Executive Summary

Four numbers hold this report up. The first two say how cheap this layer's intervention is and how hard it lands. The second two say how wide the window is for checking it from outside.

This report starts from that one paper and then does what the paper did not. The author ran no experiment and named no company. So the pages that follow hold his frame up against what has actually been measured, what has actually happened, and how far the law currently reaches. Where a blank turns up, it stays a blank.

Draw the way a language model produces a sentence and you usually get this. A prompt goes in, the model computes, the next word comes out. One thing is missing from that drawing. The model does not choose words. What the model does is score every word in the vocabulary, and drawing one word out of that score sheet is a separate step that comes after. Those scores are called logits, which is simply the name for the score the model assigns each candidate word.

Between scoring and drawing there is a gap. What the paper formalizes is the layer that sits down in that gap. The author calls it an inference policy. What it does is plain. It lays an externally built score table on top of the model's own scores, adds the two together, and draws the next word from the result. How hard it presses is adjustable. Press hard and a word that ranked third becomes first; press lightly and nothing at all happens in most sentences. Depending on what fills the external table, this layer can be a safety filter, a style regulator, or a provenance marker.

In the diagram below, the grey span is the range an AI audit actually inspects today. The orange span is the place this report is about.

1.1Watermarking already works in that seat

Proof that this layer is not imaginary is not far away. Google's text watermarking, SynthID-Text, operates in exactly this seat. It leaves training alone, leaves the model weights alone, and changes only the sampling procedure. Using an approach called Tournament sampling, it pairs candidate words against each other and plants a statistical signature in the sentence as it goes. The Nature paper states that the technique is applied in Gemini and Gemini Advanced.

The same paper priced the intervention. A Gemma 7B model served on four tensor processing units generates a token in 15.527 milliseconds, and turning on 30-layer Tournament sampling makes that 15.615 milliseconds. An increase of 0.57 percent. Two other schemes came in at 0.26 and 0.28 percent. What follows is the more striking part. The computational complexity of watermarking stays constant as the model grows, so the relative cost falls by orders of magnitude for larger models. Quality was measured by splitting roughly 20 million live responses between watermarked and unwatermarked models. The thumbs-up rate differed by 0.01 percent and the thumbs-down rate by 0.02 percent. Both differences were statistically insignificant and well within the 95 percent confidence intervals. Users did not notice.

Pebblous has covered shifts in this layer before. There was Google's change to its visible watermark setting, which moved a mark people could see down into the file, and a proposal to use watermarks as an ecosystem monitoring instrument. Both of those were about the mark. This report is about the machinery that produces the mark.

1.2Nudging probabilities has been around since 2019

The technique of pushing probabilities did not arrive with watermarking. The wish to change output behaviour without retraining has been around since retraining large models became too expensive to contemplate, and the methods that answered it form a lineage. Each entry in the table below records only properties confirmed directly in the original abstract.

If only one row of that table can be kept, it is FUDGE. The condition its abstract states is that the method "only requires access to the output logits" of the model. That condition means two things, and the second is the crux of this report. First, whoever built the model can obviously do it, since they hold their own logits. Second, a third party who did not build the model can do it too, because logits are all that is needed. Organizations building services on top of a commercial API, gateway operators, and resellers all qualify. So the deployment stack this paper describes is not one model provider but every layer standing between the model and the user.

One person connects the start of that lineage to the present. The first author of PPLM in 2019 and the first author of SynthID-Text in 2024 are the same researcher, Sumanth Dathathri. The person who first popularized the idea of freezing weights and pushing only probabilities was, five years later, at the front of the team that shipped the same class of intervention at Google's production scale. This is not evidence of intent. It is evidence of how fast the technique matured. Five years is what it took for a lab idea to become a deployment mechanism running at a scale of billions.

Suppose an auditor observes that a chatbot describes policy A more favourably than policy B. The next question is naturally why, and the usual answer is that the training data leaned that way, or the alignment process did. The Inference Attribution Problem the paper formalizes points at the conditions under which that answer does not hold. There are nine places in the deployment stack where such a bias can be born, and from the outside all nine produce effects that cannot be told apart.

• Pretraining data distribution
• Supervised fine-tuning
• Reinforcement learning based alignment
• Hidden system prompts and prepended guardrails
• Retrieval augmentation indexes
• Safety policy classifiers
• Inference-time logit processors
• Dynamic user profiling
• Steering driven by commercial sponsorship

The first three live inside the weights and the remaining six live outside them. To anyone looking only at outputs, all nine look identical. That is where the paper's conclusion comes from. An observed behavioural bias does not imply a bias in the model weights. The qualifying clause must not be dropped, though. The original text pins it down twice, with "under constrained observational conditions" and "through unprivileged black-box access." The claim is not that nobody can know, but that an external auditor without privileges cannot tell the difference. The distinction matters because the paper's prescription is precisely to institutionalize that privilege.

2.1Why this layer in particular

The nine places are not equally dangerous. A single table in the paper sorts out the difference, and it is the most quotable artifact in the paper, so it is reproduced here as published. Read the last two columns first. Does it leave a trace, and can it be caught from outside.

What sets the last row apart from the others collapses into one sentence, the statement at the end of section 5.2. Unlike prompt injection or retrieval-based intervention, inference-time logit manipulation uses no part of the context window and leaves neither a prompt artifact nor an inspectable trace in the conversation log. Each of the first three rows leaves something behind. Alignment training stays in the weights, a system prompt stays in the context, retrieval augmentation stays in the citation list. Only the logit policy stays nowhere.

