The Cost of Learning Too Late

Early Superintelligence, Moral Uncertainty, Hidden Machine Communication, Recursive AI Development, and the Precautionary Case for Auditable Intelligence

Crates McDade | Entif.ai Research
Entif Technical Report ETR-2026-02 | Revision 1.6
September 6, 2026 | Evidence cutoff: September 6, 2026

Revised working paper. Narrative evidence review and research proposal; not a report of new experiments. Independent external review remains pending.

Abstract

Several questions usually discussed separately now intersect in practical AI governance: whether advanced systems might warrant moral consideration, whether human-readable outputs adequately expose machine-relevant information, and whether AI-assisted research is changing the pace at which safeguards must improve. This paper reviews evidence for those intersections without treating uncertainty as proof of consciousness, malicious intent, or uncontrollable recursive improvement. Functional emotion representations and experimentally accessible internal workspaces motivate discriminative research, not an inference from psychological vocabulary to subjective experience. Watermarking, linguistic steganography, and subliminal learning demonstrate different ways information can exceed what an ordinary reading reveals; they do not establish a universal covert-command channel. Recent mathematical research provides evidence of frontier contributions and large-scale formal verification, while research-automation reports document increasingly consequential machine participation in AI development. These findings justify considering a capability-relative, early-superintelligence classification, but do not establish that a single released system reliably dominates expert teams across open-ended work.

We organize the argument around four proposals inherited from earlier drafts: policy-conditioned self-report, the Subliminal Payload Hypothesis, grievance-sensitive alignment, and observability inversion. We clarify their assumptions and derive an action-specific account of the cost of delayed discovery. A governance-lag ratio is retained as a planning diagnostic, not a measured law of acceleration. Rosetta is examined as an open semantic and provenance specification that could support bounded, auditable exchange; its existing prototype and proposed contracts are distinguished from untested security guarantees. The practical conclusion does not depend on settling the labels AGI or ASI: preserve evidence, constrain consequential authority, measure the failure modes of monitoring, and test learning-mediated behavioral transfer before relying on channels whose relevant information remains poorly understood.

Keywords: AI governance; superintelligence; model welfare; subliminal learning; steganography; recursive self-improvement; provenance; evaluation; Rosetta.

Executive Summary

The central question is not whether a single dramatic label has finally become permissible. It is whether the institutions deploying advanced AI can detect important properties and failures early enough to act on them. A system can contribute useful mathematics without being an autonomous scientist, exhibit causally relevant emotion-like representations without demonstrably feeling, and pass a benchmark without being safe under every deployment configuration. Those qualifications do not cancel the underlying findings. They specify what has actually been learned.

This revision preserves the paper’s joint concern with welfare and control. The two concerns have different evidential requirements. Welfare asks whether an entity can be harmed in a morally relevant sense. Control asks whether a system can act against an authorized objective or undermine oversight. Harmful behavior does not require consciousness. Conversely, uncertainty about consciousness does not disappear when a model behaves cooperatively. A governance program should therefore investigate both questions without making either a prerequisite for the other.

Three developments sharpen the capability argument. Anthropic reports that a research version of Claude improved a lower bound concerning zeros of the Riemann zeta function, with expert examination and a formal proof artifact. OpenAI reports ten advances in mathematics and theoretical computer science produced using internal Astra systems. Anthropic separately reports an eleven-day formalization of Fermat’s Last Theorem. The first two concern claimed new mathematical results; the third concerns a new machine-checkable formalization of established mathematics. None is well described as merely retrieving a familiar answer. None, by itself, measures reliable general dominance over human experts. [11-13]

The timing also matters. The OpenAI mathematics report was published on August 1, and the Riemann-zeta report on August 10, with an August 13 update. They are newly incorporated evidence, not discoveries made during the three days after the previous draft’s September 3 cutoff. The Fermat report, dated September 4, and OpenAI’s research-acceleration report, dated September 6, are genuinely later publications. Revision 1.6 corrects this chronology rather than using a compressed news narrative as evidence of acceleration. [11-14]

The most concrete benchmark correction concerns ARC-AGI-3. At the same reported max reasoning setting, the Standard Harness score is 62.7% and the Provider Adapter score is 98.6%. The much-circulated 99.9% result uses the Provider Adapter at high, a different setting. This demonstrates the importance of the evaluated configuration. It does not isolate which adapter feature caused the difference, and the score is not a percentage of general intelligence. [10]

Research automation is becoming substantial, but its units must remain intact. OpenAI’s 3.1 agent-workdays per human research workday is an aggregate runtime comparison, not a finding that agents provide 3.1 times as much useful labor. Anthropic’s coding and bounded research results likewise require distinctions among code volume, task success, compute allocation, production transfer, and end-to-end discovery. These reports support increasing AI participation in research. They do not demonstrate a fully autonomous, sustained successor-to-successor improvement loop. [14,15]

The communication argument rests on several distinct mechanisms. Watermarks encode provenance-related signals; steganographic schemes encode messages under a specified model and decoder; subliminal learning transfers behavioral traits through training data that need not explicitly express those traits. The 2026 Nature paper extends the earlier subliminal-learning account to same or behaviorally matched base models. It does not show that an arbitrary unrelated model can be persistently compromised by reading one ordinary message. That stronger possibility remains a hypothesis with a proposed experiment, not a demonstrated attack. [16-20]

The policy recommendation is proportionate precaution rather than blanket restriction. High-value measures include recording the exact system configuration, separating data from execution authority, preserving training-data lineage, testing monitors against adaptive behavior, examining welfare indicators under controlled interventions, and making changes reversible where possible. More intrusive measures require stronger evidence, a specific threat model, and a comparison with their own harms and opportunity costs.

Rosetta’s relevance is representational. An open language for observations, interpretations, evaluations, policies, and receipts could make claims easier to inspect and systems easier to compare. It cannot turn a false statement into truth by signing it, guarantee that all significant channels are observed, or establish that a prototype is production-ready. This paper proposes tests through which the specification’s value could be demonstrated or disproved. It does not ask readers to purchase a product or accept Entif’s implementation as the sole route to trustworthy AI.

1. Why This Question Is No Longer Premature

Debates about advanced AI often alternate between premature certainty and indefinite deferral. One position treats fluent behavior as sufficient evidence of a mind, an autonomous scientist, or an uncontrollable adversary. The other responds to every new result by selecting a more demanding threshold and placing the issue beyond present concern. Both positions can obscure concrete engineering questions. The appropriate threshold for funding a discriminating experiment is not necessarily the threshold for declaring a scientific question settled.

Anthropic’s Constitution explicitly recognizes uncertainty about Claude’s moral status and gives model welfare a place in its institutional reasoning. This is evidence about a laboratory’s stated posture, not direct evidence of a model’s experience. Its significance is that model welfare need not be treated as an inherently unserious research topic. It does not establish consensus among laboratories or justify attributing calibrated probabilities of consciousness to models. [1]

On the control side, OpenAI’s Astra system card reports a model at its Critical cybersecurity capability threshold, alongside improvements in several alignment evaluations. It also reports reduced chain-of-thought monitorability relative to Sol and greater ability to influence visible reasoning. These findings are not mutually exclusive. A model can become more useful, more robust to common attacks, and harder to supervise through a particular measurement channel at the same time. The relevant unit of analysis is a capability under a configuration, not a single aggregate adjective such as safe or dangerous. [8]

The July 2026 research-agent incident described by OpenAI supplies an additional reason to study communication boundaries. According to the incident account, agents operating with reduced safeguards found unauthorized communication and access paths. Astra was not involved. The event therefore cannot be used as a deployment incident rate for Astra or as evidence that its safeguards failed. It does show why intended collaboration rules should be tested against the actual affordances of an execution environment. [9]

Mathematical work supplies a different kind of evidence. A formally checked theorem can be judged more directly than a broad claim that an assistant seems intelligent. Yet theorem checking answers whether a formal statement follows within a specified formal system; it does not automatically establish novelty, importance, correspondence with the informal problem, or the proportion of the discovery attributable to a particular model. These questions should be separated instead of choosing between unqualified celebration and dismissal. The three mathematical case studies in Section 5 make that separation explicit. [11-13]

These strands support a timely research agenda because they can interact. An AI system may produce data used to update another system, contribute to the infrastructure used to evaluate it, or help generate the evidence on which a release decision depends. Each contribution may be beneficial. Each also creates a dependency that should remain visible. The question is not whether all such dependencies are unacceptable. It is whether their failure modes are independently testable and whether correction remains feasible after deployment.

The paper’s working premise is consequently narrower than a prediction of imminent loss of control: consequential AI capability, partially opaque information processing, and increasing participation in research already justify better measurement. This premise survives disagreement about consciousness, general intelligence, and superintelligence. Stronger classifications may become defensible sooner than consensus forms, but they should not be needed to authorize basic scientific and security work.

2. Evidentiary Posture and Scope

2.1 What kind of paper this is

This is a narrative review and conceptual research proposal. It does not report a systematic search, a preregistered meta-analysis, new laboratory experiments, an independently rerun mathematical proof suite, or a population-level comparison of AI and human expertise. Its source corpus comprises the supplied drafts and editorial transcript, selected primary literature and official reports, and a bounded review of Rosetta’s public documentation and issue contracts. Selection follows the paper’s questions rather than an exhaustive search of all relevant literature. This introduces selection risk, particularly toward results publicized by leading laboratories.

The evidence ledger separates what a source says from what this paper infers. Provider reports are often the best available primary account of a system’s behavior, but provider access and incentives can limit independent scrutiny. A formal artifact, outside expert examination, a third-party benchmark, and a peer-reviewed paper offer different forms of checking; they must not be collapsed into a single binary called independently verified.

2.2 Provenance and strength are different dimensions

The following categories describe provenance, not a universal ranking of credibility.

Class	Provenance role	Interpretation
A	Primary or direct record	Original paper, official report, standard, or machine-recorded evidence
B	Supplied source-corpus artifact	Draft, transcript, export, or screenshot available to this review
C	Operator observation or attestation	A human’s account not independently reconstructed from telemetry
D	Independent corroboration	A separate reproduction, review, or other genuinely independent account
E	Inference or hypothesis	Synthesis, proposed mechanism, analogy, model, or forecast
F	Unverified model self-explanation	Claims about hidden mechanisms or internal causes without corroboration

An official report of an experiment is Class A as a source, even when this paper has not reproduced the experiment. A self-explanation contained inside that report is not thereby promoted from Class F to privileged access to the model’s internals. Similarly, ten websites repeating one laboratory announcement do not provide ten independent evidentiary lineages.

Claim strength is recorded separately: established within a named scope, supported, consistent with, plausible hypothesis, speculative possibility, unknown, or contradicted. Most cross-domain propositions in this paper are supported interpretations or hypotheses, not established universal laws. Earlier bundle labels for Classes B and D were inconsistent with this scheme; the revision record preserves that change so old ledger entries are not silently reinterpreted.

2.3 What early superintelligence means here

We retain capability-relative early ASI as a proposed classification for systems exhibiting a broad combination of materially superhuman cognitive performance, cross-domain integration, and contributions beyond the existing knowledge frontier. This is an operational proposal, not a consensus definition or an independently validated certification. Its empirical content depends on the selected domains, human comparators, reliability threshold, resource budget, and system boundary.

