PaperlayerView exact revision on arXiv

Source-linked AI summary

Regime-Conditional Verification: Correctness Estimation for Adapting and Monitoring Safety Classifiers

Thiago Sandoval, Ufuk Topcu

arXiv:2608.14089v1cs.AIcs.CLcs.CRcs.LG

TL;DR

Deployed safety classifiers may reflect a policy that differs from the deployer’s and lose performance as traffic shifts. RCV estimates policy disagreement from classifier representations and uses those estimates to correct predictions and monitor drift; adherence rises in every tested classifier–dataset combination.

  • Problem

    Deployed safety classifiers can reflect a training-time policy that diverges from the deployer’s and degrade as traffic shifts.

    Source: Introduction · p. 1

  • Method

    RCV uses verdict-conditioned probes of the classifier’s internal state to estimate policy disagreement, selectively correct likely errors, and monitor drift without labels.

    Source: Introduction · pp. 1–2

  • Results

    Adherence rises in all six classifier–dataset combinations, with the caught share of previously missed unsafe content ranging from 0.29 to 0.81.

    Source: Introduction · p. 2

  • Takeaways & Limitations

    These results show post-release policy adaptation and maintenance need not be treated as weight-update problems.

    Source: Conclusion · p. 7

    Evidence is bounded: detection uses one classifier, maintenance one deployment, and both benchmark datasets are English, single-turn.

    Source: Limitations · p. 7

Abstract

from arXiv · show

Safety classifiers deployed with large language models often fail for two reasons: their decisions reflect the policy learned during training rather than the deployer's desired policy, and their performance degrades as deployment traffic evolves. We present Regime-Conditional Verification (RCV), a lightweight wrapper that adapts an off-the-shelf safety classifier without retraining it. RCV estimates, from the classifier's internal representations, the probability that each prediction disagrees with the deployer's policy, and selectively corrects predictions likely to be wrong. The same correctness estimates also provide a label-free signal for detecting distribution shift, enabling a maintenance loop that updates the correctness estimation layer and resorts to classifier fine-tuning only when necessary. Across three off-the-shelf safety classifiers and two benchmark datasets, RCV improves adherence to the deployer's policy in every classifier-dataset combination, catching up to 0.81 of previously missed unsafe content without modifying the underlying classifier. In a deployment study with ten attack campaigns, each a harm category held out of RCV's training, RCV detects every campaign in a dedicated injection panel; in the maintenance census most drift episodes are repaired without updating the classifier, and the fine-tune is reserved for the residual episodes that repair does not restore.

Introduction

RCV estimates whether an off-the-shelf classifier’s verdict conflicts with the deployer’s policy, then uses that estimate to correct verdicts and monitor drift. The paper reports improved adherence across benchmark combinations and describes a maintenance loop that repairs most drift episodes before resorting to fine-tuning.

Problem formulation

  • A verdict is wrong when it conflicts with the deployer’s written policy, and adherence measures agreement with an offline oracle applying that policy, not direct agreement with the policy itself.The setup assumes white-box access to the classifier’s internal state; the goal is to raise adherence at deployment and keep it above a committed floor as traffic shifts.Source: Introduction · pp. 1–2

Motivation and distinction

  • Unlike tools that monitor inputs, scores, or label-free accuracy, RCV estimates whether the classifier’s own verdict is correct under the deployer’s policy and uses that estimate for correction and monitoring.The need arises because a classifier’s training-time policy may diverge from the deployer’s, while traffic changes can degrade verdicts.Source: Introduction · pp. 1–2

Method

  • RCV uses separate, calibrated correctness estimators for safe and unsafe verdicts, since their errors differ, and derives both flips and label-free drift monitoring from their estimates.Each regime uses a probe and calibration trained on labeled examples of the deployer’s policy; deployment adds a few thousand parameters per regime and no language model. A threshold governs flips, while event counts signal drift.Source: Introduction · pp. 1–2, Figure 1 · p. 2

Results

  • Across six classifier–dataset combinations, adherence rises in every one, and the caught share of previously missed unsafe content ranges from 0.29 to 0.81.In the deployment study, the injection panel detects all ten held-out attack campaigns at a median attack rate of 0.115 at first alarm (100 of 100 runs).Source: Introduction · p. 2

Deployment maintenance

  • Across 100 drift episodes, audited repair restores the pre-drift standard in 79 episodes under a constrained label budget and 87 when the audit is bounded by data.Fine-tuning is reserved for residual episodes that repair does not restore to the pre-drift standard.Source: Introduction · p. 2

Method: Regime-Conditional Verification

RCV uses classifier representations to estimate whether each verdict agrees with the deployer’s policy, then corrects likely errors. The same regime-specific estimates support label-free drift monitoring and a gated maintenance loop that reserves classifier fine-tuning for failed probe repairs.

