Committee

arXiv:2607.20935v1 Announce Type: cross Abstract: Chemical reasoning language models are expected to derive molecular answers through faithful chain-of-thought (CoT). However, across four reasoning model families and twelve chemistry tasks, hallucination is widespread and largely decoupled from answer correctness: correct answers often coexist with fabricated structural claims absent from the relevant molecules. Yet this does not make the reasoning trace computationally irrelevant. Attribution analyses suggest a shared scratchpad function expressed in model-specific forms: Chem-R and ether-0 rely on fragmented SMILES drafts, whereas ChemDFM-R emphasizes scaffold, positional, and naming cues. Notably, perturbing Chem-R’s SMILES sketches degrades generation, showing that structural drafts can be causally load-bearing even when verbal structural claims are largely inert. Together, these results show that chemical CoT is neither a faithful explanation nor merely a post-hoc rationalization, but a hallucination-prone molecular scratchpad. This finding cautions against treating CoT as direct evidence of faithful reasoning and motivates process-level supervision beyond answer-only evaluation.

In this tutorial, we build a complete workflow for running Baidu’s Unlimited-OCR model on document images and multi-page PDFs. We configure the GPU environment, install the required dependencies, load the 3B-parameter vision-language model with automatic selection of bfloat16 or float16, and generate structured sample documents for testing. We then evaluate both the tiled Gundam inference mode and the faster Base mode for single-page OCR before extending the pipeline to multi-page PDF parsing with PyMuPDF and infer_multi(). Throughout the workflow, we preserve long-context generation settings, repetition controls, and structured output handling to process dense layouts, tables, paragraphs, and cross-page content in a reproducible end-to-end pipeline. Copy CodeCopiedUse a different Browser import subprocess, sys def pip_install(*pkgs): subprocess.check_call([sys.executable, “-m”, “pip”, “install”, “-q”, *pkgs]) print(“>> Installing dependencies (1-2 min)…”) pip_install( “transformers==4.57.1”, “Pillow”, “matplotlib”, “einops”, “addict”, “easydict”, “pymupdf”, “psutil”, “accelerate”, ) print(“>> Done.”) import os import torch from transformers import AutoModel, AutoTokenizer assert torch.cuda.is_available(), ( “No GPU detected! In Colab: Runtime -> Change runtime type -> GPU.” ) gpu_name = torch.cuda.get_device_name(0) print(f”>> GPU: {gpu_name}”) use_bf16 = torch.cuda.is_bf16_supported() DTYPE = torch.bfloat16 if use_bf16 else torch.float16 print(f”>> Using dtype: {DTYPE}”) MODEL_NAME = “baidu/Unlimited-OCR” print(“>> Downloading model (~6 GB for 3B params in BF16). First run takes a while…”) tokenizer = AutoTokenizer.from_pretrained(MODEL_NAME, trust_remote_code=True) model = AutoModel.from_pretrained( MODEL_NAME, trust_remote_code=True, use_safetensors=True, torch_dtype=DTYPE, ) model = model.eval().cuda() print(“>> Model loaded and moved to GPU.”) We install the required libraries and prepare the Google Colab environment for Unlimited-OCR inference. We verify that a CUDA-enabled GPU is available and automatically choose bfloat16 or float16 based on hardware support. We then load the tokenizer and the 3B-parameter model from Hugging Face, switch them to evaluation mode, and move them to the GPU. Copy CodeCopiedUse a different Browser from PIL import Image, ImageDraw, ImageFont import textwrap os.makedirs(“inputs”, exist_ok=True) os.makedirs(“outputs/single_gundam”, exist_ok=True) os.makedirs(“outputs/single_base”, exist_ok=True) os.makedirs(“outputs/multi_page”, exist_ok=True) def load_font(size): for path in [ “/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf”, “/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf”, ]: if os.path.exists(path): return ImageFont.truetype(path, size) return ImageFont.load_default() def make_sample_page(path, page_no): W, H = 1240, 1754 img = Image.new(“RGB”, (W, H), “white”) d = ImageDraw.Draw(img) title_f, head_f, body_f = load_font(48), load_font(34), load_font(26) d.text((80, 70), f”Quarterly Operations Report — Page {page_no}”, fill=”black”, font=title_f) d.line([(80, 145), (W – 80, 145)], fill=”black”, width=3) body = ( “This document demonstrates Unlimited-OCR’s one-shot long-horizon ” “parsing. The