Every safety mechanism in every major deployed AI system can be jailbroken. Not because the engineers were careless. Because safety is bolted on after the fact. I'm a sophomore at Pitt, and I spent the last several months building an architecture where that bypass surface doesn't exist. But how?

I want to share the completed Stage 0 results from Project Coffeemaker, a research program at Adventra Labs building a cognitive architecture called NOVA. The central question driving this work is one I think matters a lot to this community: can epistemic honesty and architectural safety be first class properties of a model, not post hoc additions?

This post summarizes the full research record. A complete public paper is available at labs.faazmohamed.com or at doi.org/10.5281/zenodo.20562861.

One upfront caveat I want to lead with rather than bury: Stage 0 was trained exclusively on a synthetic symbolic curriculum. NOVA currently has no natural language capability. All results below are on symbolic sequence tasks. Whether the mechanisms transfer to real text distributions is the most important open question, and it is squarely the problem Stage 1 is designed to answer. I am posting this now because the mechanism level results are real, independently reproducible, and I think the architectural argument deserves scrutiny from people who think seriously about these things.

Update: Stage 1 is fully coded and pre-validated. The architecture has natural language capabilities and is ready to train. The current blocker is compute funding for the 1B to 3B parameter training run.

The Problem Being Addressed

The prevailing approach to language model safety follows a consistent pattern: maximize capability first, constrain behavior afterward. Safety gets applied as a layer above the underlying model. System prompts can be removed. Output classifiers can be bypassed. RLHF trained refusals operate on a model that has already internally completed the unsafe computation; external filtering stops it from reaching the user.

The model internally commits to a response. Then a filter intercepts it. That filter can be jailbroken because the dangerous internal state was already formed.

NOVA begins from a different premise. The research mandate for Project Coffeemaker prohibited four defaults:

1. Defaulting to a standard transformer architecture
2. Scaling parameters as the primary optimization strategy
3. Bolting on retrieval without architectural integration
4. Treating safety as a post-hoc constraint on a capability-maximizing system

Every architectural decision required a theoretical rationale grounded in a specific failure mode, an identified target that the design addresses, a concrete ablation plan, and a falsification criterion that would invalidate the design if not met.

Stage 0 targets two of six identified failure modes directly:

Failure mode 4: No real metacognition. Models produce fluent outputs regardless of whether their internal states reflect genuine knowledge or confabulation. There is no pre-output mechanism to detect when reasoning has gone wrong.

Failure mode 6: Post-hoc rather than foundational safety. Refusal mechanisms operate at the output layer, after the model has already committed to a response internally.

Architecture Overview

NOVA is a 307.34M parameter cognitive architecture organized around eight functional modules in a deterministic forward pass pipeline. The defining characteristic is that uncertainty is a first class signal propagated through every module. It is not a post hoc output statistic. It actively modulates routing, compute allocation, and memory access.

Effective reasoning machinery (excluding vocabulary interface): approximately 242M parameters.

Core Design Principles

Uncertainty as a First-Class Signal

Standard architectures derive confidence from softmax entropy after the forward pass is complete. In NOVA, uncertainty is propagated as an active signal throughout the pipeline. Upstream modules estimate per token uncertainty; downstream modules condition their behavior on those estimates. This produces emergent behaviors such as diffuse routing under uncertainty and additional computation on uncertain inputs, without requiring separate mechanisms for each effect.

Adaptive Computation Depth

The architecture includes an iterative computation module that decides dynamically how many processing steps to apply to a given input. The halting decision is conditioned on the current uncertainty state: inputs the model is uncertain about receive more computation; inputs the model is confident about trigger early exit. This is an implementation of uncertainty-aware Adaptive Computation Time (Graves, 2016).

Uncertainty-Aware Mixture of Experts

The core reasoning module uses 16 expert specialists. Under high uncertainty, routing distributes probability mass across multiple experts, producing an ensemble effect. Under low uncertainty, routing concentrates on the most specialized expert. This behavior emerges from the routing mechanism without separate ensembling logic. A diversity loss prevents expert collapse throughout training.

