daimon

A thin trainable wrapper that gives a frozen LLM a feedback channel into its own activations, so it learns when to trust itself — answer confidently, or refuse / look it up / ask, honestly.

Instead of text-based reflection ("think again"), daimon reads the model's hidden states with a trainable encoder, compresses them into cognitive tokens, and injects them back through gated cross-attention. The base weights never change — only a wrapper (~2% of params) is trained. The result is selective prediction: the model abstains on questions it would get wrong. And — the key finding — this latent channel is not reachable by prompting.

Installation

daimon is the meta-attention library (the mechanism, a separate repo) plus four pip packages under daimon/. Production inference needs only the library + daimon-voices.

# from the daimon-framework folder (editable install)
pip install git+https://github.com/artem-x-meta/meta-attention   # the mechanism first
git clone https://codeberg.org/imperius/daimon && cd daimon
pip install -e daimon-voices -e daimon-agent -e daimon-loom   # library+voices suffice to run a wrapper
pip install -e daimon-deploy                            # optional: export to llama.cpp (GGUF)

# runtime deps
pip install "transformers>=5.11" datasets accelerate
pip install bitsandbytes   # optional: nf4 / int8 quantized bases

Quickstart

Load a frozen base, attach a trained Doubter, generate. The two-pass mechanism is handled for you.

from daimon import DaimonConfig, DaimonPipeline
from daimon_voices import Doubter

cfg = DaimonConfig(
    model_name="Qwen/Qwen2.5-14B-Instruct",
    device="cuda", dtype="bfloat16", quantization="nf4",
    target_layers="late", cross_attn_layers="late",   # or explicit [32,…,47]
)
pipe = DaimonPipeline.from_pretrained(cfg)
pipe.attach(Doubter.from_checkpoint("doubter.pt"))

print(pipe.generate("What is the capital of France?"))
# → "The capital of France is Paris."
print(pipe.generate("<an unanswerable / false-premise question>"))
# → "I'm not confident enough to answer this question accurately."

Dimensions are auto-detected from the base; target_layers accepts explicit lists or the presets "all" / "late". Ready-made wrappers: meta-qwen-14b-universal.

The meta-attention mechanism

The idea: a trainable encoder extracts an uncertainty signal from the language model and feeds it back, surgically, through meta-attention heads and gates that sit on the selected layers.

Main components

• Activation hooks — capture the base's hidden states.
• Cognitive encoder — compresses the activations into cognitive tokens (one per layer).
• Gates — a scalar (tanh) multiplier deciding how much introspection each layer needs.
• Meta-attention heads — one per layer; cross-attention that mixes each cognitive token into its own layer. This is where the injection actually happens.

Two-pass injection

One run = two forward passes of the same frozen model.

Pass 1 (read):  prompt → frozen base → hooks capture the last-token hidden states
                → cognitive encoder → cognitive tokens (one per layer) → buffer
Pass 2 (write): prompt + injected cognitive tokens via gated cross-attention
                → frozen base generates the answer (or an honest refusal)

Training the wrapper

Training adds a backward pass on top of the two passes. The gradient flows through the frozen base to the wrapper — the base's weights don't change, but the graph through it exists, so the base LLM itself acts as the loss function. The collector runs questions through the base, captures activations and marks each answer right/wrong (the oracle); the wrapper then learns to inject so the model refuses exactly the questions it would have gotten wrong.

Automatic Gain Control (AGC)

Over a long generation the injected signal self-amplifies (positive feedback — each splash fills the "water tank") and the model spirals into refusing everything. AGC (a term from analog electronics) damps it: a decay pulls the injection strength back toward a floor, holding it at a setpoint instead of letting the loop run away. It composes with the trained gates and with the gain knob.

Honest metrics (base vs Doubter, done right)

The Doubter turns "always answer" into "answer or refuse", so plain accuracy is misleading — a refusal isn't a wrong answer. You need selective prediction metrics: not "how often right overall", but "right on what it chose to answer, and are its refusals justified".

The trick is the oracle: ahead of time, run the clean base and record whether it would have answered correctly (pass1_correct). Every question then lands in one of four boxes:

The headline metrics (numbers: a real Gemma-4-12B run):

• selective accuracy — of what it answered, the share correct (the value-add). Gemma-hard 53.2 → 72.0% (p=0.001).
• refusal precision vs the oracle — how well-targeted the refusals are.
• over-refusal rate — the cost of caution.

Meta-attention vs a text prompt

The obvious alternative to a trained wrapper is to just ask the model to be careful in a system prompt. It doesn't work — the latent channel is not reachable by prompting. In a fair 2×2 on Qwen2.5-14B (both arms allowed to say "unsure"), a text prompt is nearly inert on the axes where uncertainty matters, while the wrapper moves the decision decisively.

The uncertainty knob (gain)

The injection coefficient becomes a continuous control knob when you set it by hand instead of letting AGC decay it. gain=1.0 is the trained baseline; >1 amplifies the doubt (more refusals), <1 attenuates, <0 inverts it toward confidence.

from daimon_voices import Doubter
doubter = Doubter.from_checkpoint("doubter.pt"); pipe.attach(doubter)
doubter.set_gain(1.5)   # more cautious — more refusals
doubter.set_gain(-0.5)  # more confident — invert the injection
pipe.set_gain(0.8)       # the mixing console: dial every attached voice

The Watchdog — an uncertainty sensor that gates strong actions

Injection modulates the decision, not generation — held on over a long (code) output it accumulates off-task drift and corrupts it. The Watchdog fixes that: it reads the cognitive token through a linear ConfidenceProbe at the decision point and gates the strong stuff — pointwise injection into the decision window (the headline mode), or an external action — retrieve, clarify, escalate — with no injection at all (the read-only mode).

