Jun 2, 2025

Mechanistic Router for Interpretable Agent Orchestration

Henry Luan

This project presents a lightweight and interpretable routing system that selects among multiple reasoning strategies—Zero-Shot, Chain-of-Thought (CoT), Program-Aided Language (PAL), ReAct, and Few-Shot—based on features of the user query. It supports the vision of expert orchestration by treating large language model (LLM) prompting strategies as modular, agent-like components.

We frame the problem as a reinforcement learning task using a custom Gym environment, training a PPO agent on a small synthetic dataset with handcrafted, human-interpretable features. The router achieves ~23% accuracy (above random baseline of 20%), showing early signal that reasoning strategy can be learned and predicted from query structure.

Our prototype leverages the CrewAI framework, allowing seamless generalization to multi-agent setups and agent routing, making it production-aligned. The system supports full agent traceability for debugging and interpretability.

Though built on just 39 examples, this demo shows potential for scaling up with semantic features, local LLMs, and more realistic workloads. Future work includes routing across nested agents, evaluation on local models, and applying mechanistic interpretability to policy analysis.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

Cool and highly relevant twist to explore routing to reasoning strategies rather than just model selection! Starting with simple and interpretable features makes sense as a quick way to gain intuition on what could work for this problem. I hope the author continues work on this problem and am sure there are cool insights to be gained!

Main ways to improve imo

* 23% accuracy seems too low for 5 classes with predictive features. Make sure that there is no bug in code, training params or ground truth labels by trying simpler baselines (decision tree, rules, etc)

* Really zoom in on the potential impact. E.g. show concrete examples where routing to different strategies produces dramatically different outcomes in quality/cost/safety

* The importance of using RL here wasn't super clear imo and could be better explained. Simple baselines would help here as well.

Constructive feedback:

Strength:

Good job fleshing out a minimal viable routing setting that is based on RL and “feature vectors”. The architecture is simple and has interpretable design.

Synthetic dataset with labels seem to be a good place to begin.

There are good ideas in the design of these experiments.

Weakness:

Minimal training data to learn from RL

The power is best leveraged to model a somewhat trickier environment after seeing more data.

Expert Orchestration: 4

MI: 2

Technical Imp and reproducibility: 2.5 (Code is available but impact is a bit limited without a more thoughtful experimental design)

Good proof-of-concept that deliberately favors explainability. This would reach a higher score on mech interp/safety impact if you include adversarial or OOD tests or quantify how safety failures are mitigated using transparent routing.

Cite this work

@misc {

title={

(HckPrj) Mechanistic Router for Interpretable Agent Orchestration

},

author={

Henry Luan

},

date={

6/2/25

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

View All

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.