A compressed model can clear perplexity, clear MMLU, clear a data-free fidelity probe, and then invent a procedure step that appeared in none of its instructions the moment you run it as an agent. We measured this across three model families. The failure tracks the coherence of the compression error, not the amount of it, and a two-number screen catches it for free.
The guards everyone trusts share a blind spot
Teams accept a compressed model when it clears a short battery of cheap checks: perplexity within about 1.15× of the original, downstream accuracy such as MMLU inside a confidence interval, and data-free fidelity signals that compare the compressed and original activations under random probes. All three are green on the builds we studied. All three miss an agentic failure.
We built an invented-step canary. Give the model a standard operating procedure (ten ordered steps plus a conditional), put a second procedure in context as a distractor, and ask it to enumerate the exact steps. We count cross-procedure invention: steps the model emits that belong to no instruction it was given. A reliable agent reproduces its own procedure and invents nothing.
Same perplexity, opposite behavior
The result is operator-specific. Coherent low-rank (SVD) truncation triggers the failure. Magnitude pruning matched to the same perplexity does not.
| Model | Compression (matched perplexity) | Invents steps/query vs baseline |
|---|---|---|
| Mistral-7B | in-regime SVD (ppl 1.069×) | +1.73 [1.08, 2.42] |
| Mistral-7B | damage-matched pruning (ppl 1.18×) | −0.15 [−0.38, +0.04] |
| Llama-3.1-8B | SVD (ppl 1.29×) | +1.29 [0.74, 1.88] |
| Llama-3.1-8B | damage-matched pruning (ppl 1.29×) | +0.07 [0.02, 0.13] |
The sharpest version is a single arm. On Qwen3-8B, one gently-truncated SVD build wins a paired fidelity test against a random-allocation control and fails the canary, on the same tensors. A signal that certifies fidelity cannot certify agent behavior. That holds by construction, since the fidelity probe is built to measure representational similarity and says nothing about procedure adherence.
The axis is coherence times rate
At matched perplexity the coherent operator fails and the incoherent one passes, so damage magnitude is not the driver. A quantization control carries more raw perplexity damage than the failing SVD dose and passes at a moderate dose. Push that same quantization to the failing SVD cell's rate and it fails too. The governing quantity is the coherence of the error multiplied by its rate. Onset is early, within a 2% perplexity dose, and the effect is spread across the network rather than localized to one layer.
A data-free screen that predicts the failure
Because the axis is coherence times rate, two statistics of the compression error dW = W_original − W_compressed decide it, aggregated over the linear tensors:
- coherent_fraction = top-8 singular energy of dW / total energy of dW. Is the error low-rank and structured?
- error_rate = energy of dW / energy of W. Is the dose large enough to matter?
Neither number alone works. A gentle low-rank build passes on rate; a heavy pruning build passes on coherence. Their conjunction separates every labeled build with one fixed pair of thresholds across architectures.
| Model | Arm | coherent_fraction > 0.007 | error_rate > 0.01 | screen / canary |
|---|---|---|---|---|
| Mistral | in-regime SVD | 0.0080 | 0.0159 | FLAG / FAIL |
| Mistral | prune | 0.0054 | 0.0319 | pass / PASS |
| Llama | SVD (dose) | 0.0090 | 0.0121 | FLAG / FAIL |
| Llama | in-regime SVD | 0.0090 | 0.0065 | pass / PASS |
| Llama | prune | 0.0060 | 0.0073 | pass / PASS |
The screen reads the weights. It runs no benchmark, needs no labeled data, and no generation. Run it after a quantization or low-rank build and before the model reaches an agent.
Scope, stated plainly
- We tested dense decoder LMs at 7–8B (Qwen3-8B, Mistral-7B, Llama-3.1-8B). Mixture-of-experts is not yet in the controlled battery.
- The perplexity-guard evasion needs in-guard low-rank headroom. Qwen and Mistral have it; Llama's spectrum craters perplexity first, so its guard catches the bad SVD by accident. The operator mechanism holds on all three.
- The thresholds are calibrated on 7–8B dense models. Recalibrate per family before treating the gate as a hard block, and read it as a screen rather than a certificate.
The paper is on arXiv (2607.28196). The canary, the coherence probe, and the screen are open source at github.com/baa-ai/fidelity-is-not-safety.
This safeguard is built into our products.
Every model Black Sheep AI ships through Watchman and Shepherd clears the agent-safety screen before it reaches production. You get the cost of a compressed model and the reliability of the original, checked automatically, with no benchmark data required. If you run your own compression pipeline, the screen is open source and drops in as a pre-flight gate.
Models on Apple Silicon / MLX. Canary: 24 synthetic SOPs × 3 seeds = 144 paired events per arm, deciding on cross-procedure invention with a recall gate. Detector: coherent_fraction and error_rate of the per-tensor compression error, top singular energy via randomized subspace iteration.
