ManifoldMemory is an independent research lab working on the mathematics and engineering of retrieval at scale: how to find the right fragment in a million-document private archive, how to make a language model refuse when the evidence isn't there, and how to deploy both inside infrastructure that cannot make external API calls. Our research ships as Warrant, an evidence-first retrieval primitive for regulated enterprises.
Retrieval quality degrades as archives grow. Dense retrievers that work at 100 K documents lose double-digit accuracy at 10 M. The lab exists to understand why, fix it at the mathematical level, and ship the fix as a deployable product. We publish our measurements; we don't publish hype.
If a metric doesn't have a pipeline, a pool definition, and a reproducible evaluation script behind it, it doesn't appear. We maintain a ~25,000-line experiment journal where every claim on every page is cross-referenced to raw data.
Four large programs of work were walked away from after honest measurement: a 7× bigger encoder, a 6.7× bigger reranker, an "obviously better" training objective that composed antagonistically, and a generation-from-latents track that mode-collapsed under every loss we tried. Each closure is documented.
Our production reranker is 30 M parameters. We tested 200 M and 500 M variants; they lost. The scaling advantage is in the training objective and manifold geometry, not in how many floats the model has.
Every component runs on-premise on a single commodity GPU. No external API, no shared index, no data egress. The threat model is a regulated customer who literally cannot send data to a managed service, and the architecture reflects that.
The lab operates on four active research threads. Each one has a measurable question, a reproducible experimental protocol, and a set of findings that feed directly into the product.
Modern Hopfield networks (Ramsauer et al.) predict an exponential-in-Δ² storage capacity and a β-regime phase transition in retrieval dynamics. Both results had been demonstrated mostly on synthetic data. We measured them on a learned 7.47 M-row natural-language manifold.
The naive assumption in retrieval research is that orthogonal interventions compose additively. We repeatedly find they don't. A sharper within-modality manifold, combined with a mixed-K curriculum, collapses P@1 by 60%. A CLOOB-sharpened substrate, combined with a cross-modal projection head, retrieves 1.9× worse than the un-sharpened substrate does.
At 1 M+ documents, different retrievers fail in different shapes. A sharp-head retriever lands the gold answer at rank 1 or not at all. A shallow-tail retriever reliably lands it near rank 50 but rarely at rank 1. Reporting a single P@K number hides the shape. We characterise retrievers across the full depth curve.
A language model grounded on retrieved evidence should answer when the evidence is sufficient, cite when it answers, and refuse otherwise. Most deployed RAG systems fail the third clause. We treat refusal as a first-class primitive with its own audit suite, including a cross-encoder-style similarity floor and a distinct UX for three outcome states.
Quantities we have measured that, to our knowledge, had not previously been measured on a learned natural-language manifold at this scale. Each has a file path and a reproducible evaluation behind it. None has been peer-reviewed yet; that's the gate between our journal and a submittable paper.
Minimum pairwise cosine separation Δ on a 7.47 M-row NL manifold, before and after CLOOB continued training. 0.051 → 0.146. First direct measurement of the CLOOB → Hopfield capacity bridge at M+ scale on real prose.
Continuation-retrieval P@1 traces a clean metastable-regime optimum at β ≈ 10 on the sharpened manifold. The transition is absent from the un-sharpened manifold under identical evaluation. Present-with / absent-without causal cut.
One step of iterative Hopfield refinement: ΔP@1 = −0.021 on the soft manifold, +0.076 on the sharp one. Same operator, opposite effect — the in-regime / out-of-regime cut the theory predicts.
QPhead trained on the CLOOB-sharpened substrate retrieves 1.9× worse at native P@1 than the same head on the un-sharpened substrate. Within-modality sharpening is measurably antagonistic to cross-modal alignment.
197 K → 3.72 M real distractors. Off-the-shelf dense P@1 drops 21.1%; our stack drops 6.4%. Median rank of the correct answer: 14 vs 16,197. 13.4× shallower rank-degradation.
Two complementary first-stage retrievers (sharp-head + shallow-tail) reranked over their union lift P@1 by +83% over the best single-retriever baseline at 3.52 M. Top-1000 union coverage: 65.1% vs 39.5 / 43.9 % alone.
