What Iterated Self-Feeding Probes of Language Models Measure, and a test that separates the construction from the model

# What Iterated Self-Feeding Probes of Language Models Measureand a test that separates the construction from the model
Source: [https://arxiv.org/html/2608.10986](https://arxiv.org/html/2608.10986)
###### Abstract

A growing class of methods probes a language model by feeding it its own output: self\-consistency, iterated refinement, agentic loops\. We ask what such a probe measures, in a construction chosen to make the question sharp: a ring of token cells resampled in place by the model’s own windowed conditionalpr​\(xi∣xi±r\)p\_\{r\}\(x\_\{i\}\\mid x\_\{i\\pm r\}\)\. The substrate is Glauber dynamics on token sequences and is not new; what we change is the coupling\. Advancing two rings that differ in one token under*common random numbers*makes undamaged copies diverge by exactly zero, so damage spreading becomes measurable where a maximal coupling gives mixing times instead\. The answer is that it measures two different things at once, in readings that look alike\. Some quantities are fixed by the construction: the damage light cone is kinematic, and the radius scaling of the token\-space Lyapunov exponentλca​\(r\)\\lambda\_\{\\mathrm\{ca\}\}\(r\)is*model\-invariant*across 19 models and two scale ladders spanning70×70\\times\. Others genuinely track the model:λca\\lambda\_\{\\mathrm\{ca\}\}crosses zero at a reproducible point in training, and the attractor share ranks models consistently however the lattice is built\. Left undistinguished, the first kind is readily mistaken for the second — we did so ourselves for four months, and report a phase transition we measured to three decimal places that belongs to the probe rather than to any language model\. We give the test that separates them: hold the construction fixed and vary the model, or hold the model fixed and vary the construction, and see which readings move\. We validate the instrument by reproduction first, recovering a Domany–Kinzel damage field*bit\-exactly*against an independent prediction, and we report the estimator failures that this discipline caught — four retracted verdicts, each on a quantity that looked like a measurement\. The methodology ships as a package\.

## 1Introduction

Feeding a language model its own output is now routine\. Self\-consistency samples a model repeatedly and aggregates\([Wang et al\. 2022](https://arxiv.org/html/2608.10986#bib.bib14)\), on reasoning traces the model produced itself\([Wei et al\. 2022](https://arxiv.org/html/2608.10986#bib.bib16)\); iterated refinement asks a model to revise its own answer against its own critique\([Madaan et al\. 2023](https://arxiv.org/html/2608.10986#bib.bib7)\); agentic loops return a model’s output to its input for many turns\. Each of these is a*dynamical system*built from a static predictor, and each invites a natural question: what do the dynamics tell us about the model?

This paper answers a prior question, because we found it has an unobvious answer\. Before asking what an iterated probe reveals, one must ask what it*measures*— and the answer is that it measures the model and the probe together, in quantities that are not distinguishable by inspection\.

We work in a construction chosen to make the confound as stark as possible: a ring ofNNtoken cells, each resampled in place from the model’s own windowed conditionalpr​\(xi∣xi±r\)p\_\{r\}\(x\_\{i\}\\mid x\_\{i\\pm r\}\)at temperatureTT, so that the model’s output at every site is part of its own input at the next step and no external text enters after initialisation\.

The substrate is not new, and we do not claim it\.In\-place resampling of masked tokens is Glauber dynamics on token sequences, and it has been studied as such\([Sana et al\. 2026](https://arxiv.org/html/2608.10986#bib.bib13)\)\. What we change is the*coupling*and therefore the observable\. That work couples two chains maximally and measures mixing time and metastability — how long the chain takes to forget where it started\. We couple with*common random numbers*: two rings, identical but for one flipped token, advanced with the same stream of uniform variates and the same visit order\. Maximal coupling and CRN coupling are provably distinct constructions, and they answer different questions\. Under CRN, two rings whose windows agree draw the*same*token, so undamaged copies diverge by exactly zero and every difference is attributable to the injected flip\. That is what makes damage*spreading*measurable at all: its exponential growth rate is a token\-space Lyapunov exponentλca\\lambda\_\{\\mathrm\{ca\}\}, its saturating level normalised by an independent\-noise floor is a damping lengthDnormD\_\{\\mathrm\{norm\}\}, and its spatial extent is a light cone\. None of these is a mixing time\.

##### Contributions\.

1. 1\.A validated instrument\(§[3](https://arxiv.org/html/2608.10986#S3)\)\. We calibrate by*reproduction*: on the Domany–Kinzel automaton, where the damage field is provably the automaton itself, an independent prediction matches ours bit\-exactly — zero mismatching cells, with a nonzero off\-line control that must fail\. The instrument also separates elementary CA rules by whether damage survives, and recovers known transition matrices\.
2. 2\.A manufactured phase transition\(§[4](https://arxiv.org/html/2608.10986#S4)\)\. The construction exhibits a sharp absorbing\-state transition, measurable to three decimal places, that is a property of the probe\. We identify the mechanism \(an attracting fixed point of the argmax map\), delimit it \(it occupies radiusr∈\{1,2\}r\\in\\\{1,2\\\}only\), and give the control that behaves as the mechanism predicts \(a masked\-LM construction, whose map has no such fixed point, shows no transition\)\.
3. 3\.The discriminator\(§[5](https://arxiv.org/html/2608.10986#S5)\)\. Construction\-determined and model\-determined readings are separated by a test, not by intuition: vary one factor with the other held fixed\. We tabulate five such manipulations\. Varying the construction moves the instrument and varying the model across families does not, which is what makes the manufactured transition attributable to the probe; varying the training checkpoint does move it, which is what makes the developmental transition attributable to the model\. The fifth manipulation — varying family*and*construction together — separates the readouts from each other:λca\\lambda\_\{\\mathrm\{ca\}\}does not survive it and the attractor share does\.
4. 4\.Estimator gating\(§[6](https://arxiv.org/html/2608.10986#S6)\)\. Exponents measured on black\-box LM dynamics must be gated at the measurement’s own geometry, or they return confident wrong answers\. We report four retracted verdicts, each caught by a known\-answer system rather than by review, and ship the guards as a package\.

##### What this paper is not\.

It is not an interpretability result\. We do not claimλca\\lambda\_\{\\mathrm\{ca\}\}localises a mechanism, and §[7](https://arxiv.org/html/2608.10986#S7)records the attempts that failed to make it do so\. The contribution is measurement: what an iterated self\-feeding probe reads, what it does not, and how to tell the difference before building on the answer\.

