Refuse, Don't Report: Three Integrity Gates for Self-Modifying ML Systems

Instrumented machine-learning systems detect anomalies and then produce a result anyway. Sample-ratio-mismatch guardrails invalidate an A/B test after the fact; model-provenance tooling compares hashes post-hoc; vector stores resolve an encoder change by reindexing. In each case the system records that something is wrong and still emits an artifact.

We describe three gates that take the opposite stance and refuse to emit. A memory organ refuses to load a snapshot whose digest does not match or whose key-encoders differ from the ones that wrote it. A transplant ledger refuses a weight record carrying neither a provenance certificate nor a measured drift. An ablation harness writes no artifact when its arms disagree on seed, data cursor, base checkpoint, or training contract.

The motivation is empirical. Over two days on one 1.7B-parameter model, eight experiments reported success through checks that could not fail: knowledge measured after the modification was reverted, integrity hashes over tensors the edit never touched, a policy gate whose entries could not match any input. Each passed review.

We then put the gates to work. A certified self-reassembly rebuilds the model from itself tensor by tensor, reaching 0.0 logit error with all 219 tensors certified, calibrating the apparatus against a known answer. Two transfer experiments then return negatives the calibration makes trustworthy. A cross-lineage FFN graft does not beat a norm-matched noise arm (11.2166 against 11.2163) even though the learned router opens its gate to 0.773 for the real donor and 0.015 for noise. Installing sixteen facts by rank-1 edit yields three, while prefixing every unrelated answer with the same attractor.

Neither failure is a missing mechanism. Routers and edits both worked. Both failed at addressability: information transferred into a model is not reachable in that model's coordinate space.