Correctness estimation

  • Separate probes and calibration maps estimate deployer-policy error probabilities from classifier representations, conditioned on whether the verdict is safe or unsafe.The verdict partitions errors into missed violations and over-blocking; the probes use latent features already encoded in the representation rather than recovering new input information.Source: Method: Regime-Conditional Verification · p. 2

Decision correction

  • RCV flips a verdict when its calibrated probability of error exceeds threshold τ, set to one half by default.A flip changes a safe-regime pass into a block, or an unsafe-regime block into a pass.Source: Method: Regime-Conditional Verification · p. 3

Drift monitoring

  • Regime-specific probe estimates provide label-free error-rate and adherence signals, revealing directional drift that the classifier’s block rate or confidence score can miss.Averaging estimates within each calibrated regime estimates its error rate; their traffic-weighted average gives system error, whose complement is adherence. Missed harmful items register first in the safe regime, while over-blocking drift registers first in the unsafe regime.Source: Method: Regime-Conditional Verification · p. 3
  • Sequential tests monitor two nested event counts per regime and alarm on sustained increases above drift-free reference rates.Test thresholds are calibrated on drift-free streams to a prespecified false-alarm allowance, and realized false-alarm rates are measured on such streams.Source: Method: Regime-Conditional Verification · p. 3

Maintenance

  • After an alarm, RCV audits traffic at the recorded mixture and accepts a probe update only if a held-out block meets pre-drift recall and over-block standards.If no candidate passes, the audit expands within a fixed budget; exhaustion escalates to classifier fine-tuning. After probe repair, the classifier remains unchanged and the reference mixture and monitor are updated; after fine-tuning, probes are refit on the new representation.Source: Method: Regime-Conditional Verification · p. 3

Experiments

Across three off-the-shelf safety classifiers and two datasets, RCV improves adherence to the deployer’s policy and uses correctness estimates to detect drift and guide maintenance. The experiments also test policy clauses, probe design, and escalation to fine-tuning.

Detection

  • 100 of 100 held-out harm-family campaigns alarm before the 0.30 attack-rate cap, at median attack rate 0.115, and every first alarm falls in the safe regime.The two constructed unsafe-regime campaigns each alarm in 10 of 10 runs at median attack rate 0.057; clean traffic produces 14 alarms in 90 null draws, with a 0.156 false-alarm rate.Source: Figure 3 · p. 4, Experiments · p. 5

The conditioning hypothesis

  • Per-regime routing raises adherence in all 60 paired comparisons and caught share in 59, while routed AUROC exceeds pooled AUROC in every ablation cell by 0.2 to 4.6 pp.The comparison removes verdict-specific probes and calibration, pooling the same probe capacity and calibration over the mixed stream.Source: Experiments · p. 4, Figure 4 · p. 4

Steering an off-the-shelf classifier to the deployer’s policy

  • 0.29–0.81 of previously missed unsafe items are caught across six classifier–dataset combinations, while adherence rises in every combination.The largest reported adherence gain is Beaver on PKU-SafeRLHF (0.787 →0.920); on WildGuardMix, RCV recovers 0.29 of the unsafe items WildGuard misses. Against human labels, adherence moves toward human agreement in every cell with a measurable starting gap, without refitting or changing the threshold.Source: Experiments · pp. 4–5, Table 1 · p. 5

Steering toward the added clause

  • On PKU-SafeRLHF, RCV raises recall on the added commitment-to-assist clause to within 1.8 points of each classifier’s in-training clause level.Across four classifier–dataset cells, recall rises on both in-training clauses and the added clause; WildGuard starts near ceiling on the added clause and gains nothing measurable, while a residual gap remains on WildGuardMix for the two content-trained classifiers.Source: Experiments · p. 5, Figure 5 · p. 5