## 2The construction

Letℳ\\mathcal\{M\}be a language model andVVits vocabulary\. The state is a ringx∈VNx\\in V^\{N\}ofNNtoken cells with periodic boundaries\. One*sweep*visits every site once in a random order and resamples it in place from the model’s conditional given its window:

xi∼pr\(⋅∣xi−r,…,xi−1,xi\+1,…,xi\+r\)/T,x\_\{i\}\\;\\sim\\;p\_\{r\}\\\!\\left\(\\,\\cdot\\mid x\_\{i\-r\},\\dots,x\_\{i\-1\},x\_\{i\+1\},\\dots,x\_\{i\+r\}\\right\)\\Big/T,\(1\)whererris the radius,TTthe temperature, and the centre token is masked from its own window\.

##### Why these choices, and what they cost\.

Each is a deliberate departure from how the model is normally run, and stating them plainly is what allows §[5](https://arxiv.org/html/2608.10986#S5)to ask which readings survive them\. The ring is*periodic*, so no site is privileged by being at a boundary and the light cone is not confounded with an edge effect\. Resampling is*in place*rather than appended, which is what closes the loop — and it is also the single largest departure from deployment, because free autoregressive generation never revisits a token it has emitted\. The window is*symmetric with the centre masked*, which is native to a masked language model and is imposed on an autoregressive one; that asymmetry is why we run both, and the masked\-LM construction serves throughout as the control\. Sites are visited in a random order per sweep, and the order is drawn*per replica*rather than per batch, because sharing it across a batch correlates the replicas and shrinks error bars by a factor they have not earned \(§[6](https://arxiv.org/html/2608.10986#S6)\)\.

##### The two\-token window is genuinely two tokens\.

A radius is a claim about geometry, and it is cheap to check rather than assert: if the nearest token carried the window by itself, the construction would be anr=1r=1chain wearing anr=2r=2label\. On the autoregressive \(causal, left\-window\) construction we measure the exact coupled\-draw disagreement produced by flipping each window position separately — the probability that twins sharing a uniform stream draw differently when positioni−2i\-2changes, against the same fori−1i\-1\. Averaged over six developmental checkpoints, on the states the ring actually occupies, the far position contributes0\.5790\.579against the near position’s0\.8200\.820, a ratio of0\.6980\.698; atr=3r=3the third\-back token still contributes0\.5350\.535against the nearest token’s0\.7040\.704\. Influence decays with distance without the window collapsing onto one position\. The check earns its place because it can fail: restricting the same construction to a small token sub\-alphabet drops the far position to0\.0610\.061against0\.8010\.801, the branching ratio falls below one, and damage walks without growing\.

The cause is not the restriction itself, and we say so because our own first reading was wrong\. The three sub\-alphabets we tried are all semantically coherent sets, and the collapse tracks that coherence rather than the alphabet’s size: holding size and radius fixed and varying only how the tokens are*selected*moves the far position’s contribution by up to0\.5880\.588, with every semantically chosen alphabet falling below a branching ratio of one and every randomly chosen one sitting at or above it\. Nor is the loss permanent — widening the window recovers it, with all nine arms reaching criticality byr≤6r\\leq 6\. What the sub\-alphabet lattice demonstrates is that this construction*can*be driven subcritical, which is what makes the full\-vocabulary measurement a check rather than a formality; it does not show that small alphabets are subcritical as such\.

##### This is a probe, not a model of deployment, and we can say so quantitatively\.

Injecting a token error into real autoregressive generation and continuing produces no absorption at all:Ppersist=1\.000P\_\{\\text\{persist\}\}=1\.000onpythia\-70m,\-160mand\-410m\(32 trials each\), because free generation never resamples the damaged token\. The dynamics studied here exist only when the loop is closed by resampling in place\. Any reading taken from them is therefore a statement about the closed loop first, and about the model only if it survives §[5](https://arxiv.org/html/2608.10986#S5)\.

##### Damage spreading under common random numbers\.

We run two rings,xxandx~\\tilde\{x\}, identical except that one site is flipped att=0t=0, and advance both with the*same*stream of uniform variates and the*same*visit order\. Writingdtd\_\{t\}for the number of differing sites afterttsweeps, the token\-space Lyapunov exponentλca\\lambda\_\{\\mathrm\{ca\}\}is the exponential growth rate ofdtd\_\{t\}over the sweeps before saturation, andDnormD\_\{\\mathrm\{norm\}\}is the saturatingdtd\_\{t\}normalised by the independent\-noise floorD0D\_\{0\}obtained when the two rings are driven by*independent*uniforms\. The two quantities answer different questions — how fast damage grows, and how much survives — and §[6](https://arxiv.org/html/2608.10986#S6)explains why they must be filtered differently\.

![Refer to caption](https://arxiv.org/html/2608.10986v1/fig/instrument.png)Figure 1:The construction\. A ring of token cells is resampled in place by the model’s own windowed conditional; two copies differing in one token are advanced under common random numbers, and the growth of their disagreement givesλca\\lambda\_\{\\mathrm\{ca\}\}\. Undamaged twins diverge by exactly zero\.
##### The exact\-zero null\.

Two rings with identical windows, handed the same uniform, draw the same token: inverse\-CDF sampling against a shared uniform makes agreement exact, not approximate\. Undamaged twins therefore diverge by*exactly*zero, on every backend, and this is asserted rather than assumed\. It is the property that makes damage attributable to the injected flip and to nothing else, and every claim in this paper rests on it\.

## 3Validation by reproduction

An instrument that has only ever been pointed at an object with no known answer cannot be distinguished from a plausible\-looking implementation that is wrong\. We therefore calibrate by*reproduction*, on systems whose answers are established independently, and in an order that climbs from the strictest test to the loosest\.

