From the Lab
The Blocker Was Twelve Lines: A 4-Bit Checkpoint Rejected on Thursday and Serving the Following Wednesday
On 4 September we evaluated the NVFP4 quantisation of Qwen3.8-Flash-Next at our resident seat's shape and rejected it: a fixed 47.68 GiB embedding table would not fit beside the weights, and the only stock lever offloaded weights instead, leaving the seat at 8.69 tok/s against the FP8 incumbent's 85.99. Five days later the same checkpoint served at the full shape after a 12-line backport into an image we had not tried, because the README had pointed us at the one image that lacked the offload. At the resident placement the 4-bit checkpoint gives 2.25x the KV cache, 15% more aggregate throughput and 13% lower p95 latency for 12% less single-stream, and ties the FP8 seat on our internal frontier benchmark at every reasoning-effort rung. The seat stays FP8 until two reliability cells are re-measured; the paper is about how a correct verdict on a configuration became a wrong verdict on a checkpoint.
ReadSpeculative Decoding Wins the Benchmark and Loses the Seat
We switched on the bundled draft heads of two mixture-of-experts models on two different serving engines: a 4-bit Qwen3.8-Flash-Next on two workstation Blackwell GPUs, and the 475 GB DeepSeek-V4.1-Flash across two nodes. Single-stream throughput rose 1.61x and 3.5x, the largest speculative gains we have measured. Neither shipped. On the resident seat the draft cost 17.5% of the KV cache, 14 to 26% of aggregate throughput at 64 concurrent, and 3.7x cold time-to-first-token on long prompts. On the large seat it capped concurrency at 8 slots and cut the token pool from 890,000 to 260,000. Speculation converts memory and concurrency into single-stream speed, and the single-stream benchmark is exactly the metric a shared seat cares least about.
ReadSame Answers, Different Confidence: 4-Bit Weights Preserve Accuracy and Destroy Calibration
We ran GLM-5.3-Flash in BF16 and in an NVFP4 quantisation on the same eight-GPU Hopper node, where the 4-bit weights are dequantised before arithmetic so that any difference is a property of the stored weights alone. On our internal frontier benchmark every per-dimension accuracy delta was one item, inside the noise: on accuracy the quantisation is a tie. The one dimension that did not tie is calibration. Both checkpoints answered 85.0% of the calibration items correctly, but the BF16 checkpoint's Brier score was 0.070 and the NVFP4 checkpoint's was 0.170, 2.4 times worse and near the 0.1875 random floor. The 4-bit experts keep the answers and flatten the model's stated confidence, so wrong answers arrive with the same tone as right ones. For tool lanes verified downstream the smaller checkpoint is free; for any lane that consumes the model's confidence, a judge, a scorer, an abstention gate, the calibration loss is the price.
ReadDistributed Inference on Workstation Blackwell, Part 4: Cross-Node Tensor Parallelism Over 200 GbE, and the Five Fixes the SM120 Path Needed
Parts 1 to 3 of this series characterised the fabric between two workstation Blackwell nodes and ran models across it by RPC. This part shards every layer across all four RTX PRO 6000 GPUs over 200 GbE with GPUDirect RDMA, which is the only on-premises shape for models that do not fit one node. Nemotron 3 Ultra 550B served three minutes after a cold boot, answered 10 of 10 on a reasoning ladder, and completed a 90-minute soak at 912 of 912 requests with zero errors; GLM-5.3-Flash needed nine attempts and five distinct fixes in the SM120 attention path before it produced a coherent token, and a qualified community image later took it to 691 tokens per second aggregate at 16 concurrent streams. Two failures turned out to be structural to multi-node rather than to any engine: a custom all-reduce prober that deadlocks every rank before a weight loads, and speculative decoding whose data-dependent acceptance length diverges the ranks' collective counts. We also record a public 1,004.9 tokens-per-second headline that measured a locked repeat loop, and two attempts that produced no model-quality evidence and were not scored.
ReadGreen Gate, Lost Hunks: Nine Ways an Automated Merge Train Dropped Merged Code While Every Test Passed
An adversarial code-review wave produced about 330 pull requests across 21 repositories in one day, every one carrying a semantic-version bump in the same commit, so every merge conflicted on the version surface. The merge train we wrote to restack, restamp, gate, and merge them lost merged work in nine distinct ways, and every one shipped a green test gate: a base-wins rule that dropped a pull request's own middleware from a file that was both a version file and a code file; a version extractor that took an IP address for a version and rewrote it over seven consecutive merges; a silent checkout failure that force-pushed one pull request's content over the next. The only control that caught them was a per-pull-request marker pass on the final default branch, run by a different actor and asking a different question: not whether the tree is healthy, but whether this change arrived.