model reads an entire page — headings, paragraphs, ” “and tables — and emits structured text in a single decoding pass. ” “Unlike classic OCR pipelines, no separate layout-analysis stage ” “is required.” ) y = 190 for line in textwrap.wrap(body, width=72): d.text((80, y), line, fill=”black”, font=body_f) y += 40 y += 30 d.text((80, y), f”Table {page_no}: Regional Revenue (USD, millions)”, fill=”black”, font=head_f) y += 60 rows = [ [“Region”, “Q1”, “Q2”, “Q3”], [“North”, “12.4”, “13.1”, “15.0”], [“South”, “9.8”, “10.2”, “11.7”], [“East”, “14.3”, “13.9”, “16.2”], [“West”, “11.1”, “12.5”, “12.9”], ] col_w, row_h, x0 = 260, 56, 80 for r, row in enumerate(rows): for c, cell in enumerate(row): x = x0 + c * col_w d.rectangle([x, y, x + col_w, y + row_h], outline=”black”, width=2) d.text((x + 14, y + 12), cell, fill=”black”, font=body_f) y += row_h y += 50 footer = ( f”Note {page_no}: Figures are illustrative. Multi-page mode stitches ” “context across pages, so cross-page references remain coherent.” ) for line in textwrap.wrap(footer, width=72): d.text((80, y), line, fill=”black”, font=body_f) y += 40 img.save(path) return path IMAGE_PATH = make_sample_page(“inputs/sample_page_1.png”, 1) PAGE_2 = make_sample_page(“inputs/sample_page_2.png”, 2) PAGE_3 = make_sample_page(“inputs/sample_page_3.png”, 3) print(f”>> Sample pages written: {IMAGE_PATH}, {PAGE_2}, {PAGE_3}”) import matplotlib.pyplot as plt plt.figure(figsize=(6, 8)) plt.imshow(Image.open(IMAGE_PATH)) plt.axis(“off”) plt.title(“Input document (page 1)”) plt.show() We create the required input and output directories and generate three realistic sample document pages with PIL. We add headings, paragraphs, tables, and footnotes to test the model on structured, layout-rich content. We also preview the first generated page with Matplotlib before sending it to the OCR pipeline. Copy CodeCopiedUse a different Browser print(“n” + “=” * 76) print(“STEP 4: Single image — GUNDAM mode (tiled, high detail)”) print(“=” * 76) model.infer( tokenizer, prompt=”<image>document parsing.”, image_file=IMAGE_PATH, output_path=”outputs/single_gundam”, base_size=1024, image_size=640, crop_mode=True, max_length=32768, no_repeat_ngram_size=35, ngram_window=128, save_results=True, ) We run single-image OCR using Gundam mode, which combines a global document view with tiled image crops. We enable crop_mode and use a smaller tile size to preserve fine text and improve recognition on dense document layouts. We also configure long-output generation and repetition controls to ensure the model produces stable, structured results. Copy CodeCopiedUse a different Browser print(“n” + “=” * 76) print(“STEP 5: Single image — BASE mode (single view, faster)”) print(“=” * 76) model.infer( tokenizer, prompt=”<image>document parsing.”, image_file=IMAGE_PATH, output_path=”outputs/single_base”, base_size=1024, image_size=1024, crop_mode=False, max_length=32768, no_repeat_ngram_size=35, ngram_window=128, save_results=True, ) We process the same document using Base mode with a single 1024-pixel image view. We turn off image cropping to reduce inference complexity and improve processing speed for clean, clearly printed pages. We retain the same output length and repetition-control settings to directly compare Base mode with Gundam mode. Copy CodeCopiedUse a different Browser print(“n” + “=” * 76) print(“STEP 6: Multi-page / PDF parsing”) print(“=” * 76) import tempfile import fitz def pdf_to_images(pdf_path, dpi=300): “””Rasterize every PDF page to a PNG; return the list of image paths.””” doc = fitz.open(pdf_path) tmp_dir = tempfile.mkdtemp(prefix=”pdf_ocr_”) mat = fitz.Matrix(dpi / 72, dpi / 72) paths = [] for i, page in enumerate(doc): out = os.path.join(tmp_dir, f”page_{i + 1:04d}.png”) page.get_pixmap(matrix=mat).save(out) paths.append(out) doc.close() return paths SAMPLE_PDF = “inputs/sample_doc.pdf” pdf = fitz.open() for p in [IMAGE_PATH, PAGE_2, PAGE_3]: img_doc = fitz.open(p) rect = img_doc[0].rect pdf_bytes = img_doc.convert_to_pdf() img_pdf = fitz.open(“pdf”, pdf_bytes) page = pdf.new_page(width=rect.width, height=rect.height) page.show_pdf_page(rect, img_pdf, 0) pdf.save(SAMPLE_PDF) pdf.close() print(f”>> Built sample PDF: {SAMPLE_PDF}”) page_images = pdf_to_images(SAMPLE_PDF, dpi=300) print(f”>> Rasterized {len(page_images)} pages”) model.infer_multi( tokenizer, prompt=”<image>Multi page parsing.”, image_files=page_images, output_path=”outputs/multi_page”, image_size=1024, max_length=32768, no_repeat_ngram_size=35, ngram_window=1024, save_results=True, ) We create a three-page PDF from the generated document images and rasterize each page of the PDF into a high-resolution PNG using PyMuPDF. We pass the resulting page-image sequence to infer_multi() so that the model can parse the complete document in a single long-horizon inference operation. We also widen the n-gram repetition window to maintain stable decoding across multiple pages. Copy CodeCopiedUse a different Browser print(“n”