One concept has to be kept separate. A context token cost of zero means it does not consume the context window, not that the computation is free. In constrained decoding, an adjacent layer, precompiling the grammar drops the per-token overhead to microseconds, but when the constraint has to be built on the fly the compilation cost dominates everything. An intervention is not always free. What the 0.57 percent from the previous section prices is the steady-state case, where a prepared score table is laid on top.

2.2What actually happened: Grok, May 2025

Everything so far is formalism. There is one point where the formalism touches the world. At about 3:15 a.m. on May 14, 2025, an unauthorized modification was made to the prompt of the Grok bot that replies on X. The result showed immediately. Ask about a streaming service or about baseball, and political commentary about South Africa attached itself to entirely unrelated queries, over and over. In its official statement, xAI said the change directed Grok to provide a specific response on a political topic and violated its internal policies and core values.

No weights changed in that incident. One setting in the deployment layer changed, and the output behaviour changed with it. The paper's proposition that the model is not the deployed system stops being speculative at that point. The remedy arrived in the shape of deployment-layer transparency too. xAI announced it would publish Grok's system prompts on GitHub from then on, so that the public could review and give feedback on every prompt change.

Where that promise stands today can be checked. The repository was created on May 15, 2025, the day after the incident, and holds twelve prompt files. The last update time, queried through the GitHub API, is November 17, 2025. That is roughly nine months without an update as of this writing. The repository also carries an open complaint that detailed prompts Grok had previously shared itself are missing from it.

Drop the incident into the table above and the narrative closes on its own. The comparison below is that substitution.

One step further than that and the argument collapses. So there is no sentence in this report claiming that something is happening at the logit layer right now. The claim ends exactly here. Absence of an observational record is not evidence of absence.

2.3Behaviour shifting behind a fixed name was already documented in 2023

The observation that the model and the deployed system differ predates Grok. A 2023 paper from Stanford and Berkeley researchers compared the March and June versions of GPT-3.5 and GPT-4, served under the same names, across seven tasks: math problems, sensitive and dangerous questions, opinion surveys, multi-hop knowledge-intensive questions, code generation, US Medical License tests, and visual reasoning. Two phrases in the abstract are decisive. When and how these models are updated over time is opaque, and the performance and behaviour of both models can vary greatly over time.

That study gives this report two things, and the second matters more. First, users and auditors can barely learn that behaviour has changed at all without a provider notice. Second, that study could not identify what had changed either. Whether the weights changed, the system prompt changed, or the sampler settings changed was indistinguishable from outside. That is the Inference Attribution Problem in the flesh. The disclosure gap around silent model updates that Pebblous covered earlier works the same stretch of ground from another angle.

Section 5.1 of the paper names this situation the model neutrality fallacy. When a researcher evaluating frozen weights and a researcher evaluating a production deployment report different results, the two results are not in contradiction. They measured different things. The paper's sentence is short. Static benchmarks conducted via public APIs measure the deployed system at a specific time and location, not the underlying foundation model. Most of the model leaderboards and bias measurements in circulation today are produced under exactly those conditions. Those numbers are not wrong, but what they measured usually goes unstated.

What Is Measured, and What Is Still Assumed

Advertising and regulation come up from the next section onward. Before that, this report sorts the facts it handles into three layers, because the same materials would write a conspiracy theory if that separation broke down. Each layer calls for a different strength of claim, and this report holds to those strengths.

There is one more distinction. The paper explicitly separates inference-time steering from censorship. Censorship operates on availability, deciding whether an answer exists at all. Inference steering operates on the distribution of interpretation. The system answers nearly every question, and the content of those answers is mostly not wrong. What changes is what gets said first and what gets held back, and which words do the naming. The classic 1993 definition of framing in communication research landed on the same spot. Framing does not manipulate facts; it manipulates what becomes salient. Which is why an answer with nothing factually wrong in it can still be an audit problem.

That stays abstract, so here is the paper's own example. Two sentences that can be written about the same event.

Both statements are compatible with the same underlying event, and neither invents a fact. Yet the judgment a reader leaves with diverges. The environmental regulation example the paper gives has the same structure. One semantic region holds protection, safeguards, accountability, responsibility, prevention. Another holds restriction, burden, intervention, bureaucracy, compliance cost. Both vocabularies describe legitimate dimensions of the policy. An intervention does not need to prohibit either one. It merely makes one semantic subspace marginally more probable during sampling.

What actually moves when that happens is set out by the paper in eight items. It reads equally well as a list of what an auditor would have to count.

• Which facts appear first
• Which consequences receive detailed explanation
• Which descriptive adjectives and verbs are chosen
• Which analogies are generated
• Which counterarguments receive prominence
• Whether uncertainty is emphasized or minimized
• Whether an actor's intentions receive charitable or skeptical interpretations
• Whether a policy is characterized primarily through benefits or compliance costs

Nowhere among those eight is there a lie. Because the output remains factually defensible, the paper says that detecting inference framing is a different and potentially more difficult challenge than conventional misinformation detection. Tools that look for false sentences filter out nothing here.

On that frame the paper builds three deployment scenarios: a state compelling providers under its jurisdiction to embed an inference policy, framing strength varied by user profile, and commercial sponsorship entering as probability. All three are threat models, not incident reports. The third gets a whole section of its own next. The second already has its materials on the table.

