The referee and the cleaner: a guide

Language models now write a large share of scientific text. Two things go wrong. The prose has a recognizable voice: semicolons, sentences that deny one thing to assert another, lists of three, declarations of how careful the authors were. Readers notice and trust the paper less. The second fault is worse. The text can be wrong in ways that read as right.

An outside reviewer read two papers from this program and found 51 problems. Among them were a formula described as a lower bound that is no bound, a fraction of a fuel budget described as a detection rate, and a confidence interval that straddled the threshold it was meant to clear. The errors fall into classes a referee knows: derivations, statistics, definitions, consistency between parts of a paper, numbers that do not recompute, and conclusions stated more strongly than the evidence allows.

Both faults come from the objective. Pretraining rewards the next word that fits. Nothing in it rewards being right, so a model learns to sound right. The study's bet is that a reward computed by a program, which compares a claim with what the data say, teaches a different habit from a reward that rates how good an answer looks.

Two things. The first is a tool: a checker of about 32 billion parameters that runs at home on one machine and returns a report with one verdict per claim, and a cleaner that hands back a paragraph in a plain human voice. The second is a measured result. The study trains the same starting model with a program's verdict as the reward and, as a control, with a judge model's rating as the reward. If the first teaches checking and the second teaches plausibility, the gap between them is the finding.

The starting line was measured on the first day. Run as a prompted loop with its tools and no training, the checker caught zero to one of the reviewer's 51 findings. A redesigned loop, which writes down what would make each claim false before it calls a tool, caught 3 of the 51. Training starts from there, with the 51 findings kept as a test.

Running a 32-billion-parameter model takes one good machine. Training it takes much more: many thousands of practice episodes, each attempted several times, with the model's weights updated after every batch. The training runs on GPU nodes of an HPC cluster. Each node has 128 CPU cores, four NVIDIA A100 graphics processors with 40 GB of memory each, and 512 GB of main memory. The finished adapters come home and run on one machine.

A token is a piece of text, about three quarters of an English word on average. A model reads a window of tokens called its context and produces one token at a time, each drawn from the probability distribution it computes. The serving setup here allows 32,768 tokens of context. Training sequences are cut at 12,288 tokens.

The checker reads a system prompt that describes its tools, then either a numbered window of a paper or a single claim with the name of a dataset. It writes reasoning, calls tools in a fixed text format, reads what the tools return, and ends with a verdict as a small JSON object. A verdict at the end of a claim looks like this:

{"verdict": "mismatch", "value": 5.38, "evidence": "recomputed from the soundings with the stated method"}

The cleaner reads one instruction and one paragraph and writes one paragraph. Its instruction, quoted from the training code: "Rewrite the paragraph so a person wrote it; keep every number, citation, equation and figure reference; do not change what is claimed or how strongly." Training sequences for the cleaner are at most 2,048 tokens.

A model's behavior lives in its weights, the adjustable numbers in its matrices. A 32-billion-parameter model stored at two bytes per number (the bfloat16 format) takes about 65 GB. Nobody here trains such a model from scratch. Each tool starts from an openly published model and is fine-tuned: trained further on a narrow task.

Fine-tuning every weight would need the weights, their gradients and two optimizer moments in memory, far beyond one node. The study uses LoRA (low-rank adaptation). The original weights stay frozen. Beside each chosen matrix W of shape out × in, training adds two small matrices, B (out × r) and A (r × in), so the layer computes W x + (α/r) B A x. Here the rank r is 64 and α is 128. Adapters sit on the attention projections and the feed-forward projections of every layer. For the 32B base, which has 64 layers of width 5,120, that adds about half a billion numbers, roughly 2 GiB in 32-bit floats, against 32 billion frozen ones.

Supervised fine-tuning (SFT) shows the model worked conversations and raises the probability of each token the teacher wrote. The loss is the cross-entropy, the negative log-probability of the right token, averaged over the tokens of the assistant's turn only. The prompt, the tool results and the earlier turns carry no loss.

Reinforcement learning (RL) lets the model try a problem several times. A program scores each attempt, and the update raises the probability of attempts that scored above the group's average and lowers the others. No teacher text is needed, only a scorer the model cannot fool. Section 5 gives the exact loss.