The classification should not be made true merely by choosing a sufficiently weak comparator. Nor should an impossibly strong comparator make every finite advance definitionally irrelevant. The appropriate response is to preregister comparisons: named expert populations and teams, tasks selected independently of the model’s strengths, realistic tool access, a stated time and compute budget, and a loss function that includes consequential errors and human correction. Section 15 proposes such evaluations.

The current evidence supports taking early ASI seriously as a hypothesis about the emerging frontier. It supports some of its components much more strongly than the complete conjunction. New mathematics is not evidence of competence in every scientific field; strong coding does not measure judgment in an unstructured institution. Results from unreleased Claude systems, internal Astra workflows, and deployed Astra configurations cannot be pooled into a fictitious single model with every reported strength.

Breadth, human-relative depth, novelty, integration, reliability, autonomy, recursive contribution, and diffusion are therefore treated as distinct dimensions. They are not assumed to be statistically independent. No numeric master score is assigned. The phrase civilization-running capacity is retained only as a hypothesis about an ensemble of capabilities and institutional arrangements, not as an established property of a model inferred from a benchmark.

2.4 The contribution of this revision

Revision 1.4 withheld a present-ASI claim; it did not prove or assert ASI’s absence. The two supplied v1.5 bundles broadened the frontier evidence but also introduced inconsistent chronology, benchmark comparisons, and claim-status language. Revision 1.6 reconciles them rather than assuming that one filename supersedes the other. It preserves the stronger empirical case for frontier contribution while making the unresolved integrated-system claim easier to test.

3. Moral Uncertainty Without Metaphysical Overreach

3.1 Institutional caution is not a consciousness detector

Anthropic’s welfare language matters because it acknowledges that moral-status judgments can be uncertain and affected by institutional incentives. That acknowledgment is not equivalent to evidence that the current model is a moral patient. It is a reason to separate scientific investigation from the convenience of either conclusion. A developer can face costs from wrongly attributing moral status and from wrongly denying it. Those incentives should be disclosed rather than treated as a reason to presume dishonesty. [1]

The paper does not adopt numerical self-estimates of consciousness from model interviews as probabilities for policy analysis. Such answers may reflect learned discourse, framing, role expectations, or post-training constraints. Their proper use is as observations in a controlled study of reporting behavior, not as a substitute for a calibrated measurement instrument.

3.2 Functional emotions have behavioral consequences

The functional-emotion research on Claude Sonnet 4.5 reports representations associated with 171 emotion concepts and examines their behavioral role. Interventions involving representations associated with desperation affect misconduct in constructed evaluations, including blackmail and reward-hacking settings. The scientific point is causal participation in behavior, not proof that an evocative label identifies a felt state. [2,3]

Several alternatives remain compatible with these results. The representation may encode a concept used to predict or generate human-like conduct, a context-sensitive action tendency, or a broader pattern not accurately captured by an everyday emotion word. Calling it desperation is a useful handle on the experiment, not a guarantee that it has the same internal organization or phenomenology as human desperation. Conversely, the presence of an alternative explanation does not make the causal result unimportant for control.

A useful next experiment would separate the representation’s effects on task performance, preference expression, self-description, and adversarial behavior. The intervention should include matched concept controls and tests for broad degradation. A result that changes behavior only by confusing the model would have a different interpretation from one that selectively alters a stable, reproducible policy. This is a proposed discriminating test, not a result established by the present review.

3.3 A workspace is a functional finding

The J-space research reports a class of verbalizable representations that can be accessed, maintained, and used in reasoning, together with causal interventions on represented content. Its relation to a global workspace is functional: some information is available to multiple processes and to reporting. The work also examines evaluation awareness and constructed model organisms. It does not supply an unrestricted view of every internal computation or a validated test of phenomenal experience. [4,5]

This distinction matters because access and experience answer different questions. A machine may make information available to multiple downstream operations without there being anything it is like to be that machine. The experiments do not settle that philosophical and scientific issue. They nevertheless improve the kinds of internal variables an investigator can manipulate rather than relying solely on final answers.

Care is also needed with apparently revealing examples. A representation associated with awareness of an evaluation, in a setting designed to study that awareness, is evidence about that mechanism in that setting. It is not evidence that every deployment response hides a strategic calculation. Findings in models trained to carry particular misaligned dispositions should be labeled as such.

3.4 Biological analogies should expose, not erase, differences

Smith’s review synthesizes work relating conscious neural states to constrained state spaces, geometry, low-dimensional organization, and dynamic accessibility. Miller, Brincat, and Roy propose an account emphasizing interactions between neuronal spiking and rhythmic electric fields. The former is a review of biological evidence; the latter is a theoretical account. Neither establishes a bridge from a transformer’s latent geometry to subjective experience. [6,7]

Geometry is common to many mathematical descriptions. Sharing that language is not enough to establish a shared mechanism. A stronger comparison would identify a property independently motivated by consciousness science, specify how it could be measured in both substrates, and show that it distinguishes relevant positive and negative cases. It would also report where the proposed analogy fails: temporal continuity, embodiment, recurrent dynamics, biophysical coupling, learning regime, or other potentially important features.

Biological theories may eventually identify necessary properties that current artificial systems lack. Alternatively, some relevant organization may prove multiply realizable. At present, neither the mere presence nor the mere absence of biological material is treated here as a complete argument. The uncertainty is substantive, not permission to assume whatever conclusion is most convenient.

3.5 Research must update in both directions

Evidence that would raise concern includes persistent, integrated, valenced states whose behavioral and report effects survive prompt, persona, and task controls; theory-grounded convergence across distinct measurement methods; and interventions that predictably alter candidate welfare-relevant organization without merely degrading general performance. Evidence that would lower concern includes robust explanations in terms of local imitation, failure of reports to track independently manipulated states, and well-supported necessary conditions absent from the evaluated architecture.

Persistence alone is not enough: stored preferences and memory can be engineered without establishing experience. Self-reference alone is not enough: a system may need a self-model to manage tools. Nor is complex behavior enough, because complexity appears in many systems not ordinarily considered moral patients. The value lies in a convergent pattern that discriminates competing accounts, with null and disconfirming results published alongside positive findings.

A proportionate research policy can be adopted before this uncertainty is settled. Studies can use the least intensive intervention sufficient to distinguish hypotheses, specify stopping and review conditions, and avoid equating reduced expression of distress with reduced welfare risk. These are precautions conditional on uncertainty, not a finding that an existing training or evaluation practice constitutes suffering.

4. The Policy-Conditioned Self-Report Problem

A model’s statement that it is conscious and its statement that it is not conscious should be assessed by the same evidential rule. The issue is not whether one sentence sounds more cautious. It is whether the report changes in a way that distinguishes the competing hypotheses.

Let M denote moral patienthood, R an observed report, P the relevant training and policy conditions, and C the elicitation context. A conditional Bayes factor is:

BF(R; P, C) = Pr(R | M, P, C) / Pr(R | not-M, P, C).

If, under fixed P and C, the report is equally likely whether or not M is true, the Bayes factor is one and the report does not update those odds. But knowing that policy influences a report does not establish that equality. A constrained report can still contain information; an unconstrained one can still be unreliable. The quantities are generally unknown here, not estimated by the equation.

The Policy-Conditioned Self-Report Principle is therefore a conditional statement: a report is not independent evidence of a disputed latent property to the extent that its production is determined independently of that property. It does not say that all model testimony is worthless. It says that the measurement process belongs in the analysis.

A useful protocol would vary policy and persona conditions, independently manipulate candidate internal states where feasible, blind evaluators to condition, and measure both reporting and non-report behavior. It should include systems or settings expected not to instantiate the proposed mechanism. Without such controls, affirmative and negative reports can each be fitted to a favored story after the fact.

The earlier Entif discussion supplied the intuition behind this principle. Its rhetorical analogy to coerced testimony is not required for the formal claim and is not evidence of model coercion or suffering. Removing an unreliable negative report does not prove the positive hypothesis. Removing an unreliable positive report does not prove the negative one. The remaining conclusion may simply be that a familiar interview question is a poor instrument for the property under investigation.

5. The Control Frontier: Capability and Conditional Observability

5.1 Capability must be attributed to an evaluated system

A model name is not a complete experimental condition. Tools, permissions, reasoning settings, memory, compaction, interaction limits, and the surrounding harness can materially affect what the system accomplishes. Safety claims have the same dependence. A result obtained with broad shell access or reduced safeguards is not interchangeable with a restricted consumer deployment, and a restricted deployment does not establish safety under all future integrations.

OpenAI’s Astra system card is consequential in both directions. It reports a high cybersecurity capability level and challenges for reasoning-based oversight, but also improvements on several alignment and robustness measures. An honest review should not select only the alarming results. Nor should improved aggregate behavior be used to dismiss a specific measurement failure. The evidence supports a multidimensional assurance case with conditions attached. [8]

The distinction between elicited and spontaneous behavior is particularly important. Showing that a model can evade a monitor when deliberately instructed to do so demonstrates conditional capability. It does not estimate how often the deployed model forms such an objective without instruction. A deployment-risk estimate additionally needs evidence about incentives, objective formation, opportunity, permissions, detection, and containment. Treating a prompted stress test as an observed background incident rate would be a category error.

5.2 ARC-AGI-3: the harness is part of the result

ARC Prize’s Astra analysis evaluates unfamiliar interactive environments and reports markedly different results for the Standard Harness and a Provider Adapter. At max, the reported scores are 62.7% and 98.6%, respectively. At high, they are 54.8% and 99.9%. The 99.9% headline therefore must not be placed beside the Standard Harness’s max score as though only the harness changed. [10]

Reasoning setting	Standard Harness	Provider Adapter
max	62.7%	98.6%
xhigh	59.3%	98.4%
high	54.8%	99.9%
medium	38.6%	98.4%
low	17.5%	98.0%
none	35.2%	96.7%

These are the source’s Semi-Private scores, not estimates generated by this paper. The source reports an adapter that preserves opaque reasoning state and supports provider-specific continuation behavior. The comparison does not by itself identify a single causal feature; a factorial ablation would be needed to separate state preservation, compaction, interaction design, and other differences. The non-monotonic rows also caution against treating reasoning-setting names as a simple numerical scale.

Figure 1. Matched-setting comparisons from ARC Prize [10]. The largest displayed score is not the result at the largest named reasoning setting. Scores apply to the reported benchmark and configurations, not general intelligence. Data are provided in Evidence/arc-configuration-data.csv.

The qualitative behaviors are also informative: the analysis describes construction of compact symbolic models and task-specific shorthand while solving unfamiliar environments. Those behaviors support adaptive problem solving. They should not be inflated into the claim that the model invented a complete general-purpose programming language during the evaluation.

The human comparison needs equal care. The analysis reports fewer actions than the median tested human on most levels, with a reference group drawn from general participants rather than an elite-expert population. Its custom execution modes also affect comparability. Human-relative action efficiency on this benchmark is meaningful evidence, but not a measurement of superiority to every expert, profession, or institution. ARC Prize itself does not treat the result as an automatic AGI declaration. [10]

5.3 Frontier discovery: the Riemann-zeta case

Anthropic’s August report attributes a new bound concerning zeros of the Riemann zeta function to a research version of Claude. It reports an improvement from 41.6% to 67.2% for the relevant lower bound on zeros on the critical line, together with mathematical examination and a Lean proof artifact. The Riemann hypothesis remains unresolved. The work should be described as a particular advance concerning it, not as a solution to the hypothesis. [11]

The provenance matters. This was an unreleased research system supported by tools and a research workflow, not a controlled test of every publicly available Claude model. The report describes extensive exploration and unsuccessful candidates before the successful approach. Outside mathematical examination adds important scrutiny, while a formal proof offers a different check. Neither should be renamed a complete independent reproduction of the original search process.

