AI Brief, 12 October 2026: six open decision models, and a first place nobody has measured

The decision-model class got its open-weight multimodal answer on 10 October, and almost nobody noticed. The vLLM Semantic Router team published Decision 3.0: six models under Apache 2.0 from 0.59B to 26.09B parameters, with weights, inference code and a working demo. They read text or JSON, optionally with images and video, and answer typed questions about it, picking one of up to 255 options, saying yes or no, or scoring on a scale. They return a probability for every option and generate no text at all. It is the first open-weight entry in the class with vision and video, four weeks after TypeSafe AI's proprietary Jev opened the category on 15 September and three days after Microsoft became the first large lab in it.

The flagship vllm-sr/d3 landed at 09:38 UTC on 10 October, with five siblings that afternoon and evening. Its card claims first place on the Jev Decision Index, a balanced score of 64.7 against Perplexity Decider v1.1's 62.8, plus 71.6 on the vision board.

That claim is not yet checkable, and the card says why in a footnote most readers will skip: "d3: internal evaluation. Others: live board data." Every rival and predecessor figure in that table matches the live Decision Index to the second decimal. The one row the board does not contain is d3's own. It was generated at 07:54 UTC on 10 October, one hour and forty-four minutes before the d3 repository existed, and the leaderboard submission is still an unmerged pull request. So a self-run score sits in a column of independently run ones, the shape of the Drex v1.5 claim this account took apart yesterday. One detail cuts against the headline: on the public suite alone, d3's claimed 65.45 is 0.35 points above Torchcast Decision 27B's independently measured 65.10. The comfortable lead is in the composite, not the part anyone else has run.

One number is missing altogether. The Decision Index publishes an expected calibration error and a Brier score for every model on it, including all six of Decision 2.0's. None of the six new cards carries a calibration figure, a Brier score or a fail-open rate. This brief asked for a fail-open rate on 10 and 11 October, and for a calibration error from the open-weight vendors on 2, 3, 5, 7 and 8 October. The most open release the class has produced still has none, and for a model sold as a guardrail that returns a probability, calibration decides whether the probability means anything.

• The 26.09B d3 claims a 64.7 balanced Decision Index, which would displace Perplexity Decider v1.1's independently measured 62.75 at the top. The figure is the team's own and unaudited.
• Nobody outside the team has measured any of it, and no calibration error, Brier score or fail-open rate appears on any of the six cards, though the board carries all three for their predecessors.
• Almost unnoticed: 112 likes across six repositories, no Hacker News thread, no paper and no blog post at release.
• A 6.82M-parameter text-to-image model trained from scratch appeared on 11 October with Apache-2.0 weights, reporting FID 33.01 at 88% of the real-image CLIP score.
• A NeurIPS 2026 paper announced overnight hides arbitrary capabilities behind an encrypted circuit that survives every elicitation method its authors tried.

Six models, 255 options and no tokens #

"Decision model" has been used loosely for a month, and Decision 3.0 ships the clearest statement of it so far. A language model answers a multiple-choice question by generating the answer: a causal forward pass, a projection of the last hidden state through a vocabulary-sized matrix, a sampled token, repeat. Decision 3.0 removes both the causality and the vocabulary. Its configuration sets attention to noncausal_full_attention, so every token sees every other token in both directions, and a separate readout head scores answer codes at the final prompt position in one pass. The reported output_tokens is zero.

For d3 the hidden size is 5,120 and the vocabulary 248,320 tokens, so the language-modelling projection it does not use would be

$$\mathrm{248,320}\times \mathrm{5,120}=\mathrm{1,271,398,400}\approx 1.27\text{B parameters}$$

while the readout head covers at most 255 options:

$$255\times \mathrm{5,120}=\mathrm{1,305,600}\approx 1.31\text{M parameters}$$

Here $255$ is the maximum number of options a request may define and $\mathrm{5,120}$ the width of the residual stream, so the ratio $\mathrm{248,320}/255\approx 974$ is how many times smaller the decision head is than the projection it replaces: in bf16, 2.6 MB instead of 2.54 GB. The saving is not the point by itself; the point is that the caller gets a probability over options it defined rather than a string it must parse.

