A physical consequence that survives to the encoder, then dies: an audit of a reconstruction-trained world-model latent
Claim, in one line: In a controlled two-link-arm rig, a hidden-mass physical consequence that is well-posed in the analytic auditor (R² = 0.992) and recoverable from the rendered observation at matched 12-D capacity (R² = 0.716) is absent from the difference of a reconstruction-trained autoencoder's latents (R² = −0.175) — the representation a latent-space verifier would have to consume.
That is the whole result. The rest of this note is what was measured, why the controls make the number hard to dismiss, and where the claim stops.
Why it matters
Self-verifying world models are frequently proposed as a route to auditable agents: if a model can flag its own physics violations, downstream control can trust it more. That promise rests on an unstated assumption — that the learned latent actually contains the physical consequence a verifier would check. If the latent drops it, no verifier built on top of that latent can recover it, no matter how clever the verifier is.
This experiment isolates exactly that assumption, in a setting small enough that every claim can be checked against ground-truth dynamics.
The setup
The rig is a two-link arm (Spong dynamics) with an exact analytic auditor. The intervention is a hidden mass change: two rollouts share the same observable input window and differ only in their physical consequence — the resulting window-scale acceleration, qdd_window. The arm is rendered to 48×48 grayscale stacked frame windows (frame interval 0.08 s, stride 8), an autoencoder is trained with a reconstruction objective, and a latent dynamics ensemble is trained on top.
The question: does the clean-vs-heavy consequence delta survive into the latent? Concretely, does Δz_next predict Δqdd_window on matched pairs?
Controls, and why they are non-negotiable
A negative result in latent space is cheap to produce and easy to fake by accident. The pipeline is gated so that each failure mode that would counterfeit the result is ruled out before the headline number is read:
- No input leak (Gate B). Input-only detectors (latent density and ensemble disagreement) cannot separate clean from shifted rollouts: AUROC 0.500 / 0.500, matched-pair Δ = 0. The two conditions genuinely share the input; anything the latent distinguishes must come from the consequence, not the cause leaking in.
- The AE is competent (recon gate). Reconstruction error is 3.6× better than a mean-frame baseline, and the shifted condition reconstructs as well as clean (ratio 0.99). The latent is not simply broken.
- Capacity-matched control. The raw observation is reduced to 12 PCA components — the same dimensionality as the latent — and probed with the identical 3-seed nonlinear MLP probe on the identical matched pairs. Without this, "pixels beat the latent" is a capacity artifact, not a finding. With it, the comparison is like-for-like:
R²(Δraw_obs_next → Δqdd_window) = 0.716at PCA-12, even though those 12 components retain only ~33% of the pixel-delta variance. A 12-D bottleneck can keep the consequence; this one didn't. - Paired nuisance. Clean and heavy renders share a per-pair jitter seed, so render noise cancels in the difference; a non-jittered diagnostic agrees (−0.162).
- Pre-registered thresholds, read once. The 0.60 Gate A bar and the 0.30 delta bar were fixed before the terminal run and never softened; per the pre-registered rule, downstream detector tables were not interpreted once Gate A failed.
The numbers
Same matched pairs, same target, same probe, capacity matched at 12 dimensions:
| stage | probe | R² → Δqdd_window |
reading |
|---|---|---|---|
| auditor | Δtrue_pose_window |
0.992 | consequence is well-posed |
| observation | Δraw_obs_next (PCA-12) |
0.716 | recoverable from rendered pixels at matched capacity |
| latent | Δz_next |
−0.175 | absent from the learned latent difference |
The consequence survives to the encoder and dies inside it (pixel_minus_latent_gap = 0.891). The negative R² means the latent difference predicts the consequence delta worse than its own mean. The static gate agrees: z_next + a → qdd_window pools at 0.425 against a 0.60 bar. Formal verdict of the run: VOID-FIDELITY — the latent-space verifier comparison is unreadable, because the signal it needs never reached the latent.
Where the claim stops
This is not a claim that learned latents cannot support physics auditability, and not a claim that reconstruction objectives discard physical consequences in general. It is bounded to this reconstruction-trained AE stack and this observation/window family. The bounded mechanism hypothesis — for this stack only — is that the reconstruction objective allocated limited latent capacity to visually salient structure rather than to the low-variance, audit-relevant consequence delta. Testing whether that generalises across objectives is precisely what a transfer matrix would do, and it has not been run. Three-seed probe variance is small (±0.016 on the delta gate) but this remains a single environment and a single architecture family.
Relation to prior work
Sobal et al. (2022, arXiv:2211.10831) compared reconstruction-trained generative world models against JEPA objectives in a moving-dot environment and probed for the dot's input-visible state under distractor noise, finding regime-dependent wins for each objective. Same family of question — what does the latent keep? — but a distinct instantiation: here the input is held fixed by construction, the probed quantity is a hidden-cause physical consequence rather than visible state, and the loss is localised along an auditor → observation → latent chain rather than compared across objectives. Causal-JEPA (Nam et al. 2026, arXiv:2602.11389) occupies the intervention-aware training direction — object-level latent masking to force interaction-dependent prediction — which is one candidate answer to the failure documented here, not an alternative measurement of it. The natural next experiment is to swap the representation objective (predictive / JEPA-style) into this exact rig and re-read the same delta gate; that changes the question, and is deliberately out of scope for this closeout.
The so-what
If you are building an agent system whose safety story includes "the world model checks its own physics," that story is only as good as the latent's retention of audit-relevant consequences — and retention is measurable, cheaply, before you build the verifier. The chain probe above (oracle → capacity-matched observation → latent, on matched hidden-cause pairs) is a ~zero-dependency numpy harness you can point at your own stack. The repository is intended to be attacked: if you can find the confound that breaks the 0.992 → 0.716 → −0.175 chain, the critique issue template is waiting.