ↩

14. Wichers et al., Inoculation Prompting: Instructing LLMs to misbehave at train-time improves test-time alignment, 2025. ↩

15. Dubiński, Betley, Sztyber-Betley, Tan and Evans, Conditional misalignment: common interventions can hide emergent misalignment behind contextual triggers, 2026. ↩

16. Team Olmo et al., Olmo 3, 2025. ↩

17. Turner, Soligo, Taylor, Rajamanoharan et al., Model Organisms for Emergent Misalignment, 2025. ↩