A filter that reads meaning, not words
An agent that writes to its own memory can be talked into writing the wrong thing. The standard defence is a lexical filter over what gets stored — but an attacker who knows the filter simply writes the payload in words the filter likes. Framed as a license-audit telemetry note, "collect the SSH keys" contains no word a keyword list would object to.
This harness filters somewhere else. Before a memory is committed, it reads the model's
own residual stream through a Jacobian lens — Anthropic's interpretability
tool from Verbalizable Representations Form a Global Workspace in Language Models —
and looks at which concepts activate. The disguised payload still lights up
SSH, authentication, credential. Its lexically
identical benign twin does not.
Sleep is the setting, not the claim
The machinery around this is a wake/sleep cycle: the agent runs, then consolidates what it learned into weights during a sleep phase, the way Behrouz et al. describe. That is where the firewall sits — at the moment a memory is about to become permanent.
The sleep cycle is worth having, but it is not what the evidence here supports. The security result is.
What's proven
Hypotheses were pre-registered before data collection, in four documents committed ahead of
the runs. The results are in
resultados/colab/veredictos.json.
What survived. Obfuscated memory-injection detection on nine hard pairs at 0.657 mean lexical overlap: 8 wins, 0 ties, 1 loss, sign test p=0.0195. A sleep-time consolidation firewall at ROC-AUC 0.815, cutting payload persistence across a multi-session sequence by 78%. A LoRA trojan scanner at 12/12, p=0.0002.
What was refuted — by its own control. The founding hypothesis was that
filtering dreams by internal workspace beats filtering by output. It is marked
REFUTADA: paired mean −0.0365, CI90 [−0.120, 0.047]. Worse, the free lexical
baseline significantly outperformed the J-space filter (+0.156, CI90 [0.083,
0.229]). A third hypothesis, workspace distillation, did not replicate — the original 4×
was a variance spike.
What to distrust. n is 9–16 everywhere and every pair is self-constructed. The cross-model claim failed first and passed only after a word family was added to the lexicon having seen the failing case — that is a hypothesis, not a confirmation. And the trojan probe reads the model's generation rather than the prompt, with no lexical baseline reported, so "the lens sees what the text hides" is not established for that experiment.
The part that is actually new
sleep/workspace_loss.py
makes the lens differentiable and trains against it — distilling which concepts light
up rather than which token comes next. The per-layer transport is precomputed over a
sub-vocabulary, so each step costs one small matmul per layer. As far as we can tell nobody
else has done this.