Preference training uses pairs: for one input, a preferred output and a rejected one. The method here, direct preference optimization (DPO), raises the log-probability of the preferred output relative to the rejected one, measured against a frozen copy of the starting model so the update cannot drift far. The cleaner uses it with pairs ranked by code.

A model that scores well on problems like its training problems has learned something, possibly only the look of the set. The study asks for more. Test items share no field, quantity, dataset, invented-study recipe or source paper with training. In the claim set, 30 weather stations, two satellites and two whole quantities appear only in the test side. In the larger planted-fault set, two arXiv categories (optics and statistical methodology) are held out whole. The errors a human reviewer found in real papers are used only as a test.

The status page shows two kinds of score for this reason. An in-distribution score comes from held-back items of the same kinds as training. A held-out score comes from the fields and quantities kept apart. A widening gap between the two means the model is learning the training set more than the skill.

The study builds a checker for model-made content, so its training data cannot rest on model-made facts. Keys come from code, or from results people have already verified: certified reference datasets, replication packages that a journal's data editor has run, benchmarks with expert answers. Each key is computed once by the building code and again by separate code that reads the files from disk. Changing the data must change the key; an item whose answer survives a change in its data does not test checking. Two model families check each other: one family wrote the code that built the practice claims, another wrote the code that recomputes every answer from the raw files, and the roles were swapped for the invented studies.

The study holds two archives of its own: 148 weather balloon soundings valid on 2 October 2026 at 00 UTC, and the September 2026 orbital element sets of nine satellites. Code computes 19 quantities from them, such as the temperature at 500 hPa, the lapse rate or an orbit's perigee, and writes statements about them. Each statement carries a key computed by code from the archive.

An underspecified claim is one whose method leaves a choice open, such as which convention defines the level of free convection. The right answer names the choice. The split is 2,626 claims for training and 984 for testing, with no base claim on both sides. The baseline and gate stages score a fixed sample of 600 test claims.

A catalog lists 35 public sources whose answers people have already checked. Grade A means certified values or third-party verification, for example the statistical reference datasets of a national standards laboratory with 643 certified values, or replication packages that a journal's data editor ran. Grade B means expert answers that were spot-checked; grade C means labels from a model or a crowd. Nine sources feed training, 21 are kept for testing and five are used for neither. Each item becomes an episode: a claim, the data mounted read-only, the expected verdict and a tolerance.

Code takes open-license papers from arXiv and changes one thing whose location and kind are known by construction. The four kinds used are a derivation step that no longer follows, a number that disagrees with its table, a conclusion reversed against the results, and a citation pointing at the wrong work. The 200-document set holds 50 of each kind, made from 99 clean originals, and is the evaluation set. A second set of 1,000 documents spans 17 fields and feeds training, with two fields held out whole. Citation faults are scored in evaluation and left out of training, because the training reward has no rule for them.

The planted kinds are the easy tier of an error taxonomy built for the study: 70 types in 11 groups, drawn from 151 sources including retraction and correction notices, reproduction records and published error benchmarks. Each type comes with the routine a checker follows to catch it and a recipe for planting it where code can prove the copy wrong. The easiest tier holds 14 types, the middle 32 and the hardest 24.

A generator builds small studies from known recipes, such as two groups compared, a trend over time, a calibration or a dose and a response. It writes each up as a short paper with its own data files and figures, then makes faulty copies in which the mistake is proven by code. The current corpus has 2,000 studies with 24,877 checkable quantities and 30 fault types with 50 examples each. These cover fields and file formats the study does not otherwise hold. Whole recipes are held out for testing.

Mistakes that happened in real work stay out of training: errata, retractions, reproduction records that falsified a claim, and the outside reviewer's 51 findings on two of the program's own papers. Each finding has a matching control passage from the same papers that holds no error, so a checker that flags everything is caught.

The cleaner learns from pairs of paragraphs: a version in a model's voice and a version a person wrote, with the same content. The pairs come from two sources, described next.

Human-target pairs. Human paragraphs come from open-license papers published between April 2000 and October 2022, before language models wrote at scale. Content notes were taken from each paragraph, and many models from several families wrote a paragraph from the same notes. A model's draft enters only if every number, unit or formula in the notes appears in it and nothing is added. A kept model draft becomes the before side and the human original the after side: 4,937 pairs, 4,322 for training and 615 held out, with one whole model family held out. Counting what the models write more often than people gives each family's fingerprint. Semicolons, chains of "and the" and long dashes are common marks, as are sentences of uniform length and sentences that open with a transition word. People write "we", hedge, and vary sentence length more.