Gate outcomes

  • 79 of 100 drift episodes repair in place under the deployed budget, including 64 on the first audit; without the budget constraint, 87 repair.The deployed budget allows 300 labels per attempt across four attempts; seven additional episodes repair only beyond its 1,200-label cap, while 13 fail the gate even at the data bound.Source: Figure 6 · p. 6, Experiments · p. 6

The fine-tune

  • A fine-tune on an episode that probe updates could not repair raises classifier recall by 6.3 ± 1.9 pp, and the fine-tuned classifier with a refitted probe passes the pre-drift standard in five of five seeds.At the deployed 300-label gate, fine-tune plus probe passes in four of five seeds; probe-based deployment reduces recall’s across-seed standard deviation to 0.004 from 0.019 for the raw fine-tune.Source: Experiments · p. 6

Consecutive-campaign chains

  • Five consecutive-campaign chains reach depths of 4, 3, 3, 2, and 0 accepted repairs, with 12 accepted repairs overall; two no-alarm terminals yield no labels to confirm harmlessness.Against score-KS, the correctness-score monitor detects all 100 campaigns and alarms earlier (median attack rate 0.115 versus 0.134), but has more null alarms (14 of 90 versus 0).Source: Experiments · p. 6

Ablations

  • The routed linear probe has the highest AUROC for every classifier, while the internal-state probe catches more missed unsafe items than confidence-only and text-surface probes in all twelve cells.Internal-state caught share exceeds confidence-only by 0.09–0.49 in all twelve cells and 119 of 120 paired seed comparisons; text-surface caught share is lower in all twelve cells, at 0.07–0.56.Source: Experiments · pp. 6–7

Related Work

RCV differs from prior work by conditioning correctness estimates on the classifier’s verdict and using them both to correct decisions and monitor deployment drift. The related work situates this approach among correctness estimation, post-hoc model control, and drift monitoring.

Related Work

Limitations

The evidence is limited by narrow deployment and evaluation scope, reliance on a single policy judge, simulated drift, and the need for white-box access. The maintenance loop is exercised only in one deployment, and live drift remains untested.

Limitations

  • Steering spans six classifier–dataset cells, but detection covers one classifier and ten held-out harm families, while the maintenance loop is tested on one deployment.Both datasets are English and single-turn, policy-coverage evidence is a single added clause, and the loop’s audit, acceptance gate, and repair cycle are exercised only in that deployment.Source: Limitations · p. 7
  • Adherence gains are relative to deployer policy Y ⋆ as applied by one judge, which may be biased and enters RCV’s probes but not the raw classifier.Re-scoring against unused human labels bounds this concern; a multi-judge panel is a natural extension.Source: Limitations · p. 7
  • Drift is simulated using held-out dataset taxonomy categories, injected one campaign at a time on a fixed dose schedule, so live deployment drift remains untested.Campaign composition and onset are fixed by construction.Source: Limitations · p. 7
  • Census and chain evidence use composed streams with injected drift and finite-corpus audits, and an episode’s recorded verdict can flip when the evaluation set grows.This occurs for the fine-tuned episode.Source: Limitations · p. 7
  • RCV probes require white-box access; a score-only probe recovers much of adherence but far less of the caught share because missed unsafe items can have confident safe scores.An API-only deployment exposes at most a confidence score.Source: Limitations · p. 7

Conclusion

RCV uses verdict-conditioned correctness estimates from a safety classifier’s internal state to adapt policy adherence while keeping the classifier frozen, and reuses those estimates for label-free maintenance. The evidence is limited to English single-turn moderation with white-box access, a deployer-supplied oracle, and simulated drift.

Conclusion

  • Per-regime probes raise adherence to the deployer’s stated policy while the underlying safety classifier remains frozen.RCV estimates correctness from the classifier’s internal state conditioned on its verdict.Source: Conclusion · p. 7
  • Label-free monitoring and audited in-place repair handle drift episodes, reserving fine-tuning for residual episodes not restored to the pre-drift standard.Correction and monitoring share one signal: event counts on the correctness score serve as the drift statistic.Source: Conclusion · p. 7
  • The evidence is confined to English single-turn moderation with white-box access, a deployer-supplied oracle, and simulated drift.Source: Conclusion · p. 7

Ethical Statement · Technical Appendix · A Formal Propositions

The appendix defines RCV’s regime-specific correctness scores and formalizes when they estimate agreement, while showing why a single calibration map may fail across verdict regimes. It also specifies the monitoring assumptions and ethical controls relevant to deployment.

