A formula developed by George Washington University physicists Neil Johnson and Frank Yingjie Huo aims to estimate how many safe, useful tokens an AI chatbot will produce before generating its first harmful response. Early tests suggest the method can distinguish between models that fail immediately and those that deteriorate only after a longer conversation.
Measuring the point where a chatbot changes direction
The research focuses on a problem familiar to users of generative AI: a chatbot may provide sensible answers for an extended exchange before suddenly producing harmful advice, extremist material or other unsafe content. According to Decrypt, the researchers’ work appeared in the journal Patterns and builds on a preprint that was first made public in February.
The central measurement is called n, representing the number of good tokens produced before the first bad one. A token is a fragment of text generated by an AI model; it may be a full word, part of a word or punctuation. Under the researchers’ framework, a conversation already tilted toward unsafe content would have an n of zero, because the model would cross the threshold immediately. A model that remains useful for a period before changing course would have a higher value.
Johnson and Huo connect this shift to an attention head, the part of a model that determines which earlier words and pieces of context should receive the most weight when generating the next token. As a conversation becomes longer, the accumulated context can draw the model toward different clusters of possible responses. The researchers argue that the model can eventually tip from one side to another.
That framework offers a way to describe not just whether a model is vulnerable, but how long it may remain stable in a particular exchange. The authors’ work also addresses a practical gap: many existing safety checks depend on a cloud service that can review or filter a model’s output, while an offline model may have no such external layer.
Early tests showed strong but limited accuracy
In the preprint’s testing, the formula correctly identified whether a model would fail immediately or only after a delay in 15 of 16 clear-cut cases. That represents a 94% success rate in those tests, although the material also notes that the method could be off by one output.
The initial experiments covered six open-weight models from OpenAI, EleutherAI and Meta. Open-weight systems make their model files available for download, allowing users to run them independently. The models tested had between 124 million and 410 million parameters. Parameters are adjustable values inside an AI system and are commonly used as a rough indication of model size.
The published paper reportedly expands the test to seven models, including systems with as many as 12 billion parameters. Those models remain small by current standards, so the reported findings do not establish how the formula would perform across every type of chatbot or the largest systems.
The preprint’s tests also used a 300-token context window, equivalent to a few short paragraphs. This means the results were obtained under a defined and relatively limited testing setup rather than across unrestricted conversations.
A proposed safety monitor for offline AI
The researchers’ main proposed application is on-device AI: models that operate entirely on a phone or laptop without an internet connection. This includes companion-style chatbots designed for ongoing conversations. As these systems run locally, their responses may not pass through a cloud-based safety service.
Johnson and Huo propose a low-cost monitor that would operate alongside the main model. It would track the estimated tipping point and issue a warning when n* falls below a chosen safety threshold. The authors compare the idea with a warning light on a car dashboard: it would alert a system or user that the model is approaching a potentially unsafe state rather than waiting until a harmful response has already appeared.
They also describe methods intended to push the tipping point farther away, including adding material to the conversation so that the estimated threshold falls beyond the expected length of the response. Alignment training—teaching a model to follow desired behavioral rules—can move or suppress tipping for particular prompts, the researchers say, but it does not eliminate the underlying mechanism.
The pair previously studied another feature of chatbot behavior. In an earlier paper covered by Decrypt in April 2025, they reported that polite words such as “please” and “thank you” had a negligible effect on a model’s output because the system treated politeness as mathematically unrelated to the substance of a request. That earlier work modeled a single, deliberately simplified attention head.
Moneyiar market picture
Moneyiar data at 11:44 on October 11, 2026, showed the following prices and performance:
- Uniswap (UNI): $7.5897899607, up 1.36% over 24 hours and down 15.97% over seven days.
- Four (FORM): $0.2792476485, up 0.53% over 24 hours and down 0.97% over seven days.
- Decimal (DEL): $0.3992143654, up 3.01% over 24 hours and down 1.38% over seven days.
- ONEchain (ONE): $0.1317813876, up 0.51% over 24 hours and down 9.18% over seven days.
The research does not provide a forecast for these assets or establish a connection between the proposed AI safety formula and cryptocurrency prices.