ReadThe Reliability Champion Is Not the Single-Shot Champion: pass^5 Inverts a Leaderboard
Single-shot leaderboards measure whether a model can be right. Production needs models that are right every time, and the two rankings differ. On our internal frontier benchmark, Nemotron 3 Ultra 550B set the single-shot record at 92.7 flat and then shed 8.6 points when every item had to pass five rollouts at temperature 0.7; an anonymous stealth model that had tied our local 27B open-weight seat shed 8.4; the 27B shed 1.6 and became the reliability champion. A week later the same inversion appeared inside one model's reasoning-effort ladder: the gap between two effort settings was 4.5 agentic points single-shot and 12.5 under pass^5, with the multi-step tool-loop dimension collapsing from 9 of 12 items surviving to 4 of 12. We give both experiments, the control that was cancelled, the counterweight from a workspace-scored battery that did not reproduce the quality lead, and a small-sample result that reversed sign between n=3 and n=64.
ReadA Memory Layer With External Anchors: LongMemEval and LoCoMo on a Sovereign Retrieval Stack
Until this week our agent-memory substrate had no score on any public long-term-memory benchmark, so nothing it did could be compared with anything else. We ingested LongMemEval-S (100,548 chunks) and LoCoMo (1,540 questions) and report every configuration on all three axes that matter, accuracy, context tokens, and retrieval latency, with the reader model named. Two zero-cost changes, ordering retrieved chunks by session date and telling the reader that later excerpts supersede earlier ones, lifted a fully on-premises 27B configuration from 67.4% to 72.8%. With a gpt-5.4 reader and the official judge, a top-25 window reaches 90.6%, edging past Zep's published 90.2% at 2.7 times their context budget; at their budget we sit 2.4 points behind. On LoCoMo a distilled fact layer helps as a supplement (+3.7 points) and hurts on its own (−4.9), which is the structural risk in extraction-only memory.
ReadRed-Teaming Your Own Benchmark: Three Model Lineages Attack a 94-Item Bank, and What Survived
A benchmark scored entirely by code is only as honest as its checkers. We paid three model lineages (a GPT-5.6-family seat, Gemini 3.7 Flash, and our on-premises 27B open-weight model) to construct wrong answers that our internal frontier benchmark would accept, and re-executed every claimed exploit through the real checker code. Every one of the 94 items was false-greened by at least one lineage; the 217 exhibits collapsed into four classes, two of which would bite honest models and were fixed with paired regressions, and two of which are adversarial-only and are documented rather than patched. A fresh, blind Claude Opus instance scored 4.5 points below the author-answered self-baseline under identical checkers, which is the first direct measurement we have of non-blind inflation, and one item that all 18 stored strong-model runs had failed turned out to be missing its opening user turn.
ReadFour Days Later: A 753-Billion-Parameter Model on One Workstation GPU, Reproduced
On 18 August a Berkeley-led team released FreeToken, an open-source inference engine whose headline configuration serves GLM-5.2, a 753-billion-parameter mixture-of-experts model, at 14.9 tokens per second on a single 96 GB RTX PRO 6000 Blackwell workstation GPU, with the 419 GB expert pool held in host memory. Four days later we reproduced the configuration on our own hardware and measured 16.9 tokens per second warm, with time to first token between 7.2 and 7.8 seconds against the paper's 7.5, and a first-ever cold start that landed on their stated worst-case bound of 44 seconds. Two follow-up tests sharpen the picture: an expert-kernel A/B showed the GEMM kernel is not the constraint and decomposed that 44-second cold start into one-time compilation over a steady-state 8 seconds, and a timeout-guarded NCCL collective on a second dual-GPU machine cleared tensor parallelism on hardware where a documented hang defeats the capability probe. We have not found another published reproduction of the frontier configuration as of this writing.