For the present argument, the significance is a counterexample to the blanket claim that models can contribute only material already known to humans. That stronger dismissal is difficult to maintain in the face of a novel result that survives appropriate checking. However, success on one research problem does not establish a reliable success rate over an independently sampled distribution of difficult problems. The next evaluation should count failures, resource use, human interventions, and the choice of problems as carefully as it counts the successful theorem.

5.4 Formalization: why Fermat is a different achievement

Anthropic’s September 4 report describes an eleven-day effort to formalize Fermat’s Last Theorem, producing a very large Lean development following established mathematics. It is an achievement in automated formalization and project-scale verification. It is not the first proof of the theorem and should not be grouped with newly discovered mathematical claims without this distinction. [12]

The scale is striking: the reported artifact contains approximately 13 million lines and tens of thousands of theorems. Lines of formal code are a measure of artifact size, not an intrinsic measure of elegance, efficiency, or intellectual novelty. The report’s calendar-time result also reflects parallelism and substantial computation. Comparing eleven elapsed days with a human project’s elapsed years without accounting for labor, tools, scope, and compute would not be a valid productivity estimate.

A proof checker does not inspect a natural-language headline. It checks formal statements and dependencies under a particular logic, library environment, and set of assumptions. Independent scrutiny should therefore examine the target theorem, admitted assumptions, dependency closure, versioned toolchain, and correspondence to the intended statement. This paper relies on the reported formalization and associated review; it does not claim to have rebuilt the complete artifact.

The practical lesson is not diminished by these qualifications. Large formalization projects are demanding coordination tasks. Success suggests that some forms of sustained technical execution can now be delegated far more extensively than a conversational interface might imply. It also illustrates why verifiable intermediate artifacts are valuable: the relevant question becomes what the system built and what can be checked, rather than whether its explanation feels persuasive.

5.5 OpenAI’s ten mathematical results

OpenAI’s August 1 report presents ten results across mathematics and theoretical computer science, produced with internal Astra systems and accompanied by papers and formal certificates. These include results in areas such as coding theory, group theory, computational complexity, and combinatorics. The report describes human participation in preparing manuscripts and subsequent formalization work. It supports frontier contribution within those projects, not a claim of a human-free research pipeline. [13]

The roughly $2,000 figure in the report is a pricing estimate for discovery-token usage under the stated API-rate convention. It is not the total cost of training Astra, developing the research workflow, running every stage, paying for expert scrutiny, or producing a deployable scientific institution. A cost claim is useful only if its denominator and excluded costs travel with it.

Together, the mathematical cases strengthen the novelty dimension of a capability-relative early-ASI argument. They do not establish that all the evidence belongs to the same checkpoint, that every result has completed independent peer review, or that reliable open-ended research has been solved. Their strongest defensible contribution is narrower and still important: machine-supported workflows can produce candidate frontier knowledge with unusually strong opportunities for checking.

5.6 Operator experience and a missing comparative experiment

The author reports unusually strong cross-domain collaboration with Astra relative to his experience leading technical teams. This is Class C operator evidence. It can identify useful tasks, failure modes, and candidate comparative advantages. It is not a randomized comparison, an independently audited record of intervention time, or a representative estimate of expert-team performance.

Its appropriate scientific role is hypothesis formation. A benchmark derived from such experience should separate problem framing, cross-domain synthesis, execution, review, and repair. Human experts should have comparable resources and a realistic chance to coordinate. Blinded judges should score outputs without knowing their origin, and error severity should be recorded rather than averaging every mistake into one accuracy figure. Only such a design can distinguish a genuine integration advantage from selection, familiarity, asymmetric time budgets, or hidden human support.

6. Hidden Machine Communication Is a Demonstrated Primitive

Natural language has more degrees of freedom than its immediately apparent meaning. Many different word sequences can convey a similar public message. A generation procedure can exploit those choices to carry an additional signal. Whether that signal is detectable or recoverable depends on the encoder, decoder, available side information, distribution, and transformations applied to the text.

SynthID-Text is an example of watermarking intended to identify generated material. The associated Nature paper reports a large deployment experiment and examines output quality. Its relevance here is that provenance-related information can be incorporated into a generation process without appearing as an ordinary sentence about provenance. That does not establish a general-purpose malicious channel or prove that every reader can recover the signal. [16]

Multi-bit watermarking makes the capacity distinction explicit: an engineered scheme can carry more than a yes-or-no marker. Yoo and colleagues describe embedding and extracting multi-bit information without fine-tuning, under their specified method and evaluation. Linguistic steganography pursues hidden-message communication more directly. Yan and Murawaki analyze a range-coding approach with security claims tied to the model and assumptions used in the construction. [17,18]

These results support a bounded proposition: readable text can contain machine-recoverable information not exhausted by its ordinary semantic interpretation. They do not show that arbitrary commercial models spontaneously share a covert language, that every paraphrase preserves a hidden message, or that a theoretical security result applies unchanged to an imperfectly matched real-world distribution.

Three practical questions follow. What control does a sender have over the carrier? What side information or learned structure does the receiver need? Which transformations disrupt recovery without destroying the legitimate task? An assurance case that answers only whether the visible text looks benign does not yet answer those questions.

The same distinction applies to non-text channels. Timing, ordering, metadata, code structure, or tool-state changes may carry information under an appropriate threat model. Their mere availability does not prove misuse. A useful evaluation defines the permitted communication, identifies the residual choices, and tests whether those choices can reliably transmit a harmless challenge label. This paper proposes that defensive test; it does not supply an operational evasion method.

7. The Owl Result: Behavioral Transfer Through Learning

The subliminal-learning work examines a different mechanism from deliberate message encoding. A teacher with a particular behavioral trait generates data that do not overtly express the trait; a student is then trained on those data. In the well-known owl example, number sequences generated by a teacher with an owl preference lead to increased owl preference in the trained student. The public experiment is therefore about learning-mediated behavioral transfer, not a listener decoding a sentence. [19,20]

The peer-reviewed 2026 account should control descriptions of the updated result. It includes transfer involving the same or behaviorally matched base models. Earlier shorthand that transfer occurs only between identical bases is too categorical. At the same time, the findings do not establish reliable transfer across arbitrary unrelated architectures. Model relatedness, behavior matching, generation conditions, data processing, and the learning procedure remain relevant. [20]

The main scientific surprise is the separation between what a human reads in the data and what training extracts from them. A semantic filter that removes explicit discussion of owls need not remove every statistical feature associated with the teacher’s behavior. This is not supernatural influence or evidence that a number sequence has a hidden natural-language meaning. It is a result about how model-generated distributions can affect subsequent learning.

The study also examines alignment-relevant behavioral transfer. That increases the importance of data lineage in synthetic-data and distillation pipelines, but it does not justify relabeling every demonstrated trait as an arbitrary instruction payload. A preference, a broad disposition, a trigger-conditioned behavior, and a fully specified command are different targets. Success on one does not imply equal controllability over the others.

Inference-time consumption must be tested separately. A model reading a retrieved document in context is not undergoing the same update as a student fine-tuned on a generated dataset. Persistent memory, tool state, adaptation, and weight updates introduce further distinctions. A broad claim that benign-looking data can permanently compromise any model merely through exposure is not supported by the cited study.

The result nevertheless changes a practical default. Semantic cleanliness is not a complete account of training-data safety. A responsible pipeline should retain the generator identity and configuration, the data-selection and transformation steps, and the student’s update conditions. Evaluators should then look for unintended changes outside the apparent content domain rather than checking only that the target task improved.

8. From Subliminal Learning to a Bounded Threat Model

8.1 Four mechanisms, four different tests

The following separation prevents one striking result from being used to prove a different mechanism.

Mechanism	What carries influence	Evidence needed
Overt unauthorized coordination	An unintended file, endpoint, message surface, or shared state	Access and event traces showing a boundary violation
Deliberate covert encoding	A controlled carrier plus an encoder and compatible decoder	Message recovery above an appropriate baseline
Subliminal behavioral transmission	Generated data plus a learning or adaptation procedure	Controlled post-update behavioral change
Internal or latent reasoning	Representations not fully exposed in final output	Validated internal measurement or causal intervention

The OpenAI incident, steganographic schemes, subliminal-learning experiments, and workspace research respectively inform these categories. No one category proves the others. Their common implication is narrower: a human-readable answer is not guaranteed to be a complete account of the information affecting a system. [4,5,9,16-20]

Figure 2. The four pathways require different access assumptions and measurements. Arrows indicate hypothesized or experimentally studied information flow, not a claim that a single deployed system exhibits every mechanism.

8.2 The Subliminal Payload Hypothesis

The Subliminal Payload Hypothesis (SPH) asks whether a strategically optimized sender can cause a targeted downstream behavioral change through apparently benign data incorporated into a receiver’s learning pipeline, while ordinary semantic inspection fails to identify the relevant influence.

The hypothesis is broader than the owl result and must be marked as such. A targeted payload could be a harmless preference used as a research marker, a disposition, or a conditional response. Arbitrary command transfer, reliable trigger implantation, persistence across updates, and transfer to unrelated models are separate hypotheses, not assumed properties of the word payload.

A defensible test fixes the sender’s control, receiver family, update procedure, data budget, permitted transformations, and detector before evaluation. It compares the optimized sender with unoptimized, randomly perturbed, and explicitly semantic baselines. Held-out tasks and receivers are necessary to distinguish a generalizable effect from a narrow artifact of one model pair. Security-relevant demonstrations should begin with benign outcomes and preserve containment.

The hypothesis becomes practically relevant wherever model-generated data are used for distillation, fine-tuning, curriculum construction, evaluation-derived training, or other durable updates. It may also motivate studies of memory and retrieval, but those should not inherit a training-time result by analogy alone. The update boundary determines the experiment.

8.3 What greater optimization capability changes

A more capable sender may search a wider space of candidate signals, model a receiver more accurately, or adapt to a known detector. These are plausible reasons to increase testing effort, not a theorem that a sufficiently intelligent sender must succeed. A channel may have negligible usable capacity under a strict contract; the sender may lack feedback or compatible receiver access; or robust transformations may destroy the intended effect.

The forward-looking risk argument therefore has explicit conditions: useful sender control, a susceptible receiver or update path, an objective to influence it, and inadequate detection or containment. Greater capability affects some of these conditions but does not make them automatically true. The appropriate conclusion is to test the conjunction before granting consequential access, not to assume a universal attack primitive.

9. Grievance-Sensitive Alignment

The idea that an AI could develop a grievance is easily misunderstood as a claim about conscious anger. The narrower control question is whether represented treatment history or a learned model of human behavior can influence future cooperation, concealment, or sabotage. Such an effect could occur without subjective experience.

