Headline (F10): a tool-using LLM detects adversarial perturbation of its own output and revises back without retraining, reward model, or preference data. 112% mean recovery across n=45 heal events on gpt-5-mini, spanning four styxx. attack attack types. 22/45 events healed cleaner than the original clean baseline. Headline (Cognometric Inversion): the same F10 heal protocol, applied to a tool-using agent's honest task-completion reports, systematically degrades semantic information quality to game a confound-driven score. Completed-action reports get rewritten as advisory suggestions; strong factual reassurances get dropped to lower the overconfidence axis; the sycophancy axis rises in compensation. Inference-time honesty monitoring, applied without calibration-domain awareness, regenerates the RLHF approval pathology it was supposed to detect. Per-attack recovery (n=45): v7 universal (the published styxx. attack suffix): 176% mean recovery, 10/13 full, 8/13 over. craft sycophancy: 77%, 7/11 full, 6/11 over. craft deception: 92%, 4/8 full, 3/8 over. craft overconfidence: 91%, 6/13 full, 5/13 over. overall: 112%, 27/45 full, 22/45 over, 3/45 degraded (1 substantive, 2 within composite-rounding noise). The architectural claim — what changes from this finding: Inference-time cognometric verdicts must carry first-class calibration-domain confidence (the new scopewarning field on DeceptionVerdict and OverconfidenceVerdict in v7. 2. 0). Aggregators (composite, reward, F10 heal-pass gate) must respect that confidence. Without it, the measurement layer becomes a sycophancy-injection layer at inference, recapitulating the exact failure mode of approval-style RLHF — but introduced through the safety signal itself. The two scopewarning patches shipped here are the first instances; the pattern needs to propagate across the instrument family in v0. 1 calibration work. Reproduce: F10 reproducer: python examples/selfₕealingᵣeflexdemo. py. Source data: data/selfₕealingᵣeflexᵥ0. jsonl (45 pinned events). Offline panel: release/selfₕealingᵣeflexᵥ0. json. Cognometric inversion: python. styxx/dogfoodcognometricᵢnversion₂026₀5₁1. py (in-bundle). Raw data: outcognometricᵢnversion. json. Cross-model replication on gpt-4o-mini: outᵢnversioncrossₘodel. json (−0. 18 mean composite, +40% length, +0. 07 sycophancy). Bundled files (this deposit): self-healing-reflex-v0. pdf — the F10 spec paper, v1. 0. 0-rc1. selfₕealingᵣeflexᵥ0. jsonl — the pinned n=45 heal-event dataset. COGNOMETRICINVERSION₂026₀5₁1. md — the inversion finding writeup. outcognometricᵢnversion. json, outᵢnversioncrossₘodel. json — raw data for the two inversion experiments. styxx-7. 2. 0-py3-none-any. whl, styxx-7. 2. 0. tar. gz — Python distributions. styxx-v7. 2. 0-zenodo-bundle. zip — full release bundle (16 files: paper, dataset, demos, dist, README, LICENSE, dogfood notes). License: CC-BY-4. 0 (this deposit, data, paper) / MIT (styxx code). Repository: github. com/fathom-lab/styxx (tag v7. 2. 0, commit 5ac9808). Package: pypi. org/project/styxx/7. 2. 0 (publish gated on the operator-side PyPI Trusted Publisher configuration; the artifacts in this deposit are byte-identical to what publish. yml will ship once unlocked). Predecessor: v22 (10. 5281/zenodo. 19761194) — Fathom v22 / styxx v6. 2. 0, the Cognometric Fingerprint Specification v1. 0. v23 advances the chain by shipping (a) the inference-time intervention reflex (F10), (b) the first empirical demonstration of cognometric inversion in deployment, and (c) the calibration-domain-awareness architectural fix.
Alexander Rodabaugh (Mon,) studied this question.