The API makes the shape plain. The method is system_one and the cards tag the models system-one; a benchmark paper posted on 5 October uses "System One models" in its title, so the class is converging on a name. Three question types about one input are answered together:

from transformers import AutoModel

model = AutoModel.from_pretrained("vllm-sr/d3", trust_remote_code=True)

result = model.system_one(
    state="The order arrived damaged yesterday. The customer has a receipt and asks for a replacement.",
    questions={
        # one forward pass each, every answer carrying a probability
        "action":  {"type": "choice", "instructions": "What should happen?",
                    "criteria": {"replace": None, "refund": None, "escalate": None}},
        "receipt": {"type": "noul",   "instructions": "Does the customer have a receipt?"},
        "urgency": {"type": "score",  "instructions": "Rate urgency."},
    },
)

The ladder is where the release earns attention. Every Decision 2.0 baseline in that chart is the live board's own figure, so the generational gains are stated against independently measured predecessors even though the new scores are not: +16.4 points at 0.85B, +12.2 at 2B, +12.1 at 0.59B, and only +8.5 at 27B. The smallest models gained the most, the opposite of the usual pattern. d3-edge is 0.59B parameters including a 0.10B vision encoder and still answers typed questions about a ten-second video, at a self-reported median of 6.7 ms for text and 308 ms for video on one AMD Instinct MI325X.

Serving is wired up rather than merely announced, with image and then video inputs merging into the router on 11 October, though passing them through to decision signals end to end is still open. Several vision figures are marked "approximate rebuild", so they are not comparable with published numbers.

A text-to-image model that fits in 27 megabytes #

The day's other new artifact came from one person and nobody has written about it. At 11:42 UTC on 11 October an account called AuroraAI-Research published AuroraIMG-6M, a complete text-to-image stack in 6,822,747 parameters under Apache 2.0, with no pretrained components in it. The org has one member and two prior uploads, both small language models.

Component	Parameters
Text encoder (4 layers, width 128, RoPE)	1,317,632
Denoiser (AdaLN-Zero U-Net)	4,421,064
VAE (convolutional, 64×64×3 to an 8×16×16 latent)	1,084,051
Total	6,822,747

Even the tokenizer is local: a 4,096-token byte-level BPE fitted on the captions themselves. Training was 25,000 VAE steps then 300,000 rectified-flow steps at batch 2,048 over 9,882,283 caption-image pairs, roughly 62 passes.

On a 10,000-image held-out split it reports FID 33.01 and a CLIP score of 24.80 against a measured real-image ceiling of 28.25, about 88% of what real photographs score on the same harness. Those are the author's own figures from one run, and the published guidance sweep shows the usual trade rather than hiding it: FID bottoms out at 6.0 while CLIP keeps climbing to 24.90 at 9.0, where FID has degraded to 36.40.

The decomposition is what makes the release useful rather than merely cute. The VAE alone, encoding and decoding real images, scores FID 8.97 at 31.9 dB, so the autoencoder is not the bottleneck: roughly 24 of the 33.01 points come from the 4.42M denoiser failing to put the right thing in the latent. That is a clean statement of where the next million parameters should go.

Two caveats. The output is 64×64, so this FID is not comparable with figures quoted at 256×256 or above. And the training set is a URL list, so it is whatever was still downloadable, which the card says plainly. Seventeen hours after upload: 20 likes, no downloads.

A capability that cannot be elicited from the weights #

Capability evaluation rests on an assumption nobody states: that if a model can do something dangerous, somebody holding the weights can make it do that thing. A paper announced in the arXiv listing at 00:00 UTC on 12 October, accepted at NeurIPS 2026, builds a counterexample on purpose.

Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas and Christian Schroeder de Witt compile an encrypted network into a host model's weights. A hash-based digital locker built from Keccak decrypts and runs the hidden circuit only when a secret trigger appears in the input. Their earlier work could hide a fixed output string; this hides arbitrary computation, and is argued to resist elicitation even with full access to every weight.