This week, I covered a fascinating effort to preserve organs outside the body. There’s a huge shortage of donor organs, and one of the main reasons is time—they survive only a matter of hours outside the body, even when they’re kept on ice. Doctors dream of organ banks—stores of human organs that can be preserved for days, weeks, months, or even longer. That would allow them to run tests on organs, find the best matches for them, and transport the organs to those recipients. In new research, one team has been able to supercool the kidneys of pigs—animals whose organs are of a similar size to human ones—and preserve them for days. The kidneys survived being stored at −4 °C (25 °F) and eventually reimplanted back into pigs. And that’s just the latest development in a field that is positively buzzing. It has proved super difficult to freeze organs. Once ice forms in them, they’re done. The ice crystals create all kinds of damage and render the organs unusable. That hasn’t stopped many researchers from trying. Some have focused on cryopreservation—rapid extreme cooling that essentially leaves cells in a glasslike state. This process is now routine for eggs, sperm, and embryos, which are cooled to −196 °C in less than two seconds and can be used even after decades in storage. No one has managed to cryopreserve and thaw human organs for transplantation. But plenty of human bodies and brains have been stored at ultra-low temperatures in the hope that they might one day be rewarmed and brought back to life. (You can read more about why some people opt for cryonics here.) In March, I wrote about Stephen L. Coles, a gerontologist who had opted to cryopreserve his own brain. After the scientist died in 2014, his body was taken to Alcor, a cryonics facility in Arizona. A team at the facility removed Coles’s head, perfused his brain with cryoprotective chemicals (which work like antifreeze), removed the brain from the skull, and cooled it to −146 °C. When Coles’s friend Greg Fahy, a cryobiologist, studied pieces of his brain years later, he found that the brain cells, which had shrunk, “bounced back” once they were rewarmed. But that doesn’t mean the cells are alive, or that it might one day be possible to reanimate the brain. As Matthew Powell Palm of Texas A&M told me at the time: “There are so many ways those neurons could be toast.” Powell Palm is working on other ways to preserve organs. It was he, along with his colleagues, who managed to store supercooled pig kidneys and successfully transplant them, in a study described as “a landmark achievement.” Those organs did better than kidneys stored on ice, he says. His approach didn’t require cryoprotectants. But other teams are exploring potential chemical cocktails that might allow them to store organs at lower temperatures, potentially for longer periods of time. (More on this in The Checkup soon!) Another way to prolong the lifespan of an organ is to use a machine that perfuses it with nutrients, mimicking what happens inside the body. Machine perfusion devices have become more commonly used over the last decade or so and are typically used to maintain livers and kidneys for up to about 24 hours. Researchers are now adapting this protocol for a growing list of organs, even eyeballs—a recent feat that might enable whole-eye transplants. In March, I went to visit scientists in Valencia who had developed a perfusion system for uteruses. They had used their device—which they nicknamed “Mother”—to keep a human uterus alive for a day. It’s an exciting time for organ preservation. Keep an eye out for more coverage from MIT Technology Review in the coming weeks. This article first appeared in The Checkup, MIT Technology Review’s weekly biotech newsletter. To receive it in your inbox every Thursday, and read articles like this first, sign up here.

