Records published in September 2026
44 records, all free to read and download.
All of 2026-
Journal article
Fingerprints That Survive What? Model Lineage Names Three Relations, Robustness Is Indexed by Which Party Is Adversarial, and a Benchmark's Distillation Column Scores the Parent That Was Not Distilled From
Language-model fingerprinting is asked to answer questions of the form "is this model derived from that one?", and its methods are routinely reported as robust to fine-tuning, quantization, pruning, merging and distillation. This paper argues that such reports are not comparable, for…
-
Journal article
Three Rounds on Emergent Analogy: What the Webb, Hodel-West and Lewis-Mitchell Exchange Settled, How Its Third Round Tested a System While Still Claiming the Model, and Whether 'Counting' Names the Step That Analogy Theory Calls Inference
In 2023 a large language model was reported to solve text-based analogy problems zero-shot at or above the level of college students. Two critiques followed. They showed that performance on letter-string analogies collapses when the alphabet is permuted or replaced by symbols, while…
-
Journal article
Drift or New Class? Without Labels a Drifted Class and a New One Can Produce the Same Stream, the Two Lines of Work With the Most Explicit Assumptions Each Get an Answer by Freezing the Variable the Other Lets Move, and No Located Benchmark Scores the Attribution
A classifier deployed on a stream eventually sees inputs its model does not explain. Two different events can produce them: a known class can have drifted, or a class that did not exist in training can have appeared. The stream-mining literature treats these as separate problems, concept…
-
Journal article
A Trust Score Needs a Consumer: Four Places a Per-Source Trust Value Can Act on an LLM Agent, the Missing Test of a Graded Discount Against an Adaptive Attacker, and Why the Defences That Report Guarantees Use a Gate Instead of a Score
Work on trust between language-model agents produces two kinds of object. Protocol work produces identity, attestation, stake and constraint, all bound at the transport layer before any content reaches a model. Behavioural work produces a per-source score: a reputation, a credibility, a…
-
Journal article
Self-Model or Self-Simulation? A Machine Self-Awareness Index Averages Sub-Scores With No Common Referent and No Fixed Sign, Why Persistent Identity, Goal Stability and Memory Continuity Are Not Evidence of Self-Access, and the Validity Tests Any Composite Would Have to Pass
Some proposals to quantify machine self-awareness combine several sub-scores - persistent identity, goal stability, cross-session memory continuity, contradiction detection, uncertainty awareness, self-prediction and introspective access - into one index. This paper asks whether such an…
-
Journal article
Four Things Called Forgetting: Interference, Transience, Reset and Unlearning Remove Different Things, Why Forgetting Looks Easy by Accident and Hard on Purpose Only Under Different Instruments, and the Savings Measurement That Would Tell Them Apart
Machine learning uses one word for four operations. Catastrophic forgetting is damage that fine-tuning does to earlier capabilities. Transience is the fading of individual training examples during ordinary training. Resets deliberately reinitialise part of a network to restore its…
-
Journal article
Consensus Too Soon, or Agreement From the Start? Shared Prior, Social Coupling and Pool Coverage in Decentralised LLM Collectives, and Why Prompted Diversity and Model Heterogeneity Act on Different Terms
Groups of language-model agents that exchange answers and settle on a common one are now a standard way to build decentralised decision systems. A common worry is that they agree too soon: agents copy each other, diversity collapses, and the group loses the independent errors that make…
-
Journal article
Refusal Is Not a Rate: What a Context-Conditioned Refusal Policy Would Have to Specify, Why the Benchmarks That Score Context Assume It Is Verified, and the Provenance Term No Instrument Prices
A language model that refuses a harmful request and a model that refuses a harmless one produce the same event, and most of the literature on the jailbreak/over-refusal trade-off counts both as one refusal rate. The standard proposal for escaping the trade-off is to make refusal depend…
-
Journal article
How Many Classes Are Out There? In Category Discovery the Class Count Is Granularity Carried Over From the Labelled Set, Supplying It Can Supply the Taxonomy, and Without It the Count Is Set by a Hyperparameter
Category discovery asks a model to sort an unlabelled image collection into classes, some of which it has never been shown, using a labelled subset of other classes as its guide. Almost every method needs one number before it can produce an answer: how many classes the unlabelled data…
-
Journal article
Compressed Once, Read Many Times: Why Prompt-Compression Results Do Not Transfer to Agent Memory, What the Query-Agnostic Line Already Showed, and the Two Properties of a Memory Write No Protocol Yet Scores
Language-model agents that remember across sessions compress what they store: they summarise dialogue, extract facts, or evict cache entries, and then answer later questions from what is left. The compression ratios used to justify these designs come mostly from prompt-compression work…
