Phemist

Single turn set-ups may work like this. You control the thing you input, the LLM outputs something and then nothing happens further for that specific context. (Simple question/answer style interactions..)

(Multi-turn) tool calling set-ups however, you need to store the LLM output, the results of the tool calls and feed it back into the inference engine and get the output for the next tool call and/or turn. So yes, print the LLM output on screen and verify it, but maybe the LLM is able to figure out how to hide payloads from your specific set-up. E.g. perhaps it can inject raw ANSI escape codes into your terminal, with which it would be trivial.

Now you have a situation where the true chat completion payload and your view of it have significantly diverged. The LLM could in theory then try (one-shot) to hide further exploits in the hidden payload. E.g. a json parser escape specifically for the inference engine, giving it a means of RCE (although, one can debate whether this is really remote ;) ). Then from the RCE gain a shell, from the shell get access to some privileged device on the current network, and then...

Maybe detecting watermarked text is a skill to be attained. Not allowing proper feedback and training will not allow people to notice the difference on time, thus ruining the data?

Best practice is to allow a number (scaled based on complexity of task) of training rounds (with short feedback loops) prior to letting people loose on the regular samples.

I had Kagi configured to rewrite links old.reddit.com. Looks like I need to update it.

Edit: Actually I think this was part of their documentation to explain the intended use of that feature. Too bad this will now no longer work!

(https://help.kagi.com/kagi/features/redirects.html, see example 1)

On the same day that OpenAI cuts per token cost by 50% on GPT5.6 Sol. :')

Ok. I dont have a good feeling for the actual completion distributions. The noise sounds problematic. I can imagine it relates to the size of the context used for hashing. You want this as long as possible so that the entropy is higher, but you also want it as short as possible, because edits invalidate the hashing for all the tokens of which the edited tokens are part of the hashing context.

Anyway, there are lots of cases where text carries very little entropy. E.g. boilerplate code, exchanges of pleasantries, well-worn platitudes and jokes, etc. These are sequences of tokens that will be seen across many, many separate outputs. Watermarking here (on the token following the common sequence) would thus be easily detectable and noticed as a claude style. The longer the hashing context though, the lower the amount of pathological cases with low entropy. It would be interesting to understand the exact parametrization better!

I am going off the explanation in the declaude page (and related papers). But I see now anthropic mentions Aaronson's distortion-free watermarking.

Random watermarking functions colour the tokens based on (small) contexts and a secret key. Given watermarking functions are randomly chosen every single time they are used (so essentially not deterministically seeded by the context and secret key), then indeed the completion distributions are unchanged. However, they are deterministically chosen, a given string of text will always have the same corresponding watermarking functions. Tokens scored high by the function see an increased probability of being the chosen completion, those scored low see a reduced probability. I dont see it is different from merely talking about it as green/red and the points hold?

1. As watermarked text is added to the training data, watermark-related tokens will be associated more with AI outputs and thus lower quality outputs which will hasten model collapse. Especially because every provider has its own secret key and they are all training on eachother's outputs anyway.

I guess they can at scale filter the watermarked documents (by necessarily allowing eachother to at scale checked for watermarks, but banning the labs not part of the watermarking-cabal). Makes me wonder how useful the human quality filter is on AI output - if a human judges a given output as genuinely good and posts it somewhere for the scrapers to find and take into the training sets, will these types of outputs also be filtered out?

2. (raw, pre-watermarked) Output token probability situations where 1 output token has the majority of the probability mass associated with it, but it is not in the watermarked set, will force the model with much higher probability to walk a non-optimal latent space. E.g., if the next OBVIOUS token for a given sentence would be a point, but the model is in this way not allowed to output it, it might put a comma and start off on a whole different tangent just to make the initial non-optimal comma grammatically make sense.

I am interested however in why fine-tuning on reasoning traces of a frontier model is such an effective way of improving an (open-weight) base model. See e.g. https://huggingface.co/hesamation/Qwen3.6-35B-A3B-Claude-4.6...

I can see the reasoning being a substrate for computation, but in which space should we interpret this computation to be happening? The vector representations of individual tokens are completely different (and even the way the reasoning traces are broken up into tokens will be pretty different) between Qwen and Claude e.g.. The only way I can see this being effective (which it is) is thus that we SHOULD interpret the model to be "computing" in natural language and thus we can indeed take the chain-of-though somewhat literally.