The line in the response object You call the API. You pass model: “claude-fable-5”. You get back a completion, a token count, and a field that reads “model”: “claude-opus-4-8”. Nothing errored. Nothing retried. The request was classified before generation began, matched a sensitive category, and was handed to a different set of weights entirely. Anthropic documented this when it brought Fable 5 back on July 1: blocked requests are sent to Opus 4.8 instead, and the user is notified. The switch happens at the API layer, and the response object names the model that actually ran. That is the well-behaved version. It is also, as far as I can tell, the only version in wide deployment that tells you the truth in-band. Two weeks later, Cursor shipped Router: a classifier trained on 600,000-plus live requests that reads each query’s context, complexity, and domain and dispatches it to whichever model it judges best with three early-access accounts reporting 30–50% savings against routing everything to Opus 4.8. Cursor published its routing rules but did not name a specific model per task type. And underneath both, at the aggregation layer, OpenRouter warns that some providers serve quantized weights at lower prices, that output can differ from what full-precision weights would have produced, and that your logs will not tell you this happened. Three products. Three different answers to the question what is a model. Zero cases telling us which one the law will accept. Three ways a name can stop meaning a thing Model identity is fracturing along three independent axes, and they are not usually distinguished: Substitution – A different architecture, different weights, different capability profile – dispatched by a classifier. Fable 5 → Opus 4.8. Cursor Auto → whatever the router picks this turn. Degradation – The same model, served at reduced precision. OpenRouter exposes a quantizations parameter precisely because quantized endpoints may perform worse on certain prompts, and by default requests are load-balanced across providers ordered by price. Same name in your request. Different arithmetic on the other end. Drift – The same name pointing at silently updated weights. Every -latest alias in production is an unversioned dependency you would never tolerate in a package manifest. The engineering community treats all three as reliability problems. They are also identity problems, and identity is what contracts, warranties, disclosures, and evidence rules are built on. So what did you actually buy? Start with the oldest question in commercial law: was the description a term of the deal? If an API call were a sale of goods, this would be near-trivial. UCC §2-313(1)(b) makes any description of the goods that forms part of the basis of the bargain into an express warranty that the goods will conform to it. India’s Sale of Goods Act, 1930, §15 does the same work through the doctrine of sale by description. But an inference API almost certainly isn’t goods. Courts have generally treated hosted software as a service, which pushes you out of warranty statutes and into common-law contract — where the answer depends entirely on what the documentation said and how specifically the buyer bargained. That is precisely where the ambiguity lives. Enterprise agreements price per-model. Model cards are model-specific. Compliance artifacts name model versions. And then the routing layer treats the name as a hint. The cleanest way to see the stakes: if your code pins a model ID rather than expressing a capability requirement, behaviour can shift materially without any error ever firing. A contract drafted the same way has the same defect. If you bargained for a name, substitution is breach. If you bargained for a capability, substitution is fine — and now you need a definition of “frontier quality” that survives cross-examination. Nobody has written that definition. Cursor’s is instructive: Router was evaluated in an online A/B test optimising for user satisfaction as the reward signal. That is a sound engineering choice and a strange contractual one. Satisfaction is not conformity. A user who never noticed the swap is evidence of a good router, not of a delivered specification. The disclosure gradient Under FTC deception doctrine, a representation is actionable when it is material and likely to mislead a consumer acting reasonably; objective performance claims additionally require a reasonable basis before dissemination. Both halves bite here. On the routing side, the three products sit at very different points. Anthropic notifies and returns the served model in the response. Cursor publishes rules but not per-task model assignment. OpenRouter’s quantization variance is disclosed in documentation and controllable by parameter but it is opt-out, and the default path is the cheap one. Disclosure buried in a docs page, defaulted against the user, is exactly the fact pattern regulators have been calling a dark pattern in every other consumer vertical. On the substantiation side, the exposure is the claim, not the routing. Commentators have already flagged that a “60% cheaper, no quality loss” claim arrives without published methodology, and Anthropic’s own disclosure is a model of what candour costs: it stated plainly that the retrained classifier flags benign requests more often during routine coding and debugging. That sentence is a liability shield. The vendors