Pitting AI Against Itself to Fact-Check My Architecture

I'd sketched an architecture called Rewire, and it looked good on the whiteboard. That's usually the moment I trust it least. So before building anything, I gave the whole proposal to three different models, Llama 3, Mixtral and Qwen, and asked each one to find what was wrong with it. Then I looked at where they agreed.

The reason for three different models is the same reason you don't grade your own homework. A model reviewing its own design tends to like it. Models from different families at least start from different training and different habits.

What I asked them to check

Rewire depended on three things working.

Native memory in the model. Most applications use RAG, which is like pausing a conversation to look something up. I wanted the model itself to remember: a separate memory module with discrete key-value slots and a forget gate, updated without disturbing the pre-trained weights. The base model was Gemma.

Split learning. The network is cut in two. Your phone runs the bottom half on your private data and sends only an intermediate vector to the cloud, which runs the top half. The raw data never leaves the device. I planned to build it in JAX.

A hierarchical swarm. Many of those split agents, each local, coordinated by one orchestrator.

How the review worked

Each model got the same proposal and the same instruction: find the blind spots and say whether it's viable. Then I compared the answers. Anything all three raised went to the top of the list.

What they found

They agreed the overall shape was reasonable. A memory module with a forget gate is possible, and the swarm pattern made sense. Then they found three places where I'd been optimistic.

JAX doesn't do the networking. I'd assumed gradients could go back and forth between phone and cloud over an ordinary REST API without much effort. JAX is a numerical computing library. Moving tensors and gradients between an untrusted device and a server is infrastructure I'd have to build myself, and the proposal didn't account for it.

The vector isn't automatically private. This one was my biggest mistake, and it's worth knowing even if you never build anything like this. I'd treated "send a vector, not the data" as privacy. It isn't. Pasquini, Ateniese and Bernaschi showed that a malicious server in split learning can steer training so that it reconstructs the client's private inputs from what's sent (Unleashing the Tiger, CCS 2021). The split moves the problem. It doesn't remove it.

Training the memory through time is unstable. I'd planned to update the memory module with backpropagation through time while the transformer stayed frozen. Gradients through long sequences tend to vanish or explode (Pascanu, Mikolov and Bengio, 2013), and I had no derivation showing my setup avoided that.

What agreement between models is worth

Agreement is useful as a way to sort the list. It isn't proof. Models share a lot of training data, so three of them can be confidently wrong about the same thing. The way I'd use it now: let the models find the candidates, then check each one against something that isn't a model, like a paper, a benchmark or a small test. Two of the three findings above I could check against published work. The JAX point I could check by reading the documentation.

The architecture turned out far more complicated than the whiteboard sketch. That's a good result. It's much cheaper to find that out from a review than from three months of code.