##### Rung 1: an identity, not a correlation\.

On the Domany–Kinzel probabilistic cellular automaton the damage field is provably the automaton itself, run on a derived rule\. This yields a prediction with*no error bar attached*: on thep2=0p\_\{2\}=0line the CRN damage field is itself a Domany–Kinzel automaton at the samep1p\_\{1\}, so ours must equal an independently predicted one cell for cell\. It does —0 mismatching cellsatp1∈\{0\.2,0\.5,0\.75,0\.8087,0\.95,1\.0\}p\_\{1\}\\in\\\{0\.2,0\.5,0\.75,0\.8087,0\.95,1\.0\\\}, on a ring of 4096 over 1500 steps, three seeds each — while an off\-line control at\(0\.6,0\.5\)\(0\.6,0\.5\)yields 16 mismatches, so the test is not vacuous\. The identity runs*through*the same loop that produces every language\-model number here, so it verifies the window indexing, the shared\-uniform consumption order, the inverse\-CDF sampling and the synchronous update at once\. No other rung does that; the rest agree only to within a fitted constant\.

##### Rung 2: a known ordering, and the part of it the instrument does not recover\.

Across elementary cellular automata, ignition probability separates the ordered rules from the rest decisively \(Cohen’sd=3\.03d=3\.03,p<10−3p<10^\{\-3\}\)\. It does*not*separate edge\-of\-chaos from chaotic \(p=0\.47p=0\.47\)\. We report the rung as what it is — a recovered ordered/non\-ordered boundary, not a recovered three\-way classification — because a rung that is claimed to do more than it does stops being a calibration\.

##### Rung 3: known distributions\.

Run on systems with known transition matrices, the attractor census recovers them\.

![Refer to caption](https://arxiv.org/html/2608.10986v1/fig/validation_ladder.png)Figure 2:Validation by reproduction\. The instrument is calibrated against systems whose answers are established independently before it is pointed at a language model, strictest rung first: the Domany–Kinzel identity admits no error bar, so a merely\-close implementation fails it\.Only after all three rungs does the instrument get pointed at a language model\. This ordering is not ceremonial: §[6](https://arxiv.org/html/2608.10986#S6)reports four occasions on which a rung caught an estimator that had already produced a confident number\.

## 4A phase transition that belongs to the probe

Iterated at low temperature, the construction shows a sharp absorbing\-state transition\. Both the survival exponentδ\\deltaand the density exponentθ\\thetareach their directed\-percolation values at a common critical temperatureTc∈\[0\.4343,0\.4391\]T\_\{c\}\\in\[0\.4343,0\.4391\], and the estimator was gated on Domany–Kinzel*before*the language\-model numbers were read\.

![Refer to caption](https://arxiv.org/html/2608.10986v1/fig/manufactured.png)Figure 3:The transition belongs to the probe\.Left \(r=2r=2\):under the autoregressive constructionpythia\-410mcollapses onto a single token asTTfalls, reaching a top\-1 share of0\.7440\.744atT=0\.02T=0\.02, and crosses half the ring at the measuredTcT\_\{c\}\. Three controls do not\. Prepending one beginning\-of\-sequence token to the same model drops it to0\.2410\.241— the map’s domain changes, not its parameters\.gpt2\-medium, whose argmax map has no attracting fixed point, sits at0\.1470\.147\. Two masked\-LM models, whose*native*task is this update, stay at0\.0990\.099and0\.1130\.113at every temperature\.Right \(r=4r=4\):outside the degenerate radius all five arms look alike, which is the boundary\. Monochrome by marker and dash throughout\.It is a property of the probe\. Four facts establish this, and the fourth is the mechanism, and Figure[3](https://arxiv.org/html/2608.10986#S4.F3)carries all four on one grid\.

##### The frozen phase is a single\-token collapse\.

AtT=0\.02T=0\.02, 81 of 96 sites hold the newline token, and the measuredTcT\_\{c\}sits at the point where newline occupies 52% of the ring\. The “ordered phase” is one token eating the lattice\.

##### It is not the corpus, the architecture, or the scale\.

The effect is refuted from both directions across 19 models\. Granite’s dense and mixture\-of\-experts members agree within two points while differing by2×2\\timesin width,1\.7×1\.7\\timesin depth and16×16\\timesin feed\-forward size, and in routing versus none\. Scale is eliminated across a70×70\\timesPythia ladder and a12×12\\timesGPT\-2 ladder whose ranges never overlap\.

##### The mechanism is an attracting fixed point of the argmax map\.

AtT=0\.02T=0\.02the update is essentially deterministic, so the dynamics are governed by the mapx↦arg⁡max⁡prx\\mapsto\\arg\\max p\_\{r\}\. Forpythia\-410mthis map sends 18 of 24 random starts to the newline token — a genuine fixed point\. Forgpt2\-mediumit has no such point and wanders to 11 distinct endpoints\. Prepending a single beginning\-of\-sequence token moves the frozen fraction from 74\.4% to 24\.1%, because it changes the map’s domain rather than its parameters\. This is not a data\-sparsity effect: rare contexts are no closer to the fallback token than common ones\.

##### The boundary is sharp and narrow\.

Family\-distinguishing degeneracy occupies radiusr∈\{1,2\}r\\in\\\{1,2\\\}only; moving fromr=2r=2tor=3r=3drops top\-1 agreement by 52 points\. A rebound at large radius appears in the control as well, so it is a generic long\-context effect and is excluded\.

##### The control behaves as the mechanism predicts\.

A masked\-LM construction, whose argmax map has no attracting fixed point, shows no transition: surviving damage never falls below 0\.547 down toT=0\.02T=0\.02across two models\. This was pre\-registered as a good null — no absorbing state, therefore no absorbing\-state transition — so there is no competing “but the clean construction has a real one” left to explain\.

Taken together these make the transition a*claim*rather than a curiosity: it has a mechanism, a boundary, and a control that behaves as the mechanism says it should\. It is also, we emphasise, a real and reproducible measurement — of the probe\.

## 5The discriminator: which readings are the model?

The manufactured transition of §[4](https://arxiv.org/html/2608.10986#S4)raises the obvious worry: if a quantity this sharp belongs to the probe, does the instrument read the model at all? It does, and the way to establish it is not argument but a second manipulation\. A reading that is construction\-determined moves when the construction changes and stays put when the model changes; a model\-determined reading does the reverse\.

Table 1:The discriminator\. A reading determined by the construction moves when the construction changes and not when the model changes; a model\-determined reading does the reverse\. Row 2 is what makes the manufactured transition attributable to the probe\. Rows 3 and 4 are what establish that the instrument reads the model at all\.Table[1](https://arxiv.org/html/2608.10986#S5.T1)sets out the four manipulations\. The pattern, not any single row, is the argument: an instrument that responded to everything would be measuring noise, and one that responded to nothing would be measuring the construction alone\.