ReadPast the Peak: Maximum Reasoning Effort Made Our Model Measurably Worse
Our on-premises text seat had run at its chat template's highest reasoning-effort setting since the day it was deployed, because nothing in the stack ever set the value. Measured across 94 benchmark items per setting, that default scored 84.6 on our flat composite against 93.4 at the middle setting, while spending 81 percent more completion tokens; disabling reasoning entirely was worse than both, so the reasoning was doing work and its length was the defect. The dimensions measuring raw reasoning were already at ceiling and could not improve. Everything that moved measures whether the model commits: tool selection, abstention, multi-step execution, grounding. Abstention rose from 66.7 to 100.0, meaning maximum effort had reasoned the model into answering questions it should have refused. Because the settings are inserted sentences rather than compute budgets, we then reproduced the top setting as a hand-written expert-persona prompt and watched tool selection fall to the same 62.5 it scored at maximum effort. We give the method, the non-termination failure at the top of the dial, and an explicit account of what these numbers will not carry.
ReadThe Flat Line: Why a Single Throughput Number Cannot Tell Batching From Queueing
A production inference engine reported the same aggregate throughput at one concurrent request as at sixty-four. It was not batching at all: every request past the first was queueing, and the single benchmark point we had been quoting could not see the difference. Sweeping the concurrency ladder corrected a stored throughput figure by 3.2× and moved a model comparison from a reported ~7× to 17.0×, or 33.9× per GPU, since NVIDIA's Nemotron 3.5 Lightning sustained 5,613 tokens per second across 64 concurrent requests on a single Blackwell card, at sub-three-second p95, and had not saturated when our ladder ran out. We give the diagnostic signature (flat aggregate, linearly climbing p95), the four-configuration sweep that exposed it, a quality result that survived repetition and one that did not, and why a recorded performance number belongs to a configuration rather than to a model.
ReadMake It Go Red: The False-Green Failure Class in Production Monitoring
For five months a nightly backup reported Complete over a zero-byte archive. An alert rule had been structurally incapable of firing for its entire life. A dashboard rendered missing telemetry as health, and 37 of 49 deployment scripts could silently ship stale monitoring state. We name the failure class, the false green, map its mechanisms in four families from a 24-day production audit, show that verification tooling itself reproduces the class it hunts, and describe the falsification harness now grading all 279 of our alerting controls continuously: registry, structural liveness, mutation-proven firing tests, and end-to-end canaries. Monitoring correctness is a reachability property, not a syntax property.
ReadThe Day an Agent Ate the Workstation: OOM Forensics of a 178 GiB CLI Memory Leak
An agentic coding CLI ballooned to 178.5 GiB of resident memory during a routine fleet upgrade and froze a production workstation. The kernel killed fourteen innocent processes before touching the culprit. A forensic walk through the OOM killer's victim ordering, why swapless machines turn leaks into freezes, the four-layer guard we deployed the same afternoon, and the upstream report we filed instead of posting screenshots.
ReadPower-Resilience by Design: Making a Stateful Kubernetes Fleet Survive Losing Its GPU Nodes
Our GPU compute tier is powered off most of the time by design. That makes any persistent state, or any hard scheduling pin, that lands on it a silent failure waiting to happen. Here is how we audited every hard dependency, relocated all state onto the storage cluster, and then proved resilience the only way that counts: by cutting the power.
ReadAn Immune System for a GPU Cluster: Building a Reflex Arc for Autonomous Self-Healing
We set out to design a self-healing v2 and found the opposite of a greenfield: four generations of self-healing stacked in sediment, maximum architectural sophistication, near-zero closed-loop coverage. The fix was not a fifth system: it was naming the missing shape, and then discovering the real blocker was signal quality, not architecture.
ReadMarkdown Is Sovereign, Postgres Is a Cache: Engineering a Rebuildable Agent-Memory Substrate
An agent's memory is its most dangerous component: poison it quietly and every downstream decision inherits the lie. We built a memory substrate on one governing principle (Markdown is the source of truth, Postgres is a rebuildable cache) and then learned the hard way that our retrieval eval had been measuring the wrong thing all along.
ReadA First Look at Text-Diffusion LLMs: Benchmarking DiffusionGemma on a Single Blackwell
Google shipped its first open-weights text-diffusion language model: a different generation paradigm that paints a whole canvas of tokens in parallel instead of writing left to right. We benchmarked it within days of release, and a 3.8B-active model beat a 128B production model on hard mathematics.
ReadServing a 550B Open Model on Blackwell B200: A Field Recipe and an Honest Agentic Benchmark
Can a 550-billion-parameter open model be served on Blackwell B200 and stand up to a frontier closed model on real agentic tool use? The serving path is a gauntlet of era-specific gotchas, and the most important result in the whole campaign is the one we published, retracted, and corrected.
