The state the tokens never showed

This story starts with a different kind of model.

On reasoning LLMs we built a thing called NAD (Neuron Activation Distribution): while the model answers, record the activation distribution of tens of thousands of neurons — never reading what it wrote, only these internal states. The result: among many sampled answers to the same question, the neuron activity alone picks out the one more likely to be right. Confidence and hesitation are not written into the tokens, but the internal state carries them.

It left one question open: is this a quirk of language models, or a property of large models in general?

Carry the same idea into embodied AI: would the inside of a VLA model hold a similar signal? We took a cooking robot to find out. Its "words" are not text but twenty joint actions per second; it too can "think wrong" — not a wrong answer, but an arm frozen mid-air, or shuttling between two pots until time runs out. The two rollouts below start from a bit-identical simulator state, run the same model, and differ in exactly one thing: the noise stream used for sampling. The left one puts both pots on the stove in 19 seconds. The right one struggles for the full 26, times out, and fails.

Whatever separates these two runs never appears in any token. The action stream keeps flowing, the trajectory keeps extending, every frame looks like work being done. To tell them apart while they are still running, the output is the wrong place to look.

Part one — what a trap looks like in the physical world

First, the failure itself. Sample 32 rollouts from one initial state — again, only the noise differs — and 14 succeed while 18 fall into a trap, on a 52-step budget.

We call this whole family of failures a trap: the rollout keeps running, but its progress is already dead. It wears two main faces — an arm hanging mid-air, nearly motionless, consecutive frames identical; or an arm shuttling between the two pots, returning to the same spot again and again, plenty of path and zero progress. Two looks, one condition: caught in a trap.

The rest is a grab-bag of still moving, but doing the wrong thing: pots lifted and dropped, placed and then dragged away (all 32 trajectories, frame by frame against the deep-layer neuron activations).

From the token side, three limits you cannot get around:

• The action stream won't tell you. A stuck model still emits a full, well-formed action chunk every step — ten numbers, right format, normal magnitudes. No error, no silence. The failure happens in the form of perfectly normal output.
• Length has two readings. A long trajectory might mean the problem is hard, or that the run is already stuck. The two call for opposite responses — wait it out versus cut it off — but the trace shows one symptom: long.
• The verdict comes at the finish line. The success predicate stamps only when the episode ends. By the time failure is "confirmed", the 26 seconds are spent.

Part two — the neurons knew all along

Inside certain layers of this VLA, every control step lights up a small, sparse set of neurons to do the work — lighting up the top 4 to handle that step. Which four are lit — call that roster the pattern.

While the arm is working, the pattern reshuffles step after step. The moment the arm stalls, the pattern freezes: the same four pathways stay lit until the clock runs out. The trap is written right there, inside the neurons — while the action stream shows nothing at all.

So the detector can afford to be one sentence long: count how much the pattern changes per step, divide by this rollout's own opening rate to get a dimensionless ratio r(t), and fire when it spends three consecutive steps below θ = 0.95. No learning, no calibration, four constants, all frozen in advance.

On that corpus the rule calls 80.1% of rollouts correctly against a 66.8% majority-guess baseline. On a second, independently collected corpus of 512 rollouts it calls 82.0% against 57.8% — with the same threshold. Because the ratio divides by the rollout's own opening, θ is a dimensionless number, and the false-alarm rates the two corpora produce at any given θ agree within two points, bracket by bracket.

The false alarms deserve their own sentence. Of 203 alarms, 19 land on runs that ultimately succeed — and those 19 are the slow successes, median length 48 steps against 39 overall. They really did stall, then walked out of it. So the alarm's semantics are "this run is stuck right now", not "this run is doomed". That distinction pays off below.

Part three — an honest word about why it works

The first time the deep-layer pattern froze on screen, it looked like magic — until the control experiment made it soberingly plain:

Robot stuck → observation unchanged → model input unchanged → of course the neuron activations don't change. The activation's stickiness correlates with the input's own stability at r = +0.93; regress the input out, and the activation metric collapses to chance.

The neurons are not an oracle. They are a free state sensor: they faithfully write "the physical world has stopped moving" into a log the model produces anyway. Mundane is precisely why it is dependable — nothing mystical, so nothing fails mystically. And free is meant literally: neuron activation is a by-product of the forward pass, so reading it adds no inference and no probe.

One counter-intuitive detail. Which neurons are lit carries almost no outcome information — the static roster identifies the initial scene at nearly 100% accuracy yet is nearly useless about success once scenes are held out. Identity is a fingerprint of the scene; change is the state. The ratio above is invariant to renumbering the neurons, so it takes only the latter.

One more thinking — can it be rescued, live?

An alarm that only keeps score is a dashboard nobody reads. So the last experiment used it as a trigger: a fresh rollout runs online — threshold and all constants frozen beforehand — and the alarm fires at step 32. At that exact step the full simulator state is saved, and eight fresh noise streams are run out of it.

Three of the eight resamples succeed. A rollout headed for certain failure swapped its noise at the step the alarm pointed to, and finished in eight. Detection closed into intervention.

The limits were measured the same way, and none are hidden:

• Not every state is rescuable. Another initial state, same procedure: 0 of 8. Nothing in the alarm reading tells the two apart.
• The moment is not special. A control arm forked at a random earlier step also rescued 3 of 8. The alarm's value is knowing that it is time to act — not having found the perfect instant.
• The pattern cannot pick the winner. Among the eight candidates, the one with the largest activation change failed; the rescue happened to be the smallest (n = 1, and the direction ran against intuition).
• No early warning. The median alarm lands at 54% of the horizon; before that, single-step readings are coin flips. It reads already stuck, it does not prophesy about to be.

The takeaway

A trajectory is what the model did. The pattern is what state it was in. The first gets stamped only at the finish line; the second says its piece halfway through — in a log the model writes at every step, that nobody had read. The gauge was on the whole time. We just finally looked at it.