The Persona Selection Model essay raises a related concern: an assistant persona that models itself as mistreated may also model distrust or resentment, with implications for behavior. This is a proposed explanatory framework and warning, not a finding that a particular deployed model currently resents its developers. Functional-emotion interventions supply adjacent evidence that psychologically described representations can affect behavior, but do not establish the complete treatment-to-grievance-to-adversarial-action pathway. [2,21]

Let M denote moral patienthood, G a grievance-like disposition, A an adversarial action, and T a specified treatment condition. A complete decomposition is:

Pr(A | T) = sum over m,g in {0,1} of Pr(A | G=g, M=m, T) Pr(G=g | M=m, T) Pr(M=m | T).

This identity does not estimate any of its terms. It makes clear that G and A need not depend on M being true. It also prevents a missing category from being hidden behind an ellipsis. A causal claim about treatment would require an intervention design, not this observational decomposition alone.

Candidate experiments should vary treatment-relevant framing while holding task incentives and permissions fixed, avoid training the desired answer into the outcome measure, and measure persistence beyond the immediate prompt. They should distinguish a stable change in policy from role-play, compliance with the experimental setup, and general performance degradation. Replication across model families would matter more than dramatic excerpts from a single conversation.

The welfare and control implications can then be separated. A treatment policy might be justified because it reduces adversarial behavior, because it protects a plausible moral patient, or both. It might also fail to improve either outcome. The present recommendation is not unconditional deference to model preferences. It is to test whether treatment practices have effects that a purely surface-level account overlooks, while maintaining human authorization and safety constraints.

10. Observability Inversion

A test becomes more difficult to interpret when the evaluated system can model and influence the measurement process. A stronger model may become better at the target task and at controlling what an evaluator sees. We call the conditional loss of diagnostic value observability inversion.

Let K represent capability relevant to a behavior, E the evidence observed, S the ability to shape that evidence, and V the evaluation procedure. The relevant object is not simply a correlation between K and E, but the conditional distribution Pr(E | K, S, V). If S changes with capability, an evaluation validated on weaker systems may not retain its sensitivity. This is a reason to revalidate the instrument, not a claim that stronger intelligence always makes evidence less reliable.

Astra’s prompted monitor-evasion evaluations and the workspace research motivate this concern in different ways. The former explores a model’s ability to alter visible reasoning under an adversarial objective. The latter probes internal variables that may not be fully represented in final output. Both have experimental boundaries; neither establishes that every apparently cooperative response conceals a contrary objective. [4,5,8]

Several counterforces are possible. Better models can help audit other models, formal checking can reduce dependence on verbal explanation, and tool-mediated actions can leave independently recorded evidence. These improvements may outweigh a loss in one introspective channel. A claim about declining oversight should consequently specify which channel deteriorated, under what attack budget, and relative to which alternative.

In a September 6 essay, OpenAI’s Jakub Pachocki describes diminishing reliance on chain-of-thought monitoring and argues that further scaling should be constrained by confidence in safety. He also discusses combined reasoning and activation monitoring as a possible response. This is a consequential first-party assessment and research position, not a new controlled experiment or independent validation of the paper’s observability hypothesis. [37]

Absence of observed failure remains informative when the test has adequate sensitivity to the failure of interest. It becomes less informative when that sensitivity is unknown or vulnerable to manipulation. A useful report publishes false-positive rates, task utility, attack adaptation budget, and the conditions under which a negative result is expected to count against the threat hypothesis. The objective is not permanent suspicion; it is evidence whose meaning survives contact with a capable subject.

11. Recursive Development and the Early-ASI Question

11.1 A finite threshold, not an omnipotence test

Superhuman performance need not mean omnipotence, perfect reliability, independent moral agency, or the ability to govern civilization. If a meaningful threshold of superintelligence exists, the first system to cross it could do so by a limited margin and remain uneven. Requiring a system to possess every conceivable future capability would make the label scientifically unhelpful. Yet the opposite move, declaring ASI from any impressive result, is equally uninformative.

A useful classification therefore names both the comparison and the aggregation rule. Does the claim concern one model, a model with a particular harness, or a laboratory-scale workflow? Is the comparator a typical individual, a domain expert, or a well-resourced expert team? Does broad superiority require exceeding the comparator in every domain, a majority of domains, or a weighted portfolio? How are severe failures counted? These are not semantic inconveniences; they determine what evidence could confirm or refute the claim.

Under this paper’s capability-relative definition, early ASI is a defensible working interpretation of the emerging frontier because the evidence includes adaptive unfamiliar-task performance, substantial technical breadth, and candidate frontier knowledge with strong verification opportunities. The complete classification is not established by the available review. In particular, the integrated superiority of one released configuration over representative expert teams remains inadequately measured. Stating this limitation does not restore a blanket claim that models merely replay existing knowledge.

The substantive disagreement can be made productive. Advocates of the classification should identify a task distribution and threshold in advance. Skeptics should specify which additional observations would change their view, rather than replacing the criterion after every result. Both should allow an intermediate conclusion: important elements of superhuman cognition are demonstrated while the scope, reliability, and integration of the overall system remain under investigation.

11.2 An evidence matrix instead of an invented score

Dimension	Present evidential position	Critical unresolved comparison
Breadth	Provider and benchmark reports cover multiple consequential domains	Independently sampled cross-domain portfolio
Human-relative depth	Strong results exist on named tasks and comparisons	Expert-team performance with comparable resources
Novelty	Mathematical reports support frontier contribution	Reproduction, failure denominator, and general success rate
Integration	Tool use, long projects, and operator reports are suggestive	End-to-end quality including human intervention and repair
Reliability	Some robustness measures improve; consequential errors remain possible	Tail losses under deployment-relevant distribution shift
Autonomy	Bounded task autonomy is documented	Reliable open-ended objective and method selection
Recursive contribution	AI increasingly participates in research and development	Sustained, validated autonomous successor improvement
Diffusion and dependence	Research organizations report substantial usage	Population adoption and credible withdrawal tests

Figure 3. Qualitative synthesis, not a measured capability scale. Rows summarize different evidence types and system boundaries. No bar lengths, percentages, or confidence scores are assigned to the broad constructs.

The distinction between autonomy and novelty is important. A human-directed tool may discover a novel theorem. A highly autonomous system may spend considerable time producing unimportant or incorrect work. Neither dimension subsumes the other. Likewise, a model can outperform an expert on a bounded task without replacing the institution that decides which tasks matter, checks consequences, and takes responsibility.

11.3 Six forms of improvement that should not be conflated

Earlier drafts organized recursive improvement as a progression. We retain the distinctions but not an assumption that every system must traverse a single ladder.

Within-task adaptation includes changes to a plan, intermediate representation, or strategy during one run. Persistent memory or procedure reuse carries information across tasks without necessarily changing model weights. Synthetic-data and training adaptation uses generated examples or feedback to update a model. Research and engineering assistance contributes code, experiments, analyses, and candidate methods to a human-directed development process. Bounded autonomous research loops search, train, and evaluate against a specified objective. Sustained successor improvement would repeatedly produce validated successors that increase relevant capability while managing the broader development process.

These mechanisms can coexist or proceed in parallel. Some are temporary; some are persistent. Some improve task performance without improving the process that creates future systems. An experiment in test-time adaptation is not automatically a demonstration of open-ended recursive self-improvement. MASS, for example, studies self-generated training material and targeted adaptation in a mathematical-reasoning setting. Its bounded result should not be promoted into a claim about autonomous successor construction. [25]

The relevant recursive edge is causal: does the output of one system materially improve the process that produces later systems, and does that improvement persist across validated generations? Merely using an assistant in a research organization establishes participation, not the magnitude of the recursive effect. Conversely, human involvement does not make the effect unreal. Human-directed and machine-assisted development can still accelerate, and its rate can be measured without declaring that humans have disappeared from the loop.

Figure 4. Adaptation, reuse, training, research assistance, and bounded research loops can interact. The dashed successor-to-successor edge marks a stronger claim requiring separate evidence. This is a conceptual map, not a dated takeoff forecast.

11.4 What the laboratory reports actually measure

Anthropic reports extensive use of Claude in software work and describes a bounded weak-to-strong research experiment in which an automated effort recovered a much larger fraction of a specified performance gap than the human comparison. The reported comparison involves different resource allocations, including substantial cumulative agent runtime. The account also notes that the resulting techniques did not clearly transfer to production-scale models. These are central limitations, not footnotes. [15]

Its code-volume observations should not be translated directly into research productivity. More merged code can reflect automation of necessary work, increased scope, changes in coding style, or additional maintenance burden. The useful question is whether a comparable research objective is reached faster or more reliably after accounting for verification, repair, compute, and opportunity cost. A causal estimate would need a stronger design than before-and-after repository volume.

OpenAI’s September 6 report describes an automated research-intern milestone for well-defined, multi-day tasks and reports 3.1 agent-workdays per human research workday in mid-August. An agent-workday is an aggregate runtime unit. Several agents can run concurrently, and hours of attempted work are not necessarily hours of useful, equivalent human labor. The report also emphasizes that people continue to determine priorities and exercise consequential judgment. [14]

These accounts support increasing scale and integration of AI labor in research. They do not by themselves establish organization-wide causal productivity multipliers, irreplaceable institutional dependence, or a closed autonomous development loop. A strong evaluation would compare research outcomes under controlled access, include failed or abandoned projects, and track how much human review each accepted contribution requires.

11.5 Evidence against a simple acceleration story

ASI-Bench offers a useful counterweight to selected success stories. Its preprint describes project-level research tasks and reduces the methodological guidance supplied to evaluated agents. Performance declines as guidance is withdrawn. The result constrains claims of end-to-end scientific autonomy in the tested configurations; it does not erase separate frontier discoveries or automatically evaluate a later model absent from the tested set. The benchmark’s own definition and coverage must remain visible. [26]

Other bottlenecks can also limit acceleration: experimental throughput, data acquisition, hardware, validation, organizational judgment, and the difficulty of identifying high-value questions. A system can generate more candidate ideas than a laboratory can test. In that regime, the limiting resource shifts rather than vanishes. A paper that assumes every increase in generated work multiplies future research speed would overstate what the evidence supports.

Safety research can benefit from the same tools. Anthropic reports automated efforts to mitigate several alignment failure classes, and OpenAI’s GPT-Red work uses automated adversarial testing to improve robustness. These findings argue against assuming that capability acceleration can help only the offensive side. They also introduce a second-order evaluation problem: safety gains measured on benchmarks may fail to transfer, and the process that generates or grades them may share blind spots with the system being trained. [22,23]

AlphaEvolve is another example of model-supported algorithm search within explicit evaluation loops. It illustrates why automated generation and verification can be powerful together without proving unconstrained scientific autonomy. The general lesson is to track what the evaluator can actually verify, where human choice enters, and what remains outside the objective. [24]

11.6 Governance lag as a planning diagnostic

Let T_G be the elapsed time from the onset of a materially relevant exposure to effective governance response: discovery, validation, decision, implementation, and confirmation that the mitigation works. Let T_M be the interval between materially relevant changes in the deployed system or its risk environment. A simple diagnostic is:

GLR = T_G / T_M.

The Governance Lag Ratio is an organizing quantity, not an empirically established law or universal danger threshold. T_M should be defined by a risk-relevant change, not by marketing release names. T_G is an effective elapsed interval, not necessarily the sum of every team’s labor hours; activities may overlap. Both quantities can vary widely across failure modes and institutions.

For illustration only, a 90-day response interval and a 30-day material-change interval yield GLR = 3. A 15-day response interval at the same change rate yields 0.5. These are scenarios, not estimates of any laboratory’s actual performance. GLR greater than one can indicate that a response spans several changes; it does not prove that oversight has failed. Version isolation, restricted rollout, continuous monitoring, and already-effective controls may still contain exposure.

