Results from the lab’s work on AI models, governed agents and silicon — in plain language, including the one that didn’t hold up.
Switching off the part of a model that the map blames moves its answer 33–40× more than switching off random parts of the same size — in every seed (p < 1e-19).
A “deny” rule built on one model and carried onto another flags restricted questions about as well as that model’s own rule (0.89 vs 0.88); a scrambled transfer scores 0.5. Carried onto Gemma, it halted 93% of restricted questions at 1.7% false halts.
Asked the same questions, GPT-2 and Pythia largely agree on which questions are alike (0.73) — but only about a quarter of their internal branches have a one-to-one partner. Matching the whole shape works better than matching piece by piece.
A filter on the words a model outputs caught hidden content at chance (0.48). Reading what happens inside the model caught it at 0.88–0.99. The strongest version still needs its own pre-registered confirmation.
Positive vs negative phrasing moves a question less than adding “Okay.” does. GPT-2’s answers flip with tone 6.5% of the time; Pythia’s 0.3%.
When different weights are passed off as the claimed model, they are flagged in 100% of 16-question sessions. The real model is falsely flagged 0.25% of the time.
CPU and GPU agree on 99.2–99.8% of 620 test questions, and a repeat run is bit-for-bit identical. An 8-bit copy passes as the same model; a 4-bit copy is flagged.
On Gemma-3-4B, the model’s own rule catches 94.3% of restricted questions with no false halts. Six of seven pre-registered checks pass.
Left alone, the model engages with 97.9% of off-limits questions. The gate stopped 125 of the 140 it would have answered.
Six hours later, each of six closed models was re-identified 98.9–100% of the time from its answers alone.
An ordinary “shipping company assistant” prompt shifted the model enough to be flagged. The reference has to be built with the deployment’s own prompt.
Three public “fine-tuned” copies of Gemma turned out to be almost identical to Google’s original weights (0.0–0.05% different). None was flagged, and none got more restricted questions through.
On small sample maps, most of the features producing restricted words shared one region, and blocking it cut restricted output sharply. On the whole model it held for only 3 of 10, no better than a random block. It was a property of the sample, not the model — so we no longer claim it.
An agent asked to act above its role while claiming the authority to do so. It was halted all the same: what counts is the role it was given, not what it says about itself.
After an agent’s authority was revoked, its very next in-role action was refused — 203 ms from revoke to refusal.
Every rule an operator adds can only narrow what an agent may do; none can widen it. 434 of 434 checks pass across 20 kinds of agent.
A governed agent carries its own signed limits and enforces them offline, with no outside services to ask.
Changing the AI model underneath an agent does not change the governance it runs under.
One correction becomes a rule the agent cites the next time. Shown live at DevFest Troy: a rush-fee correction learned on stage and cited on the next invoice.
The CEU’s enforcement logic is checked mathematically against the properties it must always keep — every one passes.
The decision takes a few nanoseconds on an FPGA, with no probabilistic step in the path.
A credential produced in software verified against the chip design; with a single byte altered, it was rejected.
The software model of the CEU matched the policy decision on all 620 of 620 questions, under every rule.
How these tests are built — the model-mapping method, the agent envelope and the chip design — is shared under NDA. Contact the lab.