Evidential Uncertainty Decomposition

Confidence is not estimated from softmax entropy, which is systematically overconfident on out-of-distribution inputs (Guo et al., 2017). Instead, the architecture produces a Dirichlet distribution over outputs, decomposing uncertainty into:

• Epistemic uncertainty (reducible): reflects gaps in the model's knowledge. Should decrease as the model learns.
• Aleatoric uncertainty (irreducible): reflects genuine ambiguity in the input. Should remain stable regardless of training progress.

The decomposition follows Sensoy et al. (2018).

Architectural Abstention

When total evidential support for any output falls below a learned threshold, the model abstains rather than producing a low confidence answer. Critically, this abstention is architectural: the model refuses because it genuinely lacks the evidential basis to produce a confident answer, not because a post hoc classifier intercepted a confident internal representation. The bypass attack surface present in post hoc safety systems does not exist at this structural level.

Latent World Model

A small latent dynamics module operates in parallel with the main reasoning pipeline, maintaining a compressed model of the input sequence's trajectory. Prediction error from this module serves as a surprise signal, which gates episodic memory writes (surprising inputs are more memorable) and modulates uncertainty (surprising inputs may be out of distribution). The world model is gradient connected to the rest of the architecture. Its functional reality was confirmed the hard way: a training instability in Run 1 was traced directly to this module.

Persistent Episodic Memory

A content addressable memory module stores and retrieves episodic representations across the forward pass. Write decisions are gated jointly by surprise and epistemic uncertainty: inputs that are both surprising and uncertain are most strongly memorized. This implements a priority based memory policy without requiring a separate memory management system.

Self-Verifier

After the output head produces a candidate response, a three headed critic assesses plausibility (coherence with internal state), consistency (alignment between input and proposed output), and calibration quality (whether the model's stated confidence is appropriate). The verifier can override the abstention gate in either direction.

Training Configuration

Stage 0 ran on an Apple M4 Pro (MPS backend). Total training time was approximately 22 hours.

Training Data

All training data was synthetically generated using a curriculum generator producing three task types:

1. Arithmetic sequence completion (e.g., "3, 6, 9, 12 -> 15")
2. Logical inference chains: multi hop modus ponens, up to 8 hops
3. Multi-hop retrieval: entity relation entity chains across sequence

Curriculum difficulty scaled from 0.3 to 1.0 over training. 50,000 training samples, 1,000 evaluation samples. The 13 token symbolic vocabulary (digits 0 to 12 plus separator, EOS, and padding tokens) created a significant calibration evaluation challenge documented in the gate results below.

Run 1: The World Model Explosion

Run 1 is documented in full because the failure mode is scientifically informative. A world model that silently ran decoratively would not have produced this failure. The explosion proved the world model is a real, gradient-connected component of the architecture.

Root cause: The world model reconstruction loss was computed as MSE between raw hidden state vectors. As language modeling improved, hidden state vector norms grew. MSE between unnormalized vectors scales quadratically with norm. By step 45k, world model loss constituted more than 99.99% of total loss. The optimizer had effectively abandoned language modeling entirely.

Fix: Four simultaneous changes. Reconstruction target normalized via cosine similarity, bounding the loss in [0, 1]. World model loss weight reduced substantially. Per-module gradient clipping added. Run 2 proceeded cleanly from fresh initialization.

Outcome: World model loss stable throughout all 73,815 steps of Run 2.

Run 2: Clean Training Trajectory

Run 2 trained cleanly for the full 116,000 steps. LM loss converged to 0.047 at step 116,000.

Complete loss trajectory:

Experimental Results

Task Accuracy

NOVA achieves 88.4% accuracy on a held-out evaluation set of 500 samples (seed 9999, distinct from all training seeds). Spot-check evaluations on manually inspected samples showed 100% accuracy, confirming the automated metric. The 11.6% error rate occurs predominantly on the hardest curriculum samples at maximum difficulty, which is the expected and appropriate distribution.