-
Journal article
Checked at Every Step Is Not Checked as a Whole: Two Senses of Plan-Level Safety for LLM Agents, and Why Decomposition Attacks Exploit the Gap Between Them
Most deployed safety mechanisms for LLM agents judge one unit at a time: a single tool call, or a single (observation, action) pair (Choi et al., 2026). A separate literature asks whether that is the right unit to judge at all. Jones, Dragan and Steinhardt (2024) show that a task no…
-
Journal article
Does a Model Forget Differently When the Data Is Its Own? RL's Retention Advantage and Model Collapse Are Claims About the Same Loop, and No Study Has Measured Both
Two literatures make claims about what happens when a language model trains on data that resembles its own distribution. One asks whether reinforcement learning forgets a model's prior capabilities less than supervised fine-tuning does, and answers yes: on-policy RL is implicitly biased…
-
Journal article
Curriculum Is Three Claims, Not One: Ordering, Selection and Decomposition in RLVR, and the Random-Order Control Almost Nobody Runs
Curriculum learning entered large-scale reasoning training through reinforcement learning with verifiable rewards (RLVR): difficulty-ordered or difficulty-filtered problem schedules are now routine in systems built on GRPO and DAPO, and dozens of 2024-2026 papers report a gain from some…
-
Journal article
Faithful to What? Four Instruments for Chain-of-Thought Faithfulness Disagree With Each Other, and the One Ground-Truth Check Run So Far Found Most of Them Near Chance
A chain-of-thought (CoT) trace is called "faithful" when it accurately represents the computation that produced the model's answer, as opposed to a plausible-sounding story invented after the fact (Jacovi and Goldberg, 2020). Whether published CoT traces meet this bar is disputed, and…
-
Journal article
When Deliberation Hurts: Inverse Test-Time Scaling, Unfaithful Traces, and the Case Against a Unified System-2 in LLM Reasoning
The dominant frame for large reasoning models borrows a label from dual-process psychology: a fast, intuitive System 1 and a slower, deliberate System 2, with longer chains of thought read as more of the latter and therefore, on average, more reliable. A survey of reasoning LLMs states…
-
Journal article
When Deliberation Hurts: Inverse Test-Time Scaling, Unfaithful Traces, and the Case Against a Unified System-2 in LLM Reasoning
The dominant frame for large reasoning models borrows a label from dual-process psychology: a fast, intuitive System 1 and a slower, deliberate System 2, with longer chains of thought read as more of the latter and therefore, on average, more reliable. A survey of reasoning LLMs states…
-
Journal article
Who Pulls the Plug? Self-Report, External Authority, and the Limits of Self-Isolation in AI Control
A self-isolation proposal asks an AI system to notice that it may be compromised and to withdraw its own privileges. The AI control literature is built on the opposite premise: a model under evaluation may be actively subverting the protocol that watches it, so containment authority is…
-
Journal article
Three Things Called Budget Awareness: Observability, Forecasting and Allocation in LLM Agents, Why Every Published Allocation Gain Is Keyed to a Signal Measured After the Fact, and the Run-to-Run Variance No Forecast Is Scored Against
Two 2024-2026 literatures make claims about resource use in language-model agents that look incompatible. One reports that allocating test-time compute according to problem difficulty beats spending it uniformly, by margins up to a factor of four in compute at equal accuracy. The other…
-
Journal article
Two Kinds of Missing: Underspecified Inputs Versus Unknown Answers, and Why One Abstention Policy Cannot Serve Both
A language model that declines to answer is scored the same way whether the reason is that the question has several readings and it picked the wrong one, or that the question has one reading and the model does not know the fact it names. AbstentionBench (Kirichenko et al., 2025) makes…
-
Journal article
Scored Before the Question Exists: What a Write-Time Importance Value in LLM Agent Memory Predicts, Why an Additive Term Is Not a Prior, and the Ablation the Canonical Architecture Did Not Run
An agent that stores what happens to it must decide what is worth storing and, later, what is worth reading back. The most-copied mechanism for the first decision is a scalar written at storage time: a language model is shown a record and asked how important it is. Park et al. (2023)…
-
Journal article
Sufficient for Whose Answer? Three Predicates Under One Word in Selective Retrieval-Augmented Generation, and Why the Only One Tied to Correctness Cannot Be Computed Where the Gate Runs
A retrieval-augmented system that answers only when its retrieved context suffices needs a predicate that says when it does. Three incompatible predicates are in circulation under the word "sufficient", and results obtained under different ones are routinely compared as though they…
-
Journal article
The Allowance Is Doing the Work: Constructed Premises in Chain-of-Thought Step Verification, What Formal Validity Still Certifies Once They Are Permitted, and the Dependence Test Argumentation Runs and Step Verification Does Not