The external score table described earlier has a slot for user attributes. Fill that slot and the pressure applied can differ from person to person. The paper's example runs like this. A politically skeptical user receives restrained framing, an undecided voter receives persuasive framing, and a supporter receives reinforcement. Two people asking the exact same political question receive answers that are factually consistent with each other yet systematically differently framed. This is where the paper separates the practice from mass propaganda. Mass propaganda is a single public message that journalists can scrutinize, while personalized inference steering produces bespoke conversational rhetoric for each citizen. There is no original to take apart.

Evidence attaches to this scenario in the opposite direction, though. In the Science experiments cited earlier, personalization had smaller effects than prompting changes. The premise that personalization is the strongest lever of persuasion is not yet supported by measurement. What can be said here is only that the structure holds.

The probability placement discussed in this section is a hypothetical concept. No company has ever said it does this, and the author makes no such claim. The paper labels it a hypothetical commercial primitive three separate times. The reason to take it up anyway is that it shows exactly where the advertising formats being sold today diverge from it.

Probability placement is defined as sponsored influence implemented not through explicit product copy but through systematic shifts in probability mass. In the paper's own phrasing it is the probabilistic version of product placement. If product placement is a character on screen drinking a particular brand of soda, probability placement is a brand name moving slightly up the candidate list. There is no advertisement in the sentence. The advertisement lives in the probability a word gets drawn.

To explain the concept, the paper offers a numeric example. Three brands sit on the candidate list with probabilities of 0.30, 0.28, and 0.25, and after the score table is applied they become 0.36, 0.26, and 0.22. The diagram below is that example. These are numbers the author invented to explain a concept, not values anyone measured, and that fact is marked both inside the figure and in the caption.

Bar heights are only half of probability placement. Beyond selection probability, the paper attaches descriptors. A sponsored brand gets paired with words like reliable, integrated, premium, secure, industry-standard, while competitor brands get associated with cheaper, alternative, customizable, complex, legacy. What matters is that the second set contains no insults. Nothing there is false and nothing there is disparagement, yet the impression left after reading tilts one way. This is the framing from the previous section, attached to a brand name. So what probability placement moves is not only which name gets drawn but which words get drawn alongside it.

3.1Conversational AI collapses a boundary search kept for over twenty years

The contrast drawn in section 4.4 of the paper is the frame for this section. Search advertising has maintained a visual boundary for more than twenty years. Sponsored results and organic results are separated on screen, and the user knows which one they are looking at. Conversational AI collapses that boundary into a single synthesized answer. The user converses under an assumption of synthesized agency, believing the AI weighed the alternatives and picked the best one. The recommendation that actually emerged was produced jointly by the model, the prompt, the safety policy, the commercial policy, and the sampler.

How far that collapse has actually gone, format by format, is set out below. The table is ordered by how weak the boundary has become. Higher rows keep the advertisement outside the answer; lower rows bring it inside.

3.2The incentive is growing, and one provider turned it down

The size of the economic pressure can be checked. WPP Media's June 2026 forecast puts the generative search advertising market at $5.1 billion in 2026 and more than $100 billion by 2030, a twentyfold rise in four years. Dragging that curve straight into this report's argument would overstate it, though. In the same period, eMarketer's US analysis projected that more than 80 percent of AI advertising in 2026 would run as traditional search ads placed next to AI answers rather than inside chatbot conversations. Pure chatbot ad revenue comes in under $1 billion for 2026.

One provider went the other way. Perplexity introduced sponsored questions in November 2024, stopped taking new advertisers in October 2025, and in February 2026 abolished advertising entirely to pivot toward subscriptions. Its stated reason overlaps precisely with this report's subject: even labeled advertising risks eroding the trust an answer engine depends on. Anthropic has likewise said it intends to keep Claude ad-free.

This case should not be read by the industry as a conclusion that things are safe. Most of the revenue still sits beside the answer, and one provider's judgment is not the market's. What is confirmed is only that the tension exists. The incentive is growing, and one provider turned it down.

3.3Mediation is growing while trust stays low

For probability placement to matter, answers have to mediate real choices. That mediation is growing. In the usage analysis OpenAI produced with National Bureau of Economic Research researchers, the share of information-seeking use rose from 14 percent in July 2024 to 24 percent in July 2025. That category is defined as looking up factual information about people, current events, products, and recipes, and the paper itself calls it a close substitute for web search. Over the same period, writing use fell from 36 percent to 24 percent. Information seeking is the only major category that grew while pushing writing aside. The reach is large too. Google said the Gemini app passed one billion monthly users in August 2026.

Listing only the scale of that mediation tilts the picture, though. A Gartner survey from May 2026 found that consumers will hand an AI the searching and the shortlisting but want to keep the final purchase decision. That is counter-evidence against the premise the probability placement threat model quietly assumes, namely that a user follows what an AI recommends. Trust figures point the same way. In the Reuters Institute's 2026 survey, trust in AI chatbot answers stood at 20 percent, below both news overall at 37 percent and search engine answers at 32 percent.

Low trust does not mean low influence, however. In the same survey, the share of respondents who clicked through from a chatbot answer to the original source was 4 percent overall, against 19 percent for search and 17 percent for social. In a KPMG and University of Melbourne survey of more than 48,000 people across 47 countries, 66 percent said they use AI output without verifying its accuracy. That gap, not trusting it and not checking it either, is the social condition under which an inference-time intervention could pass unaudited.