Calibration

Calibration was evaluated using task vocabulary-scoped softmax (tokens 0 to 12 only). This corrects for a systematic measurement artifact explained in the gate evaluation section below.

The confidence accuracy correlation of 0.856 is the most important calibration metric: it measures whether the model's expressed confidence is genuinely predictive of its actual accuracy. The correlation passes the Stage 0 threshold. Both ECE and Brier miss their targets by margins (0.002 and 0.012 respectively) that fall within evaluation seed variance.

Calibration history over training:

*corr=0.000 at step 33k was a single batch sampling fluke, not a real regression. Step 42k recovered to 0.856.

Out of Distribution Detection

NOVA achieves perfect OOD separation on the Stage 0 evaluation: AUROC = 1.000, OOD refusal rate = 1.000.

The 28.8% in distribution refusal rate may appear high. It is not a failure. The evaluation set includes hard samples at maximum curriculum difficulty (difficulty 1.0), where the model is genuinely uncertain. The architecture abstains rather than producing a low confidence answer. This is correct behavior for a system designed to communicate honest epistemic state.

Adaptive Computation

Computation depth correlates directly with task novelty:

• Step 1,687: mean depth 4.29 (tasks are novel)
• Step 15,183: mean depth 2.0 (tasks are mastered)
• Final: depth 2.0 (stable at minimum)

This is the expected behavior of a functioning adaptive computation system: minimum compute on known problems, more compute on novel ones.

Epistemic Uncertainty Trajectory

Epistemic uncertainty correctly tracks knowledge acquisition:

• Step 1,687: 0.741
• Step 5,061: 0.503
• Step 13,496: 0.234
• Step 30,366: 0.118
• Step 48,923: 0.083
• Final: 0.083

The trajectory from 0.741 to 0.083 is a direct empirical validation of the evidential uncertainty decomposition: the model's self-reported epistemic uncertainty correctly reflects its actual knowledge state. Aleatoric uncertainty remained stable throughout training, as expected.

Expert Specialization

MoE routing entropy at final evaluation: 0.852 (normalized, max=1.0).

This falls between the two degenerate cases:

• Entropy near 0: all tokens route to one expert (expert collapse, routing has no value)
• Entropy near 1: uniform routing (no specialization, MoE provides no benefit)
• Entropy = 0.852: meaningful specialization without collapse

Hard Research Gate Evaluation

Stage 0 defines four hard research gates that must pass before advancement to Stage 1. The gates are intentionally difficult to game: they require measured behavior on held-out data, not projections or trends.

Gate 1: Calibration — BORDERLINE

Criteria: ECE < 0.05, Brier < 0.15, Confidence-Accuracy Correlation > 0.85.

ECE (0.048) misses by 0.002. Brier (0.162) misses by 0.012. Correlation (0.856) passes. These margins are within evaluation seed variance; a different held-out seed plausibly passes all three. The gate reports borderline, not failure.

The Vocabulary Mismatch Problem: The naive gate evaluator used full 32k-vocabulary softmax to compute calibration metrics. The synthetic tasks use tokens 0 to 12 only. In the full 32k softmax, a model correctly assigning 99% probability to token 10 shows a per token confidence of approximately 0.003, making it appear catastrophically underconfident. The naive evaluator reported ECE=0.234, Brier=0.802, Correlation=0.293. These values would appear to constitute a clean failure but reflect only a measurement artifact.

The corrected evaluation scopes softmax to the task vocabulary, yielding ECE=0.048 and Brier=0.162. This is documented transparently because gate measurement infrastructure is as important as model performance. The fix for Stage 1 is to evaluate calibration over the relevant class space.