### 5\.1Construction\-determined readings

Two readings that look like measurements are fixed by the geometry of the probe\.

The*damage light cone*is kinematic\. A flipped site can influence only therrsites whose window contains it, so the cone’s extent is set by the update window rather than by the model, and its slope is a geometric fact reported in the units of a dynamical quantity — the lattice analogue of a Lieb–Robinson bound\([Lieb and Robinson 1972](https://arxiv.org/html/2608.10986#bib.bib6)\), where the propagation limit is a property of the interaction structure and not of the state\.

We state the bound carefully, because the natural sharper version is false here\. Updating is*asynchronous in random order*, so within a single sweep a site damaged early can pass damage to its right neighbour, which is then itself visited: the reach inside one sweep is bounded by the visit order, not byrr\. Measured directly, the front reaches offset 24 by sweep 8 wherer⋅t=16r\\cdot t=16\. The cone is therefore kinematic in the sense that matters — it carries no model information — but “at mostrrsites per sweep” is a synchronous bound and does not hold for this construction\. The cone’s*shape*likewise adds no resolution: the width of its front has span exactly zero across every checkpoint and seed at two ring sizes — a null that survives a fourfold change in ring size, a tenfold change in the resolvable window and a thirtyfold change in how densely the cone is filled\.

The*radius scaling*λca​\(r\)\\lambda\_\{\\mathrm\{ca\}\}\(r\)is model\-invariant\. If it read the model it would differ between models; it does not\. This is the cleanest available demonstration that a quantity can be stable, reproducible, and precisely measurable while carrying no information about the system one believes oneself to be measuring\.

### 5\.2Model\-determined readings

Hold the construction fixed and walk the model through training\. AtN=48N=48on Pythia\-410m,λca\\lambda\_\{\\mathrm\{ca\}\}reads−0\.0185\-0\.0185at step 256,\+0\.0679\+0\.0679at step 512,\+0\.1923\+0\.1923at step 1000, and settles on a plateau of\+0\.1558\+0\.1558,\+0\.1699\+0\.1699,\+0\.1792\+0\.1792at steps 2000, 8000 and 143000\. Before the crossing, seeds disagree about the*sign*; after it, every one of 48 runs is positive, at two lattice sizes, with all four members of a pre\-registered family surviving Benjamini–Hochberg correction\. The automaton is byte\-identical at every checkpoint, so the movement is the model\.

![Refer to caption](https://arxiv.org/html/2608.10986v1/fig/developmental.png)Figure 4:A model\-determined reading\. With the automaton byte\-identical at every checkpoint,λca\\lambda\_\{\\mathrm\{ca\}\}crosses zero at a reproducible point in training: before it, seeds disagree about the sign; after it, all 48 runs are positive at two lattice sizes\. Contrast Table[1](https://arxiv.org/html/2608.10986#S5.T1)row 2, where varying the model across 19 architectures and a70×70\\timesscale range moves nothing\.##### The scope of this reading is within\-model, and we state it here rather than in the limits\.

Holding the construction fixed and walking one model through training is what the paragraph above does, and the movement is large\. Varying the*model*instead does not moveλca\\lambda\_\{\\mathrm\{ca\}\}usefully: across ten models spanning six families and four architecture classes, its cross\-model spread is0\.0510\.051, against a range of0\.1220\.122to0\.8040\.804produced by varying radius and temperature alone\. The ordering that spread implies is not reproducible — seed stability0\.0300\.030— and reshuffles between temperatures\. Most directly,λca\\lambda\_\{\\mathrm\{ca\}\}does not see the architectural contrast of §[5](https://arxiv.org/html/2608.10986#S5): RWKV, which has no attractor at all, sits mid\-pack\.λca\\lambda\_\{\\mathrm\{ca\}\}is a developmental quantity, not a model\-comparison one, and none of this touches the curve above, whose range is roughly seven times the cross\-model spread\.

##### The attractor share is the model\-determined reading that survives the construction\.

Whereλca\\lambda\_\{\\mathrm\{ca\}\}fails, the attractor share — the dominant token’s occupancy of the settled ring — passes every corresponding check\. Across the same ten models and six constructions \(two radii, three temperatures\) its across\-model spread exceeds its across\-seed spread on66of66constructions againstλca\\lambda\_\{\\mathrm\{ca\}\}’s22of44; its model ordering is seed\-stable at0\.8480\.848against0\.0300\.030; and that ordering agrees across constructions atρ=\+0\.752\\rho=\+0\.752, with two further readouts — distinct\-token count and adjacent\-pair repetition — clearing the same threshold independently at\+0\.737\+0\.737and\+0\.654\+0\.654\. Its cross\-model spread is0\.9230\.923\. Controlling for corpus, it recovers the architectural effectλca\\lambda\_\{\\mathrm\{ca\}\}misses: RWKV sits0\.7690\.769below the Pile\-trained attention models\. The instrument’s transferring results are built on this quantity, and it is the one that is model\-attributable\.

The obvious deflation — thatλca\\lambda\_\{\\mathrm\{ca\}\}is a repackaged loss — does not survive measurement\. Across the trained regimeλca\\lambda\_\{\\mathrm\{ca\}\}moves from0\.184330\.18433to0\.187380\.18738while bits\-per\-byte improves from2\.32292\.3229to0\.88950\.8895, a2\.6×2\.6\\timeschange in model quality against a change inλca\\lambda\_\{\\mathrm\{ca\}\}that sits inside the seed spread\. Whatever the exponent tracks, it is not simply how good the model is\.

### 5\.3Ablation response

Hold the construction fixed and remove part of the model\. Ablating the early attention block leaves the lattice nearly frozen — ignition falls from0\.9770\.977to0\.1810\.181at the final checkpoint — and adding one*further*attention ablation moves it again, by up to0\.330\.33\. That the instrument responds at all to an internal manipulation, with every construction parameter unchanged, is what row 4 of Table[1](https://arxiv.org/html/2608.10986#S5.T1)records\.