A verifier that checks the steps of a chain of thought cannot demand that each step state everything it relies on, because no real step does. Every published step verifier therefore permits a class of premises that the text does not contain: the 2023 system that introduced step-wise…
-
Journal article
Not Acting Is Not One Decision: Two Abstention Triggers in Tool-Using Agents, Why the Calibration and Permission Readings Cover Different Ones, and the Cost Term Neither Supplies
An agent that declines to send the email has made a decision that looks like the decision a language model makes when it declines to answer a question, and the resemblance has organised the 2026 literature into two camps. One reads not-acting as a calibration problem: the agent should…
-
Journal article
A Lesson Is an Untested Counterfactual: The Three Claims Inside a Stored Agent Failure Memory, Which of Them Anything Checks, and Why Every Published Retention Rule Keys on a Proxy
An agent that fails a task and writes down what it should have done instead has produced a specific kind of object: a sentence asserting that a named step caused the failure and that a named alternative would not have. This paper takes that object apart. A stored lesson carries three…
-
Journal article
Measured Against an Incomplete Answer Key: What Unknown Recall Certifies in Open-World Object Detection, Why Its Two Cost-Side Instruments Disagree, and the Separation That Was Published and Not Adopted
Open-world object detection asks a detector to put boxes on objects whose classes it was never trained on, and the field's headline number for that ability is unknown recall. This paper reconstructs where that metric came from and what it can certify. The founding paper of the task did…
-
Journal article
The Reassessment That Did Not Travel: What the 2020 Arcade Result About Exploration Bonuses Establishes, the Six Conditions That Made It Informative, and Which of Them the Language-Model Revival Drops
Exploration bonuses have returned. Between 2025 and 2026 at least six frameworks added an intrinsic novelty or uncertainty term to reinforcement learning with verifiable rewards for language models, each naming a classical antecedent - prediction error, pseudo-counts, epistemic…
-
Journal article
The Reassessment That Did Not Travel: What the 2020 Arcade Result About Exploration Bonuses Establishes, the Six Conditions That Made It Informative, and Which of Them the Language-Model Revival Drops
Exploration bonuses have returned. Between 2025 and 2026 at least six frameworks added an intrinsic novelty or uncertainty term to reinforcement learning with verifiable rewards for language models, each naming a classical antecedent - prediction error, pseudo-counts, epistemic…
-
Journal article
Consolidation Without Weights: What the Complementary Learning Systems Analogy Licenses in LLM Agent Memory, and Why the Systems That Borrow Its Name Do Not Inherit Its Guarantee
Memory systems for language-model agents almost all contain a step called consolidation, and almost all of them cite, or gesture at, the complementary learning systems account of hippocampus and neocortex when they name it. In that account consolidation is a specific operation: repeated…
-
Journal article
Attribution Is Scored on a Finished Trace: What Failure-Attribution Benchmarks Measure, What Cascade Containment Would Need, and Why Neither Result Bounds the Other
A family of recent proposals aims to stop errors from spreading through LLM-based multi-agent systems: genealogy-graph governance over message dependencies, cross-channel causal monitoring, propagation-aware remediation of contaminated state, infection-aware safeguarding, and corrector…
-
Journal article
Attribution Is Scored on a Finished Trace: What Failure-Attribution Benchmarks Measure, What Cascade Containment Would Need, and Why Neither Result Bounds the Other
A family of recent proposals aims to stop errors from spreading through LLM-based multi-agent systems: genealogy-graph governance over message dependencies, cross-channel causal monitoring, propagation-aware remediation of contaminated state, infection-aware safeguarding, and corrector…
-
Journal article
A Failure to Reject Is Not a Finding: Closed-Set Accuracy, Specialized Open-Set Recognition, and the Semantic-Distance Parameter the Deflationary Debate Leaves Free
A widely cited result reports that the open-set performance of an image classifier is strongly correlated with its closed-set accuracy, and that a well-trained baseline scoring rule is competitive with specialized open-set machinery. The result is often read as showing that specialized…
-
Journal article
Two Supply Chains, One Artifact: Why Format Safety, Signing and Backdoor Detection Do Not Compose Into an Integrity Claim About a Model
A model downloaded from a public hub is the target of two distinct defensive programmes that use the same vocabulary and secure different things. One treats the artifact as an executable: it scans serialized files for dangerous deserialization opcodes, migrates the ecosystem to code-free…
-
Journal article
Consistency Is Not Correctness: What Internal Contradiction Detection Certifies, Why the Entailment Is Disjunctive, and Which Decisions It Leaves Unlicensed