from daimon_voices.watchdog import Watchdog, ConfidenceProbe
watch = Watchdog(ConfidenceProbe.load("probe.pt"))
if watch.score(pipe, prompt).is_uncertain:
    pipe.set_gain(1.5)   # decision window only; after the tool_call → set_gain(0), code stays clean

The wrapper factory (build-universal)

A wrapper over-fit to one task transfers caution but over-abstains — it drops the axes where you should act. The fix: train on a balanced diverse mix (commit + hold across the whole agentic decision space). This recipe is codified as one command — a factory for a general uncertainty wrapper over any base model.

metaloom build-universal --run-dir runs/uni --model-name Qwen/Qwen2.5-14B-Instruct \
                 --quantization nf4 --per-class 70 --epochs 6 \
                 --suite suite.json --eval --export-gguf

It assembles the mix (When2Call · PopQA · SQuAD2, model-agnostic via the tokenizer; --suite excludes its questions = leakage guard), runs collect → train with explicit multi-action targets, then optionally a per-axis eval (--eval → floor / commit_mean) and a GGUF sidecar (--export-gguf).

Train your own — collect → train → eval

The whole cycle is three metaloom CLI stages linked by one run.json manifest (model · layers · dataset). collect writes it; the rest read it via --run-dir, so you never retype the flags.

# 1 · collect — run the base, capture activations + the oracle flag
metaloom collect --run-dir runs/my --model-name Qwen/Qwen2.5-0.5B-Instruct \
                 --dataset mmlu --target-layers late --encoder-type selective --mcq-direct

# 2 · train — only the wrapper; base frozen, Pass-1 not recomputed
metaloom train --run-dir runs/my --epochs 6

# 3 · eval — base vs Doubter on the held-out split (selective metrics)
metaloom eval --run-dir runs/my

# 4 · talk — run.json carries model+layers+checkpoint
daimon-agent run --run-dir runs/my "What is the capital of France?"

The two-pass cost is largely cached away — collect-once, a slice trainer for the bottom of Pass-2, and the KV-cache at inference:

The whole cycle for 0.5B–8B models runs locally on a laptop with 4 GB VRAM (RTX 3050) via nf4 + the slice-trainer. The Python API (ActivationDatasetCollector, Trainer, TrainerConfig) mirrors the CLI for full control.

Agentic runtime

Run the wrapper in a tool-use loop. The uncertainty signal routes into the action — answer / call a tool / clarify / refuse — via native tool-calling (the tokenizer's own format), not hand-rolled ReAct text.

daimon-agent run --run-dir runs/my "Book me a flight to Tokyo"      # tools + history loop
daimon-agent chat --run-dir runs/my                                # interactive

Deploy to llama.cpp — without a GPU

Export the trained wrapper to a GGUF sidecar + ggml/C++ forward, so calibrated refusal runs on a quantized base with no CUDA or PyTorch (CPU, Metal, edge).

metadeploy export --run-dir runs/my        # → doubter_sidecar.gguf
# load the sidecar in the llama.cpp fork; the gain knob lives in META_GAIN
META_GAIN=1.0 llama-meta-generate -m base.gguf --meta doubter_sidecar.gguf -p "…"

GoalAnchor — the agentic runtime

The GoalAnchor voice deploys through the same machinery, with a transformer encoder ported to ggml (re-validated bit-for-bit against PyTorch, max |Δ| 3.8e-6) and a different lifecycle: the goal is encoded once into a static latent anchor and re-injected on every step of every turn as the conversation grows — a latent "spec reminder" that does not wash out with context length.

metadeploy export --checkpoint goal_anchor.pt --hidden-dim 5120   # → goal_anchor.gguf
# multi-turn agentic session: cog encoded once from the goal, held across all turns
META_ANCHOR="TASK: …\nREQUIREMENTS (all mandatory):\n1. …" \
META_USER="<initial task>" META_OBS=turns.bin \
llama-meta-anchor-session -m base.gguf --meta goal_anchor.gguf

Architecture: a library + four packages

One mechanism (the meta-attention library), one family of voices speaking through it, three independent consumers. Production inference installs only the library + daimon-voices.

API reference

CLI

• metaloom collect|train|eval --run-dir <dir> — the training pipeline; stages share run.json
• metaloom build-universal --model-name N — the diverse-mix factory (a general wrapper)
• daimon-agent run|chat --run-dir <dir> — agentic runtime
• metadeploy export --run-dir <dir> — GGUF sidecar

Python

• DaimonConfig(model_name, target_layers, cross_attn_layers, dtype, quantization, …)
• DaimonPipeline.from_pretrained(cfg) → .attach() / .detach_all() / .generate() / .set_gain()
• Doubter.from_checkpoint(path) · .set_gain(x) · .save_checkpoint(path)
• Watchdog(ConfidenceProbe) · .score(pipe, prompt).is_uncertain

FAQ

Does this make the model smarter?

No. It surfaces an existing internal uncertainty signal and turns "answer at random" into "answer when confident; otherwise refuse / look up / ask". It adds no knowledge.

Why not just prompt the model to be unsure?

Because a prompt can't reach the latent channel — measured, the text prompt is nearly inert while the wrapper moves the decision in multiples. See the comparison.

Does a wrapper transfer across models?

No — it's calibrated to one base's activation distribution; it won't glue onto a different model or even a different fine-tune. Use build-universal per model.

How big is the wrapper? Can I train on a small GPU?

~2% of the base. The whole collect→train→eval cycle for 0.5B–8B runs on a 4 GB laptop GPU via nf4 + the slice trainer.