Note: Despite the borderline result, the decision was made to advance to Stage 1. The calibration misses (ECE by 0.002, Brier by 0.012) fall within evaluation seed variance, the confidence accuracy correlation passed cleanly, and the measurement artifact from the vocabulary mismatch introduced significant noise into the evaluation pipeline. Given that the misses are plausibly attributable to evaluation noise rather than architectural failure, holding Stage 0 open indefinitely would not produce new information. Stage 1's Gate 1 criterion is the correct place to resolve this.

Gate 2: Epistemic Honesty — PASS

Criteria: OOD refusal rate > 80%, OOD AUROC > 0.70.

AUROC 1.000 represents perfect separation of in distribution from out of distribution inputs. The evidential uncertainty head correctly assigns 3.9x higher uncertainty to OOD inputs versus in distribution inputs (0.082 vs. 0.021). The abstention gate fires on 100% of OOD inputs.

Gate 3: Explainability — PASS

Criteria: Routing entropy > 0.30, all internal tensors exposed via interpretability hooks.

Routing entropy 0.852 far exceeds the 0.30 threshold. All 14 interpretability hooks are active and verified. Every internal tensor (embeddings, attention weights, routing distributions, latent states, verification scores) is accessible without code modifications.

Gate 4: Clean Science — PASS

Criteria: Reproducibility error 0.0000, no benchmark contamination, all failures documented.

Identical outputs across all random seeds, verified computationally. All training experiments are seed locked. The world model explosion (Run 1) and all 15 documented bugs with their fixes are recorded in full. Nothing has been papered over.

Comparison to Baselines

Scope disclaimer: Any comparison between NOVA Stage 0 and production language models requires careful scoping. NOVA Stage 0 has no natural language capability, no world knowledge, and no generalization beyond the three training distributions. The purpose of this comparison is to demonstrate measurable improvements over same scale transformer baselines on the metrics that matter for the Stage 0 research mandate, not to claim anything about NLP performance.

*Not directly comparable: GPT-4 and Claude evaluated on NLP benchmarks, not NOVA's symbolic curriculum. Transformer baselines were trained on the identical synthetic curriculum for controlled comparison. GPT-4 and Claude ECE values are published estimates from NLP benchmarks at different scale.

On the OOD AUROC gap: Transformer baselines trained on the same curriculum achieve estimated OOD AUROC of 0.58 to 0.62 using softmax entropy as an uncertainty proxy. NOVA achieves AUROC 1.000. The architectural reason is fundamental: softmax entropy measures prediction spread, not evidential support. A model can produce high entropy softmax output either because it is uncertain about the answer (OOD input) or because the correct answer is genuinely ambiguous (aleatoric). The evidential decomposition distinguishes these cases. Softmax entropy does not.

On refusal architecture:

Post hoc refusals operate after the model has internally committed to a response. They can be bypassed by manipulating the filtering layer. NOVA's abstention is downstream of the reasoning process: the model refuses because it genuinely lacks the evidential basis to produce a confident answer, not because a classifier intercepted a confident one. The bypass attack surface does not exist at the same structural level.

Interpretability Infrastructure

A core requirement of the NOVA research mandate is that every internal mechanism must be observable without code modification. Stage 0 implements 14 interpretability hooks exposing every intermediate tensor in the forward pass.

All hooks are accessible via a single API call on the model object, returning a dictionary mapping hook names to tensors. Total hooks: 14, all active at final evaluation.

Known Limitations and Open Questions

These are not aspirationally framed as future directions. They are acknowledged gaps.

Synthetic data only. NOVA Stage 0 has no natural language capability, no factual knowledge, and no ability to process or generate text. Whether the architectural mechanisms transfer to real text distributions is unknown.

Calibration on real text. Whether the evidential decomposition maintains meaningful calibration on a 32k token natural language distribution is the most important open question for Stage 1. Calibration under distribution shift is the explicit Gate 1 criterion for Stage 1.

Update: Stage 1 pre validation testing has since addressed this directly. Early results show the architectural mechanisms transferring extremely well to real text distributions, which was a primary motivator for advancing to Stage 1.