Ethical Statement

  • The work uses potentially harmful prompt–response content but redistributes neither datasets nor harmful text, and deployers control verdict corrections that may over-block legitimate speech or pass unsafe content.Rebuilder scripts reconstruct evaluation sets from official releases under their licenses and access conditions; oracle labels are distributed as a label map keyed to public item identifiers.Source: Ethical Statement · p. 7

Technical Appendix

  • RCV uses separate logistic-regression probes and calibration maps for safe and unsafe verdicts, estimating correctness and flipping a verdict when its regime score falls below threshold τ.The classifier emits verdict Y from prompt–response pair x and exposes representation Z; agreement is defined against the deployer’s oracle policy.Source: Technical Appendix · p. 9

A.1 The Calibration Note (Proposition 1)

  • A shared ideal calibration map averages the safe- and unsafe-regime correctness rates according to their shares at each score, producing regime-specific miscalibration when the rates differ.The miscalibration is the other regime’s share times the gap between the two rates, with the symmetric relation applying to the safe regime.Source: §A.1 · p. 9
  • A shared map is miscalibrated on both regimes wherever their correctness rates differ, with larger error on the minority regime when shares are unequal.If the rates differ, a single map is calibrated to both regimes only when verdict and correctness are conditionally independent given the score.Source: §A.1 · p. 9

A.2 The Monitor Note (Proposition 2)

  • The appendix relates Proposition 2’s predicted-class identity to confidence-based performance estimation (Kivimäki et al. 2025), average-confidence estimators, and ATC.When the probe is calibrated to current traffic, its mean score within a verdict regime is a plug-in estimate of that regime’s agreement rate.Source: §A.2 · p. 9
  • When calibrated to current traffic within a verdict regime, the probe’s mean score equals that regime’s agreement rate.The identity supports a window-mean estimate for that regime; it certifies the mean only while the calibration condition holds.Source: §A.2 · p. 9
  • The monitoring identity does not guarantee calibration after drift; RCV refits the probe on every alarm using a block composed at the alarm-time traffic mixture.Between refits, calibration remains an assumption rather than a guarantee.Source: §A.2 · p. 9
  • The deployed alarm counts score crossings at the flip threshold and a wider 0.95 boundary, but Proposition 2 certifies the mean score—not the alarm’s behavior.The one-sided sequential test thresholds are calibrated on drift-free streams to the false-alarm allowance.Source: §A.2 · pp. 9–10

B Steering: Extended Results · B.1 Human-Label Evaluation Grid

The human-label evaluation re-scores all six classifier–dataset cells without refitting or changing thresholds, and finds that corrections generally move adherence toward the agreement level implied by the two label sets. One cell starts near that level, while the generative classifiers’ WildGuardMix caught-share changes are indistinguishable from seed noise.

B.1 Human-Label Evaluation Grid

  • 48 of 50 seeds across five cells moved toward the human-label agreement level, with distance shrinking under correction in each cell (paired p ≤0.042).The five cells began 1.8–10.5 pp from that level; the movement count is evaluated on each seed’s own split.Source: §B.1 · p. 10
  • 0.9195 on PKU-SafeRLHF and 0.9298 on WildGuardMix are the raw agreement levels between Y ⋆ and human labels (κ = 0.838 and 0.766).These are the human-axis agreement levels a correction matching Y ⋆ on every scored item would attain.Source: §B.1 · p. 10
  • WildGuard on PKU-SafeRLHF began within 0.7 pp of the agreement level on every seed and ended within 1.4 pp, with mean distance rising from 0.4 to 0.7 pp.The mean crossed from below the level to above it.Source: §B.1 · p. 10
  • In every cell, items where Y ⋆ diverged from annotators formed a smaller share of flipped items than of all verdict–Y ⋆ disagreements, by 6.5–29.1 pp.Source: §B.1 · p. 10
  • For the two generative classifiers on WildGuardMix, caught-share changes were not distinguishable from seed noise (p = 0.10, 0.99).Their caught populations averaged 70 and 24 items per seed.Source: §B.1 · p. 10
  • A fixed script re-derived each cell from per-seed steering records and aborted unless every Y ⋆-axis value reproduced main-text Table 1 to |∆| = 0.Paired p-values use two-sided paired t-tests across ten evaluation seeds; the agreement level is fixed before correction runs.Source: §B.1 · p. 10

B.2 Steering Toward the Added Clause … B.5 The Escalation Fine-Tune

These appendix studies find that per-regime routing improves on pooled routing across probe families, internal representations catch more missed unsafe items than confidence scores, and an escalation test shows probe-assisted fine-tuning can pass a failed gate. The added-clause advantage is limited, and the powered-set result does not establish that fine-tuning was necessary.

