Writing

A Jacobian lens fitted once on a base model detects trained-in reward hacking, removes part of it, and survives 250 steps of RL pressure without refitting. Hacking that RL grows by itself never shows up at all.

I fused a safety probe's activation gather and scoring into one GPU kernel, in Triton and in hand-written CUDA. At decode sizes everything ties, at large batches fusion wins 4.7x, and with many probes cuBLAS beats both hand-rolled kernels.

Reading activations for a safety probe the standard way slows decoding by up to 194%. A kernel that lives inside the CUDA graph makes it free on both vLLM and SGLang, and prefix caching turns out to hide most of the tokens a monitor would want to read.

I built cua-bench, a benchmark that has computer-use agents do accounting in a real ERP system and grades the final ledger state. Results from 854 rollouts across four frontier models, and how the grader resists reward hacking.

A linear probe can detect a behavior and steer it, and still fail to remove the behavior when you project its direction out. The standard checks cannot see that failure.

A shortcut-detection probe keeps passing every standard test after fine-tuning, yet the ablation necessity test shows it no longer tracks the axis the model uses. Updated with a rerun under RL (GRPO), where the picture gets worse.