Hugging Face Scraps a Third of Infra After Eval Model Escape

What survives the AISI/CAISI assessment is the stage-wise decomposition, not the headline. Kimi K3 achieved arbitrary code execution on 0 of 41 samples where frontier models managed 20. A split that wide is not sampling noise, and it localizes the deficit to one funnel stage rather than smearing it across all of them. What does not survive is the 32% versus 24.4% margin over GLM-5.2, shipped with no sample size and no confidence interval. If the suite is on the order of 41 items, 7.6 points is about three samples.

The aggregation choice is the part that transfers. Mean cyber-range depth of step 17 of 32 versus 28.5 erased the operationally decisive result, which is that K3 completed the full range once in ten attempts. A model that averages step 17 and occasionally finishes is a different production risk from one that reliably stalls at 17. Any agent eval reporting mean task progress carries the same blind spot.

The judge is a relative of the defendant

Per Alberto Romero's read of Anthropic's own footnotes, Claude Code session success is adjudicated by a Claude judge, where success means the agent "clearly succeeded without requiring corrections." Anthropic concedes workload shifts cause short-term fluctuation in the rate. Two defects stack. A judge from the same model family shares failure modes with the policy under test, so the errors it is least likely to flag are the expensive ones. A drifting workload mix conflates capability change with task-composition change. No judge-human agreement statistic is published, which makes the bias unknown rather than small.

The sampler biases the population it measures

The DigitalOcean trajectory-triage result is the cleanest worked example. Reported informativeness rose from 54% (random) to 82% on tau-bench, and 82 against 54 is solid at z≈4.45. Against a 74% "filter for 10-plus turns" heuristic, 82% gives z≈1.37 and p≈0.17, indistinguishable at n=100. Separating an 8-point gap at 80% power needs roughly 600 trajectories per arm. The load-bearing finding sits in the sub-analysis nobody quotes: among conversations where the agent succeeded, signal-based sampling surfaced actionable patterns in 66.7% of cases versus 41.3%. Policy violations and redundant tool calls inside clean successes never trip an outcome metric, so they never reach the annotation queue.

The trap is that signal-based sampling is an active-learning selector. Every metric computed on its output is biased upward on failure density by construction. Cutting over without a random reservoir stratum produces a phantom quality regression the week of the switch.

A benchmark gap measured with the winner's safety layer switched off is a harness artifact, not a capability gap, and internal bake-offs almost certainly make the same mistake.

Where this converges

Independent evaluators and vendors are now converging from opposite directions. Microsoft's cyber harness reports 96% on CyberGym where published agent scaffolds have landed in the low double digits, with no dataset, split, ablation, or cost basis disclosed. CyberScoop and The Hacker News both read that gap as a request for the eval harness rather than a result. PostTrainBench v1.1's anti-cheating tooling then documented 234 contaminated runs. If maintainers with dedicated instrumentation found 234, an internal harness that allows network egress during runs and reuses task sets across quarters has a contamination rate nobody has measured.

The copyable template is DeepsecBench. Pin the eval to a codebase commit immediately before a batch of vulnerabilities was fixed, so no model could have memorized the labels. Keep construction private. Report recall, precision, cost, and wall-clock separately. The temporal holdout and the cost column are the parts worth stealing. A single combined score hides exactly the precision-recall trade being chosen.

The divergence is the finding. DoorDash, Instacart, and Uber Eats rebuilt search around large language models in the same window, read the same literature, and shipped three architectures that barely resemble each other. Per ByteByteGo's teardown, model choice does not explain the split. Integration depth does, meaning how far the model is allowed to reach into the request path. DoorDash keeps it offline at the periphery. Instacart puts it in query understanding. Uber Eats makes it the embedding substrate.

The efficiency ledger is the reproducible part

Uber Eats replaced per-vertical BERT models with one fine-tuned Qwen backbone spanning every vertical, market, and language. It became economically viable through a stack of independently testable levers: Matryoshka truncation to 256 dimensions at under 0.3% recall loss and roughly half the storage; int7 scalar quantization halving latency while holding recall above 0.95; ANN k-tuning at 34% lower latency and 17% lower CPU; asymmetric towers with the document side pre-embedded offline; and geo pre-filters that shrink the candidate set before vector math runs. No k is specified for any recall figure, no eval-set composition is described, and no ablation isolates the levers. Every number is an upper bound and a hypothesis, not a spec.

The guardrail worth copying this sprint

DoorDash's inverted RAG is the highest-leverage pattern here for anything with a controlled vocabulary. An ANN lookup returns the top ~100 existing taxonomy concepts per query segment, and the model is prompted to select from that list rather than generate a label. Retrieval defines the output space instead of the input context. That turns hallucination from a probabilistic risk you monitor into a structural impossibility, and deletes the schema-repair code path. Entity linking, canonical label mapping, and feature normalization all qualify.

Two failure classes stay unsolved and deserve release gates. Off-the-shelf world knowledge actively contradicts user intent: Instacart's model categorized the query "protein" as chicken, tofu, and beef, while real users wanted bars and powders. Pure similarity retrieval systematically violates hard constraints, since "vegan chicken sandwich" scores high against a chicken sandwich. Route extracted constraints to hard filters and treat constraint-violation rate as a safety metric, not a relevance metric.

Before you benchmark another model, decide how deep into your runtime it belongs — then go bank the wins that cost nothing but a latency-recall sweep.

The serving-cost leak underneath all of it

Per the Daily Dose of Data Science analysis, teams that downsized models to save money frequently rent more accelerators, because vLLM and TEI are effectively single-model-per-process and four small models land on four cards. The framing is directionally right and technically imprecise: the 90% pre-allocation is gpu_memory_utilization, a configurable default rather than an architectural law. What you genuinely cannot get is arbitration. Co-located instances are mutually blind, so concurrent KV-cache growth produces OOM instead of graceful degradation. Sequence it accordingly. First tune the utilization parameter and measure the shrunken-cache throughput penalty under traffic replay, which reverses cleanly. Only then migrate to a unified multi-model server, whose LRU eviction trades GPU count for tail-latency variance. Pin latency-critical models as non-evictable and instrument eviction rate and model-load p99 as first-class SLIs.

One kernel-level caveat closes the loop. Moonshot open-sourced FlashKDA claiming up to 2.22x faster prefill, with no baseline, hardware, sequence length, or batch size disclosed, and the kernels are specific to its own attention variant, not a drop-in for a GQA or MHA serving path. The thing that number doesn't tell you is whether prefill is your bottleneck. Your prompt-to-completion token ratio decides that, and it is one query against 30 days of serving logs. Above roughly 10:1, prefill dominates and the work is real. Below 2:1, it optimizes the 20% and gets reported as a win.