ReadRight Pool, Right Workload: How Every Database We Ran Was Quietly Paying a 17× Storage Tax
A benign-looking storage warning led to an uncomfortable discovery: every production database on the cluster had its data on an erasure-coded pool, paying a partial-stripe read-modify-write penalty on every single fsync. The disks were fine. The pool was wrong, by about 17×.
ReadCharacterising a 200GbE RDMA Fabric on Commodity Hardware: From a Hidden PCIe x4 to PAM4 Optics
A routine fabric test found one inter-node link running at 29% of capacity, not broken, just quietly starved of PCIe lanes. Chasing that thread all the way down took us from a hidden slot-bifurcation trap to NCCL collective ceilings to a per-lane optical asymmetry that error-correction was silently hiding.
ReadPast the VRAM Wall: Serving a 397-Billion-Parameter Model That Does Not Fit Three Workstation GPUs
A 397-billion-parameter mixture-of-experts checkpoint occupies 378 GiB. The three workstation GPUs we pointed at it hold 294. It ran anyway, at 8.8 tokens per second warm on a single stream and 17.8 aggregate across four, using pipeline parallelism across two nodes with the expert weights offloaded to host memory. The wall is not a hard stop, but the price is paid immediately and in full. The interesting part is what was not the bottleneck: the 200 GbE fabric moved a gigabyte between nodes in 0.06 seconds, and the GPUs sat at 44 to 71 percent utilisation with power well under their limits for every measured second. Capacity was the constraint, not communication. Getting there needed a patched assertion in the serving runtime, a pinned network interface for the collective library, and the acceptance that no optimised kernel exists for this shape on this silicon.
ReadBuilding One Operator Cockpit for a Sovereign GPU Fleet
A sovereign GPU fleet emits a dozen overlapping signals (GPU box health, Kubernetes workloads, distributed storage, metrics, out-of-band power) and operators were jumping between tools to read them. The engineering story here is what it takes to turn an internal cockpit into something safe to expose: config-driven topology, read-only-by-default gates around every dangerous action, and secret-scanning in CI.
ReadThe Instrument Was Wrong: Stream Count, Slot Topology and Receive-Path Backpressure on a 200 GbE Fabric
For five weeks a three-node 200 GbE fabric appeared to run at 56 to 70 percent of line rate while the slower 25 GbE and 10 GbE tiers next to it reported 94 percent. Eight hardware hypotheses were eliminated before the arithmetic gave it away: the benchmark used eight parallel streams, each iperf3 stream saturates one core at 14 to 18 Gbps, and eight times fourteen is the 112.01 Gbps we had been staring at. The slower links looked healthy under the same harness because they fit inside a single core. Raising the stream count put all six directed paths within a fraction of 198 Gbps. Two more deficits were also instrument failures: a routing directive orphaned outside its interface stanza that had quietly sent storage traffic down a 10 GbE fallback, and a diagnostics dashboard whose 22 failing checks were 22 bugs in the dashboard. One genuine defect survives, a receive-path backpressure on a single host that two plausible tunings both made worse.
ReadThe Trinity Model Shoot-out: Five Frontier MoE Models on Workstation Blackwell
Five frontier open-weight mixture-of-experts models (MiniMax-M2.7, GLM-5.1, DeepSeek-V3.2, Qwen3-235B and Qwen3.5-397B) served on the same three-Blackwell cluster under llama.cpp TCP RPC and graded on one mechanical 30-prompt suite at matched budget. A hybrid Mamba2+transformer leads at 96.7%, and default thinking modes turn out to be a methodology trap.
ReadDistributed Inference on Workstation Blackwell, Part 3: A 228-Billion-Parameter MoE Reasoning Model via TCP RPC
Can a single-operator workstation cluster with no NVLink and no InfiniBand serve a 228-billion-parameter mixture-of-experts reasoning model at conversational speed? Part 3 distributes MiniMax-M2.7 at Q8_0, 226 GiB across three Blackwell GPUs, under llama.cpp over plain TCP RPC, and measures the no-optimisation floor.
ReadDistributed Inference on Workstation Blackwell, Part 2: Amalgamated System RAM for GPU Dataframe Analytics
Does a workstation-class Blackwell cluster extend beyond language-model inference? Part 2 retargets the same two-node, three-GPU cluster to a full GPU-accelerated click-through-rate pipeline (Parquet ingest, high-cardinality shuffle, target encoding, and multi-GPU XGBoost) on roughly 750 GB of amalgamated system RAM over RAPIDS and Dask-CUDA.
