What was done to the network, and how to check it.

Both arms have identical shape and were trained on the same data toward the same objective. At epoch 101 two of their convolutional stages are destroyed outright. The sealed arm does not degrade gracefully: it falls to chance and stays there for the rest of the run.

The controls drive an archive, not a simulation. Play and the epoch bar move both arms through the same recorded run, and the table underneath stops answering the same way for the two of them. The run's identifier and seed sit in the bar at the top of the console, and each of the four scenarios regenerates from its own seed. The fourth goes against us, and it sits in the same menu as the other three.

Nothing in the sealed pane was withheld. A standard network does not compute a per-component health signal at any point in training, so there is no quantity to display and no setting that would reveal one. That absence is the problem, drawn.

The black box was never one problem. It is two questions that were given one name.

What the open pane just did is not a better reading of a finished model. It is a different question, answered by different means — and the distinction is not academic. One of these is a question about meaning, and it is genuinely hard. The other is a question about accounting, and it is the one that decides whether a regulated institution can use a model at all. For a decade both were attacked with the same instrument.

Only the right-hand question is closed here, and only within the limits set out below. A page that claimed both would be worth less, not more, to the people who have to file against it.

An account that was never written cannot be recovered from the weights.

Every error signal in a standard neural network reaches every parameter on every step. That property is the source of a network's capability, and it is also why nothing inside one can be named afterwards. The trail does not go cold. It was never laid.

Ask a finished model what it took from a particular source and every available tool works the same way: examine the trained system, produce a best estimate of what must have occurred. The estimate is frequently a good one. It is also unverifiable, two tools disagree on the same input, and an estimate is not something a data owner accepts or a supervisor files.

This was never a tooling failure. The quantity was not being withheld. In a network where every gradient touches every parameter, there is no component whose behaviour can be isolated from the aggregate, so there is nothing for a question to be put to. Reverse engineering is the right instrument for the left-hand question and the wrong one for the right-hand question, and the field spent a decade using it for both.

That decision was reasonable when it was made and has not been revisited since. Change it — bound each component's learning path so the component stays individually addressable — and one half of the black box stops existing. Not because a better tool was pointed at a finished model, but because the model keeps the account as it goes, which is what the run above is doing.

The same record answers four different people.

It is one artefact, generated once, during training. What changes between these readers is the obligation that makes them ask.

• The engineer whose run died. A component, a step and a magnitude, while the run is still recoverable — instead of a loss curve that moved once the damage was thousands of steps old.
• The validator who cannot verify a memo. A signed, per-modification record with a declared bound, diffable against the version last approved. Evidence of what training did rather than a written account of what the team intended.
• The reviewer assessing a model allowed to update. A declared set of modification types with individual ceilings, the record of each one as it happened, and the diff. Those are the three things a change-control plan asks for.
• The counsel holding a deletion clause. What the model took from a named source, held as an addressable part rather than spread across every parameter — the precondition for removing it and certifying what was removed.

Transparency is the mechanism. The product is that data a custodian will not release today becomes data they can release, because the account they have been waiting for now exists.

Ten objections, answered before they are raised.

These are the questions a technical evaluation asks in its first five minutes, in the words a reader actually uses. The limits come first, because a page that lists only what worked is a marketing page wearing a lab coat.

Stated here, in the same place as the claim.

A page arguing that half of a decade-old problem is closed has to say exactly which half and exactly how far, in the same breath. These are the boundaries of the evidence.

• This is structural transparency, not semantic interpretability. The record names which component failed, when, by how much and inside what limit. It does not say what that component encodes, and no claim here should be read as saying it does.
• Every result is CIFAR-10 or CIFAR-100. No clinical, biological, financial or defence data has ever touched this system. That is the binding constraint on the whole programme rather than a detail.
• Transformers are a stated target, not a demonstrated result.Demonstrated on fully-connected, convolutional and residual families.
• Where it loses. Under adversarial weight injection the architecture finishes 1.0 percentage point behind a parameter-matched baseline, with no current mitigation; that run is in the scenario selector above, and it plays, and it loses. It also finishes 0.9 pp behind under a 100× weight explosion, and on ResNet-18 an uninstrumented network recovers slightly better (92.3% vs 91.6%).
• The claim stops where the evidence stops. Frontier scale, regulated data and production over time are outside it — no deployment exists, and nothing here is asserted about behaviour under any of the three.

The claim is not that a network can now be read. It is that a single-network architecture can produce mechanistically logged, per-component causal attribution that no prior single-network method offers, and that this is what makes recovery from failures possible that standard architectures cannot even detect.

The obligations arrive on legislated dates, not forecast ones.

• 17 April 2026SR 26-2 supersedes SR 11-7. In force.
• 2 December 2027EU AI Act, Annex III obligations apply.
• 2 August 2028EU AI Act, Annex I transition.
• 25 March 2029European Health Data Space, secondary use.

An architecture cannot be retrofitted into a model that has already been trained. An institution that begins the architecture question after the date is not late by a quarter; it is late by a training cycle.

Start with the problem already on the table.

Every figure on this page is measured on CIFAR-10 across the controlled experiment programme built by founder Rokib Al Dhin Raadh, whose stability analysis is accepted at DeepMath 2026, and is labelled as such wherever it appears.The technology page carries the conditions for each, the error bars, and every run where it loses.