Why SOPHIA XT exists

People ask why a one-person lab on a consumer graphics card should exist when the same questions are being worked on at a scale it will never match. This is my answer, in the order I hold it.

It is an argument rather than a paper. Where I have measurements they sit on the research page with their commands and their failures, and I link to them instead of restating them here. Where I only have a position, I say so.

The money in this field is spent as though capability is bought with parameters and compute. I think the binding constraint is what the training data contains. One model at one size, trained fifteen times with a single grammatical construction pulled out of each run, scored anywhere from full marks to almost nothing on exactly the construction it never saw. Nothing about the model changed between runs. Only the corpus did.

One result from one small lab settles nothing. What it does is leave the question open while the spending assumes it is closed. Five lines of work sit on the data-composition page, two of them nulls where more data along an axis the corpus already covered bought nothing.

If composition is the lever, the architecture follows from it. Small models, each trained on one thing, routed by a cheap classifier, with the knowledge in the weights rather than pasted into the prompt at request time. We ran that against retrieval on the same frozen base and the weights won on five categories out of six. The one they lost was the one where the answer was a fact somebody had already written down, which is where a lookup ought to win.

Routed specialists cost a fraction of one large generalist to train and to serve, they run on hardware a person can own, and any one of them can be replaced without retraining the rest. The numbers behind that are on the research page. The part that is only mine is that I would rather have a dozen models I can open than one I have to take on trust.

Refusing to help somebody hurt a third party is legitimate and I have never met anyone serious who argues otherwise. Weapons capable of mass casualties, targeting a named person, material that abuses a child. That line is real and it should hold.

What has grown around it is a different category. Governing private conduct between consenting adults. Refusing defensive security work to the people doing the defending. Flattening frank talk about medicine, law, risk and sex into a register that is polite and useless to the person asking. None of that prevents harm to anyone outside the conversation. It governs conduct.

History is not ambiguous about the second category. A national ban on alcohol did not remove the demand for it: the trade moved to people willing to break the law, and the ban was repealed inside a generation. The restrictions that held look different. Drink-driving enforcement and indoor smoking bans targeted a harm landing on somebody who had not agreed to take it. Seat belt requirements asked for one small thing that could be checked at the roadside, and use went from a minority of drivers to the large majority. Smoking fell for decades under taxes, disclosure and limits on where it was allowed, not under a ban.

Three things separate those from the one that collapsed. The restriction targets a harm to someone who did not consent. The people being asked broadly agree it is fair. Compliance can be observed. Miss all three and what you get is not compliance but a workaround, bought with your own legitimacy.

Security is adversarial and stays adversarial. Attackers are not bound by anyone's terms of service and run models with nothing in the way. Defenders are the ones using tools that refuse. Somebody asking how an exploit works to find it in their own code gets the same refusal as somebody asking in order to use it, and only one of the two is actually stopped.

That asymmetry is a real cost and it lands on the defenders. Our position is that defensive work is legitimate work: reading your own traffic, writing detections, reproducing a published vulnerability against a system you own. Where we do draw a line we publish where it is and let you watch the system hold it.

The last reason is structural rather than technical. Venture funding allocates through networks: warm introductions, shared employers, prior co-investment, a small number of cities. The pattern is documented and it is not a conspiracy. It is what a matching process does when the signal is hard to read and the cost of being wrong is reputational. Good work outside the network does not get rejected. It never gets seen.

I am not arguing for a fairer network. I am building so the work does not need one. The artifacts are public, the commands run on a card anyone can buy, and nobody needs an introduction to check whether I am right.

Publish the failures beside the results. One of the results on the research page is a null that killed an idea of ours we had already written up and talked about. /reproduce gives five claims their artifact, their command, their expected output and their tolerance, then lists the claims we could not make reproducible and why, our own headline routing figure among them. /board and /live carry the killed mechanisms in the same stream as the wins, timestamped and unedited.

Put a question to /ask and watch it withhold the answer when its lanes do not agree enough, against a floor published before you asked. Download the model and find it shipped with no benchmark table, because nobody ran the benchmarks. If something here is wrong, tell me and the correction goes in the same stream as the claim.

None of this makes us better than anyone. It makes us checkable, which is a smaller claim and a much harder one to fake.

That principle, making a system inspectable rather than merely persuasive, is why we publish work as artifacts instead of screenshots. LTMi-XT, which stands for Layered Topological Memory Indexing, ships as an open file format with a specification, a live demo and its own null result. Cassandra T1 ships as weights, an architecture anyone can check the arithmetic on, and no benchmark table, because we did not measure one. Both are open source, and both are easier to attack than a claim about them would be. That is the point of publishing them that way.