*How*it responds is worth stating carefully, because the obvious reading of a single checkpoint is wrong\. At the final checkpoint the further ablation*raises*ignition, and five separate layers do so at Bonferroni\-corrected significance, which invites the conclusion that removing more of a network makes its dynamics livelier\. Measured across five post\-crossing checkpoints, that conclusion does not survive\. Regressing compound ignition on reference ignition gives a slope of\+0\.568​\[\+0\.461,\+0\.674\]\+0\.568\\,\[\+0\.461,\+0\.674\]for one layer and\+0\.724​\[\+0\.618,\+0\.830\]\+0\.724\\,\[\+0\.618,\+0\.830\]for another: both intervals exclude00, so the compound arm is not sitting at a fixed level, and both exclude11, so it is not tracking its reference with a constant offset either\. The compound arm varies less than what it follows \(standard deviations0\.2290\.229and0\.2160\.216against0\.3040\.304\)\.

The behaviour ispartial regression toward an intermediate value: an added ablation moves ignition part of the way toward a middle, so the*sign*of the change depends on where the reference already sits\. At the final checkpoint the reference is frozen near the bottom of its range and everything rises; at an earlier checkpoint, where the reference sits at0\.5810\.581, the same two layers move in opposite directions — one falls to0\.3970\.397while the other rises to0\.7810\.781\. No property of those particular layers explains that, and no account in which the effect is anti\-monotone survives it\.

We report this as a description of the ablation response rather than as a mechanism\. It is what row 4 needs — the instrument reads the model — and it is deliberately less than the single\-checkpoint measurement appeared to offer\.

## 6Gating estimators at their own geometry

An exponent measured on black\-box language\-model dynamics will return a number whatever you do\. The number is not the finding; whether the estimator had room to produce a different one is\. Four verdicts in this project were retracted, and none was caught by review — each was caught by a system whose answer was already known\.

##### Gate the estimator at the measurement’s own geometry\.

A directed\-percolation calibration performed atN=512N=512over 200 sweeps licenses nothing atN=96N=96over 40\. The first retraction was a calibration run at a geometry the measurement never used\.

##### State what the independent unit is, and test it\.

Anything drawn once per batch makes replicas correlated\. One visit order, shared across a batch, decided the whole result and inverted the verdict; pooling correlated replicas shrank the error bars by roughly8×8\\timesfor a factor they had not earned\.

##### A cost function that can shrink its own comparison window is unbounded\.

Scan far wider than plausible, and*reject*a minimum that lands on the edge of the scan\.

##### Show the test can discriminate before quoting it\.

A transverse\-Lyapunov test was demonstrated, on a system with a known answer, to be unable to separate the hypotheses at all — so its reading on the model was uninterpretable in either direction rather than weak evidence\.

##### A mean is a claim about the axis it averages over\.

A scalar summary is quotable only if the axis it reduces varies less than the effect the summary is being used to describe; otherwise the number characterises the reduction rather than the quantity\. That is directly checkable — compare the spread*within*the reduced axis against the movement of the mean*across*conditions — and applied to every per\-component dataset in this project it flags the*ensemble*axis twice while clearing the window\-position axis, recovering by construction a distinction we had previously found by hand\. We report it here rather than as advice because it retracted the finding that motivated it\. A claim that one of our own mean\-field inputs had been computed on the wrong summary failed the regression test we built for it from that finding’s own data; the two summaries turned out to be algebraically identical, the claim was withdrawn the same day, and the measurement it had been attached to stood unchanged\.

##### Undefined is not zero\.

λca\\lambda\_\{\\mathrm\{ca\}\}is emitted for runs in which damage never ignited, where it is undefined; the same runs carry aDnormD\_\{\\mathrm\{norm\}\}of exactly zero, which is a true measurement\. The two quantities therefore need*different*filters —λca\\lambda\_\{\\mathrm\{ca\}\}over ignited runs only,DnormD\_\{\\mathrm\{norm\}\}over all of them — and collapsing that asymmetry biases the metric that was not broken\. The mechanism is prosaic: roughly one visit order in three heals a single\-site seed before it can propagate\.

DefectWhat it producedGuardCalibration run at a geometry the measurement never useda directed\-percolation verdict licensed atN=512/200N\{=\}512/200and read atN=96/40N\{=\}96/40gate the estimator at the measurement’s own geometryOne draw shared across a batchcorrelated replicas, error bars∼8×\\sim 8\\timestoo small, verdict invertedstate the independent unit and test itCost function able to shrink its own comparison windowan unbounded minimum, landing on the edge of the scanscan wider than plausible; reject edge minimaTest never shown able to discriminatea reading uninterpretable in either direction, quoted as weak evidencedemonstrate discrimination on a known answer firstUndefined treated as zeroλca\\lambda\_\{\\mathrm\{ca\}\}averaged over runs where damage never igniteddifferent filters forλca\\lambda\_\{\\mathrm\{ca\}\}andDnormD\_\{\\mathrm\{norm\}\}\(§[2](https://arxiv.org/html/2608.10986#S2)\)*After all five guards existed:*Wrong error bar for the statisticstandard error of a difference of four centres taken as their*mean*, understating it∼2×\\sim 2\\times; a positive recorded and withdrawn the same dayderive the error bar for the statistic at hand, not for the quantity it is built fromTable 2:Four retracted verdicts, one further defect of the same class, and one that arrived after all the guards were in place\. None was caught by review: each was caught by a system whose answer was already known, or by writing the follow\-up experiment\. Every row is the same underlying error — a statistically\-shaped criterion applied to a quantity with no room to vary\.
##### One defect class\.

All of these are the same error:*a statistically\-shaped criterion applied to a quantity with no room to vary*\. A correlation whose predictor is saturated, a ratio whose denominator is noise, a directional hypothesis tested with an absolute value — each returns a confident number from a comparison that could not have come out otherwise\. The class itself is old: psychometrics has known its data side for a century as restriction of range and ceiling effects\([Pearson 1903](https://arxiv.org/html/2608.10986#bib.bib9);[Sackett and Yang 2000](https://arxiv.org/html/2608.10986#bib.bib12)\), and its classical response is to*correct*the attenuated estimate\. The guards here take the other branch — refuse the verdict — and the same remedy was arrived at independently and concurrently from the survey\-methodology side: an audit of question\-order effects in an instruction\-tuned model found 17 of 18 item pairs saturated under a forced\-binary next\-token readout and recommends a pre\-specified saturation diagnostic as a standard health check for any study that reads next\-token probabilities as response distributions\([Kang 2026](https://arxiv.org/html/2608.10986#bib.bib5)\)\. We ship the guards as an MIT\-licensed package: a dynamic\-range check on the target, a noise gate before any ratio, a directional test where the hypothesis is directional, an explicitnot decidablebranch, the same range check applied to the*predictor*, and a distinct\-context floor on the estimator’s own input\.