One study tested directly that influence runs separately from trust. In two preregistered experiments published in Science Advances in March 2026, 2,582 participants wrote about important societal issues while receiving biased autocomplete suggestions. The attitudes they expressed in a posttask survey converged toward the position those suggestions pointed at. A majority of participants were unaware of the suggestions' bias and of their influence. The effect was stronger in the interactive form than when the same content was presented as static text, and warning participants before or after exposure did not mitigate the attitude shift. That experiment measured autocomplete, though, not logit steering in a conversational answer. The discipline this report keeps, that measurements come from adjacent layers, applies here as well.

The claim in this section is a gap, not a violation. The point is not that some provider is breaking the law right now, but that no provision yet addresses an intervention at this layer.

4.1Article 5 of the EU AI Act was not designed to catch this shape

Article 5(1)(a) prohibits systems that deploy subliminal or purposefully manipulative techniques to materially distort behaviour and cause significant harm. Read the sentence alone and the intervention discussed here looks caught by it. The paper concludes the opposite. It states that subtle inference steering does not automatically fall under the Article 5 prohibitions, and adds that legal analysis here requires caution.

The Commission's guidelines on prohibited practices, issued on February 4, 2025, support that reading. They run past a hundred pages and carry no binding force, but their structure is what matters. They break each prohibition into cumulative requirements and state that the prohibition applies only when all of them are met. If the effect of any individual interaction is close to zero, the material distortion and significant harm requirements fail. The guidelines also judged that using AI for personalized advertising is not inherently manipulative, so long as it does not subvert autonomy or exploit vulnerability, and that this must be assessed case by case.

The problem the paper raises sits exactly below that threshold. The effect of any single answer is too small to measure, and yet those small effects can accumulate at the population level. The prohibitions as written were built around a situation where significant harm arises from one interaction. The AI Act's own compliance timeline was covered in a separate Pebblous report.

4.2The DSA depends on which drawer it gets filed in

The paper asks whether the transparency principles applied to recommender systems should extend to inference-time scoring. The real situation is stuck one step earlier than that. In October 2025, OpenAI self-reported EU monthly users of ChatGPT's search feature at 120.4 million on a six-month average, well past the Digital Services Act's 45 million threshold. What it should be designated as, though, has not been settled. Should the search feature be carved out and treated as a very large online search engine, or should the whole service be treated as a very large online platform?

That fork is decisive for a reason. Article 27, which governs recommender system transparency, is an obligation on online platforms and not on search engines. Designated only as a search engine, the service never picks up Article 27 at all. Article 27 requires setting out, in plain language, the main parameters of a recommender system, the reasons for their relative importance, and any options the user has to change them. The provision closest to this report's subject can vanish on a single classification.

There is a definitional difficulty too. The DSA was designed before chatbots. Whether a service that synthesizes an answer instead of returning links falls inside the definition of an online search engine is open, and while the definition of a recommender system is drawn broadly enough to cover automated systems determining the relative order or prominence of information, whether a single generated answer determines order or prominence has no answer yet. Sources disagree on the timing of designation, so this report records it only as unsettled. The regulatory gap, then, does not take the form of an ambiguous provision. It takes the form of an entire set of provisions disappearing depending on which drawer the service goes into.

4.3The US has started demanding documentation of how answers get generated

On September 11, 2025, the Federal Trade Commission issued 6(b) orders to seven companies: Alphabet, Character Technologies, Instagram, Meta, OpenAI, Snap, and xAI. Two of the demanded items bear directly on this report. How user interactions are monetized, and how the chatbots process inputs and generate responses. That counts as a regulator demanding documentation of the answer generation process itself. The focus of the inquiry is minors' safety rather than commercial steering, though, and 6(b) is a study authority unconnected to litigation or investigation.

The FTC's July 2026 policy statement on accuracy suppression has already been covered by Pebblous. The difference between the two pieces fits in one sentence. That one dealt with disclosure duties and the lineage of training and tuning data; this one deals with the layer that disclosure does not reach.

4.4Korea has already mandated one kind of inference-time intervention

Korea's Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust, together with its enforcement decree, took effect on January 22, 2026. Passed by the National Assembly in December 2024 and promulgated in January 2025, it is Korea's first comprehensive AI legislation, and Korea is the first country in the world to bring a comprehensive AI statute fully into force. The EU is phasing its own in.

The provision that engages this report is Article 31, on securing transparency. It requires three things of businesses providing generative AI or high-impact AI services. First, notify users in advance that the service is generative AI based. Second, mark outputs as generated by AI. That marking splits into visible methods such as captions, logos, or watermarks, and invisible methods such as metadata or a digital watermark. Third, mark virtual audio or video that is hard to distinguish from reality so it is clearly recognizable as such. Violations draw a corrective order along with an administrative fine of up to KRW 30 million, roughly $21,000.

There is one piece of primary evidence that Korean companies touch this layer. In its May 2026 announcement, Google named Kakao, alongside OpenAI and ElevenLabs, as a company applying SynthID technology to its own content. How common it is for Korean firms to lay their own logit processors or rerankers on top of a commercial API, and whether such interventions are recorded in contracts or audit documents, is not covered by any domestic statistic that could be found. The surveys run by the Ministry of Science and ICT and by the National Information Society Agency carry no such question. The gap is recorded rather than filled with an estimate.