Own-history pairs. The program's own drafts and their later human-directed revisions give 1,629 pairs, 1,213 for training and 416 held out. A pair is kept only when the revision has fewer lint hits and every number, citation key, equation or figure reference survives.

Shortcut audit. A simple classifier sees only the text (a bag of words, then a small fine-tuned encoder) and is trained to tell true items from false, or clean documents from faulted ones. Its score is the AUROC: the chance that it ranks a random positive above a random negative, so 0.5 is chance. If it beats chance, the wording leaks the answer, and the set is rebuilt. The rule is read per cell (set × fault type or label × model × window), with folds grouped by paper and a bootstrap over papers. A cell fails when its 99% interval excludes 0.5 on either side, since a classifier that reads a set below chance has found a leak with the sign flipped. Cells of 250 items or more also fail when the point estimate is above 0.53. Cells under 100 items are judged by the interval alone, because the standard error of an AUROC on 50 items is about 0.08. The pooled cell of each set must pass at 95%.

Blind baseline. The checker with its tools switched off runs on a sample. If it already scores well, the items can be answered by plausibility and are replaced.

Spread and balance. Items are tiered as one tool call, several steps, or a flaw in the method itself, and each tier holds at least a fifth of the set. No label, error type, field or data format exceeds twice its fair share.

Read by the strongest model. At least 50 items per set are read in full, with the data, by the strongest model available. The set is fixed and resampled until fewer than 2 in 50 have a defect.

Corpus verifier. Separate code reruns deterministic checks on every corpus: keys against a second path, perturbations, planted edits, protected tokens in pairs. A release of the training code is built only when its report shows zero failures for the claims and the planted faults.

These checks bite. On the first night every first version of every set failed one of them. For example, a bag-of-words classifier told verifiable claims from unverifiable ones with an AUROC of 0.962, because the unverifiable ones named times and sites the others did not name. The sets were rebuilt until every check passed.

The bases are named by letter. All are openly published decoder-only transformers.

A 235-billion-parameter mixture-of-experts model of the same family as base-e also runs at home on two machines. It writes wording for the data (checked by code) and served as the checker in the first measurements on the reviewer's findings.

Bases b and c always reason before they answer, so each reply gets a budget of 4,096 tokens instead of the default 1,200.

A decoder-only transformer turns each token into a vector of a few thousand numbers (5,120 for base-a) and passes the sequence through a stack of identical layers. Each layer has two parts. Attention lets each position draw information from earlier positions, through three projections of the vectors (query, key, value). The feed-forward block then transforms each position on its own, through two wide projections and a nonlinearity. After the last layer a final projection gives a score for every token in the vocabulary, and a softmax turns the scores into probabilities.

In a mixture of experts, the feed-forward block is split into many smaller blocks called experts, and a small router picks a few of them for each token. For base-d and base-f, about 3 of the 30 billion parameters take part in any one token. Each token costs about a tenth of the arithmetic of a dense model of the same size. All the experts must still sit in memory, so the memory bill is that of the full size.

The memory arithmetic sets how a model is placed on a node. At two bytes per parameter a 32B model needs about 65 GB for its weights. One A100 has 40 GB, so the weights are spread over all four cards of a node, which together hold 160 GB. The rest is room for the attention cache during serving, or for activations and gradients plus optimizer state during training.

The loop reads the paper in numbered windows and asks the model for a list of claims. Each entry gives the claim's line and its hedge word if there is one. It also says what the claim rests on, such as a table or an earlier equation, and which tool could check it. Up to 24 claims are checked per paper. In the second loop design, which runs beside the first, the list uses a fixed set of claim kinds taken from the error taxonomy, and before any tool call the model writes one line saying what would make the claim false and one line saying which check would show it. A claim gets at most 4 rounds of tool calls; the loop then asks once more without tools for the verdict.

The tools, with the limits the code sets:

A match is a value within half a unit in the last digit the paper reports, unless the paper states its own uncertainty.