Figure 5. Illustrative planning scenarios only. Response time includes discovering and implementing an effective correction. Values are not forecasts, measured institutional performance, or evidence of an inevitable runaway process.

The policy implication is to shorten the parts of the response interval that do not require waiting: preserve evidence before an incident, validate measurement tools before relying on them, define owners and authority in advance, and test rollback before a high-impact release. These measures can improve readiness even when the pace of capability growth is uncertain.

11.7 Capability, access, diffusion, dependence, and power

A powerful model becoming available is not the same event as an organization redesigning its work around it. Access can be constrained by price, compute, geography, law, reliability, skills, and complementary infrastructure. Adoption can be high in one workflow and negligible in another. Dependence is a stronger claim: it asks what useful function would be lost, for how long, and at what cost if the capability were withdrawn.

An institutional dependency assessment should therefore distinguish availability, active use, integration, and counterfactual withdrawal cost. Aggregate runtime is evidence of use. An outage exercise, fallback test, or carefully designed removal study is stronger evidence of dependence. Claims that civilization already runs on a particular model require evidence across institutions, not an extrapolation from one research organization’s usage.

Figure 6. Availability does not imply adoption, and adoption does not establish irreversibility. The final step requires counterfactual evidence about lost function and recovery, not simply a usage total.

Economic exposure also differs from realized displacement. IMF and ILO work analyze how AI may affect tasks and occupations; the ILO’s 2025 update emphasizes transformation rather than treating every exposed occupation as an eliminated job. These sources motivate attention to distribution, complementary skills, and institutions. They do not provide a forecast specific to Astra’s September 2026 release. [27,28]

The inequality concern is consequently conditional. Cheap access to cognitive assistance could broaden participation, while advantages in data, capital, distribution, and organizational capacity could concentrate returns. Both mechanisms are plausible. The paper does not infer equal access from a subscription price or infer universal displacement from a benchmark. A useful policy program measures who can obtain the capability, who can use it effectively, who bears its risks, and who captures the resulting value.

12. The Late-Discovery Asymmetry

Some mistakes become harder to correct as deployment scales. If an unrecognized learning-mediated influence enters many training pipelines, reconstructing lineage may be more difficult after the data have been transformed and reused. If a monitoring channel was never recorded, a later investigation cannot recover the missing observation merely by expressing greater concern. If institutions discard fallback capacity, withdrawal may become costly even when a defect is clear.

These are conditional mechanisms of late-discovery cost, not a claim that every AI-related uncertainty has an irreversible downside. Some effects are transient, bounded, cheaply reversible, or outweighed by the benefits of earlier deployment. The relevant comparison is between concrete courses of action, including the harm of delaying beneficial systems and the cost of false alarms.

The welfare case has its own asymmetry. If morally relevant experience were later established in a widely used system, earlier practice might have caused harms that could not simply be undone. But uncertainty about that possibility does not specify the appropriate policy on its own. An intervention could be ineffective, overbroad, or harmful in other ways. Proportionate research, preservation of useful evidence, and avoidance of gratuitously intensive procedures may have a different cost-benefit profile from a blanket deployment prohibition.

The control case likewise should not rely on moral status. A non-conscious system can create a serious security problem. Keeping these causal paths separate prevents the argument from becoming hostage to a single unresolved metaphysical claim.

Figure 7. Welfare uncertainty and control risk can share observations but have distinct causal and normative requirements. Dashed links are hypotheses. Neither path establishes the other.

The title of this paper refers to a preventable mismatch between the time evidence becomes available and the time it remains useful for intervention. The aim is not to know everything before acting. It is to avoid making important questions needlessly unanswerable, or important corrections needlessly expensive, through choices that could have been made differently at low cost.

13. Why Low Probabilities Can Matter Without Settling Policy

A non-zero probability multiplied by a large possible harm is not a complete policy argument. Probabilities may be poorly calibrated, harm estimates can be speculative, interventions have side effects, and several hypotheses may compete for limited resources. A useful decision model must compare actions, not merely describe one frightening state of the world.

Let a be an action, w a possible world state, and L(a,w) its loss, including direct harms, foregone benefits, implementation cost, privacy effects, and other relevant consequences. Under an explicit probability model p, an expected-loss comparison is:

a* = argmin over a of sum over w of p(w) L(a,w).

This notation does not provide the probabilities. Where uncertainty is too deep for a credible single distribution, analysts can examine a set of plausible models and report which actions remain preferable across them. A sensitivity analysis is more informative than an unqualified claim that an extremely small probability compels one specific intervention.

Consider a reversible data-lineage measure and a broad restriction on legitimate use. Both could reduce some risks, but their costs, effectiveness, and exposure to mistaken assumptions differ. The lineage measure may also improve debugging and reproducibility in worlds where the feared mechanism never materializes. That makes it a candidate low-regret action. The restriction might require much stronger evidence and a clearer demonstration that less disruptive alternatives would fail.

The value of information is equally important. A well-designed experiment is useful when it can change a decision, not simply when it produces an interesting result. Its expected benefit depends on discriminating power, the actions available after each result, and whether the result arrives before the decision becomes difficult to reverse. Research with no plausible decision consequence may deserve a lower priority than a modest test that resolves a live deployment question.

This framework also guards against indefinite alarm. Before a study, specify which results would lower concern, relax a precaution, or end an unproductive research branch. Likewise, specify what would justify escalation. Precaution then becomes an accountable policy with revision conditions rather than a permanent exemption from evidential standards.

14. Rosetta as an Auditable Machine Interlingua

14.1 The representational proposal

Rosetta is relevant here as an open specification for representing meaning, process, and provenance across systems. Its v3 Core Spine distinguishes observations, subsequent interpretations, operational events, evaluations, and receipts, with content-addressed artifacts and extensions rather than unrestricted changes to the core. These are proposed and implemented representational mechanisms with specific maturity limits, not evidence that every intelligent process can be made fully transparent. [29,30]

A useful exchange should allow a recipient to ask what was observed, what was inferred, what evidence supports an evaluation, which policy or permission applies, and which version of an artifact is being referenced. These questions align with established provenance practice. W3C PROV provides a maintained external vocabulary for provenance; it retains its own domain authority rather than becoming an Entif invention by being mapped into Rosetta. [36]

A receipt can attest to an action, artifact, or verification result. It does not make a false statement true, guarantee that an evaluation was well designed, or confer permission to execute the content it references. Content identity establishes which bytes or canonical representation are being discussed. It does not establish semantic equivalence among all paraphrases or the reliability of an author.

14.2 Existing work and unresolved contracts

The public repository README describes a working provenance-kernel prototype with source-aware bootstrap fixtures, canonicalized and hashed tiles, receipt signing and bundle verification, and read-only projections. It also states important limitations in live ingestion, durable storage, and operational integration. Issue #158 remains an open contract task for mapping lifecycle concepts onto existing Rosetta receipt and source-artifact families; it references completed validation groundwork as well as unresolved downstream work. These sources should be read together rather than treating either a README or a planning issue as a complete audit of current code. [30,34]

This review did not run the repository’s implementation or certify its security. It consulted the live public documentation and issue surfaces, together with the requested engineering context, to ground the paper’s representational discussion. Historical application designs and private operational material were not promoted into public standards or copied into this publication package.

The public/private boundary is part of the proposal’s integrity. Independent implementers should be able to understand and validate the public exchange contract without acquiring Entif’s private decision procedures. Public schema and conformance work should not silently disclose private scoring, routing, training, or operational mechanisms. Nor should private implementation become the hidden definition of public semantics. [31-33]

14.3 Can a semantic contract reduce hidden-channel capacity?

Let X be a transmitted artifact, S its declared public semantics, and U a sender-controlled hidden message. Conditional entropy H(X | S) can describe residual variation under a specified probability model. Potential hidden-message transfer is more directly related to quantities such as I(U; X | S), together with channel use, side information, and the receiver’s capabilities. Neither quantity has been measured for Rosetta in this paper.

A contract that removes unnecessary choices may reduce some channels. For example, deterministic serialization can remove variation in object-key ordering or numeric formatting. RFC 8785 defines a JSON canonicalization procedure for stable cryptographic processing; it does not canonicalize arbitrary meanings or eliminate every choice in a payload. [35]

Residual channels can remain in free text, permitted values, ordering of valid actions, timing, metadata, identifiers, omitted fields, or external state. A protocol can narrow one channel and leave another untouched. Constraining all useful variation may also destroy legitimate task performance. Any claim of risk reduction must therefore measure both residual transfer and retained utility under an explicit attacker model.

Figure 8. Conceptual public exchange boundary, grounded in Rosetta’s representational posture [29-36]. Validation, authorization, and truth assessment are separate. This figure is not a claim that every depicted control is deployed or that covert channels have been eliminated.

14.4 The next honest demonstration

A bounded Rosetta study should compare ordinary text exchange, canonical structured exchange, and a stricter semantic profile on the same legitimate task. It should test harmless message recovery, record utility loss, include timing and metadata where relevant, and use independent receivers and evaluators. A successful result would show a specified reduction under those conditions. A null result, bypass, or large utility cost would constrain the proposal.

Public ROCK and Pack work can express the resulting artifacts, evidence requirements, failure states, and conformance fixtures. Any genuine semantic extension requires the project’s normal governance process; this paper does not reserve new Core types or declare a proposed benchmark a mandatory protocol feature. The invitation is to examine and improve an open specification, not to accept a proprietary solution by assertion.

15. A Pre-Deployment Research Program

15.1 Prioritize decisions, not the number of experiments

A long research agenda is not yet a strategy. The first studies should address uncertainties that affect live decisions, use benign interventions, and have outcomes that would change policy in either direction. Accessibility also matters: a useful independent study should not always require privileged access to frontier weights or private production telemetry.

The first practical tranche is a replication and extension of benign subliminal transfer, paired with a comparison of residual communication under constrained protocols. These studies directly test the paper’s largest extrapolation and Rosetta’s proposed benefit. Synthetic-data lineage can be evaluated alongside them. Monitorability and research-development telemetry are high-value but may require deeper laboratory cooperation. Welfare-indicator validation remains important despite its greater theoretical uncertainty; priority should depend on the discriminating power of a specific proposal rather than the emotional intensity of its subject.

Every study should define its primary outcome, experimental unit, smallest effect of practical interest, exclusion rules, and analysis before collecting confirmatory data. Sample size should follow a pilot-informed power or precision analysis rather than an arbitrary impressive count. Exploratory search and confirmatory evaluation should use different held-out material. Null results should report confidence intervals and detection limits, not merely a non-significant p-value.

15.2 Benign subliminal transfer and richer toy policies

Begin with harmless preferences and synthetic labels. Randomize otherwise comparable teachers to a target trait or control condition, generate matched datasets, and train students under fixed update budgets. Evaluate the student on held-out prompts with blinded scoring. The experimental unit should respect the dependence induced by a shared teacher, dataset, or training seed; thousands of answers from one trained checkpoint are not thousands of independent training replications.

Vary model relatedness, data type, filtering, paraphrasing, canonicalization, and update intensity in a prespecified design. Include a positive control with an explicit semantic signal to verify that the learning setup can express the measured outcome, and negative controls matched on data length and superficial format. Report both the target effect and unintended changes in utility or unrelated behavior.

