The Agent-Native Immune System proposal frames defenses as something embedded inside the agent’s cognitive loop, not bolted on at the edge. The biological metaphor can get a little grand, but the engineering direction is right.
There is a moment in a pretraining run where a small model figures something out. Feed it “Sue cried because” and it correctly resolves the next pronoun to “she.” It does this not just for names it saw, but for held-out probes too. By step 925 it scores 0.94 on that generalization test. The rule is learned. The model gets it.
Then it forgets. By step 3,500 the same model scores near zero on the same probes. Not because the evidence left the training data. The evidence is still there. The model just stopped applying the rule. And the loss curve shows nothing. No bump, no plateau, no warning. The number that everyone watches during training kept going down while a real capability quietly died.
That is the finding in “Natural Ungrokking: Asymmetric Control of Which Rules Survive Pretraining,” posted across arXiv’s cs.AI, cs.CL, and cs.LG. The authors call this within-run reversal natural ungrokking, and the part that should make practitioners uncomfortable is how predictable, how invisible, and how irreversible it turns out to be.