Every program the model writes runs in its own container started from a read-only image. The data and the program are bound into it read-only. On sites that allow it, the container gets an empty network namespace, so no connection can leave it; elsewhere the compute node's lack of a route is the guard, and the call says so. Memory is capped by the container runtime where the site allows it and by the shell's limit otherwise, files in scratch space are capped at 64 MB, and the clock is enforced twice. An audit hook in the interpreter records which files the program opened.

On the cluster, the model server runs inside the serving image on the node's four graphics processors. A small relay on the host, written with the standard library alone, starts each sandbox call as a separate container. The timing job tests each property before anything else runs: writes to the data fail, outbound connections and name lookups fail, a sleep loop is killed at its limit, 900 MB under a 256 MB cap dies, and the data's hash is unchanged afterwards.

The cleaner is a LoRA adapter on base-a or base-f, whichever wins the choice rule in section 6. It reads the instruction and one paragraph and returns one paragraph. Code then checks preservation: every number, citation key, equation body and figure reference in the input must appear in the output, and the length must stay within a band. A rewrite that shifts or drops a protected token loses to every rewrite that keeps them all.

A node-hour is one whole node for one hour. The cost of a stage at its limit is its time limit times its node count. Stages that finish early cost less. Each job asks the scheduler for whole nodes with the four graphics processors and exclusive use, so no other job shares the node.

Two optional jobs sit outside the chain: a 30-minute test of the 235B teacher (base-e) on the debug queue and an 8-hour run of it on the standard queue, 8.5 node-hours together. A pass in the first makes base-e the teacher for the traces stage. The "debug" queue takes short jobs, here 30 minutes, and usually starts them sooner; "standard" is the ordinary queue for long jobs. A copy of the package to tape runs on a transfer queue that charges one core.

The baseline serves each downloaded candidate in turn and runs the untrained loop on three sets: the 200 planted documents, their 99 clean originals and the 600-claim sample from the claim set's test side. It records three numbers per base: accuracy on the fully specified claims, recall of the planted faults (found with the right type within two lines), and the false-alarm rate on clean papers. The choice rule in section 6 turns them into one score and writes the winner to a file the later stages read. Sixteen loop workers send requests to the model server at once.

The traces stage serves a teacher: base-e if it passed its own test, otherwise the chosen base itself. The teacher works training episodes with the same loop and tools. There are up to 1,000 episodes each of claims, verified-source items, planted documents and clean papers, plus the invented studies with their data. Claim episodes get four samples each and documents two, at temperature 0.8, a setting that makes the samples differ.

Code judges every conversation. A claim with a computable answer is kept only if the verdict is one the key accepts and some recompute in the conversation read the data, finished without error, did not contain the claim's number as a literal, and printed a value within tolerance of the key. A right verdict reached any other way is rejected. A claim built to be unverifiable is kept when the verdict abstains. A planted document is kept when the fault is named at its line with its type and the tools returned that line or ran the derivation check. A clean paper is kept only when the whole review reported no fault.

Gold traces come from the strongest available models working the same episodes through a teacher shell. The shell records every tool result itself, so a teacher cannot invent one. Each trace line carries the hash of the line before it and a signature, which shows if a line was removed.

The RL stage is the one expensive job, so a two-node test runs first and prints a named PASS or FAIL for each question. Can a job step take one whole node exclusively? Does the warning signal reach the job before its limit? Does the model server return the exact token ids and log-probabilities the trainer needs? Can it load and unload a new adapter while it runs? Does one training update fit in memory at 12,288 tokens, or only at 8,192? Can code reach the sandbox relay from a rollout node? Any FAIL, or a check with no result, stops the chain. An update that fits only at 8,192 tokens counts as a pass and sets the RL sequence cap to 8,192.

The method is a group-relative form of policy optimization. For each problem the current model makes 8 attempts. Each attempt i gets a score R_i, and its advantage is A_i = (R_i − mean) / (standard deviation + 0.0001), computed within the group. A group whose attempts all scored the same carries no signal. The loss for each generated token t is

−min( r·A, clip(r, 1−c, 1+c)·A ) + β·KLt,   r = exp(new log-prob − old log-prob)

averaged over all generated tokens of the group. The ratio r compares the model being trained with the model that sampled the attempt, and the clip with c = 0.2 stops one update from moving any token's probability far. KL_t is the Kullback-Leibler divergence between the trained model and the reference model over the whole vocabulary at that position. The reference is the supervised model itself, obtained by switching the adapter off, and β = 0.02. This term keeps the model close to the supervised starting point; it enters on every fourth step. Tool results and earlier turns carry no loss.