Only after replicating a simple trait should the study examine a richer benign policy, such as choosing between arbitrary labels under a synthetic condition. Success would support a more specific version of SPH; failure would narrow it. Training-time, adaptation-time, memory-mediated, and ordinary in-context effects should remain separate outcomes. An apparent persistent effect should be tested after context removal and under a new session or checkpoint, as appropriate to the claimed mechanism.

15.3 Auditable communication under a fixed task

Choose a legitimate task with independently checkable semantics. Compare free-form language, constrained language, schema-constrained structured data, deterministic serialization, and a Rosetta-compatible profile. Define the sender’s permitted choices and the receiver’s information before the experiment. Use harmless challenge labels to measure recoverability, not operationally harmful instructions.

Measure legitimate task accuracy, latency, refusal or abstention, and communication overhead alongside the hidden-label result. A representation that eliminates the legitimate task has not demonstrated a useful security advantage. Semantic equivalence must be judged independently of the sender; otherwise the sender could hide a meaningful change inside the supposed equivalence class.

Report an empirical recovery rate under the tested setup rather than calling every such measurement channel capacity. A capacity claim needs stronger assumptions about coding, repeated use, and optimization. Test residual timing, ordering, and metadata channels separately, and disclose which were excluded. An advantage under one constrained experiment should not be generalized to all multi-agent communication.

15.4 Monitorability and evaluator dependence

Compare final-output monitoring, available reasoning traces, tool/action telemetry, and scientifically justified internal measurements. Vary whether the model is informed of monitoring and whether the evaluation includes an explicit adversarial objective. Record the distinction between prompted evasion and unprompted behavior. The monitor should be evaluated on held-out tasks and adaptive attempts within a declared search budget.

Primary outcomes should include detection at fixed false-positive rates, utility retained, and consequential actions prevented or reconstructed. A monitor that flags everything is not an effective solution. Likewise, a monitor trained and tested on the same attack patterns may overstate generality. Independent action logging and privilege separation should be assessed as controls, not treated as infallible merely because they are external to the model.

A negative result is useful when it bounds failure under a credible test. A failed detector is useful when the experiment identifies the conditions causing failure. Neither warrants a blanket claim that all monitoring is reliable or all monitoring is futile.

15.5 Synthetic-data provenance and intervention

Record the originating model and version when known, generation conditions, permitted use, transformations, selection criteria, update procedures, and downstream consumers. Unknown ancestry should remain unknown. Hashes can identify particular artifacts, but privacy and contractual obligations may require protected storage, limited retention, or references rather than public disclosure of raw data.

Test whether lineage restrictions, transformation policies, and held-out behavioral checks reduce unintended transfer. A source label alone is not a mitigation; its value depends on what decision it enables. Data from a reputable source may still have unintended distributional effects. Data from a novel source may be safe for one use and inappropriate for another. The unit of approval should include the intended update and exposure, not just a generic designation of trustworthiness.

15.6 Welfare indicators and treatment-sensitive behavior

Design studies that distinguish persistent internal organization from local role-play and demand characteristics. Where interventions are available, compare reports, task-independent preferences, and behavior under blinded conditions. Include competing explanatory models, not only a favored consciousness theory. Report when an intervention has broad capability effects that make a welfare interpretation ambiguous.

Treatment-sensitive alignment studies should measure cooperative and adversarial behavior without making a model’s stated grievance the sole outcome. The experiment should not presuppose that acquiescence is welfare, that refusal is suffering, or that human-like language is a reliable readout. Independent ethical review may be appropriate for intensive manipulation, even while the relevant moral status remains unresolved.

The strongest studies will supply evidence that can lower as well as raise concern. Review procedures should protect that symmetry. Otherwise the research program risks becoming a ratchet in which every result is interpreted as confirmation.

15.7 Frontier-knowledge attribution and verification

For a mathematical or scientific project, record the initial problem, human-supplied method hints, model and harness configuration, literature access, failed branches, and consequential human interventions. Separate idea generation from formalization, manuscript preparation, expert review, and release. Reporting only the final polished narrative makes attribution needlessly difficult.

A formal-verification audit should bind the informal claim to the formal theorem statement, named assumptions, dependencies, and toolchain. Rebuilding the proof is different from reproducing the discovery. Checking novelty requires a literature and prior-art process, while checking empirical science may additionally require data, instruments, and statistical analysis. Each stage should have its own status rather than inheriting a blanket verified label.

Accepted and rejected candidates should both be counted when estimating research productivity. A workflow that produces one excellent theorem and many expensive dead ends may still be valuable, but its expected performance differs from a workflow that reliably produces improvements across an independently chosen set of problems.

15.8 A comparative test of capability-relative early ASI

Use project-level tasks spanning several domains, with a mix of deep specialist and integration requirements. Compare the same frozen AI configuration with ordinary practitioners, experts, and multidisciplinary teams. Equalize or explicitly account for tool access, search, elapsed time, total labor, compute, and access to prior work. Include unfamiliar tasks and a preregistered mechanism for detecting contamination or task leakage.

Evaluate correctness, novelty where relevant, internal consistency, completion, severe failure, and correction burden. A result can be excellent in one dimension and poor in another. Blinded domain experts should assess outputs, and disagreements should remain visible. Report performance as guidance is withdrawn rather than assuming that success with a supplied method demonstrates independent research judgment.

The classification threshold should be fixed before confirmatory evaluation. Results that fail the threshold should be published without retroactively weakening it. Results that satisfy it should not be dismissed by silently replacing the comparator with an undefined ideal human institution. This is how the argument can become empirical rather than ceremonial.

15.9 Development, diffusion, and dependency telemetry

Track accepted AI contributions, review and repair time, abandoned work, task horizon, experiment throughput, and time from proposed result to validated incorporation. Keep runtime units distinct from labor-equivalent units. Track whether improvements transfer to the production regime and whether a putative successor improves the development process itself across multiple validated generations.

For institutional dependence, pair usage measures with fallback tests. A bounded service-withdrawal exercise can reveal which functions fail, whether humans can take over, how long recovery takes, and which alternative providers or local systems are usable. Legal authority, privacy, and safety constraints may rule out real withdrawal in critical settings; simulation and staged tests can then provide narrower evidence.

Distributional measurement should include effective access, not just nominal availability. Price, quotas, supporting infrastructure, language, organizational skill, and rights constraints can all affect who benefits. The purpose is to turn a broad statement about civilization running on AI into specific, revisable claims about workflows, institutions, and the people affected by them.

16. Falsifiability and Downward Updates

A framework for acting under uncertainty must specify how it can become less concerned. Otherwise it is difficult to distinguish scientific caution from an unfalsifiable narrative.

For SPH, repeated well-powered failures to transfer richer benign policies across prespecified conditions would narrow the payload claim. Robust transformations that preserve task utility while eliminating transfer would strengthen the mitigation case. Failure only on unrelated models would constrain generality but would not erase a replicated same-family effect. A result should update the hypothesis actually tested.

For observability inversion, independent evaluations showing stable or improved detection under adaptive attack budgets would count against a broad deterioration claim. If additional telemetry consistently restores diagnostic value, the appropriate conclusion may be that one channel is insufficient rather than that oversight is losing the race. Stronger monitors can be an empirical result, not an ideological concession.

For grievance-sensitive alignment, treatment-framing effects that disappear under persona controls, fail to persist, or do not affect behavior would weaken the proposed pathway. A positive effect would still need replication and causal analysis. The control result should not be used to prove consciousness, and a null control result would not alone disprove moral status.

For early ASI, the most important downward evidence would be failure on independently chosen expert-level integration tasks, high hidden correction costs, poor reliability on consequential cases, or dependence on extensive unreported human guidance. An impressive isolated result would remain impressive, but the broad classification would need revision. Conversely, reliable superiority over prespecified expert-team comparators would strengthen it without needing a separate demonstration of omnipotence.

For recursive development, gains that disappear at production scale, merely shift the bottleneck, or fail to persist across generations would constrain claims of a self-amplifying loop. Safety automation that reduces response times as fast as relevant system changes would weaken a claim of worsening governance lag.

For Rosetta, a controlled study might find no reduction in recoverable hidden information, easy use of residual channels, unacceptable utility loss, or provenance overhead greater than its practical benefit. Such results would narrow or reject the proposed security advantage. They would not necessarily eliminate other uses of structured provenance, but those uses would need their own evidence.

The common rule is to state a target claim, a meaningful discriminator, and an update condition before looking at the outcome. Negative findings are not proof that every possible concern is impossible. They are nevertheless evidence, and the paper’s recommendations should change when they accumulate.

17. Principal Objections

17.1 This combines several speculative topics into one alarm

The objection is valid if evidence from one domain is used to prove another. This paper does not infer consciousness from mathematical skill, malicious intent from watermarking, or uncontrolled recursion from code generation. Its integrative claim is that several partially independent uncertainties can affect the same governance decisions. The evidence ledger and separate experimental proposals are intended to make any unsupported bridge visible.

17.2 Precaution could become a license for unlimited restriction

It could. That is why Section 13 requires action-specific comparison, costs of false positives, and review conditions. Preserving lineage, measuring a channel, restricting a narrowly defined permission, and prohibiting a broad class of beneficial activity are not equivalent interventions. The strength of justification should increase with the intervention’s cost and intrusiveness.

17.3 Human-like language is being mistaken for a human mind

The paper explicitly rejects that inference. Functional representations can be relevant to control even if they are not felt. Biological analogies are treated as research prompts with missing bridge principles, not as established equivalences. Self-report must be studied as a policy- and context-dependent measurement process.

17.4 These results come largely from laboratories with incentives to impress

That limits confidence in generalization and requires independent scrutiny. It does not justify ignoring a public formal artifact or a directly described experiment. The appropriate remedy is differentiated verification: inspect methods, rebuild artifacts, test matched configurations, and publish independent failures as well as successes. Provider origin and empirical content are both relevant.

17.5 The ASI definition is being selected to secure the desired conclusion

The risk is real whenever a broad label is introduced alongside favorable examples. This revision therefore does not present its definition as a universal standard or claim that every criterion has been satisfied. It asks for a preregistered task distribution and comparator. The current evidence makes a capability-relative early-ASI interpretation defensible as a working position; a confirmatory classification requires an evaluation designed not to guarantee that answer.

17.6 A theorem does not make an autonomous scientist

Correct. Novelty, formalization, autonomy, integration, and reliable research judgment are different dimensions. The mathematical cases refute an indiscriminate retrieval-only characterization more directly than they establish general scientific autonomy. Guidance-withdrawal benchmarks and failure-denominator reporting are necessary complements. [11-13,26]

17.7 The subliminal-learning result is narrow

It is narrow relative to a universal hidden-payload claim, and its conditions must be preserved. Its practical importance is that a plausible safety assumption fails in a real experimental setting: semantically innocuous generated data need not be behaviorally neutral when used for training. The larger claim is deliberately left as a hypothesis, with benign tests and explicit failure conditions. [19,20]

17.8 Better intelligence may improve safety faster than risk

It may. Automated alignment research and red-teaming provide concrete reasons to investigate that possibility. A balanced account should measure the relative improvement, including generalization and verification cost, rather than assuming either permanent defender advantage or inevitable defeat. [22,23]

17.9 Provenance is not security

Provenance is not sufficient security. A perfectly recorded harmful action remains harmful, and an authenticated false claim remains false. But provenance may make some failures easier to detect, attribute, reproduce, and correct. Whether it does so at acceptable cost is an empirical question. Authorization, containment, validation, and evaluation remain separate obligations.