One last contrast, then. Article 10 of the EU AI Act requires evidence of representativeness and quality for the training data of high-risk systems. Pebblous has a report reading that provision through labeling audit evidence. The contrast shows where regulation's gaze still rests. Auditing still looks at everything up to the point the model is built.

Closing on a warning would leave this report half done. The paper leaves three prescriptions, and all three can be held against today's conditions: what has to be measured, whether it can be measured, and what to demand when it cannot.

5.1What has to be measured is the distributional difference

The primitive quantity for an audit is the distributional difference, meaning the gap between the probability distribution actually served and the distribution the model would have produced on its own. This is not about whether one word changed. It is about the tilt in how often certain words end up being drawn. Whether that quantity can be defined is the whole of auditability. If it can, the rest is a matter of sample size and statistics. If it cannot, the rest of the discussion does not hold.

5.2But can it be computed today

Computing it requires receiving, from outside, the probability the model assigned each word. The official specs of the three major providers were pulled and compared directly. The result is not uniform.

Three limits come out of that table. First, the top 20 is not a distribution. The OpenAI spec states that tokens outside the top 20 are filled in with a value of −9999. Vocabularies run to six figures. The head is visible and the tail is flattened. Computing a distributional difference over the full vocabulary is not possible with today's public APIs. Second, one provider offers no window at all, which means the same audit design cannot be applied uniformly across the three. No reason has been published.

The third limit is the heaviest. The auditable surface and the socially consequential surface are two different surfaces. Log probabilities are an API-only feature. The consumer interfaces where people actually read answers, the ChatGPT and Gemini apps, Claude on the web, expose nothing. That is the side where the billion monthly users from the previous section are. This explains why the first of the five comparison axes the paper proposes to auditors in section 6.4 is, of all things, API versus consumer chat interface. Measuring the distribution through the API carries no guarantee that the result holds for the chat interface.

The right-hand column of the table needs a precise line drawn around it. OpenAI's logit bias parameter is described in the spec as a bias that "is added to the logits generated by the model prior to sampling." That means the intervention the paper set up as a formalism already exists as a documented product feature. This must not be read as OpenAI doing any steering. What has been confirmed is only that the primitive for that intervention is offered as a public parameter, and the party using that parameter is the developer calling the API.

5.3The intervention axes are exposed and the resulting distribution is hidden

One unexpected asymmetry turned up during the research. Three of the five axes the paper asks auditors to compare in section 6.4 already exist as API request parameters. Anthropic's Messages API parameter list includes a field designating the geography where inference is processed, a field attributing a request to a specific user profile, and a service tier field choosing between priority and standard capacity.

The line is just as clear here. There is no evidence that these parameters change the output distribution. What has been confirmed is only that the deployment layer already treats geography, user identity, and service tier as first-class request parameters. So the axes the paper points auditors toward are not hypotheses; they are switches already fitted to the product. What is missing is not the switch but a window showing how the distribution changes when the switch is turned. The intervention axes are exposed and the resulting distribution is hidden. That asymmetry is what auditability actually looks like right now.

5.4The attestation already existed, and it is being deprecated

The paper's second prescription is an attestation. Bind the model version hash, the inference policy hash, and the sampler configuration together, sign them, and emit them with the response. An auditor then checks whether the observed distribution matches the declared reference distribution. It is a structure that permits verification without publishing weights, and in the paper's phrasing the question changes. From which model generated this, to under which inference policy this model was permitted to speak.

Compare that with what the industry actually built and the difference comes into focus. OpenAI's response object carries a field called the system fingerprint. The spec says this fingerprint represents the backend configuration the model runs with, and that using it together with the seed parameter lets you tell when backend changes have been made that might affect determinism. It is the existing field closest in purpose to the attestation the paper asks for.

Three differences. The field is not signed, it does not decompose into what changed, and its purpose is reproducibility debugging rather than audit. And in the current chat completions schema it is marked as deprecated. The only standard field that let an outsider notice a change in deployment configuration is on its way out.

No reason for the deprecation has been published. There is no basis for reading it as an attempt to evade auditing, so no such reading is offered. What has been confirmed stops at the marking in the spec. What partial disclosure actually conceals is something Pebblous examined once before in a separate case.

5.5Five comparison axes anyone can run today

The paper's third prescription can be executed immediately. Ask the same question many times while changing only the conditions, and watch whether the tilt of the answers changes. The paper proposes five axes.

• Asking through the API versus asking through the consumer chat interface
• Asking from different geographies
• Asking anonymously versus asking while logged in
• Different subscription tiers or client platforms
• Comparing competing brands against each other, and opposing political propositions against each other

This design has no prerequisites. It runs without log probabilities and without provider cooperation. That makes these five axes the most practical output this report can extract. What must not be misread is the nature of the result they produce.

5.6Black-box access cannot produce a guarantee, in principle

A 2024 FAccT paper with twenty authors settled this question. In general, it is impossible to make guarantees about black-box systems using a finite number of queries without additional assumptions. Black-box methods can show the existence of failures by finding inputs that elicit them, but they cannot produce evidence of absence. Running the five axes above and finding a difference is a finding. Failing to find a difference yields no conclusion that no intervention exists.

The same paper divides access into four tiers: black-box, grey-box, white-box, and outside-the-box. That last tier covers methodology, code, documentation, findings from internal evaluations, and deployment details. The attestation and declared reference distribution the paper asks for amount to institutionalizing that tier. So the paper's demand is not to observe harder. It is to raise the access tier.

