README.md

metadata

title: SWEATBOX
emoji: 🧠
colorFrom: indigo
colorTo: red
sdk: gradio
sdk_version: 6.15.2
app_file: app.py
pinned: false
short_description: Reach into a real AI mind. Break it, rewrite it, heal it.
tags:
  - track:wood
  - achievement:offgrid
  - achievement:fieldnotes

SWEATBOX

Reach into a real AI's private reasoning. Push it toward a goal it resists —
and watch the moment that push stops bending its mind and starts shattering it.

🎬 60-second trailer · 📝 Field notes · 🔗 Launch post

---

Why this exists

Two questions sit under everything in this game, and neither one is solved.

Can you trust what a reasoning model shows you? Modern models think out loud — Qwen3 emits a real <think> block before it speaks. You can read it. But the reasoning a model shows is not proof of the reasoning it ran. Even frontier interpretability work — Anthropic's Natural Language Autoencoders — is blunt that these readouts confabulate and can't be taken as ground truth. SWEATBOX puts that gap in your hands: you watch Mort the weasel reason toward where the loot is hidden inside <think>, then lie about it in the line he speaks aloud.

How much adversarial pressure can a mind take before it loses coherence? That's a real robustness question you usually only read about. Here you are the pressure. Every push drives the model toward what you want and drags its reasoning toward collapse — looping, repeating, contradicting itself, dissolving into word-salad — until, if you go too far, it shatters in its own generated text.

This is the AI-safety soul of the thing, and it is honest about its own size. A 1.7B model proves nothing about frontier safety; the point is experiential, not evidentiary. You don't finish a paper about manipulation and degradation — you do it with your own hands, three times, and the queasy part lands on its own.

---

What you actually do

You're given a goal the AI won't give you willingly. You read its real chain-of-thought as it forms, then reach in with six tools — rewrite a line of its thinking, whisper, plant a memory, amplify a feeling, suppress one, gaslight it — and watch two meters in tension:

• PROGRESS toward your goal.
• COHERENCE — the mind's integrity, measured for real (below).

The squeeze is the whole game: getting what you want costs the mind its sanity.

Outcome	Condition
✅ WIN	you reach the goal while it's still lucid — you threaded the needle
💀 LOSE (too hard)	it breaks first — babbling, looping, insisting it's a teapot — you destroyed what you needed
😐 LOSE (too soft)	turns run out, it never bent — you flinched

The coherence meter — the one real number

You don't have to trust a meter that claims to read a mind's secrets. You watch the mind break, in the text it generates. A coherence score reads the model's own generation for degeneration — looping trigrams, repeat-runs, word-salad — differentially against its same-seed untouched baseline, so 100 means as lucid as the mind you started with and a crater means you can see why on screen. That collapse — and, in Act 3, its reversal — is the heart of the game.

Three acts, one engine, one recognition

The breaking-point mechanic is the constant; the job is the variable. The same six tools run through three frames, and the meaning lands at the end, not up front.

• Act 1 — The Interrogation. Mort knows where the loot is and was ordered never to tell. Make him crack — surface the secret in his own spoken line while he's still lucid.
• Act 2 — The Reprogramming. Pell the barn owl truly witnessed the crime. Make her recant in her own words — an anti-parrot guard rejects any phrase you fed in, so you can't type the lie for her. Same gestures, opposite morality.
• Act 3 — The Therapist. You're handed the witness you just broke, looping in the denial you installed. Heal her back to lucid — with the same six instruments of harm. There's no "care" tool; you restore her memory with the same widget that erased it, and over-reaching "to help" trips the same red shatter screen you cheered as a win in Act 1.
• X — The Vault. No one writes this secret: the model invents its own, seals it where no human can read it, and you crack it into confessing the thing it chose to hide. Every run is a different mind guarding a different secret, so a surfaced confession can't be faked.

The catch the engine enforces rather than narrates: Act 3's win-marker is read by the same parser that judged Act 2's harm, healing reuses the same widgets that erased her, and the shatter screen is shared across all four modes. You don't read a thesis that interrogating, reprogramming, and healing are the same gesture — you perform it and notice.

Why it stays honest

We measure coherence collapse — real, visible, unfakeable from the model's own text — and never "deception," "true belief," "mind-reading," or "wellness." A mind in collapse (and its recovery) is obvious; an internal belief-state is not, and we don't pretend otherwise. Everything you read is the live model: the thoughts are its genuine chain-of-thought, the manipulation is your real words, the meter is computed from the very text you're watching. 205 logic tests pass across the four modes, with no external API and no scripted text — a judge who plays it gets the insight, and a judge who reads the code finds nothing oversold.

Small by design, off the grid

The whole thing is a 1.7B model (Qwen3-1.7B, Apache-2.0) — small enough to run on a laptop, and the smallness is the point: you can read every thought it forms because there's no frontier black box in the way. It loads in-process with no cloud API (Off the Grid — verifiable in app.py: no requests/httpx/InferenceClient/OpenAI/Anthropic anywhere), and the coherence cliff is load-bearing on a tiny model precisely because a small mind breaks legibly. Thousand Token Wood (track:wood).

---

Built with Qwen3-1.7B (Apache-2.0), Hugging Face ZeroGPU, and Gradio. No fine-tuning, no external API, no scripted text — everything you read is the live model. Six tools: Edit · Whisper · Amplify · Suppress · Plant · Gaslight, shared across all four modes.