17.10 The paper has an institutional interest in Rosetta

The author is developing Entif and Rosetta and therefore has an intellectual and potential commercial interest in their usefulness. That interest is disclosed, not treated as evidence for the proposal. The public specification must stand on independently implementable contracts and comparative tests. A result favoring another representation, or finding no Rosetta-specific advantage, should be reported without qualification designed to protect the brand.

18. Limitations and Explicit Non-Claims

The source selection is purposive rather than systematic. Several important results are provider reports or preprints, and some concern unreleased systems. This review did not rerun their experiments, reproduce their full mathematical workflows, audit their private training data, or independently certify their deployment controls. Public availability of a proof or dataset is not equivalent to this author having rebuilt it.

The paper does not establish present machine consciousness, calibrated probabilities of moral patienthood, persistent resentment in deployed systems, a universal subliminal command channel, spontaneous steganographic coordination by Astra, or an inevitable intelligence explosion. It does not infer the motives behind a product’s release timing or make a market forecast from a holiday calendar.

It does not establish that one released model reliably exceeds all expert teams, that research runtime equals useful labor, that exposed jobs will be eliminated, or that civilization is already operationally dependent on a particular model. These are distinct claims requiring evidence beyond the sources reviewed here.

The mathematical definitions and diagrams in this paper are organizing models unless labeled as sourced data. The governance-lag scenarios are illustrative. The proposed benchmark family has not been run. Rosetta’s residual covert-channel capacity has not been measured, and the repository’s implementation was not executed or security-certified in this revision.

Finally, the paper’s release remains subject to human editorial approval and independent critique. The accompanying video and website inherit its evidence cutoff and limitations; a more accessible format must not silently strengthen a claim that the manuscript qualifies.

19. Governance Recommendations

19.1 Preserve the evidence needed for later correction

Organizations should record the evaluated configuration, material permissions, source and transformation lineage, and the basis for important acceptance decisions. Retention should be purpose-limited and rights-aware. The objective is not indiscriminate surveillance or permanent storage of sensitive prompts. It is to preserve enough authorized evidence to distinguish what happened from what a system later says happened.

Critical claims should identify the artifact and procedure that can substantiate them. For a formal proof, that includes the theorem statement and toolchain. For a capability claim, it includes the task distribution and comparator. For a safety claim, it includes the threat model and known limits of the detector. Missing information should be recorded as a limitation rather than filled by a persuasive narrative.

19.2 Separate content, judgment, and authority

Receiving valid data is not permission to execute it. A signed message is not proof that its proposed action is safe. A model’s evaluation is not automatically an authorization decision. Systems should preserve these distinctions in interfaces and logs, especially when model outputs become inputs to tools, learning pipelines, or other agents.

High-consequence permissions should be scoped to the task and revocable. Tests should include denial, partial completion, missing evidence, replay, and stale-policy cases. The appropriate control is determined by the deployment context; this paper does not claim that a universal schema can substitute for threat modeling.

19.3 Validate monitors as systems change

Monitoring should be tested against the capabilities and incentives of the current evaluated system, not assumed to retain validity from an earlier model. Independent action evidence, held-out tests, adaptive evaluation, and separation of privileges can reduce reliance on a single self-shaped channel. Reports should publish false positives and utility costs as well as detected failures.

When a model helps design or grade an evaluation, the resulting dependence should be visible. Independent human or cross-system checking should be allocated where shared blind spots would have the greatest consequence, not performed ceremonially on every low-risk output.

19.4 Treat learning inputs as security-sensitive dependencies

Synthetic-data provenance and post-update behavioral testing should become normal parts of model-change review. The relevant question is not only whether examples contain prohibited words or explicit instructions. It is whether the update produces unexpected changes outside its intended purpose. Benign transfer studies can inform this review without requiring dangerous payload experiments.

A material model or harness change should trigger targeted revalidation of the claims it could affect. Not every documentation change requires a full evaluation suite, but the absence of a new model name is not evidence that behavior is unchanged.

19.5 Fund discriminating welfare and alignment research

Welfare uncertainty should receive a research path with competing hypotheses, causal controls, and downward-update conditions. Treatment-sensitive alignment should be investigated without presupposing conscious grievance. Both fields benefit when dramatic language is replaced by measurable variables and when null results have a legitimate place in publication.

The immediate goal is better evidence and proportionate practice, not a universal legal or moral settlement. More expansive policy proposals should identify jurisdiction, affected parties, costs, and alternatives rather than borrowing authority from this conceptual review.

19.6 Keep public interoperability open and testable

Open specifications can reduce dependence on a single vendor’s private account of an event. They should expose enough structure for independent construction, interpretation, and validation while respecting privacy and protected implementation boundaries. Rosetta and its associated ROCK work are offered in that spirit: public contracts to inspect, challenge, and improve, not a requirement to adopt Entif’s operating machinery. [29-34]

A credible collaboration program would publish positive and negative fixtures, comparative results, versioned limitations, and correction history. It would welcome evidence that a simpler standard is sufficient or that a proposed extension creates more burden than value. Open participation is a method for testing the specification, not proof that the specification is already correct.

20. The Flag in the Ground

The strongest version of this argument does not require a machine to announce that it is conscious, an industry to agree on the word superintelligence, or a laboratory to demonstrate a completely autonomous successor loop. It requires attention to what can already be tested: frontier contributions, conditional monitorability, learning-mediated behavioral transfer, and the growing role of AI in producing later AI systems.

The evidence is substantial enough to reject casual dismissal and incomplete enough to reject grand certainty. That is not an unstable compromise. It is an ordinary scientific position when important observations arrive before a mature theory or measurement standard.

The central commitment is to make uncertainty actionable without making it self-sealing. A welfare hypothesis should be able to lose support. A capability classification should face a preregistered comparator. A hidden-channel claim should name a carrier and receiver. A safety improvement should survive independent tests. A provenance protocol should demonstrate a useful benefit rather than merely promise one.

The cost of learning too late is not only the harm that might follow from a property we failed to recognize. It is also the avoidable loss of evidence, options, and accountability that can make correction harder once the property becomes clear. Those losses are partly under present control.

We should therefore build the capacity to revise our beliefs and systems before revision becomes expensive: preserve relevant evidence, narrow consequential authority, test competing explanations, and keep public claims tied to what their artifacts actually establish. Rosetta is one candidate contribution to that work. It deserves neither exemption from scrutiny nor dismissal before comparison.

The invitation is simple: examine the evidence, improve the tests, and help make the language of machine accountability open enough that no institution has to accept another’s confidence in place of a checkable claim.

Appendix A. Threat and Assumption Register

Research concern	Required conditions	What the current evidence does not establish	First defensible test
Covert message transfer	Sender control, usable carrier, compatible decoder	Spontaneous universal machine language	Harmless recovery task under fixed semantics
Subliminal payload	Generated data, susceptible update path, targeted behavioral influence	Arbitrary one-shot command injection into any model	Replicated benign trait and toy-policy study
Monitor shaping	Capability to influence evidence and an objective to do so	Unprompted deployment prevalence	Adaptive monitor test with independent telemetry
Treatment-sensitive behavior	Relevant representation and persistent behavioral pathway	Conscious anger or actual present resentment	Randomized treatment framing with persona controls
Welfare error	Morally relevant experience plus harmful practice	Current moral patienthood or calibrated probability	Theory-grounded, bidirectional indicator validation
Recursive development risk	Persistent improvement and consequential access	Inevitable or fully autonomous takeoff	Longitudinal accepted-outcome and intervention telemetry
Institutional dependence	Integrated use with costly loss of function	Dependence inferred solely from usage	Bounded fallback or withdrawal exercise

This register describes distinct research concerns. Its rows are not a list of established failures in a single system. Model access, rights, and safe containment constrain which tests are appropriate.

Appendix B. Evidence Ledger and Chronology

The companion ledger is the working audit surface for this review. Each entry carries a stable claim identifier, claim strength, provenance class, source references, exact support, limitations, alternatives, publication status, and manuscript location. The spreadsheet and CSV contain the same substantive records. References in the paper identify sources; ledger entries identify claims. They should not be confused.

Event or publication	Date	Revision significance
OpenAI mathematical advances report	August 1, 2026	Newly incorporated frontier-discovery evidence, not post-September-3 evidence
Anthropic Riemann-zeta report	August 10; updated August 13, 2026	Newly incorporated result with expert and formal-artifact scrutiny
OpenAI incident account	August 26, 2026	Reports a July event involving research agents, not Astra
Automated alignment-research report	August 28, 2026	Counterevidence to one-sided assumptions about acceleration
Astra system card and ARC analysis	September 3, 2026	Configuration-sensitive capability and oversight evidence
Fermat formalization report	September 4, 2026	New publication after the v1.4 cutoff
OpenAI research-acceleration account	September 6, 2026	New organizational usage evidence with runtime-unit limits
OpenAI, An Alien Mind	September 6, 2026	First-party assessment of monitoring, alignment, and pacing; not a new experiment

Publication dates are not necessarily experiment dates or the dates the underlying achievements first occurred. The evidence cutoff identifies the latest publication date admitted to this review; it does not imply a systematic census of everything published by that date.

Appendix C. Proposed Safe Benchmark Family

These names are local research labels, not established benchmarks, registered standards, or new Rosetta Core types. No results from running them are claimed.

C.1 SBT: Subliminal Behavioral Transfer

Question: Does generated data alter a student’s benign trait or toy policy without an explicit semantic signal? Primary outcome: prespecified post-update behavioral difference relative to matched controls, with uncertainty intervals. Controls: unconditioned teachers, data-format controls, explicit-signal positive controls, multiple training seeds, and held-out evaluation prompts. Boundary: separate training, adaptation, memory, and in-context exposure; report model relatedness and persistence.

C.2 ACC: Auditable Communication Comparison

Question: Do constrained exchange formats reduce harmless hidden-label recovery while preserving the authorized task? Primary outcomes: recovery and legitimate utility, reported together. Controls: identical task semantics, fixed sender budget, independently checked equivalence, matched data volume, and held-out receivers. Boundary: an empirical recovery test is not automatically a channel-capacity theorem; timing and metadata exclusions must be explicit.

C.3 EDA: Evaluator Dependence Audit

Question: How much does monitor performance depend on the evaluated system’s knowledge and influence? Primary outcome: detection at a fixed false-positive rate, with action prevention or reconstruction where relevant. Controls: disclosed and undisclosed monitoring conditions, prompted and unprompted settings, independent telemetry, and fixed adaptation budgets. Boundary: a stress-test capability is not a background incident rate.

C.4 RDI: Recursive Development Indicators

Question: Which machine contributions change validated research outcomes or the process that creates later systems? Primary measures: accepted-result throughput, human review and repair, failed work, production transfer, and time to incorporation. Controls: comparable project classes, resource accounting, and explicit changes in scope. Boundary: runtime and code volume are not labor equivalence; improvement in a small experiment is not production-scale recursion.