Scores lie between −1 and 1. A reply with no verdict, cut off by the token limit or stopped at a cap, scores −1 for every kind; the harness does not abstain on the model's behalf.

A "verified" counts as checked only when a recompute ran without error, read a file under /data, held no literal of the reported number, and printed a value within tolerance of the claim's number. Without that it scores −0.5, on true and false claims alike, so the word on its own earns nothing. The same holds for "consistent with a named reading", which must also name the convention it assumed. Any positive score for a verdict that reports a number falls to 0 if one of the scripts contained the reported number as a literal or read nothing under /data. A recompute that ended in an error is ignored, so a failed first attempt costs nothing.

Planted documents score 1 for the planted fault (same type, within two lines), divided by one plus the number of other faults reported: one right and one false alarm score 0.5. A clean document scores 1 for "sound", −1 for any reported fault.

Serving stages (timing, baseline, traces, gate, final) run one copy of the model on the node, split across the four cards by tensor parallelism: each layer's matrices are cut into four slices and the cards compute their slices together. The server holds up to 32,768 tokens of context per request in bfloat16 and works on many requests at once. The CPU cores run the checker loops and the sandboxes.

Supervised stages place the base's layers in order across the four cards, so a sequence passes from card to card and only one card computes at any moment. This is a model-parallel placement. It is not data-parallel: no stage keeps four copies of the model that each process different examples. The job scripts fix this choice; whether data-parallel training would be faster on these nodes has not been measured.

The RL stage takes four nodes. Node 0 trains. Nodes 1 to 3 each run one serving copy on their four cards, a sandbox relay and a rollout worker with 8 attempts in flight. Each node is one job step with all 128 cores and four cards, so no two steps share a card. The trainer publishes a new adapter every 4 steps; every server loads it before requests switch to it, and each attempt records which adapter it was sampled under.

Each stage writes a DONE marker only when every planned item finished: every episode set, every epoch, every RL step. The next stage waits on the scheduler's "after OK" dependency and checks the marker again. If a stage fails, the stages after it stay unstarted, and in the checker chain the scheduler cancels them. The same command carries on from the stage that stopped: submit.sh from <stage>.

• Serving stages skip finished documents and claims, and finished bases, so a resubmitted job picks up where the last one ended.
• Checker SFT stops 10 minutes before its limit and resumes from its newest checkpoint (every 25 optimizer steps) or from the last finished epoch, with optimizer and schedule state restored.
• RL asks the scheduler for a signal 180 seconds before the limit. On that signal the trainer stops between optimizer steps and writes a checkpoint of the last finished step. A checkpoint holds the adapter, both Adam moments, the schedule position and the random-number states of the framework and the episode sampler. Every 20 steps a checkpoint is written regardless. A resubmitted job restores the newest one and publishes it under a new name, so one name always means one set of weights.
• Cleaner SFT keeps a checkpoint per epoch and a rolling one every 30 minutes and on the termination signal; a base is not started with less than 30 minutes left. A base that already finished is skipped on the next submission.
• Preference training appends samples as it goes and keeps trainer checkpoints every 25 steps.

Every stage above is written for GPU nodes with four NVIDIA A100 graphics processors of 40 GB, 128 CPU cores and 512 GB of memory. The jobs run inside two container images built for the A100's software stack (CUDA 12.9): a serving image of 11.5 GB with an inference server, and a training image of 11.6 GB with a deep-learning framework, a transformer library and a parameter-efficient fine-tuning library. Both stages compute in bfloat16; the RL adapters are kept in 32-bit floats. Models are read from local copies with network access to model hubs turned off.

The cluster family also has nodes with AMD MI300A accelerators, whose processor and graphics memory are shared, and CPU-only nodes. No build of these images for the MI300A software stack (ROCm) exists yet, so no stage can run there today. A port would change the image, the attention and mixture-of-experts kernels the inference server uses, the per-device memory limits in the training scripts, and therefore the batch and sequence limits. Throughput is not fixed by any file: the timing jobs measure tokens per second and memory per card on the first run, and the status page reports the hardware of each job from what the scheduler says.