ReadDistributed Inference on Workstation Blackwell, Part 1: Cluster Bring-Up and Cross-Node Fabric Characterisation
Can frontier open-weight language models be served on workstation-class NVIDIA Blackwell GPUs interconnected by commodity RDMA Ethernet, without NVLink or InfiniBand? Part 1 of an ongoing PureTensor research programme brings up the cluster, characterises the fabric, verifies GPUDirect RDMA, and demonstrates first cross-node inference of Llama 3.1 405B.
ReadJunction Temperature Is the Wrong Fan-Control Input: A Sensor-Selection Study on a 32-Core Zen 5 Workstation
A workstation was cycling its fans audibly with no matching change in workload. The controller was reading the CPU die junction temperature, which on this generation swings thirty degrees in seconds as threads hop between chiplets, while the socket thermistor two centimetres away sat flat at 38.5 degrees. Any proportional controller fed the first number oscillates by construction. Switching the input stopped the hunting and left the machine's actual temperature unchanged, because it had never been hot. Along the way a kernel update renumbered the hardware monitoring devices and silently pointed the fan configuration at the wrong chip, and the fix for that revealed a third cause underneath: the board's own embedded controller runs a firmware fan loop that watches the same volatile sensor and overrides the operating system entirely. The fingerprint is unmistakable once you look for it, PWM registers constant while fan speed swings by half. Five distinct causes of one symptom, and we misdiagnosed each as the others at least once.
ReadToward a Rotating Embedded Braneworld Cosmology: Critical Assessment, Formal Viability, and a Research Programme for Geometric Dark Sectors
The third paper in the CMAS research series, and the artefact the methodology was built to produce. Cosmology is the conduit; the question is whether structured adversarial interaction between frontier AI models can produce research-grade technical output on an open problem where no ground truth exists. The paper below is what came out.
ReadFrom Intuition to Formalism: Cross-Model Adversarial Synthesis as a Theory Development Tool
Can a vague metaphysical idea, lacking any mathematical grounding, be refined into a falsifiable research programme through structured adversarial interaction between frontier AI models? A case study in speculative cosmology.
ReadCross-Model Adversarial Synthesis: Exploiting Latent Space Heterogeneity for Novel Knowledge Generation
Can structured adversarial interaction between independently trained LLMs produce insights that exceed any single model's capability? We present a theoretical framework and initial case study in black hole information theory.
ReadSurviving the Loss of Six of Nine Nodes: What Actually Blocks Stateful Recovery in Kubernetes
We powered off six of nine nodes in a production Kubernetes cluster, taking the entire storage backend with them, to find out what actually blocks recovery. Stateless failover was a non-event: everything rescheduled onto the four survivors unattended. Stateful recovery stalled on two things, both of them Kubernetes working exactly as specified. A StatefulSet will not create a replacement while the old pod is Terminating, and a pod on a dead node stays Terminating forever because the kubelet that would confirm its deletion is gone. Meanwhile the block-volume attachment objects persist on the dead node, so the replacement fails to attach elsewhere. Two scheduling rules that were correct at nine nodes also became unschedulable at four. A recovery job now clears both classes in sixteen seconds, and a later audit showed why soft affinity had never held placement on a fleet where one node has sixty times another's memory. The most instructive failure of the lot, a zombie storage client that blocked twenty-one pods for nineteen hours with every node healthy, is one the automation could never have caught.
ReadNative FP4 Is Slower Than Emulated FP4: A Kernel-Maturity Measurement on First-Generation Workstation Blackwell
On the day NVIDIA's 120-billion-parameter Nemotron 3 Super was released, we served it at NVFP4 on a single RTX PRO 6000 Blackwell and swept concurrency from 1 to 64 on two back ends: the hardware's native SM120 CUTLASS FP4 kernels and Marlin, a software emulation of FP4 weight-only quantisation. The native path lost at every point, by 7 to 14 percent, 83 against 97 tokens per second single-stream and 801 against 886 at 32 concurrent, because most CUTLASS tile-shape tactics failed inside the just-in-time autotuner and only fallbacks survived. A second finding is larger and less flattering: our first baseline carried a defensive flag that disabled CUDA graphs and reported 27 tokens per second, a 3.6-fold understatement that would have been published as the model's speed had the flag not been questioned. Silicon capability and kernel maturity are different things, and a first-launch number on a day-one stack is provisional.
