Field-Theoretic Memory for AI Agents
Continuous Dynamics for Context Preservation
New Accepted at ICLR 2026 · AI WILD Research
Open research lab · AI agent reliability
Research
you can
run.
Rotalabs studies how AI agents fail when they act in the world, and builds the benchmarks, probes, monitors, and protocols to measure it. Every result is published, installable, and reproducible from the saved runs.
Open source · Pre-registered protocols · Reproducible from saved runs
Adversarial evaluation · peer-reviewedICLR 2026 · AI WILD
Quality-Diversity Evolution for discovering diverse vulnerabilities in LLM safety.
Red-teaming that evolves its own attacks. A quality-diversity (MAP-Elites) search illuminates a diverse archive of interpretable attack strategies - not opaque token strings - across GPT-4o-mini, Claude, Gemini, and open-weight models.
6 strategies × 6 encodings · 4 LLMs
Accepted at the ICLR 2026 Agents in the Wild workshop, and shipped as rotalabs-redqueen - seeded runs are bit-reproducible and cross-language identical across Python and TypeScript. A baseline a safety team can triage, reproduce, and defend against.
MethodArchiverotalabs-redqueen
Spotlight - adversarial evaluation
Red-teaming that evolves its own attacks.
This is the work we've pushed hardest on. The method is peer-reviewed, it ships as a package anyone can run, and it's already turned up a real finding about how model safety shifts from one model generation to the next.
MethodQuality-diversity (MAP-Elites) evolution of interpretable attack strategies - peer-reviewed at ICLR 2026, AI WILD. (arXiv 2606.00801)
FindingRun across four Gemma generations, it shows safety alignment is non-monotonic - the mid-series model is the most attackable. (arXiv 2606.00813)
ReproducibleShipped as rotalabs-redqueen on PyPI and npm - seeded runs are bit-for-bit identical across Python and TypeScript.
AuditableEvery campaign projects into an audit-ready report - evolutionary penetration testing for language models and agents.
Research program
Nine fronts on agent reliability.
Interpretability probes, adversarial testing, verification, evaluation science, steering, and trust propagation - released as papers and installable methods through 2026.
01
Agent Reliability
Papers Q1 2026 Detection and verification for autonomous AI. Methods to identify when agents hallucinate, fail, or strategically underperform.
02
AI Evaluation Science
Published Adversarial evaluation that resists gaming - quality-diversity (MAP-Elites) red-teaming that evolves interpretable attacks to surface hidden vulnerabilities across frontier LLMs.
03
Memory Systems
Published Field-theoretic memory treating stored information as continuous fields governed by PDEs - semantic diffusion, thermodynamic decay, and multi-agent field coupling.
04
Reasoning Verification
Papers Q1 2026 Verifying AI outputs without ground truth. Methods for code, plans, and decisions from reasoning models like o3 and R1.
05
Interpretability
Active Practical interpretability for production. Not "understand the model" but "should I trust this output?"
06
Multi-Agent Trust
Active Trust dynamics when agents coordinate with agents. Propagation, verification, and failure modes in multi-agent systems.
07
Adversarial Robustness for Agents
Active Attack taxonomies, detection, and defenses for agentic AI - beyond prompt injection: tool poisoning, memory corruption, planning attacks, and coordination exploits.
08
Uncertainty Quantification
Active Calibrated confidence for AI decision support. Activation-based uncertainty estimation, propagation through reasoning chains, and calibration without ground truth.
09
World Models & Physical AI
Active Beyond language models: AI that understands and predicts the physical world. World models, embodied reasoning, simulation, and physics-aware AI.
The hard problem
Is the new model as safe as the one it replaces?
Model upgrades ship with an unchecked assumption: the new version is at least as safe as the old one. We tested it by running the same quality-diversity attacker - the method behind Red Queen - against four generations of Google's Gemma. Safety went down before it went up: Gemma 3 was significantly easier to break than Gemma 2, and misinformation attack success jumped from 29% to 99% between them. Red Queen evolves a diverse map of working attacks instead of replaying a fixed list, saves that map so old attacks can be replayed against the next model, and adds no randomness of its own: from the same seed, its Python and TypeScript versions make identical choices.
Paper · open-source engineICLR 2026 · AI WILD
Quality-Diversity Evolution for Discovering Diverse Vulnerabilities in LLM Safety.
Semantic MAP-Elites red-teaming across frontier LLMs
6 strategies × 6 encodings · 4 LLMs
Quality-diversity search over interpretable attack strategies, across single-turn, multi-turn, and agentic/MCP surfaces. Every campaign projects into an audit-ready compliance report. Ships as rotalabs-redqueen on PyPI and @rotalabs/redqueen on npm.
arXiv 2606.00801PythonTypeScript
Research distribution
Papers are only half the interface.
Rotalabs publishes installable packages so methods can be inspected, reproduced, and embedded into new experiments - all 12 on PyPI and npm, Apache-2.0.
$ pip install rotalabs-probe
$ pip install rotalabs-redqueen
$ pip install rotalabs-verity
$ pip install rotalabs-eval
# probes · adversarial testing · verification · evaluation
rotalabs-context
Context intelligence for AI agents.
rotalabs-probe
Sandbagging detection via activation probes.
rotalabs-steer
Steering vectors for runtime behavior control.
rotalabs-verity
Neuro-symbolic verified code synthesis.
rotalabs-cascade
Trust-based decision routing.
Recent papers 02 04 05
Published, preprint, in progress.
Cross-Generational Transfer of Adversarial Attacks Reveals Non-Monotonic Safety Alignment in LLMs
A longitudinal QD red-team of the Gemma family across four generations
Closing the Activation-Cone Blind Spot: Response-Time Probing and Unified Defense
Why prompt-time activation defenses miss prefilling attacks
From the blog
Notes from the lab.
Oct 12, 2026 Sep 16, 2026 Jul 12, 2026
High AUROC, Wrong Feature: Auditing Our Own Safety Probe
In June we reported a safety probe that scored AUROC 0.97-1.00 across seven models and stopped every prefilling attack. Then we audited it. On...
Portable Triton Kernels, With the Roofline to Prove It
The kernels behind rotalabs-accel have an open companion repo: fused RMSNorm, SwiGLU, MoE dispatch, and 4-bit W4A16 GEMM in pure Triton, each with a...
Pre-Extracted Steering Vectors, Ready to Use
Seven steering vector sets for Qwen3-8B, Mistral-7B, and Gemma-2-9B are on Hugging Face. Change model behavior at inference time, no fine-tuning required.
Publish the work, and let people try to break it. That's the only credibility worth having.Rotalabs operating principle
In production
Rotalabs is the open research lab. The agent-governance research here ships as RotaGrant by Rotascale →, which states what an agent may do before it acts and records what was decided. There is a live deployment you can inspect, not a recording: see the demo →