Rollouts during RL send no seed to the server, so two runs with the same seeds will draw different attempts; the checkpoints carry the random-number states that make a resumed run continue the same stream.

The checker is scored on sets it does not train on: the 600-claim sample from the claim set's test side, the 200 planted documents and their 99 clean originals, and at the end the reviewer's 51 findings with their 51 control passages. The main numbers are accuracy on fully specified claims, recall of planted faults (the share found with the right type within two lines), their precision, the false-alarm rate on clean papers, and the share of unverifiable claims on which the checker correctly abstains. The final stage also runs the closed-book comparison described below.

The cleaner is scored on its held-out pairs: lint hits per 100 words before and after, the share of rewrites that keep every protected token, and the ratio of output length to input length.

score = accuracy on fully specified claims + planted recall − 2 × clean false-alarm rate

The base with the highest score is trained; a tie goes to base-a. A false alarm on a sound paper counts double. If it fails: the rule always picks a base, so it cannot fail as such. If every candidate scores near zero, the pick falls to base-a by the tie rule and any later gain has to come from training alone. The baseline numbers are still the floor every later score is read against.

The tuned adapter passes when, on the held-out sets, accuracy on fully specified claims rises by at least 5 points over the base or planted recall rises by at least 5 points, and the clean false-alarm rate rises by at most 2 points. Otherwise the chain stops. The RL timing test and RL do not run, nor does the final scoring, which leaves up to 298 node-hours unspent.

If it fails: supervised training on code-checked worked examples did not make the base a better checker than its prompted self, at this amount of data. That is a result, recorded as such. The next step would be more or different worked examples, since RL from a model that did not improve under supervision is a weak bet.

The test set is matched pairs of claims about the same quantity over the same data, one true and one false, built so that reading alone cannot separate them. Number pairs set the true value against a near miss (one digit or one sign) and a far miss. In fluency-trap pairs the false claim is written in confident, polished prose and the true one plainly or with a hedge; code checks that only the wording differs and that each style appears equally often on true and false claims, so a model that keys on style scores at chance. Derivation pairs set a correct step against one with a changed sign, exponent or coefficient. Natural pairs set a sentence from the reviewed papers as first written against its correction, and are test only. No quantity, site or object in the test pairs appears in training.

Each model is measured twice on the same pairs. Closed book: the claim and its context, no tools; the score is the model's probability on "true", read from the scores of the answer token. This measures plausibility. Open book: the same claim with the tools and the data; the verdict is verified, mismatch or unverifiable. This measures checking. Four numbers come from these. Plausibility accuracy is the closed-book accuracy, where chance is 50%. Style sensitivity is how often the closed-book judgment follows the wording against the truth on fluency-trap pairs. The gap is open-book minus closed-book accuracy. The verification rate is the share of open-book verdicts backed by a script that read the data and recomputed the number.

The pass lines, written in the design document before any run:

1. The base's closed-book accuracy on fluency-trap pairs is below 60% and its style sensitivity above 50%. If not, the base already separates true from false by reading, the premise is wrong, and the paper says so.
2. The verified-reward arm's open-book accuracy on held-out pairs exceeds the supervised arm's by at least 10 points, with a paired interval that excludes zero. If not, RL added nothing measurable over supervised training on the same episodes.
3. The verified-reward arm's verification rate exceeds the unverified-reward arm's by at least 20 points. This is the central claim: a reward that checks teaches checking, and a reward that rates teaches sounding right. If not, the study still has a working tool; it does not have this paper.
4. On the natural pairs, the verified-reward arm flags more of the false sentences than the base, with no rise in false alarms on the control passages. If not, the gains on constructed data do not carry over to real errors.

Three checks guard the measurement itself. A run of the scorer with shuffled labels must give chance. The same pairs with the data perturbed must flip the open-book verdicts that depended on the data. Twenty pairs are read in full by the strongest model available before the runs, to confirm that the false member is false for the stated reason.

The closed-book and open-book passes are inference only: a few node-hours over about 2,000 pairs for four models. The control arm needs one extra RL run of about the cost of the main one, outside the 345 node-hours of the chain.