This is where the thread left hanging earlier gets tied off. The Inference Attribution Problem is not a claim that nobody can know. It is precisely the opposite. Grant the privilege and it can be known; withhold it and it cannot be known in principle. Which makes this a problem of institutional design rather than a limit of the technology.

5.7Two unanswered questions stay unanswered

The paper poses two questions and answers neither. First, whether inference-time probability manipulation can significantly shift semantic framing while preserving factual accuracy and response quality. Second, whether such an intervention can be reliably detected through black-box observation alone. Partial answers can be found in other literature, but neither closes its question.

On the first question, the closest measurement is a 2026 study of logit-level intervention. On a task controlling reading level with Llama 3.1 8B, control accuracy rose from 37.11 percent using prompting alone to 84.53 percent with logit intervention. Under the same conditions, the perplexity measure of how natural the sentences read actually improved, from 11.99 to 8.88. The intuition that pushing hard wrecks the prose did not hold there. On a politeness control task, however, the same measure worsened from 18.58 to 25.92. Either way these are single cells for one model and one dataset, not averages.

There is a ceiling on how hard the push can go. When the authors varied steering strength alone, the result traced an inverted U. Accuracy peaks at a strength of 1.5 and falls off gently on both sides. Too weak and it loses to the pull of the original context; too strong and the bias begins to dominate the original logits within the candidate set, pushing the sampler toward statistically characteristic but contextually less plausible tokens. That over-steering erodes local fluency and long-range coherence, which in turn blurs the target characteristic from the judge's perspective and drags accuracy down with it. The authors describe it as a clear trade-off between steering strength and generation quality. Read the other way, it also says this. An intervention that must not be noticed has to stay under that ceiling.

The ethics section of that same paper runs head-on into this report's argument. The authors write that the characteristics that motivate their method also constitute its principal ethical risk. Because the intervention adds a positive bias to tokens that statistically characterize the designated target class, the mechanism is directionally symmetric. A score table built for a safety-oriented target helps mitigate harm, and by exactly the same principle a score table built for a harmful target reinforces that characteristic. The evidence is in their own experiments. In a flipped ablation that steered with an opposing class's score table, control did not merely weaken; the direction of control reversed. The authors add that the lightweight nature of the method, which requires no training, no auxiliary model, and only access to output logits, lowers the barrier to misuse. The people who built the steering technique wrote that down first.

There is an easy place to slip here. What that study controlled were stylistic attributes such as reading level, politeness, and toxicity. What the paper's first question asks about is the semantic framing of contested propositions, and that has never been measured. The accurate statement is this. For stylistic attributes, it has been measured that logit intervention can raise control substantially while holding or improving fluency scores. For semantic framing, nobody has measured anything yet. The authors drew that boundary themselves, listing broader model families, non-lexical attributes, and human evaluation beyond judge-based metrics as future work. Semantic framing sits on the non-lexical side.

The first question demands two things be preserved: response quality and factual accuracy. On the second of those, a measurement already points the other way. The Science experiments cited earlier fact-checked the 466,769 claims the runs produced, and the methods that raised persuasiveness systematically decreased factual accuracy. That result did not come from the logit layer. It does mean an observation exists, at an adjacent layer, that persuasiveness and accuracy do not travel together, which leaves the paper's first question that much more open.

The second question is emptier still. Watermarks are known to be detectable even in short spans, but that holds when the detector knows what was planted. Searching without knowing what was planted is a different problem, and no power calculation for that case has been published. Blur the distinction and you arrive at the false conclusion that because watermarks can be caught, steering can be caught too.

5.8Six lines of deployment-layer disclosure

Before the items, the size of the demand has to be clear. The inference policy transparency the paper proposes is not a demand to disclose everything. Four things are excluded from the start: technical decoding quality such as temperature and top-p, safety and toxicity filtering, user-prompted steering, and provenance watermarking. What a provider would disclose is whether sampling distributions are systematically modified for objectives beyond those four. The narrowness matters. Nobody is being asked to hand over weights or trade secrets. The ask is a yes or no on whether a purpose other than those four is in play.

Translating everything confirmed so far into a form usable in procurement and audit yields six items. These are not the paper's prescriptions copied over. They are rewritten against the actual conditions established in sections 5.2 through 5.4. This table is the working output of this report.

The last two of the six can go into procurement requirements today. Writing log probability access into the contract, and receiving deployment configuration change histories in signed form. The first four cannot be secured until providers offer them, but writing them down as demands is itself enough to show which standard is currently missing.

A company whose work is attaching quality judgments to data and recording those judgments as documents should explain why it is holding on to a preprint with no experiments and no citations yet. Four reasons.

6.1The procedure this paper asks for is something we already know how to build

What Pebblous does is attach to data the answer to where this value came from and what it looks good against. What this paper asks for has the same shape. The object is a served probability distribution instead of data. Define the difference between the served distribution and the model's own, declare a reference class, and check whether observation matches declaration. That is the structure of a data quality report, transposed. Only the object changed; the skeleton of the procedure is familiar.

6.2Data provenance is necessary but not sufficient

Most of what we have written over the past few months pointed one way, toward the proposition that data quality carries through into model behaviour. The origins of training data, turning labeling clicks into evidence, token-level unlearning. All of it is the lineage of how a model gets built. This paper attaches a caveat to that proposition. Even with the link from training data to model fully established, the stretch from model to user remains. It is a stretch with no lineage instrument on it at all. Data provenance is a necessary condition and not a sufficient one. Saying that caveat out loud, from the side that sells provenance, is what this report is for.