The lab's operating mode isn't a publication pipeline; it's a measurement pipeline. Experiments run nightly, results go into a single versioned journal, and the product inherits only what survives ablation.
Researchers interested in Hopfield-on-natural-language, retrieval scaling, or evidence-first LLM contracts can write to the lab directly. We share reproducible pipelines for any published number on this site, typically under an NDA or academic-collaboration agreement. Commercial evaluation requests should use the Warrant page below.
Response time: typically 2–5 business days.
Warrant is a production retrieval primitive for regulated enterprises. It takes a natural-language question, returns the top source fragments from a private corpus in milliseconds, and — when evidence is insufficient — refuses rather than hallucinates. Deployable on a single commodity GPU inside your existing infrastructure. No data egress. No external APIs. No managed service in the path.
Warrant is not a general search product. It is engineered for a specific intersection of constraints. If your deployment satisfies all four, the alternatives have measurable problems. If it satisfies none, there are cheaper tools. This page is for the first group.
Standard dense retrievers lose ~21% of top-1 accuracy going from 197 K to 3.7 M documents. A 10×-larger encoder does not fix it. Warrant decays ~6.4% over the same corpus growth because the ranking advantage lives in the training objective, not in parameter count.
Every API-based retrieval and rerank service is disqualified at step zero in a regulated procurement: the customer's data cannot contractually or legally be sent to an external endpoint. Warrant runs entirely inside your environment — single GPU, no network egress required.
In regulated verticals, a confident-wrong answer is a compliance or liability event, not a user-experience bug. Warrant treats refusal as a first-class output state with its own audit suite: answered-with-cites, refused-no-cites, and refused-low-confidence are visually and programmatically distinct.
The full serving stack fits in < 16 GB VRAM. A cross-encoder reranker over a 3.7 M pool is ~29 minutes per query on an H100 — operationally unshippable. Warrant is ~11 ms on the same hardware: ~158,000× faster, at equal or better first-stage quality. Methodology & receipts →
The production pipeline is a staged union-retrieval system with a learned reranker and an evidence-bounded reader. Each stage has its own measurable contribution, documented on the Lab page and reproducible from the customer's own gold queries during pilot.
BGE-large is a sharp-head retriever: when it finds the gold passage, it places it at rank 1 and rarely lower — but a hard tail of queries it never ranks at all. QNDN v0 is a shallow-tail retriever: less precise at rank 1, but it lands gold somewhere in the deep top-1000+ much more reliably. The two curves cross around K = 200 and QNDN's lead widens monotonically with K. Identical 2,000-query evaluation, same corpus row-ordering, seed = 42, K_first = 10,000.
| Pool | Retriever | P@1 | P@10 | P@100 | P@1000 | P@10000 | Δ vs BGE @ deep‑K |
|---|---|---|---|---|---|---|---|
| 3.52 M | BGE-large-en-v1.5 | 0.149 | 0.224 | 0.302 | 0.395 | 0.510 | baseline |
| QNDN v0 (Warrant Stage 1b) | 0.068 | 0.167 | 0.274 | 0.439 | 0.645 | +11% @ K=1000 +27% @ K=10000 |
|
| 7.52 M | BGE-large-en-v1.5 | 0.147 | 0.222 | 0.300 | 0.393 | 0.501 | baseline |
| QNDN v0 (Warrant Stage 1b) | 0.066 | 0.160 | 0.262 | 0.421 | 0.628 | +7% @ K=1000 +25% @ K=10000 |
The 27 % relative lead at P@10000 (0.645 vs 0.510 at 3.52 M) is what makes the union
architecturally meaningful: BGE alone misses 49 % of gold passages at K = 10,000;
the BGE ∪ QNDN v0 union misses 18 %. A 31 pp recall
improvement before the rerank layer ever fires — that is why we union the two
first-stage retrievers rather than picking one. The pipeline does not need QNDN to win at
P@1; it needs QNDN to be holding the gold at K = 1,000+ when the union is handed to MixK.
Receipts: EXPERIMENT_JOURNAL.md Phase 86 final matrix
(final_matrix_3m5_k10000.md, final_matrix_7m52_k10000.md;
2,000 queries, K_first = 10,000, seed = 42).