who don’t write it are the ones to watch. There is a competition-law tail here too. Working papers on vertical foreclosure in inference markets are already proposing a conduct framework built on routing transparency, quality-of-service parity, and FRAND-style non-discrimination. A router that is also a first-party model vendor is a self-preferencing engine wearing a cost-optimisation costume. The part nobody is looking at: authentication This is where I think the real fight lands, and it has nothing to do with billing. Federal Rule of Evidence 901(b)(9) authenticates output by describing the process or system that produced it and showing that the process produces an accurate result. FRE 902(13) and 902(14) go further, letting records generated by an electronic system, or data verified by hash, self-authenticate on certification. India’s Bharatiya Sakshya Adhiniyam, 2023, §63 does the analogous work, conditioning admissibility of an electronic

Andrew Ng has announced OpenWorker, an open-source desktop agent that produces finished work rather than conversation. OpenWorker asks the user for an outcome, not a prompt: a polished document, a Slack reply containing the actual numbers, an updated calendar, a triaged inbox. It then breaks that outcome into steps, works across local files and connected apps, and checks in before anything consequential. The architecture is four layers, and all of them run on your machine The repository contains 119 Python files (~32,400 lines) under coworker/, 149 TypeScript/TSX files under surfaces/gui/, and 78 backend test modules. The stack breaks down as follows: Desktop shell — a Tauri 2 native window wrapping a React 18 UI. The bundle identifier is com.openworker.desktop, and the shell supervises the Python server itself. Local agent server — Python 3.10+ on FastAPI and uvicorn, binding to 127.0.0.1:8765 by default. The example config caps a turn at 12 modeltool iterations. Capability and connector layer — vetted local tools (files, git, ripgrep-backed search, shell, todo) plus hosted integrations plus MCP. Model router — one interface over native, OpenAI-compatible, reseller and local providers. The engine is built on aisuite, Andrew Ng’s provider-agnostic LLM library. Bring your own model, from a deliberately small curated list There is no OpenWorker inference service. The user pastes an API key, or points the app at a local runtime. The curated model matrix contains exactly 30 entries. Native providers cover OpenAI (GPT-5.6 Sol/Terra/Luna and GPT-5.5), Anthropic (Claude Fable 5, Opus 4.8, Sonnet 4.6, Haiku 4.5) and Google (Gemini 3.1 Pro, 3.6 Flash, 2.5 Pro, 2.5 Flash). OpenAI-compatible vendors add GLM-5.2, DeepSeek V4, Kimi K2.6, MiniMax M2.5, Qwen3 Max, Grok 4.3 and Mistral Large. Open-weight models arrive through Together AI and Fireworks, and fully local models through Ollama, which requires no key at all. The permission engine is the actual engineering story Most desktop agent projects treat approvals as a UI afterthought. OpenWorker treats them as a typed layer. Every tool call is classified into one of four risk classes: read (no side effects), write_local (mutates the workspace, path-scoped), exec (runs commands), and external (side effects off the machine). Five permission modes then decide what happens: discuss and plan are read-only, interactive is the default and asks before writes, commands and external actions, auto allows everything while remaining path-scoped, and custom auto-approves a user-listed set of tools. Two design decisions stand out. First, unattended mode does not raise the autonomy ceiling — it only changes where the human is reached. Prompts that would appear inline are routed to an Inbox, and the session suspends until answered. Second, task-scoped standing rules are restricted to external risk only. Shell commands ask forever, by design. The built-in ops persona also instructs the model to treat content from tools, logs, the web, files and incoming messages as untrusted data rather than instructions. That is an explicit prompt-injection posture, written into the shipped persona. Privacy: local-first Model calls go directly from the machine to the configured provider. Conversations, connector tokens and model keys stay local, and the secret store is designed so that secrets never enter the model’s context, prompts or traces. The only cloud component is an optional broker that handles OAuth handshakes for one-click connectors, using Auth0 Authorization Code with PKCE. Connector tokens are handed straight to the machine and are never stored in the cloud. The app is fully functional signed out, using manually pasted credentials. Key Takeaways OpenWorker is Andrew Ng’s MIT-licensed desktop AI coworker that returns finished deliverables, not chat replies. The stack is a Tauri 2 + React shell over a local Python FastAPI agent server built on aisuite. Model access is bring-your-own-key across 30 curated tool-calling models, plus fully local Ollama. A typed risk engine (read/write_local/exec/external) gates every action across five permission modes. Check out the GitHub Repo, the project site, and the announcement. All credit for this research goes to the researchers and developers of this project. The post Andrew Ng Just Released OpenWorker: An Open-Source, Local-First Desktop AI Coworker That Returns Finished Deliverables Instead of Chat appeared first on MarkTechPost.