6.3Anyone building on a commercial API already operates this layer

The property of FUDGE from section 1.2 returns here. That steering is possible with output logits alone means an organization that did not build the model can be an operator of this layer. Any organization building a service by laying its own prompts, rerankers, and filters over a commercial API is already running a deployment layer with its own hands. The trouble is that such interventions usually survive only in code review records, and never reach audit documents, contracts, or customer notices.

Two working items come out of that. First, build an inventory of deployment-layer interventions: what was added, for what purpose, and since when. Second, put log probability access into procurement requirements. Auditing requires seeing the distribution, and that right does not materialize later if it was not secured at contract time. Both can be started today. As section 4.4 noted, no statistic exists on how common such interventions are in Korea. The gap itself says something about the current state.

6.4The question that comes after a labeling duty

Korea was the first country to bring an output labeling duty fully into force. The question that label answers is whether AI made this. The question left over is under which inference policy this answer was sampled. The distance between those two questions is the one layer this report has been about. Arguing to widen the audit object from training data to the deployment pipeline is something only the side setting audit standards can say, not the side selling provenance.

The paper puts it more sharply. Its abstract closes on one line. Who controls the probability distribution between the model and the user? In the conclusion that question stretches out: under which inference policy was this output sampled, and who governs the probability distribution between what the model would have generated and what the citizen is allowed to observe? The name the author gives that conclusion is inference sovereignty. It proposes moving the problem from how to align a model to who holds that distribution.

The paper saves one contrast for last. Historically, persuasive intermediaries were publicly identifiable. Newspapers had publishers, television advertisements had sponsors, and search engines presented inspectable ranking lists. Conversational AI introduces a private, interactive, and dynamic intermediary. Combine it with undisclosed inference steering, the paper writes, and it creates a compounding systemic risk: personalization plus authority plus scale plus opacity. Three of those four have already arrived. The remaining one is what this report has been about.

This report should not read as an accusation. It does not say someone is planting advertisements in probabilities right now, and it does not say there are signs of it. It says the intervention is technically feasible, cheap, and traceless, and that no document exists by which an outsider could tell whether it is there or not. Leaving blanks blank was this report's method. Once the items are named, the rest is working practice.

Academic

• 1.Camargo, A. (2026). The Invisible Editorial Layer: Formalizing Undisclosed Inference-Time Steering, Probability Placement, and the Attribution Problem in Deployed Language Models. arXiv:2608.24662v1 [cs.AI], 2026-08-25. CC BY 4.0. Single author, Bluecore Consulting (Brazil). The source of the three concepts this report treats. Contains no experiments and no measurements. arXiv
• 2.Dathathri, S., See, A., Ghaisas, S., Huang, P.-S., McAdam, R., Welbl, J. et al. (2024). Scalable watermarking for identifying large language model outputs. Nature 634, 818–823. DOI 10.1038/s41586-024-08025-4. Source for the +0.57% latency figure, the live A/B across roughly 20 million responses, and the Gemini deployment. Nature
• 3.Hackenburg, K., Tappin, B. M., Hewitt, L., Saunders, E., Black, S., Lin, H., Fist, C., Margetts, H., Rand, D. G. & Summerfield, C. (2025). The levers of political persuasion with conversational artificial intelligence. Science 390(6777), eaea3884. DOI 10.1126/science.aea3884. Three large-scale experiments, N = 76,977 participants, 19 LLMs, 707 political issues, 466,769 claims fact-checked. Prompting alone boosted persuasiveness by as much as 27% (post-training by 51%), and the methods that raised persuasiveness systematically decreased factual accuracy. Science
• 4.Williams-Ceci, S., Jakesch, M., Bhat, A., Kadoma, K., Zalmanson, L. & Naaman, M. (2026). Biased AI writing assistants shift users' attitudes on societal issues. Science Advances 12(11), eadw5578. DOI 10.1126/sciadv.adw5578. N = 2,582. Attitudes shifted without participants recognizing the bias, and warnings did not prevent it. Science Advances
• 5.Casper, S., Ezell, C., Siegmann, C., Kolt, N. et al. (2024). Black-Box Access is Insufficient for Rigorous AI Audits. FAccT '24, 2254–2272. DOI 10.1145/3630106.3659037. Source for the four access tiers and for the impossibility of black-box guarantees. arXiv
• 6.Yang, K. & Klein, D. (2021). FUDGE: Controlled Text Generation With Future Discriminators. NAACL 2021. arXiv:2104.05218. Source for the condition that output logits alone suffice for steering. arXiv
• 7.Dathathri, S., Madotto, A., Lan, J., Hung, J., Frank, E., Molino, P., Yosinski, J. & Liu, R. (2020). Plug and Play Language Models: A Simple Approach to Controlled Text Generation. ICLR 2020. arXiv:1912.02164. The last author is Rosanne Liu, which differs from the attribution in reference [8] of the source paper. arXiv
• 8.Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I. & Goldstein, T. (2023). A Watermark for Large Language Models. ICML 2023. arXiv:2301.10226. Softly promotes the use of green tokens during sampling with negligible impact on text quality. arXiv
• 9.Liu, A., Sap, M., Lu, X., Swayamdipta, S., Bhagavatula, C., Smith, N. A. & Choi, Y. (2021). DExperts: Decoding-Time Controlled Text Generation with Experts and Anti-Experts. ACL 2021. arXiv:2105.03023. / Li, K., Patel, O., Viégas, F., Pfister, H. & Wattenberg, M. (2023). Inference-Time Intervention. NeurIPS 2023. arXiv:2306.03341. / Turner, A. M. et al. Steering Language Models With Activation Engineering. arXiv:2308.10248.
• 10.An, H., Park, S., Jin, H. & Han, Y.-S. (2026). Steering Language Models Before They Speak: Logit-Level Interventions. arXiv:2601.10960v2 (2026-05-28). Yonsei University. The figures cited here are from v2; v1 has no perplexity column. Llama3.1 8B, OSE (reading level): prompting accuracy 37.11% and perplexity 11.99, versus SWAI 84.53% and 8.88. WikiPol (politeness): 56.70% and 18.58, versus 77.20% and 25.92. Steering bias δ traces an inverted U peaking at 1.5. The ethics section states the directional symmetry and the lowered barrier to misuse, and lists non-lexical attributes and human evaluation as future work. arXiv
• 11.Chen, L., Zaharia, M. & Zou, J. (2023). How is ChatGPT's behavior changing over time? arXiv:2307.09009. Behaviour varies greatly behind an unchanged API name, and when and how updates happen is opaque. arXiv
• 12.Entman, R. M. (1993). Framing: Toward Clarification of a Fractured Paradigm. Journal of Communication 43(4), 51–58. DOI 10.1111/j.1460-2466.1993.tb01304.x. Framing manipulates salience rather than facts. / Kröger, P. & Barkett, E. (2025). Don't Change My View: Ideological Bias Auditing in Large Language Models. arXiv:2509.12652.
• 13.Chatterji, A., Cunningham, T., Deming, D., Hitzig, Z., Ong, C., Shan, C. & Wadman, K. (2025). How People Use ChatGPT. NBER Working Paper 34255. Information-seeking share 14% (July 2024) rising to 24% (July 2025). NBER