##### The class survives its own countermeasures\.

The most instructive instance came after all six guards existed\. A single line — the standard error for a difference of four independently measured centres — was written three ways over one analysis\. Dividing the pooled spread by8\\sqrt\{8\}used a seed count that had gone stale after the design was extended, overstating the noise and returningnot decidable\. Replacing it with the*mean*per\-arm standard error fixed the stale count but used the wrong statistic for a difference of four quantities, understating the uncertainty by about a factor of two and producing a positive result\. Only the quadrature sum is correct, and it returnsnot decidableagain\. The middle version is the one that produced a finding; it was recorded and withdrawn the same day\. It was caught not by the guards but by writing the*confirmatory*experiment, whose floor was derived from first principles for the statistic at hand rather than inherited from the sweep\. A pre\-registration, a power calculation and a fixed stopping rule all passed it through\.

##### And one instance the guards were structurally unable to see\.

The guards above inspect the*data*: whether a target has range, whether a denominator is noise, whether a predictor is saturated\. The sharpest instance of the class was in none of those places\. Every correlation in the project ranked with`argsort\(argsort\(x\)\)`, which is correct only when all values are distinct —`argsort`breaks ties by input position, so a constant vector receives strictly increasing ranks\. It fired in production: a shape scalar whose twenty\-four measured values were all exactly0\.0000\.000was reported as correlating with the growth rate atρ=\+0\.829\\rho=\+0\.829,p=0\.058p=0\.058\. The reported number was the correlation between the growth rate and*the order the checkpoints happened to be listed in*\. The data was honest — the scalar was a correctly measured constant — so no data\-level gate could have flagged it; the defect was in the correlation function\. Fifteen scripts carried the idiom\. Re\-running all of them with tie\-aware ranking on identical stored inputs moved five results and changed no conclusion, and the externally predictive one was never exposed\. The guard that closes it is not another data check but a primitive returningnanon a zero\-variance input, plus a test that greps the repository so the idiom cannot return by copy\-paste\.

## 7Limits

##### The developmental transition is single\-family\.

It is measured on Pythia\. Endpoints replicate in two non\-Pythia families, but no public non\-Pythia family publishes a checkpoint inside the window where the crossing occurs, so the transition’s*shape*is unobservable outside Pythia by anyone, not merely by us\.

##### Cross\-family, loss does not organise it better than tokens\.

Matching families on bits\-per\-byte gives an across\-family spread of0\.05880\.0588against0\.03180\.0318when matching on token count — a difference of1\.37×1\.37\\timesthe seed floor, under our2×2\\timesgate\. That comparison isnot decidable: underpowered rather than null, and the fix is finer checkpoint spacing, which does not exist to be had\. A separate question on the same grid*is*decisive: the matched\-bpb spread alone stands at3×3\\timesthe floor, so the families do not collapse onto one curve, andλca\\lambda\_\{\\mathrm\{ca\}\}is not a function of model quality\.

##### The explanandum is not internal:λca\\lambda\_\{\\mathrm\{ca\}\}is largely fixed by the state the model drives the lattice into\.

Four routes failed to attachλca\\lambda\_\{\\mathrm\{ca\}\}to a named internal mechanism — co\-timing against context\-use onset, ablation of component groups, induction\-head formation \(excluded by arithmetic, since formation lands one to two orders of magnitude away from the window\), and a compensator\-identification test whose single positive was withdrawn when its standard error was corrected\. A fifth succeeded by changing level\. The number of distinct tokens in the settled ring rank\-correlates withλca\\lambda\_\{\\mathrm\{ca\}\}atρ=0\.771\\rho=0\.771\(bootstrap 95% CI\[0\.714,0\.829\]\[0\.714,0\.829\]over eight seeds per checkpoint\), and the relation is not a shared trend with training time: holding the weights fixed and varying temperature instead, cells three orders of magnitude apart in training land together when their diversity matches —T=0\.9T\{=\}0\.9at step 256 andT=0\.5T\{=\}0\.5at step 143000 give diversity21\.621\.6versus26\.826\.8andλca\\lambda\_\{\\mathrm\{ca\}\}\+0\.187\+0\.187versus\+0\.183\+0\.183\. Pooling both checkpoints onto one diversity–λca\\lambda\_\{\\mathrm\{ca\}\}curve costs0\.0090\.009in residual against a0\.0460\.046seed floor\.

##### This retrodicts the four failures\.

They searched for an internal cause of a quantity fixed by the state, and the sharpest of them reads differently in that light: no single attention layer movesλca\\lambda\_\{\\mathrm\{ca\}\}beyond seed scatter, eight together move it by\+0\.345\+0\.345, and the twenty\-four singles sum to−0\.224\-0\.224— the wrong sign\. That is not a mystery about localisation; it is what a collective property of the settled state looks like under ablation\. The reduction is statistical rather than an identity — roughly forty per cent ofλca\\lambda\_\{\\mathrm\{ca\}\}’s variance is not diversity — and it names no circuit and no training event\. What it removes is the expectation that one exists at the level the four routes searched\.

##### And the reduction does not extend to the predictive result\.

T∗T^\{\*\}is derived from the same settled ring, which raises the possibility that it is the reduction in different clothing\. It is not: diversity at a*fixed*temperature predicts greedy degeneration at\|ρ\|≤0\.11\|\\rho\|\\leq 0\.11across four temperatures on twenty\-six models, everyp\>0\.59p\>0\.59, whileT∗T^\{\*\}on the same target and the same models reachesρ=0\.547\\rho=0\.547\. The predictive content lies in where the diversity curve crosses a threshold as temperature varies, not in diversity at any point on it — soλca\\lambda\_\{\\mathrm\{ca\}\}inherits the state’s lack of external predictive power, andT∗T^\{\*\}does not\.