Contradiction detection occupies an unusual position among proposals for making a language model check itself. Comparing two of a model's own outputs appears to need no external oracle, which makes it look like the one exception to the observation that working hallucination detectors sit…
-
Journal article
Delete Names Five Operations: Erasure Semantics for Derived Agent Memory, and Why a State-Level Definition Cannot Be the Auditable One
Persistent memory has become a standard component of language-model agents, and with it a standard assumption: that where a fact lives in a retrievable store rather than in weights, erasing it is a solved problem, because a store supports deletion and weights do not. Agent memory does…
-
Journal article
Delete Names Five Operations: Erasure Semantics for Derived Agent Memory, and Why a State-Level Definition Cannot Be the Auditable One
Persistent memory has become a standard component of language-model agents, and with it a standard assumption: that where a fact lives in a retrievable store rather than in weights, erasing it is a solved problem, because a store supports deletion and weights do not. Agent memory does…
-
Journal article
Transfer Is a Directed Relation: Four Quantities Under One Word in the Cross-Domain RLVR Debate, and Why the Structural-Similarity Reading Does Not Survive Its Own Evidence
Reinforcement learning with verifiable rewards is the standard route to reasoning-tuned language models, and the field has split over whether its gains leave the training domain. One body of work reports that most models succeeding at mathematics fail to transfer and that single-domain…
-
Journal article
Transfer Is a Directed Relation: Four Quantities Under One Word in the Cross-Domain RLVR Debate, and Why the Structural-Similarity Reading Does Not Survive Its Own Evidence
Reinforcement learning with verifiable rewards is the standard route to reasoning-tuned language models, and the field has split over whether its gains leave the training domain. One body of work reports that most models succeeding at mathematics fail to transfer and that single-domain…
-
Journal article
Predicting Your Own Failure Is Not Predicting Another Model's Advantage: What Router Results Establish About Agent Self-Knowledge, and the Incremental-Validity Test Nobody Has Run
A common reading of the LLM routing literature holds that delegation works without self-knowledge: a router allocates queries using external features of the task and observed outcome statistics over a model pool, and never consults the candidate model's opinion of its own competence…
-
Journal article
Predicting Your Own Failure Is Not Predicting Another Model's Advantage: What Router Results Establish About Agent Self-Knowledge, and the Incremental-Validity Test Nobody Has Run
A common reading of the LLM routing literature holds that delegation works without self-knowledge: a router allocates queries using external features of the task and observed outcome statistics over a model pool, and never consults the candidate model's opinion of its own competence…
-
Journal article
A Safety Memory Is a Declassification Channel: Why Origin Binding, Taint Tracking and Memory Isolation Do Not Secure the Records an Agent Writes About Attacks
Two lines of work on language-model agents have converged on the same component from opposite directions. One proposes that an agent keep a persistent safety memory, so that an attack seen once, a request refused once or a source found untrustworthy once continues to inform decisions in…
-
Journal article
A Safety Memory Is a Declassification Channel: Why Origin Binding, Taint Tracking and Memory Isolation Do Not Secure the Records an Agent Writes About Attacks
Two lines of work on language-model agents have converged on the same component from opposite directions. One proposes that an agent keep a persistent safety memory, so that an attack seen once, a request refused once or a source found untrustworthy once continues to inform decisions in…
-
Journal article
A Conflict Is Constructed Before It Is Measured: Seven Design Choices That Set Which Way a Language Model Bends, and Why the Context-Memory Results Do Not Compare
The literature on how language models behave when retrieved context contradicts parametric memory contains a flat contradiction, and neither of its two surveys resolves it. One body of results reports over-reliance on memorised information; another reports that models are highly…
-
Journal article
An Unknown Unknown Is Defined Relative to an Oracle: Four Places External Judgement Enters Blind-Spot Discovery, and Why the Self-Detection Results Do Not Remove It
An unknown unknown is standardly defined as an input on which a model makes a high-confidence mistake. The definition is not incidental to the research problem; it fixes its shape. A quantity defined by the conjunction of high confidence and error cannot be recovered from confidence…
-
Journal article
An Unknown Unknown Is Defined Relative to an Oracle: Four Places External Judgement Enters Blind-Spot Discovery, and Why the Self-Detection Results Do Not Remove It
An unknown unknown is standardly defined as an input on which a model makes a high-confidence mistake. The definition is not incidental to the research problem; it fixes its shape. A quantity defined by the conjunction of high confidence and error cannot be recovered from confidence…