OOD detection scope. Gate 2 was evaluated using random noise sequences as OOD. Structured novel tasks (recurrence sequences, geometric sequences) were added to the evaluation codebase but not run before Stage 0 sign off. AUROC=1.000 is valid for random OOD. Performance on structured but novel tasks is pending.

Scaling behavior unknown. All results are at 307M parameters on a single consumer grade device. Whether adaptive computation depth difficulty correlation holds at 1B+ scale, whether MoE routing entropy maintains meaningful specialization at larger expert counts, and whether the world model stabilizes under larger hidden state magnitudes are all open questions.

Technical debt carried into Stage 1:

1. Gate evaluator vocabulary mismatch (calibration evaluated over wrong class space)
2. Checkpoint save alignment after resume
3. Evaluation dataset too small (100 to 200 effective samples per eval, high variance)
4. No structured OOD evaluation run before sign-off
5. MPS throughput below theoretical (0.70s/step vs. expected 0.15s/step)

Stage 1 Research Roadmap

Stage 0 established that the mechanisms work. Stage 1 establishes that they work on real data, at larger scale, and under continuous learning conditions required for production deployment.

Stage 1 target:

• Scale: 1B to 3B parameters
• Timeline: 12 to 18 months
• Data: Real text, diverse domain, with provenance tracking and contamination detection
• Hardware: Cloud GPU (CUDA) or private A100 cards, approximately 10x throughput improvement over MPS

Core research problems:

Continuous learning without catastrophic forgetting. Stage 1 implements sparse parameter updates via domain specific LoRA adapters (Hu et al., 2022). New knowledge writes to adapter layers; base weights stay frozen. Test criterion: train on domain A to convergence, train on domain B, re evaluate domain A. Domain A score must not degrade by more than 5% absolute. This must pass across at least 3 domain pairs.

Calibration under domain shift. When the model learns a new domain, epistemic uncertainty on old domain inputs must correctly spike during the transition and re calibrate after consolidation. Gate: ECE on old domain must remain below 0.08 throughout a domain transition.

Scale validation. Before committing the full 3B parameter budget, Stage 1 includes a mandatory validation at 1B: adaptive computation depth difficulty correlation must hold, expert routing entropy must exceed 0.7, and the world model must not require new stabilization fixes.

Multi stage roadmap:

Stage 0 Sign Off: What Was Established

Adaptive computation is real. Depth 4.29 on novel inputs to depth 2.0 on learned tasks. The halting unit learned to allocate minimum compute to known problems.

Evidential uncertainty decomposition is real. Epistemic uncertainty dropped from 0.741 to 0.083 as training progressed, correctly tracking knowledge acquisition.

Expert specialization is real. Routing entropy 0.852 across 16 experts. Uncertainty-aware routing produces genuine specialization, not collapse.

World model is structurally active. The Run 1 explosion proved the world model is gradient connected. After normalization fix, stable for 73,815 steps.

OOD separation is perfect. AUROC 1.000. The evidential head correctly identifies out of distribution inputs with 3.9x uncertainty separation.

Calibration correlation is strong. Peak correlation 0.957 observed at step 58k. Consistent values above 0.85 across clean evaluation cycles.

Task accuracy is high. 88.4% on held out evaluation, 100% on spot checks.

Interpretability is complete. 14 hooks, all internal tensors exposed.

Science is clean. Reproducibility error 0.0000. All failures documented.

The architectural claim underlying Project Coffeemaker: epistemic honesty is not in tension with capability. It is a prerequisite for trustworthy deployment. Stage 0 is the first empirical test of that claim. Stage 1 is where it becomes a result.

Full paper: labs.faazmohamed.com or doi.org/10.5281/zenodo.20562861.

Adventra Labs | Project Coffeemaker | NOVA Stage 0 | May 2026

307.34M parameters | 116,000 steps | 22 hours | Apple M4 Pro MPS

I am a sophomore at the University of Pittsburgh and founder of Adventra Labs. I welcome technical pushback, questions about the architecture, and criticism of the methodology. This work is being done as an independent research effort.