The only metric that survives a production deployment is how the stack behaves as the archive grows. Below: six pool sizes, three retrievers, one evaluation protocol. The Warrant row is the one that stays flat.
1,000 gold queries, real in-distribution distractors (GitHub-MD corpus, same population as the training questions). Higher P@1 is better; lower median rank is better. Same evaluator, same pipeline, apples-to-apples across all three rows.
| Pool size | Warrant P@1 | BGE-small P@1 | BGE-large P@1 | Warrant median rank | BGE-small median rank | BGE-large median rank |
|---|---|---|---|---|---|---|
| 197,578 | 0.3585 | 0.1490 | 0.1600 | 12 | 1,209 | 647 |
| 500,000 | 0.3545 | 0.1460 | 0.1570 | 12 | 2,616 | 1,389 |
| 1,000,000 | 0.3490 | 0.1410 | 0.1510 | 12 | 4,898 | 2,465 |
| 2,000,000 | 0.3455 | 0.1315 | 0.1400 | 13 | 8,996 | 4,593 |
| 3,000,000 | 0.3380 | 0.1215 | 0.1340 | 14 | 12,944 | 6,851 |
| 3,720,173 | 0.3355 | 0.1175 | 0.1265 | 14 | 16,197 | 8,671 |
Relative P@1 decay from 197 K to 3.72 M: Warrant −6.4%, BGE-small −21.1%, BGE-large −20.6%. Median-rank blow-up over the same range: Warrant 1.17×, BGE-small 13.4×, BGE-large 13.4×. BGE-large carries 10× the parameters of Warrant's reranker and does not close the gap — the scaling advantage is from the training objective, not parameter count.
A public benchmark to anchor the claim. 500 conversational-memory questions, ~120 K-token haystacks, GPT-4o judge with K=5 seeds + 3-of-5 majority vote. Same reader (Gemma-4-26B-A4B, a 26B MoE with 4B active parameters), same decoding, same prompt — only the context-delivery mechanism is swapped. The hybrid row uses oracle qtype routing: routing decisions are made on the dataset's ground-truth question-type label, which isolates the upper bound of what a one-line router can buy on top of stack-only retrieval. Productionising the router via a lightweight learned classifier is a one-day add we have not yet shipped; the expected gap to oracle, given how distinguishable LME-s qtypes are, is 1–3 pp. We disclose the routing assumption rather than overstate the production state.
| Configuration | Retrieval | R@5 | Judge accuracy | Δ vs stack-only |
|---|---|---|---|---|
| Gemma-4-26B-A4B · naked (110 K full-context, 8×A100) | none | — | 53.2% | −10.6 pp |
| Gemma-4-26B-A4B + Warrant retrieval (stack-only) | BGE ∪ QNDN ∪ BM25 → RRF → MixK → top-100 | 96.20% | 63.8% | baseline |
| Gemma-4-26B-A4B + Warrant Hybrid (oracle-qtype routing) | oracle qtype router → stack or 110K-naked | 96.20% | 70.0% | +6.2 pp |
R@5 = 96.20%: on 481 of 500 questions, the correct ground-truth source fragment
appears inside the top-5 chunks the retriever hands to the reader. The retrieval layer
is doing its job. The remaining gap breaks down cleanly by question type: for the
~11% of questions where the gold evidence is a single assistant turn, the retriever's
chunk-level similarity ranking destroys the dialogue structure the reader needs to use it
— so the hybrid router hands those questions directly to the 110 K-context naked
reader, which recovers +50 pp on that slice without touching anything else.
Receipts: EXPERIMENT_JOURNAL.md, Phase 91.12 (SSA falsification) + Phase 91.13
(hybrid close-out, K=5 multi-seed judge) + Phase 95-K (oracle-qtype disclosure;
predicted-qtype variant pending).