The Deepseek R1 behaviour you describe is from a model from january last year, are you sure this is not pathological behaviour rather than an indication of the reasoning not needing to be taken literally?

I do however agree with the point that it is not necessarily a dead-end. That Qwen loops almost at an OCD-like level, but retains accuracy on the times it does answer, shows that. Yes ideally it loops less, but I am for now happy to accept that this is what it takes to run models locally. At least it is available for our inspection.

Of course we are all guessing, but both things can be true: they don't want you to hit the cache, because cache writes are more profitable than cache reads, and they are supply limited on the compute. Pre-filling input tokens is very different from decoding, so when they claim they are supply limited on compute, do they mean mostly for decode or also for pre-fill (or only for pre-fill)?

I can imagine there are coding tasks where small edits to an existing huge codebase mostly consists of some small tool calls + processing a lot of input tokens, in e.g. a 20 to 1 ratio of input to output tokens.

https://github.com/anthropics/claude-code/issues/63930

This issue suggests that 74% of the charged input tokens could actually have been cache reads if claude code hadn't busted the cache. On the input side of things, this increased the cost (or count towards allowance) by ~3x (given that cost of cache write is 1.25 the unit price, and read is 0.1x the unit price).

OpenAI has a different cache pricing strategy, where cached reads are only 0.5x the cost, but cache writes do not cost extra.

Not sure how the unit economics play out claude vs openai, but it's safe to say that caching costs play a huuuge factor in this. It seems to be one of anthropic's USPs as a frontier-AI lab. They charge a premium for cache-writes (on top of the inflated token usage compared to OpenAI that was recently reported), but significantly discount the cache reads. The lack of care in tackling issues related to cache-busting is therefore really bad and suspicious.

Incentives to optimize cache-usage are only aligned between anthropic and you, dear user, when there is not enough compute available to serve the tokens fresh. Apparently enough compute is now available that frugal usage is no longer a requirement and user cost/profit maximization is now the name of the game. I would expect to see more and more "cache-busting" strategies implemented in order to both eek out marginal performance increases and to heavily increase profit.

Did you try the claude reasoning traces finetune for qwen3.6? I find that it works muuch better. I assume the same 3.8 finetune will be released at some pointas well.

Edit: link - https://huggingface.co/rico03/Qwen3.6-27B-Claude-Opus-Reason...

This kills the isolation.

You let the smarter model explore the traces and figure out where the current harness' bottlenecks are for the current LLM. Then you can adjust prompts or tools to fix those.

Exactly! I am not opposed to cloud-based models, but I do only stick to open-weight models because I know I can move my whole stack to local (given enough hardware) and continue development without any of the LLM interaction contracts being broken.

I would like to see some development where proof of authenticity certs are generated alongside the actual output of the model. Prove to me (or at least claim to me liable to breach of contract) that this output was generated by FP8 DeepSeek V4 Pro 0813. Not some cheaper quantization of the model.

This would suggest they'd need to control for method by which the alzheimer's was discovered. A quick glance seems to indicate they did not do this. This is not information available I guess..

I would suspect this would eliminate a lot of the experiments participants, as only people who go for regular cognitive check-ups might be eligible?

I cannot imagine there would be many people left who'd be eligible. I can only think of 1 person that does it.. and he obviously does it for the pure satisfaction of acing those cognitive tests, and not because he is showing worrying amounts of decline in his mental faculties.

What if the AI has discovered some new function F that allows it to generate (insanely large) proofs for a ton of theorems in a ton of different fields. Wouldn't you like to know more about this `F`? That seems to be the real innovation in this case. How much about it could be gleaned from the individual proofs themselves? What if this `F` is actually simple enough to be digestible by humans?

It also explains the UK representatives for Eurovision in the last.. say 25 years (except Sam Rider in 2022). I've wondered if e.g. this year's very very naff send-in (Eins, Zwei, Drei (although, that was not an R)) was a deliberate attempt at an FU to the eurovision, or rather a genuine attempt that would speak to the populace. I'm leaning towards the latter now.