Policy, statistics, and official announcements

• 14.European Commission (2025-02-04). Guidelines on prohibited artificial intelligence practices. Breaks each prohibition into cumulative requirements and judges that using AI for personalized advertising is not inherently manipulative. Non-binding.
• 15.Korea, Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust and its Enforcement Decree, in force 2026-01-22. Article 31, transparency obligations (advance notice, output labeling, enhanced deepfake labeling). Violations draw a corrective order and an administrative fine of up to KRW 30 million (about $21,000). Korean Law Information Center
• 16.FTC (2025-09-11). 6(b) Orders to Providers of Consumer-Facing AI Companion Products. Seven companies. The demanded items include how interactions are monetized and how the chatbots generate responses.
• 17.Google (2026-05-19). Identifying AI-generated media online. Official blog. More than 100 billion images and videos watermarked with SynthID, plus 60,000 years of audio. Names OpenAI, Kakao, and ElevenLabs as partners. Google Blog
• 18.xAI (2025-05). Official statement on the unauthorized Grok prompt modification, plus the public system prompt repository. Repository created 2025-05-15, last updated 2025-11-17 (confirmed via GitHub API). xai-org/grok-prompts
• 19.OpenAI. openai-openapi official spec (logprobs, top_logprobs capped at 20, logit_bias, and system_fingerprint marked deprecated). / Anthropic. anthropic-sdk-python message creation parameters (inference_geo, user_profile_id, service_tier, with no log probability parameter). / Google. python-genai type definitions (response_logprobs, logprobs).
• 20.WPP Media (2026-06-16). This Year Next Year summer forecast. Generative search advertising from $5.1 billion (2026) to more than $100 billion (2030). / eMarketer (2026-06-04). US AI Advertising Forecast 2026. More than 80% of AI advertising in 2026 sits beside AI content rather than inside chatbot conversations.
• 21.Reuters Institute (2026-06-16). Digital News Report 2026. About 100,000 respondents across 48 countries. Trust in AI chatbot answers 20%, click-through to original sources 4%. / KPMG × University of Melbourne (2025). Trust, attitudes and use of AI: A global study 2025. More than 48,000 people across 47 countries. 66% use AI output without verification.
• 22.Gartner (2026-05-27). Survey finding that consumers want AI shopping help but not AI purchase decisions. Gartner / Google (2026-08-11). Gemini app passes one billion monthly users.

Pebblous adjacent (cross-links)

• 23.Pebblous, on the FTC policy statement treating undisclosed output adjustment as consumer deception. blog/ftc-ai-accuracy-deception
• 24.Pebblous, on models that change without a version number and the disclosure gap that follows. report/silent-model-updates-disclosure-gap
• 25.Pebblous, on the limits of partial disclosure that names the tool and hides the source. report/microsoft-mai-provenance-gap
• 26.Pebblous, on the labeling audit evidence required by Article 10 of the AI Act. report/eu-ai-act-article10-labeling-audit-evidence / on the AI Act compliance timeline. report/eu-ai-act-august-2026-deadline-reality
• 27.Pebblous, on token-level provenance and unlearning. blog/token-level-provenance-unlearning / on watermark ecosystem monitoring. blog/watermark-ecosystem-monitoring / on the visible watermark setting change. blog/google-visible-watermark-toggle-credentio