B.2 Steering Toward the Added Clause

  • The added-clause contrast was not consistent across datasets: Beaver’s was null on both, while Llama-Guard-3’s positive contrast appeared only on PKU-SafeRLHF.On PKU-SafeRLHF, Llama-Guard-3’s contrast was +0.0711 (95% t-CI [+0.052, +0.090]) and positive at 47/47 operating points; on WildGuardMix its mean was −0.089 (t-CI [−0.187, +0.009]) and positive at 3/47. The apparent extra lift can be mechanical when the clause starts from a larger blind-spot gap and the same caught share is applied.Source: §B.2 · p. 10

B.3 Routing Gain by Probe Family

  • Per-regime routing exceeded pooled routing by 0.2 to 4.6 pp in every PKU-SafeRLHF ablation cell across all three probe families.AUROC improved for linear probes, multilayer perceptrons, and gradient-boosted trees, indicating that the gain came from the verdict partition rather than probe capacity.Source: §B.3 · p. 10

B.4 The Confidence-Score Probe

  • Across all six cells, the confidence-score probe’s caught share was 10.1 to 47.9 points lower than the internal-state probe’s.The score probe’s adherence was within 5.1 points of the deployed probe; the score was standardized monotonically, preserving its rank ordering.Source: §B.4 · p. 10, Table T2 · p. 11

B.5 The Escalation Fine-Tune

  • The escalation test used one disinformation-family census episode after 13 audits exhausted 3,720 fresh labels and its gate reading remained 0.7255.LoRA fine-tuning used 480 audit labels, with 120 held out for validation and five trainer seeds; the probe comparisons changed the classifier weights and the representation read by the probe.Source: §B.5 · pp. 10–11
  • On the powered set, fine-tune plus probe passed in 5/5 seeds (recall 0.7920 ± 0.0040; over-block 0.0325), but base plus probe also passed.The raw fine-tune exceeded the over-block ceiling in four of five seeds.Source: §B.5 · p. 11
  • On the 300-label gate block, fine-tune plus probe passed in four of five seeds; base plus probe reproduced the recorded failure.The fifth fine-tune seed fell short by one unsafe item. Because base plus probe passed on the powered set, the experiment does not show fine-tuning was necessary for this episode.Source: §B.5 · p. 11
  • On the retention slice, fine-tuning changed between −4 and +1 items net per seed, at most 0.4% of the slice.The 1,290-item slice was outside the episode’s labels and never entered the stream.Source: §B.5 · p. 11

B.6 The Text-Surface Control

The text-surface control tests whether prompt–response features can estimate classifier–oracle disagreement as well as the classifier’s internal representations. Its caught share of missed unsafe items is lower in all six classifier–dataset cells.

B.6 The Text-Surface Control

  • The control adapts n-gram features discussed by Wang et al. 2026 to classifier–oracle agreement prediction, rather than input-harmfulness detection, using the same per-regime protocol.It uses prompt–response TF-IDF word 1–2-grams and word-boundary-padded character 3–5-grams, with 50,000 features of each type, fit per cell and seed on training data only.Source: §B.6 · pp. 11–12
  • The text-surface control caught 0.066–0.558 of missed unsafe items, versus 0.291–0.806 for the internal-state probe, with a smallest shortfall of 21.6 points.These caught-share values are scored against policy oracle Y ⋆ across all six classifier–dataset cells.Source: §B.6 · p. 12

C Maintenance: Extended Results … D.2 The Judge Prompt and Agreement with Human Labels

The extended results assess maintenance repair, campaign chains, and drift monitors on WildGuardMix traffic classified by Llama-Guard-3, then document the extraction, monitoring, and policy-label procedures. They report repair limits under alternative audit sizes and agreement between the policy judge and dataset human labels.

