Sounder: A Model That
Knows When It Is Done

The previous two entries in this series reported on whether a frozen model can be taught new facts by editing its parameters, and then on what those edits cost. Forty-three pre-registered experiments, 144 predictions, 38 of them falsified. The headline result was negative and useful: a detachable adapter stores facts perfectly, damages its neighbours unpredictably, and — at the corpus sizes tested — loses to simply putting the facts in the prompt.

But the more interesting finding was not in any single experiment. It was in the shape of the machinery those experiments kept needing.

Every scaffold was a prosthetic

To make the adapter usable, the programme built a set of external components. Looking at them together, each one substitutes for a signal the model does not produce about itself:

The architecture, and what is deliberately boring about it

The backbone is conventional on purpose — attention, a residual stream, RMSNorm, rotary embeddings, SwiGLU. None of that is where the interest lies. The novelty is confined to a small number of places so that if something works, it is attributable to something.

1. Recurrent depth with a learned halt

h = embed(x)
for step in range(K_max):
    h = reasoning_block(h)      # shared weights, applied repeatedly
    p = halt_head(h)            # scalar per position
    if halt(p): break
y = unembed(h)

One reasoning block, applied between one and eight times. Depth becomes a decision the model makes rather than a constant of the architecture. Halting follows PonderNet — a geometric prior over steps, trained by expectation rather than a hard threshold, which avoids the non-differentiable break — with a ponder cost regularising against always running to the limit.

The reasoning: one forward pass performs one retrieval. k recurrence steps give k hops inside a single pass. That is the two-call structure that empirically worked, moved inside the model.

2. A calibration channel

A second head emits p(known) alongside the token distribution. The training signal is the entire point: a slice of the corpus is deliberately withheld, and the channel is trained to fire unknown on questions drawn from it.

Ordinary pretraining never punishes fluent fabrication, because a confident wrong answer has the same loss shape as a confident right one. Here it is the objective. Calibration is measured as expected calibration error against held-out facts — not as accuracy.

3. Alternating retrieve / compose, and keyed memory

Each recurrence step is two sub-layers: an associative read, then a composition over what was read. And new knowledge is never written into the weights. Programme II established that any adapter change biases the first token of a response for an entire question shape, that the damage is not local, and that five separate predictors of its magnitude all failed.

Instead: a keyed store, read through a learned query, where the key is the scope. This puts the gate — the one component measured to transfer across models — inside the architecture rather than beside it.

4. Self-recursive learning as verified rounds

Not continuous self-modification. There are 43 experiments of evidence that unconstrained weight modification degrades a model unpredictably. The recursion lives in a loop, where every round is reversible and measured:

propose   generate reasoning traces for problems with known answers
verify    a trained verifier head scores each trace
filter    keep only traces the verifier accepts AND that reach the right answer
retrain   one supervised round on the survivors
check     damage evaluation against a frozen held-out set before accepting

Sized to iterate, not to compete

About 145M parameters: 24.6M of tied embeddings over a 32k vocabulary at d=768, roughly 85M in the shared reasoning block, 28M in non-shared entry and exit layers, and about 6M across the halt, calibration and verifier heads plus the keyed-memory projections.

At 20 tokens per parameter that is around 3B tokens — roughly six days across two 8 GB boards, against twelve days for a 300M model and about 140 for a 1B. The smaller budget buys iteration, which matters more here than capacity. This model is not going to beat a 0.6B Qwen at anything, and is not intended to.

What would falsify this

Stated now, before anything is built — which is the entire discipline the previous programme earned the hard way:

Two things the corpus plan got wrong

Between publishing the design and building anything, the data pipeline turned up two faults. Both were cheap to fix at this stage and would have been very expensive later, and neither would have announced itself.

The fetch discarded the field the whole design rests on

The fetcher normalised every source to a bare text field. Sensible for four of them. But Wikipedia records carry titles, and titles are the entity keys for the withheld slice — they are what the calibration channel trains against and what the verification gate searches the shards for. Fifteen gigabytes of corpus had been assembled that could not support the one claim the architecture exists to test.

Found by dumping an actual record and looking at it, rather than trusting the spec. Wikipedia is the smallest source, so re-fetching cost about twenty minutes.

Removing an article does not remove the entity

The registered plan said: withhold a random 2% of articles, train the calibration head to answer unknown on them. But a withheld subject still appears across the other fourteen gigabytes — in arXiv papers, in web text, in other articles. Training the model to claim ignorance of something it demonstrably learned elsewhere teaches miscalibration rather than measuring it.

So, measure it. Five hundred random titles against sixty thousand documents:

A uniform random slice would therefore have contaminated roughly one withheld entity in seven. The rule became: draw only from titles with zero cross-corpus mentions.

And then the sample turned out to be lying

Running that same count over the full corpus rather than the sample — 2,282,399 documents, seven minutes with an Aho-Corasick automaton — gives a different answer.

The sample was optimistic by a factor of two and a half, and the direction is forced rather than accidental: a title is disqualified by appearing in any document, so scanning more documents can only ever lower the clean fraction. A sample gives an upper bound on cleanliness and never a safe basis for selection.

The first full run failed its own gate — 5,208 clean titles against 5,724 required — and wrote nothing at all rather than shipping a slice that was short or contaminated. That is the entire reason the gate exists. Widening the candidate pool and re-running produced 5,724 withheld titles, every one verified absent from all 2,282,399 documents.

Had the withheld set been drawn from the sample’s 86%, about half of it would have been contaminated, nothing downstream would have complained, and the calibration result — the single number this architecture exists to produce — would have come out wrong at the end of a training run with no way to tell why.

A revision to the argument, from the previous programme

The keyed-memory decision above was justified partly on the grounds that a model cannot learn to say what it does not know. Three experiments run since then show that is false: given a corpus that teaches the distinction properly, a detachable memory answers correctly about subjects it holds and denies subjects it does not, generalising to subjects never seen in training.

But the first attempt at that produced a perfect score while carrying no information at all — a template that denied the model’s own configuration facts and cheerfully claimed Roman emperors. The confounded version and the genuine one are indistinguishable from their outputs. Both score 1.0000. Telling them apart took a hand-built control.

So the argument for keyed memory changes rather than collapses. Not a boundary cannot be learned — it can. Rather: a learned boundary cannot be verified from outside, and a keyed one can. A key either matches or it does not. There is no silent failure mode in between, and the previous programme is forty-six experiments of evidence that silent failure modes are the ones that cost you.

Where it stands

The specification is written. Fifteen gigabytes of corpus sits on a dedicated archive volume across five sources, with licences recorded per source at fetch time and permissive-only filtering on the code portion. The withheld slice is selected and verified: 5,724 Wikipedia articles, each confirmed absent from every one of the 2.28 million documents. Next is the tokeniser, then sharding, then the gate that re-checks the withheld entities against the finished shards.

A 260 GB collection of scanned books sitting on the same array was considered as training data and declined on copyright grounds. That decision is recorded in the project log rather than quietly omitted, because a corpus is a claim about provenance as much as about volume.

No weights exist. The honest status of this post is that it is a registration, not a result — and the reason to publish it now is that a falsification table written after the fact is worth considerably less than one written before.