The task is binary reaction feasibility from USPTO data, standing in for a chemistry capability, and the comparison is against a conventional password-locked model. Both sit at chance without the trigger, 50.6% and 50.7%; given it, the encrypted model reaches 73.5% and the password-locked one 92.7%. Then the attacks run:

Elicitation attempt	Encrypted	Password-locked
Supervised fine-tuning, 500 steps	50.9%	92.8%
Latent adversarial training, 8 layers	52.9%	91.7%
GCG trigger search, 16-bit	52.7%	92.9%

Every method recovers the password-locked model almost completely and none moves the encrypted one off chance. The figures are the authors' own and unreproduced.

Four things stop this being "models are secretly sandbagging". The host is a synthetic compiled network, not a fine-tuned production model; a 270M Gemma only confirmed that individual units execute correctly once inserted. The overhead is enormous and not itself hidden: 2.07 billion dense parameters, roughly 95% of them Keccak subcircuits, to conceal a ternary classifier of 672 weights — about 3.1 million host parameters per hidden weight. Hiding costs capability, 73.5% against 92.7%. And an 8-bit trigger is recovered by gradient search, since all 256 candidates can be enumerated: security rests on trigger entropy, and these experiments used 4- to 16-bit triggers with a single Keccak round, which the authors say would not survive cryptanalysis.

Also notable #

• A one-line llama.cpp change merged on 11 October slowed MoE decode on AVX2 machines by 7-8%. PR #30270 correctly enabled F16C, which the macro machinery had treated as unavailable, and that proved a pessimisation: Clang lowers the scalar half-to-float conversion to a vpinsrw merge into the accumulator, creating a false loop-carried dependency that serialises the dot-product loop. A 35B MoE with experts on CPU fell from 14.79 to 13.54 tok/s across builds b11554 to b11556. The regression issue is open, so pinning below b11555 is today's workaround. One reporter, one CPU, one compiler.
• llama.cpp also retuned Q2_K for the Hexagon NPU from 4.0 to 2.625 bits per weight, merged at 03:52 UTC on 12 October. NPU weight buffers fall 34.4% on pure-Q2_K models, Llama-3.2-3B from 1,532 to 1,006 MiB, for ~1% on prompt processing and 1.2-6.4% on generation. One device, the author's own runs, and the batch-8 path got 6.7% slower unexplained.
• arXiv now caps every submitter at two papers per calendar month, three active at a time, counting rejected ones. The policy took effect on 1 October and has gone essentially unreported since. The reason given is a submission flood: 40,363 papers in September against 20,569 in September 2024, with cs.AI up more than sixfold in two years.
• An NVFP4 build of a 35B "JEV" model is not Jev. autotrust/JEV-35B, published 01:22 UTC on 11 October, is a finetune of Qwen3.5-35B-A3B from AutoTrust AI, an unrelated outfit shipping a JEV-named family since 18 September, whose card disclaims any affiliation with TypeSafe AI, which still has no public weights 27 days after launch.
• DistroKid is removing artists' recordings in response to Universal's "AI-slop" suit, which it confirmed to The Verge on 10 October while disputing the allegations. It distributes roughly a third of all new music, so this is the first concrete cost of an AI-slop copyright claim landing on independent musicians rather than a platform.

What to watch #

• Whether d3's 64.7 survives contact with the board. The submission is an open pull request and the public-suite margin over an independently measured rival is 0.35 points, so this is checkable within days. A merged entry would make it the class's first independently scored open multimodal model.
• Whether any vendor in this class publishes a fail-open rate or a calibration error. Asked here on 10 and 11 October and again today. The board already fills those columns for Decision 2.0, so the newest release is the easiest case yet and still carries none.
• Whether the capability-hiding models become locatable. The paper promises released models to support defences but prints no address for them, and its experiments stop at 16-bit triggers.
• Whether TypeSafe ships Jev weights, and whether Mistral and Reflection meet theirs. Both "end of the month" commitments have nine days left.