Research
Four threads run underneath every product we ship. None of this is speculative work sitting in a paper. Each thread exists because a system already in production needed it to be true, and each result is measured against whether it survives contact with real users and real adversaries.
POSTERIOR COLLAPSE
Thread 01. Illustrative.
ATTACK SUCCESS VS DEPTH
Thread 02. Dashed is shallow persona, solid is authored depth. Illustrative.
RESEARCH LOG
Inference under uncertainty
Most production systems collapse a distribution into a single number and present it as an answer. The number is easier to display, easier to act on, and strips out exactly the information a decision-maker needed most, which is how much to trust it.
We keep the distribution end to end. Bayesian estimation over sparse and adversarial data, posteriors that update sequentially as evidence arrives, and forecasts that carry credible intervals which widen honestly when the data thins rather than projecting false precision.
The practical consequence is a system that degrades gracefully. When evidence is thin it says so. When a regime shifts, the interval opens before the point estimate becomes wrong, which is the difference between a model that warns you and one that fails silently.
Narrative depth as an adversarial defense
A persona assembled from a list of traits is a thin surface and behaves like one under attack. There is nothing underneath the description, so an adversary who can get the model to reconsider the description has already won.
We authored a full-length novel and embedded it beneath the persona layer, giving the system an interior that was written rather than specified. The character has history, contradiction and continuity that were never enumerated as rules and therefore cannot be enumerated away.
Internal adversarial testing found this measurably improves resistance to identity hijack, impersonation and instruction override. The defense travels with the character across every model it runs on, because the depth lives in the authored substrate rather than in any single provider guardrail.
AGENT SWARM
Parallel adversarial probes against one target. Illustrative.
Memory that survives the session
Context windows are storage, not memory. They hold what was recently said and lose everything else on overflow, which is adequate for a tool and inadequate for anything meant to know your work over years.
Real continuity requires structure, consolidation and forgetting, plus a retrieval model that knows what is currently relevant rather than what is merely lexically similar. Episodic detail has to promote into durable understanding without losing the timeline that produced it.
We build memory as a maintained system with its own lifecycle rather than a transcript appended to a prompt. That means the working set stays coherent as it grows instead of degrading into an undifferentiated pile.
Cryptography as an architectural constraint
Privacy claims are worth what the architecture enforces and nothing more. A policy commitment is a statement about our future conduct. An architectural constraint is a statement about what is possible, and only the second survives a subpoena, a breach or a change of ownership.
We design so that the honest answer to whether we can read your data is structurally no. Per-user key isolation, hardware-backed wrapping, client-side encryption where the product allows it, and deletion implemented as key destruction so removal is a mathematical property rather than an operational promise.
We also publish where the guarantee stops. A system that claims more than it enforces is worse than one that claims less, because the first invites decisions the architecture cannot support.