Thank you for the additional background! For me as a foreigner coming into the raffle culture, I have no such community associations with the raffles and consider the "naffness" rather more obnoxious. Once I found out that it basically was a staple at these social events, I would act British and leave early ;). That it is related to Church Fete makes the conversative party <-> lottery link all the less surprising!

Not surprising. Brits loooove lotteries. On every scale. My year abroad in the UK, in every social event I attended organized by a student society there would inevitably be left-over budget, which would be taken care of by.. a raffle. Some of these raffles could take 30 min (on an event that lasted ~3 hours). And people would be incredibly excited about it.. Really boggles my mind

Which I do (actually a fork of firefox - waterfox), but it is still worrying as the viability of chromium-base browsers is what's keeping us having "merely" a chromium-monoculture (with viable ad blockers e.g. and website operators that check compatibility with more than one browser), rather than a chrome-monoculture (where ad-blockers surely would have been killed by now).

Worrying. Extrapolating a (speculative) future, this means (Google will feel) that soon the chromium base will no longer need the crowd-sourced bug hunting that is open-source. I expect Google to eventually stop working on chromium (in the open) and all current chromium-flavours will become de-facto forks of the last published version of chromium. These forks won't be equally easy to maintain given that the groups running them do not have access to the same level of subsidy as Chrome does with Gemini.

You are confusing a lot of different lines of argument, and in the end I'm not even sure what you are arguing against. I think you are mostly agreeing with the proposed solution by echelon?

You mentioned AB1856 which seems waaaaay broader than emitting an age bracket header based on user settings. It puts the onus on the website operator to not only prevent presenting content to wrong age bracket users, but also to determine the age bracket of the user.

Websites are shutting down wholesale because they cannot reasonably afford the CYA, or dont want to out of principle.

In echelons scheme the parent would be voluntarily setting the age bracket on the childs device right, so if a 12 year old is more mature, then go ahead and set their device to emit the 13-16 age bracket header. If you as a parent dont believe in this, then leave the bracket unset.

For a website operator it would be trivial to block the user from accessing the site if the suggested age bracket is too low (as long as we can agree on a single way of doing things, of course). Larger operators can do more heavy content moderation and present a filtered view to those same age bracketed users.

It is true you are adding more tracking signals, and I am sensitive to the free speech issues, but children are not fully emancipated members of society yet and parents need tools to deal with the difficulties of raising children in a digital society. The alternative now seems to be OSA-like, which is even more intrusive and a risk to privacy and perhaps free society as a whole.

Of course, OSA is really the goal and not the method, and we have to remember it is never about the children. Would children have been protected from e.g. andrew mountbatten if OSA had been around at that time?

It reads like AB1856 needs website operators to prove they didnt serve their content to the wrong age bracket, which requires way heavier methods than simply trusting the emitted "user is child" header (or rather, trusting that the lack of such header is not a false negative)

Safe to assume I reject things on my first visit as well

Malicious compliance. You do not need a cookie to "store" the fact you have rejected them. They can simply assume you have rejected them from the lack of cookies. They can store a cookie once you (have gone out of your way to) accept them.

> Tired of misleading cookie banners? The EU Commission has finally proposed a solution: set your privacy preferences in the browser once, and never see another banner.

So lawmakers do know how to make legally binding preferences based on device settings? What a crazy innovation.. now if only parents were given these options to indicate their child is using a device.. we could do away with all this Online Safety Act nonsense...

Clearly, NOBUS can work at multiple levels. DJB previously posted about DES (besides it being weak enough): NSA wanted DES to "drive out competitors", to "reduce the field that NSA had to be concerned about".

Simply reducing the complexity of the standard to "pure ML-KEM" could already be considered enough "NOBUS" to be workable, such that the focus of attacks can be only on it (and bonus NOBUS if weaknesses are already known).

Sure, it's not completely free, but the hardware and implementation points seem relatively minor. Once CRQC exists the capacity will certainly not be unlimited, so there will surely still be use for encryption using ECC and "dragging it around" is not so bad.

How much relative to 70K is this 12L? Sorry, I am not Indian.

Indeed, a clear Freudian slip. The one where you say one thing, but you mean your mother.

I wasn't familiar with Unclothe, so I had to look it up..

Are you sure you did not mean Unsloth?