ReadThe Layered Ceiling: Measuring Every Stage Between Wire Speed and File Transfer on a 200 GbE RoCE Fabric
A 200 GbE fabric moves 25 GB/s on paper. Over five weeks we measured every layer between that wire speed and a finished file copy on a three-node RoCE fabric: raw RDMA at 24.4 GB/s, eight-stream zero-copy TCP at 24.2, NFS over RDMA at 14.5, an unencrypted eight-stream rsync daemon at 12.9, and the rsync-over-SSH restore that started the investigation at 1.98 GB/s, 7.9 percent of the link. Synthetic line-rate tests had been green the whole time. Parallelism was the answer at three unrelated layers, TCP streams, chunked file reads and erasure-coded object writes, and in each case the serial number looked like a hardware fault until the parallel number was taken. We also publish an unreconciled disagreement between two measurements of the same node four weeks apart, and the trust-boundary argument for dropping encryption on a private point-to-point path.
ReadZero Percent or Nothing: The Performance Cliff at the VRAM Boundary in Local Mixture-of-Experts Inference
On a fixed 192 GB VRAM budget, whether a model fits is binary, and it dominates every other tuning axis. On MiniMax M2.5 the smaller Q5_K_XL quantisation runs at 121 tokens per second fully resident while the nominally better Q6_K, which cannot avoid 3 percent CPU offload at any context length, peaks at 72; three percent on the host costs forty percent of throughput, and inside the resident band an eightfold change in context costs nothing. A 200 GB model against the same budget never fits and loses to a smaller incumbent on speed and accuracy. The runtime comparison is the same cliff in another costume: a production-grade engine forced to offload runs at 5.44 tokens per second, and at 35.8 once the weights fit. A second cliff sits on the concurrency axis, where a batching runtime climbs from 35.8 to 821.9 tokens per second aggregate and a serialising one holds flat at 115 while time to first token rises 257-fold. Choose the largest model that fits, never the largest model that runs.
ReadThe Missing Terminal Step: Local Language Models Investigate Infrastructure Incidents Competently and Never Report
We built a synthetic incident-response harness: an alert, four kinds of diagnostic tool, mock responses, and an explicit instruction to call a terminal function once the root cause is known. Ten multi-hop scenarios went to three locally served open-weight models on two workstation Blackwell GPUs. The result was 138 tool calls and zero resolutions. The best model found the root-cause evidence within two to eight turns in every scenario, chose the right commands and read their output correctly, and then kept investigating until the turn cap. The gap is not tool calling, domain knowledge or investigation quality; it is a stopping rule. We name six failure shapes, separate the two confounds (a parser mismatch and a tokenizer corruption) from the universal one, and argue for an orchestrator-executor split in which a protocol-adhering model owns the loop and the local model executes the steps.
ReadThermally Blind by Design: A Super I/O Register Limit Hides Memory Temperature From Hardware Fan Control
A freshly racked Threadripper workstation passed its CPU thermal validation with room to spare, then drove its 256 GB of DDR5 past 85 °C under memory stress while the fans held at 31 percent. The curve was fine. The controller could not see the sensor: the Super I/O exposes aggregate memory temperature as sensor 13 and the kernel driver clamps the fan-source selector at 12, so the board's hardware fan control is structurally blind to its own memory. Five stress runs show that a passing run under a non-deterministic stress method proves nothing (the identical configuration aborted on retry), that the intuitive fix, locking fans at 55 percent, produced the worst result of the series, and that even 100 percent fan speed lost to a 19 °C spike inside one sampling interval. A reproducible write workload and a user-space daemon reading the orphaned channel brought the peak to 54.5 °C. A secondary study on a dual open-air GPU workstation records an 11 °C recirculation delta and a confounded fix.
ReadTranslation Chains Do Not Defend Against Prompt Injection: A Paired Study With a Deobfuscation Regression
Randomised multi-hop machine translation has been proposed as a prompt-injection defence: pass untrusted text through several languages and back, and the delimiters, fake system tags and encodings that carry an attack should not survive the round trip. We ran the first empirical test, 100 public-corpus attacks against a 120-billion-parameter victim and 100 against a 20-billion-parameter one, each attack paired with its translated counterpart. The defence is indistinguishable from noise: McNemar chi-squared 0.696, p about 0.40, a net gain of five attacks in a hundred. Worse, nine attacks that were blocked raw succeeded after translation, because the chain deobfuscated code, leetspeak and encoded payloads into clean instructions and explained the attack to the victim. Both models converged on the same 20 percent defended attack-success floor, the set of attacks whose intent is language-independent and therefore translates correctly.
Read