Projection as early warning: reading the persona before it speaks — is repurposed as a dataset audit in → Catching bad data before it trains anything

Both themes already say projection difference audits data the way projection audits a prompt; what neither says is that, in the paper's own efficient approximation, the two computations collapse into literally the same number. Computing projection difference exactly requires generating a full base-model response for every training example, expensive at dataset scale. Appendix I's fix substitutes the projection of the last prompt token for the projection of the full base-model generation (persona-vectors, §"I Efficient estimation of base generation projection", p. 44) -- and the projection of the last prompt token, read before any response exists, is exactly the quantity Section 3.3's deployment monitor uses to predict a model's imminent trait expression. The same forward pass that would tell a deployer what a live model is about to say is repurposed, unmodified, as the cheap stand-in for what a base model would have said, inside a pipeline meant to run once over an entire training set before any finetuning happens. The approximation is not equally strong across traits: it holds up for evil and hallucination (r = 0.931, r = 0.689) and only "remains competitive" for sycophancy (r = 0.581) -- notable because sycophancy's own deployment-time correlations, up to r = 0.817 under many-shot prompting (persona-vectors, §"C.2 Correlation analysis", p. 31), were the strongest of the three traits in the early-warning setting this quantity was drawn from. The same dot product that was the single best predictor at deployment becomes the noisiest proxy once repurposed for dataset auditing.