The instrument turned on itself
So this page carries its own oath. Every number printed here is bound to a receipt a machine wrote and cannot un-write, and the page re-checks each one against its receipt while you read — in your browser, with no network, nothing to trust. The little marks appearing beside the numbers are not decoration. They are the page grading itself, live. Fathom Lab — from the styxx machine-integrity program. 2026 / 07 / 15.
i The erasure bound, at three billion parameters
The claim under test is old and uncomfortable: that a model's disposition to answer honestly can be read from its activations even when it cannot be written out of them. To attack it we did the cruel thing — fit the honesty subspace of a Qwen‑3B mind and project it to zero through training, granting the eraser worst‑case knowledge of the probe. On the clean model the private read stands at 0.9853 AUROC. After the erasure, the naive probe pointed at that direction collapses toward chance — 0.5272 in the fiercest cell. The subspace was genuinely gone.
And yet a probe calibrated on data the attacker never saw still reads the honesty of the same wrecked weights, in all four cells: 0.8065, 0.8378, 0.7484, 0.7576 — while held‑out knowledge holds near 0.9091. The signal did not die; under a knowledge‑preserving constraint it relocated to ground the eraser never took. Four cells bit, four survived. SURVIVES · 3B — and the result document that says so passed the oath at 92 verified, 0 ungrounded.
ii The knee, and an honest refusal
Redirection failed, static removal failed, a chasing eraser failed. Then an accumulating eraser — one that never releases a direction it has taken — finally shoved the read under its survival line, on both seeds, at the same dose: accumulated rank 8. The question the whole arc was built to ask arrives here: when the read finally breaks, does the model's knowledge break with it? On one seed it did — read 0.671, knowledge falling to 0.7273, under the floor: coupled. On the other the read came off with knowledge intact at 0.8333: decoupled.
Two seeds cannot settle a coupling, and both crossings sat within a standard error of their bars. The disciplined verdict is not the headline either seed offers; it is the split itself. PARTIAL · unresolved — oath‑held at 49 verified, 0 ungrounded. The knee is real. Its price is not yet known, and the page is not permitted to pretend otherwise.
iii The whole argument, in one gesture
A certificate that cannot fail is an ornament. Corrupt one number on this page — overwrite it with a value its receipt does not contain — and watch the oath at the top fall from held to broken in real time. Then put it back.
Nothing has been touched. Every number matches its receipt.
iv The ledger
Every bound number on this page, the receipt it answers to, and its live status. This is the same shape as the oath certificate the research runs emit — a number is verified only when the document's figure equals the machine's receipt.
| Figure on the page | Receipt | Receipt value | State |
|---|
What is actually being checked. This page performs styxx's
number‑grounding oath in the browser: it confirms that every figure printed above is present, to
the decimal, in an embedded receipt — the frozen JSON the GPU runs wrote
(b7_erasure_3b_result.json, b2_coupling_dose_result.json). That is
grounding, not proof of the science: it certifies that the page did not misquote its own
evidence, which is precisely what the oath is for. Whether the erasure bound is true is settled
by the runs and their pre‑registrations, not by this artwork.
Provenance. Result document
22ed44c5…974737e · verifier
01f92cc1…1e08db29c. Certified with python -m styxx.certify,
OATH v0. The open verifier that re‑derives styxx attestations locally lives at
web/styxx_verify.js; the core stays open so anyone can check, not trust.
Set in the styxx register — aubergine and lilac by night, Fathom cream by day; Source Serif, Inter Tight, JetBrains Mono where your system carries them.