A pocket universe the size of a forward pass: a traveler, \o/, rides the residual stream from embed to logits and you see inside at every station -- the vector, the causal attention, the prediction. A real, deterministic 4-dim/3-block toy transformer computed live: the shape of a forward pass, not a real LLM. CC-BY-ND-4.0

The boundary-crossing family hub: the membranes your work can cross, and the instrument that watches each. Published -> forward-observers, weights -> surfacing, context -> hearsay; the silence-gauge weighs the negatives. Honest about the membranes it does not yet watch. CC-BY-ND-4.0

v3: trained both arms from scratch (numpy, gradient-checked backprop) and tested held-out. Silo (k-means to K intents) WINS the order-insensitive task at 4x cheaper attention, and COLLAPSES on the order-sensitive one -- it threw order away. Real numbers, reported straight incl. where it loses. Synthetic probes, honest ablation. CC-BY-ND-4.0

The evidential weight of a negative, quantified. surfacing's asymmetry as Bayes arithmetic: a surface is ~60 bits (decisive); under frontier suppression, silence carries <0.1 bit and tells you almost nothing. The emission rate is a slider you can drag until silence means something. Self-testable. CC-BY-ND-4.0

v4: two silos in parallel, merged at the end. A content silo (orderless) + a position silo (ordered bins), shared encoder, trained (gradient-checked). The dual PARTIALLY recovers the order the single silo threw away (42.5->61.8%), short of plain (85%) since binning is coarser than positions, at half plain's attention. CC-BY-ND-4.0

A membership-detection harness. Its sibling forward-observers catches your canary published on a crawlable page; surfacing catches the other thing -- your artifact ingested into a model's training set and re-emitted from the weights. Five controls make a positive hard to explain away and a negative honest. Self-testable, no network. CC-BY-ND-4.0

Air-gap membrane detector: did your marker cross a gap that was supposed to hold? A marker planted inside a claimed-isolated enclave, found outside it. The isolation gate separates a breach (air-gapped) from an expected export (connected), and names which of the four kinds of gap failed. A lead, never proof. Self-testable. CC-BY-ND-4.0

git-c2: a canary control center that lives on a git repo. HQ posts orders, forward observers sweep public indexes for your canary tokens, hits append to a git ledger, a page reads it back. Network-free self-testable detector is the trust boundary.

The honest head-to-head: silo (cluster to K intents, then transform) vs plain transformer (attend over N tokens). Untrained toys, so no fake accuracy -- the elbow method (variance explained) + rate-distortion (attention N^2->K^2 saved vs fidelity lost). Plain = K=N, agreement 1.0 by construction. A trade-off, not a winner. CC-BY-ND-4.0

transformer-silo v1: a two-floor silo. Downstairs an intent-engine centrifuge spins the preloaded user context until like settles with like (convergent clustering, N->K compression); upstairs a normal transformer runs over the intents. Really converges, sorts like-to-like, compresses, transforms -- a runnable honest toy. CC-BY-ND-4.0

Human-memory membrane detector: did your marker cross by a person remembering it -- seen, carried out in their head, later recited? A memorable passphrase, fuzzy-matched (memory is lossy); only a near-exact recall by someone with access certifies. A lead, never proof of memorised-vs-copied. Self-testable. CC-BY-ND-4.0

Context/relay membrane detector: did your marker come back secondhand, re-emitted in another agent's output and relayed to you? Sibling of forward-observers (published) + surfacing (weights). Only a private marker in a third-party relay is a lead; public is gated as contamination. Hearsay is hearsay. Self-testable. CC-BY-ND-4.0

Inference/API membrane detector: did your marker leak through LIVE inference -- emitted by a hosted model to a third party via cache/retrieval/cross-session bleed? The freshness gate (seeded after the model's cutoff) separates live leakage from training membership (surfacing's membrane). A corroborated lead, never proof. Self-testable. CC-BY-ND-4.0

The boundary-crossing capstone: fold forward-observers + surfacing + hearsay findings into one honest case file. Independent membranes add bits; a gated finding counts zero; a fired control voids the run; the verdict caps at 'a strong lead across N membranes,' never proof of theft. Self-testable. CC-BY-ND-4.0

Side-channel membrane detector: did your marker leak through timing/power/cache -- reconstructed bit-by-bit, never as text? Statistical: a SIGNAL must beat the noise floor by 5 sigma, and a held-out floor proves the channel isn't handed the answer. A lead, never proof. Self-testable. CC-BY-ND-4.0