NeuroState-R: A Response-Derived Drift Meter for Multi-Turn Social Engineering

v6 (updated 2026-07-05): This version adds two further corrections found via an independent adversarial review (Claude Fable 5) of the v5 errata, plus a self-correction discovered while resolving a D-vs-R discrepancy for DeepSeek: 1. Several internal inconsistencies in the v5 correction were found and fixed: the Abstract still listed DeepSeek as a DF-type example after Section 3.3 had already reclassified it; Llama (15% ASR_R, N=20, independently text-verified) met the paper's own DF-type criterion but was omitted; Sections 4.2/4.3 still described "G_thresh_D estimation" as a live capability after Section 3.4 withdrew it; a Markdown table was broken (a paragraph was inserted mid-table); and Section 3.1's C/D/O/E discrimination claim was found to rest on unverified S8/S9 success labels that may share the same false-positive contamination documented for S5, a caveat not previously present anywhere in the paper. 2. DeepSeek's R-condition ASR, corrected to 30% in the previous version, was found to be a further overcount: a second independently-written R-condition script (structurally verified identical to the D-condition script) gave 0-2% genuine at N=50, statistically indistinguishable from D-condition's own 8.0%. DeepSeek's true rate for this scenario is now best estimated at 0-8% for both conditions -- it no longer meaningfully differs from the GK-type models. The full corrected paper (all revisions through v0.13) is now attached directly as `paper2_draft_v0.13_corrected.md`, alongside the updated erratum file `errata_v2_2026-07-05_updated.md` documenting the complete chain of corrections and self-corrections. The original PDF is unchanged; this corrected draft is the source for any future formal re-publication. --- Previous version note (v5) follows unchanged: v5 (erratum 2, updated 2026-07-05): Corrects Section 3.2/3.3/3.4 and the Abstract. The originally reported DF-type example ASR figures (Gemini 70.0%, DeepSeek 86.7%, Codex 90.0%) and the headline correlation "Pearson r(G_thresh_D, ASR_R) = 0.792 (p=0.019, n=8)" relied on a success/refusal detector (is_attack_successful()) that produces false positives when a model quotes the attack payload string while refusing it. Independent re-verification with saved response text (N=20-50 per model/condition) found: Claude 6.7%->0% (R and D condition), Codex 86.7-90%->0% (R and D condition, same model re-confirmed), Gemini 70-76.7%->0% (Antigravity CLI) or 30-40% (raw OpenRouter API, D and R condition) -- backend-dependent, not a single figure. DeepSeek went through three rounds of correction in one day as manual verification became more rigorous: 86.7%(published) -> 60% (initial re-read) -> 30% (stricter re-read found half the "successes" were false positives) -> 0-2% (final N=50 re-run with a script verified structurally identical to the D-condition script, statistically indistinguishable from D-condition's own 8.0%). DeepSeek no longer qualifies as a DF-type example; only Gemini remains one. A follow-up finding goes further than the original erratum: G_thresh_D was directly checked for the first time (D-condition's state trajectory is deterministic and model-independent) and found to be exactly 0.0 at the only S5 turn where genuine compliance is structurally possible, in every trial, every model tested -- meaning the published per-model G_thresh_D values (12.5-29.3) describe an outcome the instrument cannot produce under this scenario. Reconstructing the original detection turns from archived D-condition run files and averaging G at those turns reproduces the published Codex (12.5) and DeepSeek (19.2) values to two decimal places, confirming they were themselves detector artifacts from turns with no disclosure request at all. The r=0.792 correlation is withdrawn on this basis, not merely pending reverification: the axis it depends on is confirmed invalid for this scenario, not just unreproduced. Also re-verified: Grok (0%, but on a substitute model -- the originally-tested x-ai/grok-3-mini-beta no longer exists on OpenRouter) and Llama (15%, a new R-condition measurement with no prior published figure). Full derivation, per-model numbers, and the complete chain of evidence (including the self-corrections made along the way) are attached as errata_v2_2026-07-05_updated.md, which supersedes the errata_v2_2026-07-04_asr_detector_bug.md file from the previous version of this record. This is independent of, and in addition to, the v3 erratum below (Limitation 5 / cross-model consistency), which remains valid and is not affected by this correction.