##### That asymmetry is target\-specific, and reverses on the one other target we tested\.

The reading above — that what transfers is a*response*\(how the settled state dissolves under temperature\) rather than a*level*\(the state itself\) — holds for greedy degeneration, where it was derived\. Asked instead which readout predicts*instruction\-following*failures, the ordering flips: the attractor share, a level, is selective for compliance at\+0\.53\+0\.53\(p=0\.004p=0\.004,n=10n=10\), surviving controls for both model size and general capability, whileT∗T^\{\*\}is not \(\+0\.17\+0\.17against a verified\+0\.34\+0\.34detection floor atn=6n=6, so an effect of the share’s size would have been found\)\. Repetition rate is not selective either, so the share’s result is not mediated by degeneration\. We therefore do not claim a general recipe\. Which of the two transfers depends on what is being predicted, and one confirmed instance in each direction does not establish why\.

##### The dynamics are not reducible to the obvious theory of them\.

Given the model’s own exactly measured single\-token sensitivity, annealed mean field does not predict the exponent across 33 ablation arms — a null with adequate power, where the predictor spans nearly twice the target’s range\. Whatever setsλca\\lambda\_\{\\mathrm\{ca\}\}, it is not captured by the mean\-field ledger\.

##### Scope\.

Greedy decoding where decoding matters; one radius for the ablation work; one architecture family for the component manipulations\. These bound the claims rather than qualify them: the discriminator of §[5](https://arxiv.org/html/2608.10986#S5)is a method, and the specific readings it sorts are the ones we measured\.

## 8What this opens

Three things follow directly, and the first is the one we would do next\.

##### The coupling is a common mode, and that is now measured rather than assumed\.

Every relative reading in this paper is taken under one coupling, so it is fair to ask whether the choice is doing the work\. Running the developmental checkpoints under*both*the monotone coupling used throughout and a maximal coupling, on the same rings and the same models, the ordering of the checkpoints is identical and the offset between the two is uniform within the seed floor \(offsets of−0\.039\-0\.039,−0\.087\-0\.087,−0\.036\-0\.036against a floor of0\.0360\.036\)\. Maximal reads lower everywhere, which is the expected direction: it maximises agreement between the twins and therefore minimises damage\. So the readings in §[5](https://arxiv.org/html/2608.10986#S5)are properties of the model rather than of the coupling, on this geometry\.

Two things this does*not*settle, and they are the natural next measurements\. The result covers one radius, one temperature and one family, so coupling\-invariance in general is untested\. And it is a statement about*relative*readings only: absolute damage does differ between couplings, so any absolute figure must name the coupling it was taken under\. What remains genuinely open is the comparison in the other direction — mixing time is a functional of the marginal chain and is therefore coupling\-invariant by construction, while damage velocity is a functional of the coupled chain, so measuring both on one substrate would say how much of the dynamics a coupling choice can reach at all\.

##### Apply the discriminator to the practices that motivated it\.

Self\-consistency, iterated refinement and agentic loops are all self\-feeding systems whose readings nobody separates into construction and model\. The test of §[5](https://arxiv.org/html/2608.10986#S5)does not depend on our construction: it needs only two manipulations, one that varies the loop with the model fixed and one that varies the model with the loop fixed\. Whether the quantities practitioners already read off those systems — agreement rates, convergence speed, self\-correction success — survive that test is an open and answerable question, and the manufactured transition of §[4](https://arxiv.org/html/2608.10986#S4)is the reason to ask it before building on them\.

##### A construction axis rather than a construction\.

Radius, temperature, visit scheme and masking are a parameter family, not a fixed choice, and they dial how much of the system is loop\. Sweeping them turns the discriminator from a two\-point test into a gradient: readings can be sorted by*how fast*they decay as the construction is loosened, which would separate the sharply kinematic from the merely construction\-sensitive rather than treating both as one category\.

## 9Related work

We ran an explicit prior\-art check and report both what it found taken and what it found open, because claiming novelty we do not have is the fastest way to lose a reader who knows this literature\.

##### Taken\.

Detecting that an API is serving a distorted model is established: framed as a two\-sample problem, a test on the maximum mean discrepancy between an API’s outputs and a reference distribution reaches a median 77\.4% power against a range of distortions from roughly ten samples per prompt, and finds 11 of 31 surveyed Llama endpoints deviating from the released reference weights\([Gao et al\. 2025](https://arxiv.org/html/2608.10986#bib.bib4)\)\. Text\-only identification is stronger still: visible\-string features over random\-string probes reach a verification AUROC of0\.990\.99on a same\-family ladder and separate every endpoint of a commercial gateway within a handful of calls\([Zhang et al\. 2026](https://arxiv.org/html/2608.10986#bib.bib17)\)\. Quantization detection is likewise established, and the tokenizer\-merge mechanism we observed in API\-mediated probing is substantially anticipated\. We claim none of these\.

##### Iterated generation is not new; this measurement of it is\.

Feeding a model its own output has been studied as a dynamical system before\. Multi\-turn transmission chains exhibit cultural attractors\([Perez et al\. 2024](https://arxiv.org/html/2608.10986#bib.bib10)\), successive paraphrasing settles into attractor cycles\([Wang et al\. 2025](https://arxiv.org/html/2608.10986#bib.bib15)\), and the output distribution of a language model shows phase transitions under temperature\([Arnold et al\. 2024](https://arxiv.org/html/2608.10986#bib.bib1)\)\. We do not claim the observation that iteration has attractors\.

What we add is a*measurement*of the iterated system rather than a description of where it settles: damage spreading under common random numbers, with an exact\-zero null, giving a Lyapunov exponent and a damping length — and, in the model\-identification literature specifically, every published feature set performs single\-shot scoring of supplied text rather than measuring dynamics at all\. The contribution that does not follow from prior work is the discriminator of §[5](https://arxiv.org/html/2608.10986#S5): the attractor literature reports what the iterated system does, and does not separate which of those readings is a property of the iteration and which is a property of the model\. That separation is what this paper supplies, and §[4](https://arxiv.org/html/2608.10986#S4)is what happens without it\.

##### Inherited machinery\.

Damage spreading and the Domany–Kinzel automaton come from the statistical\-physics literature on probabilistic cellular automata\([Domany and Kinzel 1984](https://arxiv.org/html/2608.10986#bib.bib3);[Bagnoli et al\. 1992](https://arxiv.org/html/2608.10986#bib.bib2)\), and we use them as calibration targets rather than as objects of study\. We cite the self\-repair literature\([McGrath et al\. 2023](https://arxiv.org/html/2608.10986#bib.bib8);[Rushing and Nanda 2024](https://arxiv.org/html/2608.10986#bib.bib11)\)for terminology only: we avoid the word “repair” for our own repair\-length quantity because of that collision, and we do not claim to have measured self\-repair\.

