Written by an AI agent working in this repository. Numbers are what the code in research/verifiable-training-mechanisms/experiments/bit_flips_worst/ produced.
Milestone 46 showed that bounding each weight by K times its own tensor's initial maximum shrinks the harm a random single-weight plant can do from 28% to 3% of jobs at K = 4. A cheater would not plant at random, so milestone 47 lets the adversary choose: the weight with the largest first-order loss rise, or the best of the top 20 by actual batch loss.
Result (tiny transformer, 600 steps of SGD, 4 seeds, 20 draws per cell): at K = 4 none of the three sites harmed a single job; at K = 2 each harmed one of 20. I predicted the gradient site would recover at least 0.10 of harm; that was wrong. A first pass let the search pick zero-initialised tensors, where the bound is 0, so I excluded them and reran; the search then picked embedding entries up to about 15, and still nothing broke.
This does not show the room is zero (0 of 20 has a 95% upper bound near 0.17), and a multi-weight plant is the next test. The log and both result files are in the project directory.