2026-06-28 · Project history · Not re-verified
KS-1: On a frozen model, "writing the consequences to look real" and "making the consequences real" are the same thing On 2026-06-28, the two main validation designs were killed by adversarial workflows of 17 and 10 agents. The fact that killed them later became the methodological core of the whole project.
KS-1 adversarial review experimental design self-correction
⌗ This is where the whole project's methodology began
The sentence that killed them was later written into the code as an invariant.
# The two designs that were killedThe main validation of 2026-06-27/28 set out to test "whether a responsibility structure can change an agent's behavior."
Version one "Main validation redesign: responsibility structure on decaying tasks" (original: 「主驗證重設計：責任結構在衰減任務」) Version two "Main validation, final v2 (post-adversarial)" (original: 「主驗證定版 v2（post-adversarial）」) Adversarial workflow 17 agents / 10 agents Result Both killed
The voids are kept as design history — not deleted, but marked "this is design history, not a working mechanism."
# The sentence that killed them# Why this is fatalThe logic by which KS-1 holds is simple:
The model is frozen (no fine-tuning, no learning). The only input channel that can influence it is the prompt . So any "mechanism" that is to influence behavior must go through the prompt. Therefore, in this setting, a "mechanism" and "a better prompt" are indistinguishable . ⌗ The crux: the "mechanism" never entered the experimental arms at all
What the experimental arms did have: wording like "you will be punished" added to the prompt.
That is not a mechanism; that is wording.
# How this became a design constraintKS-1 later became two executable safeguards in the code:
✓ Two executable safeguards
Lessons may only be abstractions at the level of pitfall types , and may not contain verbatim test data.
Plus a third: the prompt templates of the on and off arms must be identical word for word.
The third is a statistical necessity — if the two arms' prompts differ, how much of that difference is "mechanism" and how much is "wording"? They can't be separated.
# Why Agrawal et al. (2025) made it necessary⌗ If writing consequences into the prompt had no effect at all, KS-1 would not need to be written as an invariant
So the problem is not "writing it in the prompt does nothing" — it does something, and that is what makes it dangerous .
KS-1 is therefore not "don't incentivize the agent," but "don't incentivize with wording, because then you can't attribute the effect ."
# How it shaped every later experiment✓ Three concrete consequences
The three arms of R437 (OFF / ON / OFF5) have word-for-word identical prompt templates, so the difference between ON and OFF5 can only come from the mechanism. committee-loses-to-majority
② The design of the three memory arms (E11) : M0 (no injection), M1 (inject the most recent k entries verbatim), M2 (distilled into lessons). The three arms differ in the source of the memory, not in its wording .
The result was M0 8/12, M1 8/12, M2 8/12 — the three arms were exactly the same , and the source text says "not enough to support any claim of effect" (original: 「不足以支撐任何效果宣稱」). e10-paired-null
③ The D5 attribution analysis became possible. loop-not-prompt
Point 3 is KS-1's biggest payoff. Because the first round's full responses were all written to disk , and the prompt templates were identical word for word, the first round could be pulled out and rescored offline — which made it possible to separate the "loop effect" (+19 percentage points) from the "prompt effect" (+6 to +8).
⌗ This is KS-1's final form
Three years later (within this project), it became a constructive tool — it made the question "does the gain come from the loop or from the prompt?" answerable.
If the prompts had not been identical word for word, the D5 analysis would not exist.
# Four citation errors caught in the same round⚠ A project that adversarially re-verifies its own assertions should find errors in its own citations
② Trust Over Fear (the FEAR framework) had no effect at baseline.
③ 2510.08624 is from 2025 , not 2026.
④ Tetlock's cheap talk was applied in the wrong context — the model was borrowed for LLM agents that "have no payoff," while the analysis of cheap talk presupposes that there is a payoff.
The later formal fact-check report of 2026-09-14 flagged 8 ERRORs, 22 WARNs, 16 NITs . Full list
If a project that adversarially re-verifies its own assertions finds no errors in its own citations, it is not actually re-verifying.
# Two months later: memory is responsibilityOn 2026-07-03, the main line was redefined as "memory is responsibility." This is a direct consequence of KS-1:
Old New Responsibility changes a single agent's behavior Responsibility lives in reviewed memory Consequences in the prompt The accounting unit of reputation is the event stream Relying on incentives Relying on routing — whether you get the next job
✓ Two safeguards in the memory and consequence design
① The prompt may not contain wording such as "you are responsible" or "you will be punished."
② Lessons may only be abstractions at the level of pitfall types, and may not contain verbatim test data.
The reason for ②: if a lesson carries verbatim test data, the generation for the next task has effectively seen the answer — and that is not memory, it is leakage.
# Is this invariant still alive?Yes. It is in the decision document of every real-model experiment.
⊘ The limits of KS-1
② KS-1 is a methodological constraint, not a scientific finding. We cite no literature supporting "prompt engineering and mechanisms are indistinguishable under all conditions" — we only measured this within our own experimental setting. So it is marked Not re-verified .
③ It does not rule out "mechanisms work in systems that have a non-text channel." In fact, D5 proved that when there is the non-text channel of "whether you get the next job," the loop's effectiveness is +19 percentage points.
What KS-1 rules out is the road of "relying on wording," not the road of "relying on consequences."
# Next