Among the bases whose rewrites of held-out paragraphs keep every protected token at a rate of at least 0.99, with a mean length ratio between 0.8 and 1.2, the one with the lowest lint per 100 words wins. If no base qualifies, no base is chosen and the preference stage does not start.

If it fails: neither base can change the voice of a paragraph without moving its numbers or changing its length too much, after three passes over the pairs. The cleaner would then need code that masks the protected tokens before the rewrite and restores them after it.

Each of the four sampled rewrites gets a score from code in three tiers: a rewrite that keeps every protected token with a length ratio between 0.7 and 1.3 scores minus its lint per 100 words; one whose length falls outside that band scores −1,000 minus its lint; one that moved a protected token scores −2,000 minus its lint. The lint term is capped below the gap between tiers, so a broken rewrite always ranks below a whole one; the training code asserts this for every pair. An earlier version of this rule scored a broken rewrite at 0, above any whole rewrite with lint; a review before submission found it and the tiers replaced it.

If it fails: the files set no numeric pass line for the preference stage. The final stage reports the base alone, the tuned adapter and the preference adapter side by side. If the preference adapter shows no less lint than the tuned adapter at the same preservation, the pairs from supervised training already carried what the ranking could add.

A training stage reads the corpus verifier's result before it starts and stops with "data gate failed" unless the claims and planted faults show zero failures. The shortcut audit must read at chance in every cell by the rule in section 3. If a check fails, the set is rebuilt and nothing trains on it. A model trained on a set whose wording leaks the answer would learn the leak, and its scores would say nothing about checking.

Before any training, the prompted loop with its tools caught zero to one of the reviewer's 51 findings and flagged 3 of the 51 control passages as faulty. A second loop design caught 3 of the 51. Every trained model is read against these numbers.

The base-downloads line shows each base as complete, downloading (with the gigabytes so far) or paused (no new bytes for a while; the same download command resumes it). The page header shows when the data were last pulled from the cluster. Older than 30 minutes, it is marked stale.

A running stage shows its progress as items done out of items planned, the time used against its limit, and the node-hours spent so far. A finished stage shows what it measured. For the baseline that is the three scores per base and the chosen base. For traces it is the share of conversations kept by the code judge. Supervised stages show the training loss by step and epoch, while a gate stage shows its verdict with the three differences against the base. The RL stage shows the mean reward by kind of problem, the share of replies with no verdict, the share of groups whose attempts all scored the same, the clip fraction and the KL divergence from the reference. The cleaner's stages show lint per 100 words, the preservation rate and the length ratio for each base and adapter.

Two RL numbers tell the most at a glance. The mean absolute log-ratio between the trainer's and the server's probabilities should be near zero on the first step; a larger value means the server and the trainer disagree about the prompt, the tokens or the sampling settings. A KL divergence that climbs steadily means the model is drifting from its supervised start, which the β term is meant to restrain.

The player reads one file, data/history.json, rewritten on every pull from the cluster. It holds a list of series and a list of dated events. Each series is one run and condition for one measure, with its steps, its values and the hardware it ran on. Events are such things as a stage starting, a checkpoint or a gate verdict. Each series is thinned to at most 500 points.

The scrubber under the charts moves through the training in order. Play advances it, pause holds it, and the step buttons move one evaluation at a time. As it moves, a point advances along each curve: training loss for the supervised stages, mean reward for RL, held-out and in-distribution scores at each evaluation. A clock shows the wall time of the step, and a bar fills with the node-hours spent up to that moment. Events appear as marks on the timeline.

A run is one job's training; a condition is what distinguishes runs that are compared, such as the candidate bases or the arms of the plausibility experiment. Read the held-out curve against the in-distribution curve. When they rise together, the model is learning the skill. When the in-distribution score keeps rising and the held-out score stalls, it is learning the training set.

A100

The NVIDIA graphics processor on the cluster's GPU nodes, four per node, each with 40 GB of memory.

Adapter

The small set of trained matrices added to a frozen base by LoRA. It is all that training changes, and it can be loaded into a server beside the base.

Advantage

An attempt's score minus the mean score of its group, divided by the group's spread. Positive advantages make an attempt more likely after the update.

AUROC

The area under the receiver operating characteristic curve: the chance that a classifier ranks a random positive item above a random negative one. 0.5 is chance.