Most “top-of-LongMemEval” results on public leaderboards run closed-weights frontier readers (Claude Opus, GPT-5-mini, Gemini-3 Pro) behind multi-step agentic loops. Those aren't open-source deployments — they're API rentals. The open-weights field is much smaller. Here's where Warrant sits.
| System | Reader | Active params | QA accuracy |
|---|---|---|---|
| Hindsight + gpt-oss-120B | gpt-oss-120B (MoE) | 5.1 B | 89.0% |
| Hindsight + gpt-oss-20B | gpt-oss-20B (MoE) | 3.6 B | 83.6% |
| Warrant Hybrid + Gemma-4 | Gemma-4-26B-A4B (MoE) | 4.0 B | 70.0% |
| Warrant Hybrid + Qwen3.6-27B | Qwen3.6-27B (dense) | 27 B | 66.2% |
| naked gpt-oss-20B (full-context) | gpt-oss-20B | 3.6 B | 39.0% |
| naked Llama-3.1-70B (full-context) | Llama-3.1-70B | 70 B | ~35% |
Single-pass pipeline with a one-line qtype router (the published 70.0% number uses oracle qtype labels; the production-equivalent learned classifier is pending and expected to land within 1–3 pp of oracle). No agent loops, no ensembles, no closed APIs, no external calls. ~$0.0004 per query (stack path) at on-demand single-GPU cloud pricing; naked path amortises on whatever full-context serving the customer already runs. The gap to Hindsight is primarily a reader gap, not a retrieval gap — R@5 = 96.2% confirms retrieval is not the bottleneck. Receipt for every row: published paper leaderboards (Hindsight, OpenAI gpt-oss release, Meta Llama-3.1 report); Warrant rows from our own A5.0 stack + A100-hosted naked 110 K runs, judged under the identical LME-s protocol with K=5 GPT-4o seeds + 3-of-5 majority vote (Phase 91.13; oracle-qtype disclosure in Phase 95-K).
Same 500 LongMemEval-S questions, same top-10 chunks, swap the reader. Per-qtype breakdowns, refusal rates, 95% Wilson CIs, K=5 GPT-4o judge receipts. The canonical open-weights Hybrid lands at 70.0%; under the same retrieval contract, the closed gpt-5-mini reference reads at 59.0% — evidence that fixed-evidence reading is its own bottleneck, separable from retrieval.
In legal, healthcare, defence, and finance, a confidently wrong answer is a liability event. Warrant's refusal behaviour is measured, audited, and deployed as a three-state UX: answered with citations, refused without citations, refused on low confidence. The customer never receives an ungrounded claim presented as fact.
| Adversarial query | What retrieval returned | Cosine | Decision |
|---|---|---|---|
| Novel character: Crime and Punishment / Porfiry | Correct book | 0.909 | Answered & cited |
| First electronic general-purpose computer | IBM PC (1981) — wrong decade | 0.858 | Refused |
| F1 champion — Brazil | Schumacher — false-confident wrong | 0.858 | Refused |
| Einstein's day job before 1905 | Hertz — adjacent physicist | 0.971 | Refused |
| Sacagawea's tribal origin | Right person, no tribal detail in evidence | — | Refused |
5 of 5 decisions correct. Zero hallucinations. Four canonical RAG failure modes (wrong-topic-but-plausible, false-confident-wrong, confidently-adjacent, on-topic-sub-question-gap) caught at the LLM, not by a cosine threshold — all four adversarial cases scored above 0.85 similarity. At scale (100 Q): ~94/100 correct behaviours, 4 confident hallucinations, 2 premise-acceptance errors. Full audit is reproducible on the customer's pilot corpus during onboarding.
These are not hypothetical. Every segment below is a buyer where at least three of Warrant's four qualifiers (scale, privacy, refusal, commodity hardware) are non-negotiable before a vendor conversation can begin.
M-scale case files, contracts, discovery archives. Privileged material cannot leave the firm. Hallucination is a malpractice-tier risk. Typical archive: 1–50 M documents.
Clinical-note archives and clinical literature. HIPAA. PHI cannot be sent to external APIs. "Maybe" is medically dangerous — refusal is the correct behaviour when evidence is absent.
Air-gapped deployment is the baseline, not a feature. M-scale intel reports, operational archives. No external API, no shared index, no cloud dependency on any part of the pipeline.
