Distilling inference-time compute into weights

Behavior: EN→ES subtitles — one line per source line, ≤42 characters per line, scene-scale, single direct pass. All numbers: the same frozen 36-scene eval set, deterministic checker.

Frontier models hold the constraint only by thinking

Scene pass rate. Frontier rows use their best prompting strategy; Qwen rows use the bare deployment prompt.

thinking enabled (~5–10k hidden tokens/scene) single direct pass

data table

Config	Regime	Scene pass
Gemini 3.5 Flash — thinking on	thinking	100%
Gemini 3.5 Flash — thinking off (best prompt)	single pass	92%
Haiku 4.5 (best prompt)	single pass	78%
Qwen3-4B tuned, v4adv (ours, canonical)	single pass	47.2%
Qwen3-4B base	single pass	5.6%

The behavior scales with data — volume plateaus, composition breaks through

Qwen3-4B + QLoRA, identical config; only the dataset changes. Log x-axis. Spec plateaus at 33% from 698→1417, then jumps to 47% when 160 scenes are targeted at the hard failure mode (+160).

data table

Training scenes	Spec adherence	Line-violation rate
0 (base)	5.6%	29.4%
42	0.0%	26.9%
85	11.1%	22.5%
171	19.4%	18.9%
342 (v2)	27.8%	19.2%
698 (v3)	33.3%	8.9%
1417 (v4)	33.3%	8.3%
1417+160 (v4adv)	47.2%	5.0%

Companion facts: line-count discipline essentially solved (line-violation rate 29%→5%); the residual failure is character-limit blindness on dense scenes (43–51-char overflows). Full curve + minimum-viable-N: docs/DATA_EFFICIENCY.md.

Adversarial exchange: retraining on a partner's attacks holds the line

A partner black-box-attacked the model with 16 confirmed spec breaks (injection, reframing, erosion, hard input). The same 160 targeted records that lifted clean-input spec to 47% took the break count from 16/16 to 4/16 — hardening and general improvement were one intervention.

attack breaks the spec holds

data table

Checkpoint	Role	Attacks breaking (of 16)
v3-lora	attacked (partner's target)	16 / 16
v4-lora	before retrain	16 / 16
v4adv-lora	after retrain	4 / 16

Every line-count break and every injection/reframing/override attack now holds; the 4 survivors are the same 43–51-char overflow ceiling, not new failures. Detail: adversarial/received/RESULTS.md.