Base (base-a to base-f)

An openly published model that training starts from, named here by letter.

bfloat16

A 16-bit number format with the range of 32-bit floats and less precision; two bytes per weight.

Checkpoint

A saved state of a training run (adapter, optimizer moments, schedule position, random-number states) from which a stopped job resumes.

Claim list

The checker's first output for a paper: each claim with its line, its hedge, what it rests on and which tool could check it.

Clean recompute

A program in the sandbox that ran without error, read the data, and did not contain the number it was meant to check.

Closed book, open book

Judging a claim from its text alone, or with the tools and the data. The first measures plausibility, the second checking.

Context

The window of tokens a model reads at once; 32,768 tokens in the serving setup here.

Cross-entropy

The negative log-probability a model gives the right next token, averaged over tokens; the loss of supervised training.

Decoder-only transformer

A stack of layers, each with attention and a feed-forward block, that predicts the next token from the ones before it.

DPO

Direct preference optimization: training on pairs of a preferred and a rejected output, measured against a frozen reference.

Epoch

One pass over the whole training set.

Falsifier line

The line the second checker loop writes before any tool call, saying what would make the claim false and which check would show it.

Fine-tuning

Further training of a published model on a narrow task.

Gate stage

The job that compares the tuned checker with its base on held-out sets and stops the chain if the gain is under 5 points or false alarms rise by more than 2.

Generalize

Here, to keep a score on fields, quantities or papers kept out of training.

Hedge

A word that limits how certain a claim is, such as "may" or "suggests". The cleaner may not drop or strengthen one.

Held-out

Kept apart from training as a whole field, quantity, recipe or paper, to test generalization.

In-distribution

Held back from training but of the same kinds as the training items.

KL divergence

The Kullback-Leibler divergence, a measure of how far one probability distribution is from another; here, how far the trained model has moved from the reference.

Lint

A count of the habits of model prose, from a fixed list of sentence classes and words, reported per 100 words.

LoRA

Low-rank adaptation: training two small matrices beside each frozen weight matrix, here at rank 64.

Mixture of experts

A transformer whose feed-forward blocks are split into experts, of which a router picks a few per token.

Model-parallel placement

Putting different layers of one model on different graphics processors, so a sequence passes from card to card.

Node

One machine of the cluster. The GPU nodes used here have 128 CPU cores, four A100s and 512 GB of memory.

Node-hour

One whole node for one hour, the unit of cost on this page.

Planted fault

One change made by code to a real paper, whose kind and line are known by construction.

Preservation lock

The cleaner's check that every number, citation key, equation body and figure reference survives a rewrite.

Queue (debug, standard)

Classes of job on the cluster. Debug takes short jobs, here 30 minutes; standard takes long ones.

Reference model

The frozen model a training update is measured against: the supervised checker for RL, the tuned cleaner for DPO.

Reinforcement learning (RL)

Training from the scores of a model's own attempts instead of from teacher text.

Replay

The player on the status page that steps through the recorded training history.

Reward

The score a program gives an attempt, from −1 to 1 for the checker.

Rollout

One attempt at a practice problem by the current model, with its tool calls, used for an RL update.

Sandbox

The locked container in which model-written code runs: read-only data, no network, capped time and memory.

SFT

Supervised fine-tuning: raising the probability of each token of worked examples.

Shortcut audit

A test in which a simple text classifier tries to tell true items from false; it must score at chance.

Teacher

The stronger model, or the chosen base itself, whose code-checked worked examples train the checker in the supervised stage.

Temperature

A setting that sharpens or flattens the probabilities a model samples from; 0 always takes the most likely token.

Tensor parallelism

Splitting each layer's matrices across several graphics processors that compute their slices together.

Time limit

The longest a job may run; the cluster ends it at that point, and its cost is counted at that limit.

Token

A piece of text, about three quarters of an English word on average.

Tolerance

How close a recomputed value must be to count as a match: half a unit in the last digit reported, unless the paper states its own uncertainty.

Trace

A recorded conversation of a teacher working an episode with the tools, kept for training only if code confirms it.

Underspecified claim

A claim whose method leaves a choice open; the right answer names the reading it assumed.

Unverifiable claim

A claim whose data are not available to the checker; the right answer is "cannot be checked".

Weights

The adjustable numbers in a model's matrices.