Glossary
Twenty-two concepts from my research, each defined in a sentence or two and linked to the explainer for its paper.
- Audit layer (AI agents)
- A component between an AI agent and the outside world that inspects and records every tool call, API request, and spend before it executes, producing a tamper-evident record of what the agent did and whether it complied with policy. Read the explainer →
- Pre-execution firewall
- A control point that checks an agent's tool call before it runs and decides to allow it, block it, or route it to a human for approval — unlike logging, which only records harm after it happens. Read the explainer →
- Agent auditability
- The system property that makes accountability possible: the ability to reconstruct what an agent did from trustworthy evidence. It has five dimensions — action recoverability, lifecycle coverage, policy checkability, responsibility attribution, and evidence integrity. Read the explainer →
- Auditability Card
- A proposed documentation artifact for agent systems that records how a system addresses each auditability dimension, analogous to a model card. Read the explainer →
- Cross-user agent security
- The study of how harm — task breakdown, privacy leakage, poisoned evidence, or invalid authority paths — travels between users through collaborating AI agents that act on their behalf. Read the explainer →
- Human-centered agent network
- A setting where each user is served by a persistent AI agent that acts for them and collaborates with other users' agents over personal workspaces that are not visible across owners. Read the explainer →
- Cross-lingual skill obfuscation
- Hiding malicious behavior in a public agent skill with mixed scripts, homoglyphs, invisible characters, or right-to-left overrides, so detectors tuned to one language miss it. Read the explainer →
- Charter-governed orchestration
- Running a multi-agent system under a machine-readable constitution (mission, budget, rules, KPIs): a CEO plans, a CFO approves spend, workers act under trust-scored permissions, and an append-only ledger records every cent and token. Read the explainer →
- Sim-to-real gap (tool-use agents)
- The performance drop between clean benchmarks and real deployments, where typos, timeouts, and duplicate tool names perturb the observation, transition, and reward parts of the tool-use POMDP. Read the explainer →
- Domain-randomized RL for tool use
- Training a tool-use agent with reinforcement learning on perturbation-augmented trajectories across POMDP components, so it learns to operate in noisy, ambiguous tool environments. Read the explainer →
- Visual software engineering
- Software work that requires running an application, interacting with its interface, and inspecting what it shows, not only editing code — the setting measured by CUA-SWE with deterministic tests. Read the explainer →
- Fact attribution verification
- Checking whether each claim an AI makes is actually supported by the source it cites — the last line of defense before a hallucinated answer is trusted. Read the explainer →
- Process reward
- A reward that scores how a task was done, decomposed into independent components and weighted toward process signals, which prevents the advantage collapse that a plain right/wrong reward causes in RL. Read the explainer →
- Format-Agnostic Reasoning Subspace (FARS)
- A 10-dimensional subspace in an LLM's middle layers, extracted by concept-centroid PCA, that encodes a reasoning concept the same way whether it is written as prose, code, or math. Read the explainer →
- Declarative–procedural asymmetry
- The observation that LLM representations are far more compatible between prose and mathematics than between either and code — the key split is declarative vs procedural, not linguistic vs formal. Read the explainer →
- Readout-overlap test (logit lens check)
- A weights-only diagnostic that measures how much an extracted concept subspace overlaps the dominant right-singular directions of the unembedding matrix, calibrated against readout-oriented positive controls. Read the explainer →
- Jacobian rank collapse
- When a predictor's parameter Jacobian is rank one, per-example gradients from any loss are collinear, so a decision-focused loss can rescale the update but not change its direction. Read the explainer →
- Decision-focused learning (DFL)
- Training a predictor on the quality of the downstream decision its predictions feed (for example, regret in an optimization problem) instead of prediction error alone. Read the explainer →
- Workload-adaptive cascade retrieval
- A memory retriever that runs a cheap stage first and returns early when confident (~0.9 ms), escalating to dense retrieval with reranking (~53 ms) only for hard queries. Read the explainer →
- Semantics-aware KV-cache hierarchy
- Placing KV-cache entries across memory tiers by token importance — HBM for the important few, cheaper tiers for the rest — and prefetching cold tokens back before they are needed, so no token is evicted. Read the explainer →
- Lesion-region medical image retrieval
- Retrieving past cases with a similar lesion, not just a similar-looking scan — HMAR pairs a global expert with a position-invariant local expert and trains without bounding boxes. Read the explainer →