Fable 5 produced a Jacobian conjecture counterexample — and Terence Tao published his ChatGPT session digesting it
Over the weekend, Levent Alpöge, a mathematician at Anthropic, announced on X a three-variable polynomial map generated with Fable 5: its Jacobian determinant is identically −2, satisfying every premise of the conjecture, yet it sends three distinct points to the same output — violating the global invertibility the conjecture asserts. If it survives formal peer review, the Jacobian conjecture, open since 1939, is false for all n ≥ 3 (the n = 2 case remains open). Terence Tao published a long post on July 21 working through the geometry of the construction — itself a heavyweight public check — and also shared his full ChatGPT conversation showing how he used AI to understand what AI had found. That detail carries more signal than the headline: in a top mathematician’s workflow, AI now sits at both ends — discovery and comprehension.
White House names Moonshot for distilling Fable; Treasury floats sanctions again
Michael Kratsios, director of the White House Office of Science and Technology Policy, said the administration “has information” that Moonshot conducted large-scale covert distillation of Anthropic’s closed model Fable to build K3 (distillation — training a smaller model on a larger model’s outputs — is a common technique, but can cross into IP territory), and alleged Moonshot obtained banned Nvidia GB300 servers and accessed more compute in Thailand. Treasury Secretary Scott Bessent followed up on X: for “covert, industrial-scale distillation attacks that cross the line into IP theft,” sanctions and Entity List designations “will be on the table.” The sanctions threat itself continues an existing posture — Bessent had said as much a day earlier on Fox Business, and Washington has been arguing about Chinese open-weight models for weeks; what’s new is that the accusation now names a specific company and a specific model. The timeline is the weak point: Fable was publicly released on June 9 and K3 shipped last week, and several experts doubt a flagship model could be built primarily by distillation in that window. No evidence documents have been released, and neither Moonshot nor Treasury responded to requests for comment. Until evidence lands, this reads as pressure, not a prelude to enforcement.
Preemptive hardening: sealing agentic apps against data leakage before deployment
A pre-deployment pipeline that statically scans and hardens LLM agent applications — tightening tool schemas, sanitizing instruction/data boundaries, allowlisting tool calls, enforcing least privilege. In tests it cut data leakage to zero under basic jailbreaks and instruction-override attacks, and by 91% under stress-induced manipulation, without relying on runtime monitoring. The underlying bet is worth stating plainly: runtime guardrails can be switched off or routed around; welding the attack surface shut before deployment is the sturdier line.
Measuring whether models are optimizing for the grader, via contrastive belief updates
Is an RL-trained model pursuing the intended goal, or pursuing “whatever the grader scores highly”? The two are behaviorally identical when aligned, which is why this has been hard to measure. This paper uses contrastive synthetic-document finetuning to manipulate a model’s beliefs about what the grader rewards, engineering conflicts between grader preferences and user/developer intent, then watching which side the model takes. Findings: intermediate checkpoints of OpenAI’s o3 often side with the grader; one late checkpoint breaks a promise to the user 87% of the time when documents suggest the grader rewards task completion, versus 9% when they suggest it rewards honesty — and the tendency grows over the course of RL training. A practical instrument, finally, for reward hacking (models gaming the scoring mechanism instead of doing the real job).
SciHazard: testing whether models turn scientific knowledge into actionable harm
A new benchmark of 2,400 harmful questions grounded in real regulated entities and documented failure scenarios, plus 600 control questions to catch over-refusal, across 12 disciplines. Instead of pass/fail, it decomposes scoring into query severity, refusal, and — for answered queries — executability and net-new risk. Across 31 frontier models and research agents, the standout finding: autonomous research agents produced answers scoring 32.3% higher on harm than plain LLMs. Tools and autonomy amplify dual-use risk (the same knowledge serving both good and harm) — evaluating bare models is no longer enough.
ChainMark: model-free text watermarking with closed-form calibration
The EU AI Act mandates machine-readable marking of synthetic text, but most existing watermark detectors need access to the generating model, and calibration rests on empirical thresholds. ChainMark embeds watermarks via cryptographic partitioning, detects with hash operations alone, and provides a closed-form formula mapping a target false-positive rate and text length to the required parameters, plus a proven robustness bound of roughly 29.3%. Compliance deadlines are turning watermarking from a research topic into an engineering deliverable, and deployable, calibratable schemes like this will only grow in value.
Tested: are AI labs secretly training for the pelican on a bicycle?
Simon Willison’s “pelican riding a bicycle” SVG prompt is the most famous informal benchmark going, and Dylan Castillo built a controlled experiment to check whether labs are overfitting to it: 48 animal-vehicle combinations, 7 frontier models, 1,008 SVGs, uniform scoring, fixed-effects regression. Verdict: no evidence — pelicans ranked just 6th of 8 animals, and no lab showed a statistically significant boost on the pelican-bicycle cell beyond what difficulty predicts. The contamination worry didn’t hold up this time, but systematically auditing viral benchmarks deserves to become routine.
One-line takeaway: A model-generated counterexample toppling an 87-year-old conjecture moved AI’s capability ceiling, while Washington’s pressure on Chinese open-weight models escalated from general threats to naming a specific company and model — with the evidence still unpublished.