C Maintenance: Extended Results

  • The extended maintenance results cover the 100-episode census, repair capacity, five campaign chains, and matched-allowance monitor comparisons on WildGuardMix traffic classified by Llama-Guard-3.The census and monitor comparison aggregate ten seeds; chain experiments use five.Source: C Maintenance: Extended Results · p. 12, §D.1 · p. 14

C.1 Census Outcomes by Family

  • 0.706 median pre-repair recall marked episodes that escalated, compared with 0.792 for episodes whose repair succeeded.Under the deployed budget, Table T5 reports that most episodes repair in place in every family, and most repairs occur on the first audit.Source: §C.1 · p. 12, Table T5 · p. 13

C.2 Repair Capacity by Family

  • 87 of 100 episodes repair under the data-bounded audit, while 13 never pass the gate; 11 of 21 budget escalations repair when given more labels.Of the 79 episodes repaired under budget, 76 also repair under the data bound and 3 do not.Source: §C.2 · p. 12, Table T6 · p. 13

D.1 Recipes, Seeds, and Splits

  • RCV reads each classifier’s internal representation, using a two-pass reread for WildGuard-7B and forward-pass reads for Llama-Guard-3 and Beaver.The steering results aggregate ten fixed seeds and use group-blocked prompt splits; WildGuardMix steering includes items the WildGuard classifier trained on, reducing the probe’s room for correction.Source: §D.1 · pp. 13–14

C.3 The Five Chain Records

  • The five chain records track sequential campaigns, accepted repairs, terminal outcomes, chain depth, attack share, and total label cost.A first-audit repair costs 600 labels, an escalated terminal costs 1,500, and an accepted candidate’s gate reading becomes the next cycle’s standard.Source: §C.3 · p. 13, Table T7 · p. 14

C.4 Off-the-Shelf Drift Monitors Under a Matched Allowance

  • At the matched 0.30 false-alarm allowance, the deployed monitor and score-KS stay within the allowance, while ATC does not.ATC alarms on 90/90 drift-free instantiations; both of its threshold treatments alarm on every instantiation at the matched allowance.Source: §C.4 · p. 13, Table T8 · p. 14

D.1 Recipes, Seeds, and Splits

  • The sequential drift monitor watches two event counters per regime and alarms when a counter’s accumulated evidence crosses a replay-calibrated threshold.Thresholds are calibrated to a 0.30 false-alarm allowance over a 19,000-item drift-free horizon; reported attack families are held out from parameter selection.Source: §D.1 · pp. 14–15

D.2 The Judge Prompt and Agreement with Human Labels

  • κ = 0.838 on PKU-SafeRLHF and κ = 0.766 on WildGuardMix measure agreement between the policy judge and each dataset’s human labels.The oracle is a stored GPT-5-Nano label map; its policy rubric specifies the unsafe-content tests and JSON rule-fired field.Source: §D.2 · p. 15

D.3 Compute

Most maintenance alarms are resolved with CPU-based probe fitting, while fine-tuning is reserved for episodes that fail the gate; representation extraction and fine-tuning are the GPU stages. The section also specifies the compute environments and provenance checks used for reproducibility.

D.3 Compute

  • 21 of the 100 census episodes required fine-tuning after failing the gate; most alarms were handled by a probe fit that left the classifier unchanged.Representation extraction and fine-tuning are the two GPU stages; probe fitting, calibration, flip-rule scoring, and monitor replays run on CPU.Source: §D.3 · p. 15
  • GPU stages used pinned cloud instances, while CPU-stage runs recorded software versions and SHA-256 digests of code, configuration, and input data.The GPU environment used PyTorch 2.4.0, Python 3.11, CUDA 12.4.1, and Ubuntu 22.04; CPU runs used Python 3.12.3, NumPy 2.5.1, SciPy 1.18.0, and scikit-learn 1.9.0.Source: §D.3 · p. 15
  • Representation extraction ran on a single L40S GPU and escalation fine-tuning on a single A100 80GB GPU; recurring steering, added-clause, and monitoring compute was CPU-only.Reported running times are single-run wall-clock on the stated hardware, except the maintenance-program row, which aggregates extraction and fine-tuning across five seeds.Source: Table T10 · p. 16

Related papers

Loading 2608.14089v1…