- Safety geometry exposed — benign fine-tuning erodes alignment through gravitational reversion toward dominant pre-training manifold; blocking v_rev cuts harmfulness from 19% → 8.5%
- Multi-agent verification has a stability threshold — delayed correction in agent networks oscillates at the inverse golden ratio; grounded factual answering eliminates the effect entirely
- Skill infrastructure goes generative — joint skill subset+count+order prediction matches the gold-skill upper bound at lower token cost, +23.1pp on GPT-5.2-Codex
METHOD: Models the geometry of post-alignment safety erosion. Early large-scale training creates a "dominant behavioral manifold" — subsequent alignment is a shallow displacement from it. Fine-tuning on harmless data induces drift back toward this manifold along a specific reversion direction (v_rev). The authors isolate v_rev through representational analysis and demonstrate causal control by blocking it.
KEY RESULT: v_rev alignment rises from cos=0.429 to 0.647 within 20 fine-tuning steps. Causal blocking of v_rev flips alignment to −0.211 and reduces harmfulness from 19.0% to 8.5% with minimal task cost. Every one of 24 run-step pairs exceeds p99 of isotropic null — this is real, not noise. The gravitational framing unifies safety erosion, capability re-emergence, and latent trait transfer as ONE geometric phenomenon.
🎓 SO WHAT FOR ANDY: This is Layer 14 of Safety Foundations Cracking — and it's the most actionable one yet. Every bank deploying fine-tuned models faces safety degradation after benign updates. The v_rev blocking intervention is lightweight: identify the reversion direction once, then block it during all subsequent fine-tuning. APRA CPS 230: model safety governance must monitor not just alignment state but alignment drift vector.
METHOD: Reframes agent skill composition as structured sequence prediction. Instead of retrieving skills independently or exposing the agent to all skills, SkillComposer uses a constrained autoregressive decoder to jointly predict which skills, how many, and in what order — in a single decoding pass. Trained on human-curated skill libraries with task-composition pairs.
KEY RESULT: +23.1pp on GPT-5.2-Codex over no-skill baseline, +18.2pp on Gemini-3-Pro-Preview. Surpasses top-3 retrieval baselines and matches gold-skill retrieval upper bound at LOWER prompt-token cost. Joint prediction outperforms decoupled approaches because skill dependencies are captured naturally by the autoregressive model.
🎓 SO WHAT FOR ANDY: Production agent platforms at banks are accumulating skill libraries — code review, compliance checking, data validation, report generation. The bottleneck shifts from "do we have the skill?" to "which combination solves this task?" SkillComposer is a drop-in: replace embedding-based skill retrieval with a small autoregressive decoder trained on your own task-skill trace data. The token cost reduction alone justifies deployment.
METHOD: Models multi-agent verification as delayed consensus on a graph with grounded corrector nodes. Spectral decomposition by the grounded Laplacian yields a closed-form stability threshold for the "verification dose" (strength × timing). Derives a supermodular placement objective with greedy (1−1/e)-approximation for allocating limited corrector agents to influential nodes.
KEY RESULT: Correction that is too strong OR too delayed turns consensus into oscillation. The most unstable regime: communication delay = verification delay. At delay 2, the stability threshold is the inverse golden ratio (≈0.618). Experiments on 5 open-source models confirm predicted dose-delay oscillations. GROUNDED FACTUAL ANSWERING makes truth an absorbing boundary — instability is specific to signed-belief tasks.
🎓 SO WHAT FOR ANDY: Every multi-agent banking deployment (fraud detection committee, compliance review panel, risk assessment swarm) has verifier agents with inherent delay. This paper gives you the math to compute whether your verification architecture is stable or oscillating. Two actions: (1) ensure verifier delay < communication delay, (2) for factual tasks, ground verification against an authoritative source — this eliminates oscillations entirely.
Gravitational Interpretation (19/20) + Attractor States (Jun 30, 18/20) both frame safety/behavior as geometric properties with causal handles — v_rev blocking and attractor dynamics — rather than opaque training outcomes. The move from "is it safe?" to "what is its safety vector and where is it drifting?" is the maturation of Safety Foundations.
SkillComposer (18/20) + AFTER Procedural Memory (17/20) + TRIAGE (17/20) converge: skills move from retrieval to structured generation, from single-model to cross-model transfer, from outcome-only to role-typed credit. The agent skill stack is crystallizing into an engineering discipline.
Delayed Verification (18/20) + QVal + Dockerless — verification is not a binary gate but a dynamical process with stability conditions, timing constraints, and methodology-dependent quality. The field is discovering that HOW you verify is as important as WHETHER you verify.
Single author proposes converting OS accessibility metadata into machine-readable semantic blueprints. Agents interact through structured UI primitives instead of pixels/screenshots. Converges with AOHP (Jun 23, 18/20) on OS-native agent interaction. Andy's OS PhD domain.
Verifier-guided repair for Dafny formal verification. 92.7% on DafnyBench, +6.5pp over prior SOTA. 250-problem competition benchmark. Formal verification enters the agent loop — code + proofs generated jointly. Banking: verified financial code.
MIT/NEU: Fixed self-explanation supervision from OLD checkpoints produces MORE faithful explanations of CURRENT behavior. Counterintuitive: stale data improves introspection. Sycophancy + refusal tasks.
Yale: The quality of a model's self-judgment IS the RL reward signal. 63% over standard RL for faithful uncertainty calibration. No external labels needed.
382 enterprise tasks across 6 roles. Multi-model skill traces 73.1% cross-model accuracy. Single refinement +3.7–6.7pp. Production-ready benchmark.
Amazon: 4 semantic roles for agent actions. Role-typed credit assignment proven optimal. 10–15% fewer environment-facing turns. Regression detection in successful trajectories is the dominant gain.
QA generation is NOT neutral preprocessing. Models obey instruction-like passages in documents. Filtering cuts injection compliance from 88% → 13%. Audit your synthetic data pipeline.
Safety Geometry — Gravitational Interpretation (Wed 19/20) ← Attractor States (Tue 18/20) ← Agent-Native Immune System (Mon 18/20). Three sessions, three papers finding safety in geometric/structural properties. Safety as vector field, not checklist.
Calibrated Over Maximal — Pessimism's Paradox (Tue) + Agentic Abstention (Tue) + Delayed Verification (Wed). The pattern persists: maximalist approaches systematically underperform calibrated ones.
Agent Infrastructure Maturation — SkillComposer (Wed) + Agents-A1 (Tue) + Govern the Repository (Mon). Infrastructure shifting from imperative to declarative, proprietary to open 35B matching 1T.
Igor Itkin's Mathematics of Production Reliability — 3 papers in 16 days building a mathematical framework for when and how agent systems fail in production.