发表机构
AGILabs（AGILabs）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
该研究探讨认证代码世界模型中相对于可达性的拓扑，通过LLM合成实验得出三条原则，揭示危险与可达性的关联、修复的限制及缓解措施需匹配错误维度方向的结论。
AI 中文摘要
采样门接受的代码世界模型在门可观测的所有事物上可以完全正确，而在门不可达的范围外则可以任意错误。我们研究了当遗漏是一个包围不可达内部的环形冻结模式时，认证模型能知晓什么、其错误会造成什么代价。门商使该问题变得精确：确定性接受决定了模型在可达查询集上的完全正确性；不可达范围则属于规范范畴。在一个最小环形仪器上，我们证明了极端情况（即错误拓扑的实心圆盘伪影，无法被任何采样门证伪，且在运行中逐位无害），并通过跨三个模型族的大语言模型（LLM）合成，测量一个参数（宽度为γ的通道）如何使同一伪影在三种状态间切换：无法证伪且无害、可证伪且代价高昂、即刻被证伪。三条原则组织了这些实证结果：第一，危险是相对于可达性的拓扑：规划器可使用的通道会使盲模型的利用效率崩溃（在γ≈0.1处的拐点处，运行代价从1.09降至约0），而具有相同第一贝蒂数的隐藏通道则会保持其全部强度（1.12）。第二，修复受参数和传感器限制：没有任何模型族能从外部证据中恢复该区域；从内部来看，模型能提出正确的拓扑结构，但无法确定其参数，且所提出的拓扑结构跟踪的是引导持续同调摘要的错误β₁（具有测量几何分辨率极限的传感器），而非真实值。第三，缓解措施必须匹配错误的维度和方向：点围栏对一维边界无效，维度匹配的持续围栏将利用效率崩溃为两阶段瞬态（0.999至0.058），而对偶自由度证书则对称地崩溃了发明模式的失效（1.769至0.029）。在n维空间中，壳会使误识别几乎确定，而危险仍完全可被利用：这两个维度相互独立。
英文摘要
A code world model accepted by a sampling gate can be exactly right on everything the gate can see and arbitrarily wrong beyond it. We characterize what a certified model can know, and what its errors can cost, when the omission is an annular freeze mode enclosing an unreachable interior. The gate quotient makes the question precise: acceptance-with-certainty determines the model exactly on the reachable query set; beyond reach is gauge. On a minimal ring instrument we prove the extreme case (a wrong-topology filled-disc artifact unfalsifiable by any sampling gate and bitwise harmless at play) and measure, with LLM synthesis across three model families, how one knob (a channel of width gamma) walks the same artifact through three regimes: unfalsifiable-and-harmless, falsifiable-and-costly, and instantly falsified. Three principles organize the empirics. First, danger is topology relative to reach: a channel the planner can use collapses the blind model's exploitation (play cost 1.09 to ~0 over a knee at gamma ~ 0.1), while a hidden channel with the same first Betti number keeps it at full strength (1.12). Second, repair is parameter-bound and sensor-bound: no family recovers the region from outside evidence; from inside, models pose the right topology but cannot pin its parameters, and the posed topology tracks the guiding persistent-homology summary's wrong beta_1 (a sensor with a measured geometric resolution limit), not the truth. Third, mitigation must match the error's dimension and direction: point fences fail against the one-dimensional boundary, a dimension-matched persisted fence collapses exploitation to a two-lesson transient (0.999 to 0.058), and the dual freedom certificate collapses the invented-mode failure symmetrically (1.769 to 0.029). In n dimensions the shell makes misidentification near-certain while the danger stays fully exploitable: the two axes are independent.
Comments33 pages, 2 figures. Paper 3 of a series (companion papers: arXiv:2607.14169, arXiv:2608.17956). Code, data, and Lean formalization: https://github.com/JaviMaligno/code-world-models
