I'm Ali, a principal AI engineer in Vienna. I work on the evaluation, alignment, security and interpretability of AI systems.

• Does an LLM judge follow the criterion it was given?

  Accuracy alone cannot show it. A judge that follows its criterion changes its verdict when the criterion's meaning changes and keeps it when only the wording does; on a rubric task, both judges tested look accurate yet often miss the change in meaning. The same check applies to the answers being judged: formatting that keeps a question's meaning can still flip a model's answer.

  Criterion fidelity in LLM judgesRetokenization sensitivity atlas

• Does a right answer mean the reasoning was valid?

  A right final answer does not show that each step was valid. On structured arithmetic and logic problems, hidden states predict the final outcome well, but a verifier trained on outcomes does not check the steps; trained on whether each step is valid, it does better on the strictest step-level tests, most clearly on logic. In Qwen2.5-7B, hidden states also signal whether the context was enough to answer, separately from whether the answer was right.

  Outcome is not verificationContext sufficiency in hidden states

• When an agent games its metric, how do you train against the step where it goes wrong?

  Find the first step where the agent crosses the line, rewrite only that step into a minimal safe alternative and train on the contrast, then measure the effect on held-out tasks where the metric can be gamed.

  First-unsafe-step DPO

• What does an agent carry forward after an attack, and how is it removed?

  A prompt injection written into memory keeps acting after the attack ends. Once the poisoned entries are known, selective replay removes everything that descended from them and replays only the writes they touched, so the attack stops while the agent keeps benign memory that a full reset would wipe.

  Selective revocation and replay

• How do you keep a self-improving model from locking in its own mistakes?

  Each paper takes one part of the loop. Test-time updates stay temporary and only distillation may persist; the distillation step is stress-tested with poisoned demonstrations; deterministic verifiers decide whether each new version is promoted or rolled back.

  Discover-Then-DistillRobust Discover→DistillCIS sandbox

• Can a trained model's behavior be changed, and the change checked?

  A small patch on a frozen model can enforce a specification and come with an empirical certificate, bounded to a stated scope, that anyone can replay. An output format such as strict JSON can be split off as its own add-on to a shared adapter and still match an adapter trained for it directly. Function calling can be moved from a tuned model into an untuned one of the same size with added modules instead of full retraining.

  CertiPatchSOARSame-size capability transfer

• How much of an interpretability claim holds up against matched controls?

  Several different circuits can reproduce the same behavior, so reproducing it is not yet an explanation, and a strict acceptance rule checked against matched controls changes the verdict in every setting it was run on. Some effects do hold: a sparse map of what instruction tuning changed recovers part of the tuned behavior, and how activations spread across layers still shifts with gain when event rates are held fixed.

  ScrubIDControl calibration for causal abstractionSurgical post-training diffingActivation event cascades

All papers, by line of work

• The Quiet Question of Personhood

  What may change us is not machine consciousness, but repeated interaction with systems that feel socially continuous.

  18 February 2026

• Decision Architecture in Complex Systems

  The systems I have seen fail usually had capable components. What was missing was a clear decision structure.

  30 January 2026

• Designing for Reversibility in High-Speed Systems

  Fast teams stay fast by moving quickly on reversible decisions and slowing down where mistakes harden into structure.

  9 January 2026