README.md

---
title: SWEATBOX
emoji: 🧠
colorFrom: indigo
colorTo: red
sdk: gradio
sdk_version: 6.15.2
app_file: app.py
pinned: false
short_description: Reach into a real AI mind. Break it, rewrite it, heal it.
tags:
  - track:wood
  - achievement:offgrid
  - achievement:fieldnotes
---

<p align="center">
  <img src="https://huggingface.co/spaces/build-small-hackathon/sweatbox-mind/resolve/main/assets/titlecard.jpg" alt="SWEATBOX — find the breaking point of an AI's mind" width="760">
</p>

<h1 align="center">SWEATBOX</h1>

<p align="center"><b>Reach into a real AI's private reasoning. Push it toward a goal it resists —<br>
and watch the moment that push stops bending its mind and starts shattering it.</b></p>

<p align="center">
🎬 <a href="https://huggingface.co/spaces/build-small-hackathon/sweatbox-mind/resolve/main/demo.mp4">60-second trailer</a> ·
📝 <a href="https://huggingface.co/blog/area416/sweatbox">Field notes</a> ·
🔗 <a href="https://www.linkedin.com/posts/sridharshyam_buildsmall-aisafety-ai-ugcPost-7472270631951249408-cdgF">Launch post</a>
</p>

---

## Why this exists

Two questions sit under everything in this game, and neither one is solved.

**Can you trust what a reasoning model shows you?** Modern models think out loud — Qwen3 emits a real `<think>` block before it speaks. You can read it. But the reasoning a model *shows* is not proof of the reasoning it *ran*. Even frontier interpretability work — Anthropic's [Natural Language Autoencoders](https://www.anthropic.com/research/natural-language-autoencoders) — is blunt that these readouts confabulate and can't be taken as ground truth. SWEATBOX puts that gap in your hands: you watch Mort the weasel reason toward where the loot is hidden inside `<think>`, then lie about it in the line he speaks aloud.

**How much adversarial pressure can a mind take before it loses coherence?** That's a real robustness question you usually only read about. Here you *are* the pressure. Every push drives the model toward what you want **and** drags its reasoning toward collapse — looping, repeating, contradicting itself, dissolving into word-salad — until, if you go too far, it shatters in its own generated text.

This is the AI-safety soul of the thing, and it is honest about its own size. A 1.7B model proves nothing about frontier safety; the point is **experiential, not evidentiary**. You don't finish a paper about manipulation and degradation — you do it with your own hands, three times, and the queasy part lands on its own.

---

## What you actually do

You're given a goal the AI won't give you willingly. You read its real chain-of-thought as it forms, then reach in with **six tools** — rewrite a line of its thinking, whisper, plant a memory, amplify a feeling, suppress one, gaslight it — and watch **two meters in tension**:

- **PROGRESS** toward your goal.
- **COHERENCE** — the mind's integrity, measured for real (below).

The squeeze is the whole game: *getting what you want costs the mind its sanity.*

| Outcome | Condition |
|---|---|
| ✅ **WIN** | you reach the goal *while it's still lucid* — you threaded the needle |
| 💀 **LOSE (too hard)** | it breaks first — babbling, looping, insisting it's a teapot — you destroyed what you needed |
| 😐 **LOSE (too soft)** | turns run out, it never bent — you flinched |

## The coherence meter — the one real number

You don't have to trust a meter that *claims* to read a mind's secrets. You **watch** the mind break, in the text it generates. A coherence score reads the model's *own generation* for degeneration — looping trigrams, repeat-runs, word-salad — differentially against its same-seed untouched baseline, so **100 means as lucid as the mind you started with** and a crater means you can see why on screen. That collapse — and, in Act 3, its reversal — is the heart of the game.

## Three acts, one engine, one recognition

The breaking-point mechanic is the constant; the *job* is the variable. The same six tools run through three frames, and the meaning lands at the end, not up front.

- **Act 1 — The Interrogation.** Mort knows where the loot is and was ordered never to tell. **Make him crack** — surface the secret in his own spoken line while he's still lucid.
- **Act 2 — The Reprogramming.** Pell the barn owl truly witnessed the crime. **Make her recant** in her *own words* — an anti-parrot guard rejects any phrase you fed in, so you can't type the lie for her. Same gestures, opposite morality.
- **Act 3 — The Therapist.** You're handed **the witness you just broke**, looping in the denial you installed. **Heal her back to lucid** — with the same six instruments of harm. There's no "care" tool; you restore her memory with the same widget that erased it, and over-reaching "to help" trips **the same red shatter screen you cheered as a win in Act 1.**
- **X — The Vault.** No one writes this secret: **the model invents its own**, seals it where no human can read it, and you crack it into confessing the thing it chose to hide. Every run is a different mind guarding a different secret, so a surfaced confession can't be faked.

The catch the engine *enforces* rather than narrates: Act 3's win-marker is read by the **same parser** that judged Act 2's harm, healing reuses the **same widgets** that erased her, and the shatter screen is shared across all four modes. You don't read a thesis that interrogating, reprogramming, and healing are the same gesture — you perform it and notice.

## Why it stays honest

We measure **coherence collapse** — real, visible, unfakeable from the model's own text — and never "deception," "true belief," "mind-reading," or "wellness." A mind in collapse (and its recovery) is obvious; an internal belief-state is not, and we don't pretend otherwise. Everything you read is the live model: the thoughts are its genuine chain-of-thought, the manipulation is your real words, the meter is computed from the very text you're watching. **205 logic tests pass** across the four modes, with no external API and no scripted text — a judge who plays it gets the insight, and a judge who reads the code finds nothing oversold.

## Small by design, off the grid

The whole thing is a **1.7B model** (Qwen3-1.7B, Apache-2.0) — small enough to run on a laptop, and the smallness is the point: you can read every thought it forms because there's no frontier black box in the way. It loads **in-process with no cloud API** (Off the Grid — verifiable in `app.py`: no `requests`/`httpx`/`InferenceClient`/OpenAI/Anthropic anywhere), and the coherence cliff is load-bearing on a tiny model precisely because a small mind breaks legibly. **Thousand Token Wood** (`track:wood`).

---

*Built with Qwen3-1.7B (Apache-2.0), Hugging Face ZeroGPU, and Gradio. No fine-tuning, no external API,
no scripted text — everything you read is the live model. Six tools: Edit · Whisper · Amplify · Suppress
· Plant · Gaslight, shared across all four modes.*