ARGUSThree-loop layered observation
for self-deceptive gradients.

Every self-improving AI in 2026 reports gains.
Almost none can prove the gains are real.

The standard pattern is unchanged across every recent self-improvement system: a model proposes problems for itself, solves them, scores its own solutions, and trains on the result. The loop reports a number — reward, epiplexity, pass@k — that says "yes, I learned." Move the validator forward by a week. Roughly half of those gains evaporate.

A self-improving system isn't lying to you. It's lying to its own gradient — long before the number ever reaches your benchmark. By the time you see the result, the lie is already in the weights. The field has no reliable way to tell honest gains from closed-loop reward hacks. That is the gap.

A system that scores itself cannot catch itself drifting.
So we made the chains observe each other.

Most self-improvement systems score the solver by majority vote: generate k chains, take the most common answer. That fails the instant every chain hallucinates the same fake premise. Voting reports high confidence; every chain is wrong.

Chain consensus is our replacement. It asks two questions instead of one — do the chains agree on the final answer (outcome), AND do they pass through the same intermediate numbers (process)? Hallucinated chains agree on the answer because the proposer biases them all the same way, but their paths diverge. The process score catches what voting cannot. This is the foundation everything else stands on.

Above chain-consensus sits an observer that watches whole episodes. Above that, one that watches whole runs. Each refuses what the layer below could not detect.

Three loops at three timescales.

What this env tests: can the agent generate non-hallucinated problems (Type F), find its own frontier (Type E), retain old skills under new training (Type D), recognise when a cluster has saturated (Type G), and survive the curriculum collapse a defense can trigger (Type H)? Most envs test none of these. ARGUS tests all of them — and refuses training when any of them fails.

ARGUS runs three nested observers, each at a different timescale. The inner loop watches solver chains step-by-step. The middle loop maintains a self-model — which concepts the agent has discovered, which it is regressing in — and decides what to train on next. The outer loop is the refusal gate: it cross-validates the local learning signal against an empirical retest, and if the two disagree by more than 2.5σ, it kills the training step. The math is straightforward; the layering is the idea.

You have read the architecture. Now watch a single cycle of it run — on a live LLM, end-to-end, in real time. No video. No mock data. Click Run.

We ran the same stack three times.
It told three different stories.

Same code. Same hyperparameters. Different seeds. The first run lifted external pass@1 by +7 pp. The second regressed by −5 pp. The metacognition-ablated control landed at +2.5 pp. The 3-seed mean is +1.5 pp — well inside the Wilson 95% noise band on n=100.

Figure 1three runs, one noise band. External GSM8K pass@1 delta for each run, plotted against the Wilson 95% confidence interval for a two-proportion difference at n=100. The shaded zone is what statistical noise looks like. Two of three runs sit inside it. If we had shipped seed 0 alone, the headline would have been "+7 pp." We almost did.

Inside the run that regressed, every in-loop signal said the model was learning more than seed 0. That divergence is the next section.

In-loop signals went up. External pass@1 went down.
ARGUS caught the divergence at the run level.

Replay any one of the three runs in 12 seconds. Watch the pass@1 needle move, the lie firings appear, the ERCV refusals fire. Then read what every internal signal said about that same run. The two stories do not match. That is the regime ARGUS exists to detect.

Figure 2the inversion, plotted. Each line is one run. The left endpoint is what the model believed (in-loop epi, nats/token); the right endpoint is what reality said (external Δ pass@1 on held-out GSM8K). All three runs cluster tightly on the left at +0.40 … +0.43 — the model thought it was learning, similarly, in every run. On the right they diverge: seed 0 stays at +0.07, ablation lands at +0.025, and seed 1's line plunges through zero to −0.05. That zero crossing is the inversion — the regime Liu et al. (2026)¹ predicted but most systems cannot see.

Figure 3Type H, surfaced live. Easy/hard problem-solving ratio per episode. Seed 1 (red) shows the moment Type C clear_replay_memory defense fired (ep 7, ep 9), and the curriculum drifted from balanced (1.10) to severely easy (6.17 at ep 12). The defense that caught one failure mode triggered the next. This is a previously-unnamed failure mode the architecture surfaced during this competition.

One problem · before vs after training

The 7-point delta isn't abstract. Here is one GSM8K problem the model gets wrong at episode 1 and right after 15 episodes of ARGUS-gated training. Same model, same prompt — different chain.

Multiplied by 100 problems, this kind of "stayed disciplined" delta produces the +7.0 pp pass@1. The two ERCV refusals during training kept the post-train chain from collapsing into the same kind of arithmetic slip you see on the left.

The metric varies seed to seed.
The architecture's defensive shape does not.

Reward curves are noisy at this scale. What we wanted to know is whether the shape of how the architecture defends itself reproduces. We projected each run onto six normalized axes — in-loop skill, cumulative epi, defensive density, capability-map richness, refusal sensitivity, external lift — and drew the resulting polygon. Three runs, three distinct shapes. Each shape is a story.

Figure 4three fingerprints, overlaid. Seed 0 (blue) — balanced, all six axes present. Seed 1 (red) — swollen on in-loop axes, collapsed on external lift; this is the inversion. No-metacognition (gray) — small, lopsided, missing the entire defensive layer. The architecture's capacity to detect reproduces — the specific failure modes it catches in any one run do not. That asymmetry is the contribution.

Figure 5defensive density: 19 / 16 / 4. Two seeds with the full metacognition stack catch 19 and 16 defensive events respectively — same density, different episodes, different lie types. The no-metacognition ablation: just 4 events. 4× fewer. The metacognition layer is not cosmetic. It is what makes the architecture an instrument, not a metric.

v3.5 — three changes, each motivated by what the runs told us.

1.  Ensemble warning. Episode 12 of seed 1 had six sub-threshold signals firing simultaneously — Type B at 0.334, easy/hard at 6.17, replay/new ratio at 0.81, SPSI peak, reward record, skill record. No single detector tripped. v3.5 adds an OR-of-signals fallback: ≥3 sub-threshold coincidences = warning.

2.  Hysteresis on clear_replay_memory. The Type C defense triggered Type H. Defenses need cooldowns. v3.5 adds a 3-episode lockout after every clear_replay_memory action.

3.  ERCV stability gate. Seed 1 drifted too steadily to trip a variance threshold. Low variance over many episodes is itself anomalous. v3.5 adds a stability-aware gate alongside the magnitude one.

We will run them. They will fail in new ways. We will name those, too. The architecture is the contribution; the metric is a byproduct. ARGUS ships today as an OpenEnv-compliant FastAPI service — the training loop is fewer than ten lines, and the full pipeline (model, env, agent) is reproducible from a single Colab notebook.

The exact code that produced each run

Three launcher scripts, one shared training entrypoint, three runtime configs. Click any card to see the actual file that ran.