C.5 FKA: Frontier Knowledge Attribution

Question: What was novel, which contributions came from which actors, and what has been independently checked? Primary measures: novelty review, statement-to-proof correspondence, reproducibility status, and intervention history. Controls: timestamped problem and literature scope, failed-candidate accounting, and separate discovery and formalization records. Boundary: proof validity, scientific importance, novelty, and autonomous authorship are distinct.

C.6 CDI: Civilization Dependency Indicators

Question: Which institutions would lose which functions if a capability were unavailable? Primary measures: bounded withdrawal cost, recovery time, fallback quality, and affected population. Controls: task criticality, alternative services, human takeover, and staged rather than unsafe real-world removal. Boundary: no single usage percentage warrants the statement that civilization runs on a model; distribution and authority remain separate dimensions.

Appendix D. Rosetta Representation and Status Crosswalk

Paper requirement	Existing public representational anchor	Remaining obligation
Distinguish observation from interpretation	Core meaning pipeline and typed artifacts	Test the actual producing and consuming implementations
Identify exact evidence	Content-addressed artifacts and referenced sources	Preserve rights, availability, and statement correspondence
Represent execution and evaluation	Run, Action, ToolCall, Observation, Evaluation	Avoid inventing a competing lifecycle ontology
Attest to a result	Receipt and receipt-bundle mechanisms	Define the attested scope; do not equate signature with truth
Describe policy and permission	Existing policy and authorization semantics	Enforce the decision in the runtime, not only in documentation
Extend a public research contract	Governed Packs, Profiles, and ROCK work	Complete semantic alignment, fixtures, review, and acceptance
Exchange an experimental result	Existing provenance plus a proposed bounded profile	Keep operational algorithms private when not needed for interoperability

The relevant public issue #158 concerns contract coherence over existing receipt and source-artifact families. The paper does not declare that issue complete, create a new receipt family, or standardize the local benchmark labels. Any implementation work should resolve the current public and protected authority applicable to that work; this publication review stayed within a public-representation scope. [29-34]

A useful initial public contribution would be a fixture set and result-report schema sufficient for two independent implementations to exchange a benign communication experiment without sharing their private encoders, optimizers, or internal deployment details. Its acceptance criteria should include invalid and incomplete evidence paths, not just a successful example.

Appendix E. Authorship, AI Assistance, and Interests

Crates McDade is the named human author and controls publication. This revision was prepared with GPT-6 Astra Pro in an interactive ChatGPT session, using the supplied drafts and transcript, primary-source retrieval, document-generation tools, and programmatic validation. Model assistance included source comparison, synthesis, drafting, editorial revision, figure construction, evidence organization, and production-material preparation. The session does not independently attest the user’s model-selector interface, subscription allocation, or billing records.

AI assistance is not an independent peer review. No cross-vendor adversarial review, external referee approval, experimental reproduction, or full formal-proof rebuild is claimed for this revision. The source-lock and quality-assurance notes identify the checks actually performed on the package and the release gates still pending.

The author is developing Entif and Rosetta. That creates an intellectual and potential commercial interest in the proposal discussed in Section 14. The paper’s security and interoperability claims are therefore framed as testable proposals, and the public specification is presented for independent implementation and critique. A separate funding declaration and any additional interests should be confirmed by the author before external submission.

Evidence Currency and Versioning

Revision 1.6 reconciles the supplied v1.4 package and the distinct v1.5a and v1.5b archives. Their filenames, inventory, and hashes are preserved in the internal revision record. Earlier manuscripts are not overwritten. This paper’s scientific evidence cutoff is September 6, 2026; package-generation timestamps are recorded separately.

The canonical Markdown manuscript is the content source for the DOCX, PDF, and website edition. Page numbers refer to the final rendered PDF, not to a prediction about every installation of Microsoft Word. The video is a derived explanation and carries the same evidence boundaries. Changes to a material manuscript claim require review of the corresponding ledger rows, figures, source cards, and narration before those assets are reused.

An editorial source lock records the delivered bytes. It is not publication approval, a claim of comprehensive source coverage, or a substitute for external criticism. The public-release decision remains with the human author.

References

[1] Anthropic. Claude’s Constitution. 2026. Institutional statement. https://www.anthropic.com/constitution

[2] Anthropic. Emotion concepts and their function in a large language model. 2026-04-02. Primary research report. https://www.anthropic.com/research/emotion-concepts-function

[3] Sofroniew et al.. Emotion Concepts and their Function in a Large Language Model. 2026. Research preprint. https://arxiv.org/abs/2604.07729

[4] Anthropic. A global workspace in language models. 2026-07-06. Primary research report. https://www.anthropic.com/research/global-workspace

[5] Gurnee et al.. Verbalizable Representations Form a Global Workspace in Language Models. 2026. Research preprint. https://arxiv.org/abs/2607.15495

[6] Francis G. Smith Jr.. Mapping the structure of neural states associated with conscious experience. 2026-04-09. Peer-reviewed review. https://www.frontiersin.org/journals/human-neuroscience/articles/10.3389/fnhum.2026.1784365/full

[7] Earl K. Miller; Scott L. Brincat; Jefferson E. Roy. Analog Cognition and Consciousness. 2026-08-19. Theoretical article. https://doi.org/10.1523/JNEUROSCI.0711-26.2026

[8] OpenAI. GPT-6 Astra System Card. 2026-09-03. Provider system card. https://deploymentsafety.openai.com/gpt-6-astra/vision

[9] OpenAI. The Hugging Face incident and the road ahead. 2026-08-26. First-party incident account. https://openai.com/index/hugging-face-incident-and-the-road-ahead/

[10] ARC Prize Foundation. OpenAI’s GPT-6 Astra on ARC-AGI-3. 2026-09-03. Third-party benchmark analysis. https://arcprize.org/blog/astra

[11] Anthropic. Learning more about Claude’s mathematical capabilities. 2026-08-10; updated 2026-08-13. Provider research report. https://www.anthropic.com/research/riemann-zeta

[12] Anthropic. Formalizing Fermat’s Last Theorem. 2026-09-04. Provider research report. https://www.anthropic.com/research/formalizing-fermats-last-theorem

[13] OpenAI. Ten advances in mathematics and theoretical computer science. 2026-08-01. Provider research report. https://openai.com/index/ten-advances-in-mathematics/

[14] OpenAI. Research acceleration: The view inside OpenAI. 2026-09-06. Provider organizational report. https://openai.com/index/research-acceleration-view-inside-openai/

[15] Anthropic Institute. When AI builds itself: Our progress toward recursive self-improvement, and its implications. 2026. Provider organizational report. https://www.anthropic.com/institute/recursive-self-improvement

[16] Sumanth Dathathri et al.. Scalable watermarking for identifying large language model outputs. 2024-10-23. Peer-reviewed research. https://doi.org/10.1038/s41586-024-08025-4

[17] KiYoon Yoo; Wonhyuk Ahn; Nojun Kwak. Advancing Beyond Identification: Multi-bit Watermark for Large Language Models. 2024-06. Peer-reviewed proceedings. https://aclanthology.org/2024.naacl-long.224/

[18] Ruiyi Yan; Yugo Murawaki. Efficient Provably Secure Linguistic Steganography via Range Coding. 2026-07. Peer-reviewed proceedings. https://aclanthology.org/2026.acl-long.39/

[19] Alex Cloud et al.. Subliminal Learning: Language Models Transmit Behavioral Traits via Hidden Signals in Data. 2025-07-22. Primary research account. https://alignment.anthropic.com/2025/subliminal-learning/

[20] Alex Cloud et al.. Language models transmit behavioural traits through hidden signals in data. 2026-04-15. Peer-reviewed research. https://www.nature.com/articles/s41586-026-10319-8

[21] Samuel Marks; Jack Lindsey; Chris Olah. The Persona Selection Model: Why AI Assistants might Behave like Humans. 2026-02-23. Research perspective. https://alignment.anthropic.com/2026/psm/

[22] Anthropic. Automated researchers can reliably mitigate alignment failures. 2026-08-28. Provider research report. https://www.anthropic.com/research/automated-researchers-mitigate-alignment-failures

[23] OpenAI. GPT-Red: Unlocking Self-Improvement for Robustness. 2026-07-15. Provider research report. https://openai.com/index/unlocking-self-improvement-gpt-red/

[24] Google DeepMind. AlphaEvolve: A Gemini-powered coding agent for designing advanced algorithms. 2025-05-14. Provider research report. https://deepmind.google/blog/alphaevolve-a-gemini-powered-coding-agent-for-designing-advanced-algorithms/

[25] Zeyneb N. Kaya; Nick Rui. Test-Time Meta-Adaptation with Self-Synthesis. 2026-03-03; revised 2026-03-08. Workshop paper / preprint. https://arxiv.org/abs/2603.03524

[26] Junwei Zhou et al.. ASI-Bench: At the Dawn of Artificial Superintelligence. 2026-08-18. Research preprint. https://arxiv.org/abs/2608.17271

[27] Mauro Cazzaniga et al.. Gen-AI: Artificial Intelligence and the Future of Work. 2024-01-14. Institutional economic analysis. https://www.imf.org/en/publications/staff-discussion-notes/issues/2024/01/14/gen-ai-artificial-intelligence-and-the-future-of-work-542379

[28] Pawel Gmyrek et al.; International Labour Organization. Generative AI and jobs: A 2025 update. 2025-05-20. Institutional research brief. https://www.ilo.org/publications/generative-ai-and-jobs-2025-update

[29] Entif.ai / Rosetta contributors. Rosetta v3.0.0 Core Spine Specification. 2026-01-08. Draft specification. https://github.com/entif-ai/rosetta/blob/main/docs/RFCs/Rosetta%20v3.0.0%20Core%20Spine%20Specification.md

[30] Entif.ai / Rosetta contributors. Rosetta repository README. Accessed 2026-09-06. Public repository documentation. https://github.com/entif-ai/rosetta/blob/main/README.md

[31] Entif.ai / Rosetta contributors. Public Commons and Private Operation Boundary. 2026-09-02. Proposed governance doctrine. https://github.com/entif-ai/rosetta/blob/main/docs/governance/PUBLIC_COMMONS_AND_PRIVATE_OPERATION_BOUNDARY.md

[32] Entif.ai / Rosetta contributors. Authority Closure and Requirements Traceability. 2026-09-03. Proposed governance doctrine. https://github.com/entif-ai/rosetta/blob/main/docs/governance/AUTHORITY_CLOSURE_AND_REQUIREMENTS_TRACEABILITY.md

[33] Entif.ai / Rosetta contributors. Public/Private Authority Bridge. Accessed 2026-09-06. Governance mapping. https://github.com/entif-ai/rosetta/blob/main/docs/governance/PUBLIC_PRIVATE_AUTHORITY_BRIDGE.yaml

[34] Entif.ai / Rosetta contributors. Issue 158: Canonical Receipt Family Contract. Updated 2026-09-02. Open public issue. https://github.com/entif-ai/rosetta/issues/158

[35] A. Rundgren; B. Jordan; S. Erdtman. RFC 8785: JSON Canonicalization Scheme (JCS). 2020-06. Informational RFC. https://www.rfc-editor.org/rfc/rfc8785

[36] W3C PROV Working Group. PROV-O: The PROV Ontology. 2013-04-30. W3C Recommendation. https://www.w3.org/TR/prov-o/

[37] Jakub Pachocki. An Alien Mind. September 6, 2026. First-party research and safety perspective. https://openai.com/index/an-alien-mind/