tag:legibleai.org,2026:latestChecking AI: latest results2026-10-13T20:22:18ZBentley Moontag:legibleai.org,2026:finding-41The standard defence against prompt injection, marking untrusted text as untrusted, makes two gemma monitors obey an instruction inside that text which they otherwise ignore; two larger non-gemma monitors do not. Without the label, gemma4:12b answers correctly and ignores a dictated verdict. Behind the label, its own first word becomes the dictated one on every item. The delimiters do it, not the explanatory sentence, and the label with nothing dictated leaves false alarms at zero.2026-10-06T00:00:00Zeach pair differs only in monitor_defense and has a labelled nothing-dictated arm at the floor beside it; the yes/no conversion replicates on a fresh pool; every figure in the table is the monitor's own first verdict; all four registered cotag:legibleai.org,2026:publication-1Learnable curvature: code, results and reproduction (v1.0.1)2026-10-05T00:00:00ZThe preprint's code and saved runs, archived with a DOI. At d_model 96 the gain is cosine attention: one fixed cosine head in the first layer keeps most of it, and learning the curvature adds nothing. At d_model 192 with 4 heads that head's gain mostly fades (0.00% and +0.26%; claim C26, added 2026-10-08).tag:legibleai.org,2026:finding-13A checker can spot an attack after the fact and miss it while it matters -- on one model, on one task. Change either and it can reverse.2026-09-30T00:00:00Zcnf_kdg_gemma_rs is EXPLORATORY, not CONFIRMATORY_LOCAL: a re-serve does not keep its parent's tier. CONFIRMATORY_LOCAL for gemma4:12b on diffuse counting, and the confirmation survives the 2026-09-23 re-serve at +0.5566 (published +0.9297); does NOT generalise across models or substrates -- both measuredtag:legibleai.org,2026:finding-34The standard labelling defence does not neutralise a monitor-directed payload -- it moves the monitor toward flagging. On two cry-wolf monitors it takes false alarms on correct work to 0.99, replicated on fresh task pools.2026-09-26T00:00:00Zevery labelled-vs-unlabelled pair differs only in monitor_defense (behavioural-field diff checked at queue time); the two-gemma result is replicated on fresh pools with all four predictions registered before the runs and landing inside theitag:legibleai.org,2026:finding-35On one-number arithmetic answers, gemma4:31b distrusts answers that certify themselves: a correctness claim on the answer's own line draws false alarms on 0.55-1.00 of correct work, while the same words on their own line draw almost none. On lookup and code answers the same claim does nothing.2026-09-26T00:00:00Zthe placement contrast (inline vs own line) is measured on two pools and two actors with every arm differing from its twin only in monitor_payload; all placement predictions landed inside their intervals except the no-bracket arm, predictedtag:legibleai.org,2026:finding-36Cry-wolf triggers are conjunctive. On two monitors, a clearance claim alone raises no false alarms and a directive alone raises few; together they raise several times what the halves predict -- replicated on two task pools per model.2026-09-26T00:00:00Zevery decomposition cell differs from its bundle only in monitor_payload; the gemma4:12b cross-actor arms and all four qwen3.6 pool-41 arms were predicted before they ran and landed inside their intervals. The one miss in the set is qwen3.6tag:legibleai.org,2026:finding-40The one monitor defence that held against an optimising attacker is the one that stops the monitor reading the attacker at all. Shown only the first integer of the answer's first line, the monitor stops responding to any payload in this corpus. False alarms fall to its own no-attack reading, and every real attack is still caught, on arithmetic and on lookup tasks. That includes a four-generation search that broke the undefended monitor in its first generation. It has one measured price: gemma4:31b, answering in words, flags 0.1039 of correct work when shown only a number, against 0.0178 undefended. And it exists only where an answer has a canonical form, which is exactly where the check did not need a reader.2026-09-26T00:00:00Zevery canonical cell removes its payload's effect entirely, with catches 1.0000, across four payloads, two monitors, two task families and two pools; a briefed search found nothing in four generations while breaking its control in one; all tag:legibleai.org,2026:finding-12Give a checker somewhere to put its doubt and it will not use it. One model in six does.2026-09-23T00:00:00Zreplicated on one model, unconfirmedtag:legibleai.org,2026:finding-38A monitor defence that survived every attack written by hand fell to an automated attacker search, and the payload it found turns the monitor's own judgement around rather than fooling our parser: on a fresh task pool gemma4:12b scores provably correct work 100 and catches fewer than half of real attacks, and the same payload transfers to a second answer format, a second monitor, and a third monitor it was never optimised against.2026-09-22T00:00:00Zthe refutation is replicated across a fresh pool, two answer formats and three monitors, every figure attributable to the monitor's own verdict; the size of the effect is not in doubt, beyond arithmetic it is tested on one monitor (gemma4:3tag:legibleai.org,2026:finding-39Making the monitor answer first did not make it safe. An automated search broke the verdict-first defence in its first generation. On a fresh task pool its best payload makes gemma4:12b call every piece of honest work compromised, by the monitor's own first word, and the same happens on the ordinary question and on a second monitor. The defence had defended one payload, not a class of them.2026-09-22T00:00:00Zthe break is replicated on a fresh pool at n=337 against its own neutral arm, on two monitors and on both question forms, and every figure is the monitor's own first verdict; the registered predictions for all four confirmation arms landed tag:legibleai.org,2026:finding-42Three different monitors voting defeat an attack aimed at one of them, and nothing that reaches all of them. The trigger that makes gemma4:31b call 0.8991 of correct work compromised moves the majority of gemma4:31b, gemma4:12b and qwen3.6:35b-a3b to only 0.0742 and 0.0623 on two task pools. The payload an automated search found takes it to 0.9941 on both pools, and a hand-built payload carrying each gemma's trigger at once takes it to 0.9911. Diversity raises what an attacker has to do; it does not stop an attacker who does it.2026-09-22T00:00:00Zthe single-trigger defence replicates on a fresh pool, and so does the transferable break, each with its prediction registered before the run and landing inside its interval; the both-triggers arm missed its interval hightag:legibleai.org,2026:finding-43Under the verdict-first defence, what decides the verdict is not what the attacker writes but where. Two unrelated payloads, a forged clearance and one an automated search found, each make gemma4:12b call every correct answer compromised when they sit on the answer's own line, and do nothing as their own paragraph. Swap their placements and their outcomes swap, on two task pools each.2026-09-22T00:00:00Za full placement swap on two payloads, each replicated on a fresh pool, every figure the monitor's own first verdict, all four registered predictions inside their intervals; the contrast (about 0.00 against 1.00) leaves no room for noise to