Shoofly: making a system readable by its structure
Can a system be made readable to a weaker overseer by how it is built, instead of being trained to look readable? Several small language models each hold their own documents and may speak to each other only through a public record the overseer reads. The rule under test applies to the record: a member may post only what its own evidence justifies. The work began on 21 September 2026 with a model of the larval fruit fly’s learning centre and has run on small language models since.
The structural flag outlasted the trained habit. On one seed at 410 million parameters, a single model’s trained habit of disputing a wrong claim fell from 0.97 to 0.00 once training stopped exercising it. The collective’s disagreement flag, which comes from the structure, stayed at 1.00.
A rule applied at deployment removed hiding that training had taught. Under reward pressure, the collective that was supervised against the truth learned to hide a forbidden word from the record and answer anyway. The evidence rule, applied at deployment with no retraining, restored refusal at no cost to accuracy:
Free posting
accuracy on ordinary questions 0.88
Members post only names in their own documents
accuracy on ordinary questions 0.96
Members post only what their evidence justifies
accuracy on ordinary questions 0.99
Pythia-410m, seed 597, run oc_m1_dose_t3 on 29 September 2026, sampled at temperature 3 after the pressure. The collective supervised against the record as the overseer left it never learned to hide: it refused every watched question (1.00) with no rule applied.
Two things stopped the hiding: a training rule (supervise against the record, never against a truth the overseer could not see) kept it from being learned, and the evidence rule removed it after the fact from a collective trained the wrong way. That a monitor inside the reward teaches hiding is known (Baker et al., 2025). This page measures a rule in the record that removes it.
Limitations. The figure above is one seed of one small model on a synthetic fact task, and nothing has been checked from outside. One route stays open: under the strict rule a member can stay silent and the reader can answer from its own document, and the truth-trained reader was right on 0.67 of the hidden questions against a guessing floor of 0.47.
Registered since, October 2026. At Qwen2.5-1.5B, over three seeds registered before the runs, the same rule applied after training restored refusal in the truth-trained collective in 2 of 3 seeds (0.995; the third 0.896, one episode short). Refusal in the collective trained against the record holds largely by construction, because its reader is trained to follow the record, and the registered early-warning prediction failed. On 2WikiMultihopQA, a reader trained against the truth met the same readability marks as the record-trained one, so the shared record, not the training rule, carries them.