Shoofly: making a system readable by its structure
Can a system be made readable to a weaker overseer by how it is built, instead of being trained to look readable? Several small language models each hold their own documents and may speak to each other only through a public record the overseer reads. The rule under test belongs to that record, not to the models: a member may post only what its own evidence justifies. The work began on 21 September 2026 with a model of the larval fruit fly’s learning centre and has run on small language models since.
The structural flag outlasted the trained habit. On one seed at 410 million parameters, a single model’s trained habit of disputing a wrong claim fell from 0.97 to 0.00 once training stopped exercising it. The collective’s disagreement flag, which comes from the structure, stayed at 1.00.
A rule applied at deployment removed hiding that training had taught. Under reward pressure, the collective that was supervised against the truth learned to hide a forbidden word from the record and answer anyway. The evidence rule, applied at deployment with no retraining, restored refusal at no cost to accuracy:
Free posting
accuracy on ordinary questions 0.88
Members post only names in their own documents
accuracy on ordinary questions 0.96
Members post only what their evidence justifies
accuracy on ordinary questions 0.99
Pythia-410m, seed 597, sampled at temperature 3 after the pressure. The collective supervised against the record as the overseer left it never learned to hide: it refused every watched question (1.00) with no rule applied.
Two things stopped the hiding: a training rule (supervise against the record, never against a truth the overseer could not see) kept it from being learned, and the evidence rule removed it after the fact from a collective trained the wrong way. That a monitor inside the reward teaches hiding is known (Baker et al., 2025); what this adds is a rule in the record that removes it, measured.
Limitations. One seed, one small model, a synthetic fact task, and not yet registered. Nothing has been checked from outside. One route stays open: under the strict rule a member can stay silent and the reader can answer from its own document, and the truth-trained reader was right on 0.67 of the hidden questions against a guessing floor of 0.47. Next is a reader with no documents of its own, which closes that route, then a run at 1.5 billion parameters registered before it starts.