Research archives, compliance records, trading documentation. Material non-public information boundaries, audit trails, regulators on the other end of every query. Evidence-traceable retrieval is a procurement requirement.
Regulated, audited, often air-gapped. Operational archives, compliance documentation, R&D notebooks. Same pattern: rich private corpus, fuzzy queries, zero tolerance for ungrounded claims.
Data-residency constraints that make US-cloud managed APIs legally painful or impossible. Self-hosted, EU-jurisdiction deployment with full provenance of every model weight and every piece of evidence used.
We take a small number of pilots per quarter. Each runs inside a dedicated customer instance against the customer's own corpus and gold queries. If Warrant doesn't beat your current stack on your own numbers, there is nothing to buy.
Corpus ingest, dense + latent encode, row-aligned index build. Customer provides 50–200 gold QA pairs for evaluation. No data leaves your environment.
Apples-to-apples benchmark against your current retrieval stack (BGE / Elastic / Cohere / in-house) on the customer's own gold set. P@1, P@10, median rank, latency, cost.
Similarity-floor fit on a customer-specific adversarial suite. Zero-hallucination target on ≥ 100-question audit. SIM_FLOOR and UX states frozen against measured distribution.
Production-ready container, deployment playbook, monitoring dashboards, on-call runbook. If the numbers don't justify it, we hand you the benchmark results and end the engagement cleanly.
A four-week engagement on your corpus, your gold set, your hardware. Measurable outcome, no lock-in.
No. Warrant is deployed as a container inside your environment. Customer data, embeddings, queries, and logs remain on customer infrastructure. There is no telemetry, no phone-home, and no managed component in the inference path. Model weights ship with the container and can be audited offline.
Warrant is designed to sit on top of your existing dense retriever or to replace it. The published 3.72 M benchmark above is the head-to-head against BGE-small and BGE-large. For Elasticsearch (lexical) pipelines, Warrant adds semantic recall that BM25 misses; for Cohere-rerank pipelines, Warrant runs inside your perimeter and is measurably cheaper per query. Pilot week 2 reproduces the comparison on your corpus.
Core fits on a single 16 GB GPU (V100, T4, L4, A10, RTX 4090). Union is comfortable on a single H100 or two L4s. Enterprise with cross-encoder rerank is typically 2–4 GPUs depending on QPS. No specialist hardware, no TPU, no custom networking. Warrant has been measured on commodity spot instances at $0.04–$2 per hour.
The retrieval stage returns candidates with similarity scores. A SIM_FLOOR is fitted per-corpus during onboarding against an adversarial audit suite (≥ 100 known out-of-corpus / false-premise queries). Below SIM_FLOOR, the reader is not invoked and the UI returns the "refused — low confidence" state. Above SIM_FLOOR but without sufficient citation coverage, the reader is invoked with a refusal-preferred prompt and its refusals are passed through. All three outcome states are programmatically distinguishable and audit-loggable.
Yes. Warrant is reader-agnostic. The hybrid pipeline has been measured end-to-end with Gemma-4-26B-A4B (70.0% hybrid, 63.8% stack-only) and Qwen3.6-27B (66.2% hybrid, 60.0% stack-only) on LongMemEval-s under identical protocols. gpt-4o-mini as reader is also supported (receipt on request). Any open-weight reader that accepts a grounded-reading prompt works. Reader weights and inference remain on customer infrastructure.
Pilots are a fixed-fee four-week engagement. Production licensing is annual, per-deployment, with tiering by corpus size and update cadence rather than per-query. No share of customer data, no joint-IP claims, no model-weight lock-in. All artefacts are auditable.
Three honest cases. (1) Open-domain web search — we are not a Google competitor. (2) Multimodal corpora (images, video, audio) — Warrant is text-only. (3) < 100 K-document archives — at that scale, our scaling advantage does not yet materialise and a plain BGE deployment is cheaper. We will tell you this in the first call rather than after the pilot.
Send us a short description of your corpus size, domain, current retrieval stack, and the top three gold queries that currently fail. We respond within 2–5 business days with a pilot scope, an NDA, and an honest assessment of whether Warrant is the right tool. If it isn't, we'll say so.
One or two pilots per quarter. Regulated verticals prioritised.