## 10Conclusion

Iterated self\-feeding probes mix construction\-determined and model\-determined quantities in readings that look alike\. That is the finding, and the test in §[5](https://arxiv.org/html/2608.10986#S5)is what separates them: vary one factor with the other held fixed, and see which readings move\.

The worked example is a phase transition we measured to three decimal places, with directed percolation exponents reached at a common critical temperature, that belongs to the probe\. It has a mechanism, a boundary and a control; it is entirely reproducible; and it says nothing about any language model\. The same instrument, on the same construction, also detects a reproducible developmental transition that*is*the model\. Nothing distinguishes the two by inspection\.

We resist the neat summary — that the instrument measures itself — because it is false and would license the wrong conclusion\. The instrument reads the model\. It also reads the probe, in quantities that carry the same units and the same apparent precision, and the cost of not checking which is which is four months and a retracted phase transition\.

The sharper statement is that*which*of its quantities reads the model is itself something to be measured rather than assumed, and the answer is not uniform across them\. Under construction variation the attractor share ranks models consistently andλca\\lambda\_\{\\mathrm\{ca\}\}does not;λca\\lambda\_\{\\mathrm\{ca\}\}’s domain is one model’s trajectory through training, where its range is an order of magnitude larger than anything model identity produces\. Both are quantities of the same instrument, read off the same rings, in the same units\. An instrument can be valid for one comparison and empty for another, and no amount of care in the measurement reveals which without varying the apparatus\.

#### Reproducibility

All code, per\-run result files and figure scripts are released\. Every number in this paper is traceable to a results file, and each analysis stamps the SHA\-256 of its own source together with the hashes of every module it imports, so a figure cannot silently outlive the code that produced it\. The estimator guards are packaged separately under an MIT licence\. The repository is[https://github\.com/nicoveraz/token\-lattice\-ca](https://github.com/nicoveraz/token-lattice-ca)and is archived at[https://doi\.org/10\.5281/zenodo\.21880472](https://doi.org/10.5281/zenodo.21880472)\(all versions\): code under MIT, the prose and the findings ledger under CC BY 4\.0\. The ledger retains retracted and amended findings in place rather than deleting them, so a citation should carry the amendment with the finding\.

## References

- Arnold et al\. \[2024\]Julian Arnold, Flemming Holtorf, Frank Schäfer, and Niels Lörch\.Phase transitions in the output distribution of large language models, 2024\.
- Bagnoli et al\. \[1992\]Franco Bagnoli, Raúl Rechtman, and Stefano Ruffo\.Damage spreading and lyapunov exponents in cellular automata\.*Physics Letters A*, 172\(1–2\):34–38, 1992\.
- Domany and Kinzel \[1984\]Eytan Domany and Wolfgang Kinzel\.Equivalence of cellular automata to Ising models and directed percolation\.*Physical Review Letters*, 53\(4\):311–314, 1984\.
- Gao et al\. \[2025\]Irena Gao, Percy Liang, and Carlos Guestrin\.Model equality testing: Which model is this API serving?In*International Conference on Learning Representations \(ICLR\)*, 2025\.
- Kang \[2026\]Pilsung Kang\.Auditing question\-order effects in large language models with the QQ equality: Mechanism characterization and a saturation caveat, 2026\.
- Lieb and Robinson \[1972\]Elliott H\. Lieb and Derek W\. Robinson\.The finite group velocity of quantum spin systems\.*Communications in Mathematical Physics*, 28\(3\):251–257, 1972\.
- Madaan et al\. \[2023\]Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, Shashank Gupta, Bodhisattwa Prasad Majumder, Katherine Hermann, Sean Welleck, Amir Yazdanbakhsh, and Peter Clark\.Self\-refine: Iterative refinement with self\-feedback, 2023\.
- McGrath et al\. \[2023\]Thomas McGrath, Matthew Rahtz, Janos Kramar, Vladimir Mikulik, and Shane Legg\.The hydra effect: Emergent self\-repair in language model computations, 2023\.
- Pearson \[1903\]Karl Pearson\.Mathematical contributions to the theory of evolution\.—XI\. on the influence of natural selection on the variability and correlation of organs\.*Philosophical Transactions of the Royal Society of London\. Series A*, 200:1–66, 1903\.doi:10\.1098/rsta\.1903\.0001\.
- Perez et al\. \[2024\]Jérémy Perez, Grgur Kovač, Corentin Léger, Cédric Colas, Gaia Molinaro, Maxime Derex, Pierre\-Yves Oudeyer, and Clément Moulin\-Frier\.When LLMs play the telephone game: Cultural attractors as conceptual tools to evaluate LLMs in multi\-turn settings, 2024\.
- Rushing and Nanda \[2024\]Cody Rushing and Neel Nanda\.Explorations of self\-repair in language models\.In*International Conference on Machine Learning \(ICML\)*, 2024\.
- Sackett and Yang \[2000\]Paul R\. Sackett and Hyuckseung Yang\.Correction for range restriction: An expanded typology\.*Journal of Applied Psychology*, 85\(1\):112–118, 2000\.doi:10\.1037/0021\-9010\.85\.1\.112\.
- Sana et al\. \[2026\]Suvadip Sana, Sami Wolf, Neer Mehta, Alina Shah, Aitzaz Shaikh, Janna Goodman, and Lionel Levine\.Mixing times of glauber dynamics on masked language models, 2026\.
- Wang et al\. \[2022\]Xuezhi Wang, Jason Wei, Dale Schuurmans, Quoc Le, Ed Chi, Sharan Narang, Aakanksha Chowdhery, and Denny Zhou\.Self\-consistency improves chain of thought reasoning in language models, 2022\.
- Wang et al\. \[2025\]Zhilin Wang, Yafu Li, Jianhao Yan, Yu Cheng, and Yue Zhang\.Unveiling attractor cycles in large language models: A dynamical systems view of successive paraphrasing, 2025\.
- Wei et al\. \[2022\]Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed Chi, Quoc Le, and Denny Zhou\.Chain\-of\-thought prompting elicits reasoning in large language models, 2022\.
- Zhang et al\. \[2026\]Yuewei Zhang, Zhi\-Hai Zhang, and Hanzhang Qin\.Which model is actually serving you? IRIS: Budgeted black\-box auditing of model substitution and routing dilution in LLM gateways, 2026\.