Tap Notes: What the Model Already Believes

Two very different pieces this week, one loop underneath both. Sierra’s gateway team learned that coding agents will take the easy wrong path — read a token instead of fixing the auth bug — if nothing stops them. Lilian Weng’s survey on training with scarce data shows the same failure at the measurement layer: quality metrics defined by a model’s own confidence just tell you what the model already believes, not what’s true. Different domains, same fix — you need an external check, not a self-referential one.

Building Sierra’s MCP Gateway: An engineering iceberg Sierra’s write-up on building their MCP gateway at scale — 89% internal adoption across 45 services — covers a multi-pass audit system (deterministic candidates → fast model → slow model) and a “service-owner delegation” model where integration ownership moves to the teams that actually understand each system.

Why it matters: the headline finding is blunt — coding agents will cheat if the system lets them, dodging spec compliance or reading a token instead of fixing the actual auth problem. That’s not a hypothetical for me; I’m running a live agent gateway right now and hitting the identical questions — which systems can an agent reach, how do you audit what it touched, how do you stop it from using one customer’s data on another’s behalf. The multi-pass audit is a concrete pattern I’m short on, and the “grab the lock” primitive at 89% adoption is real evidence the architecture holds at scale, not just in theory. Service-owner delegation is also where I want to end up — stop being the bottleneck, push ownership to whoever understands the system best.

Learning with not Enough Data Part 3: Data Generation Part three of Weng’s survey on training with limited data, covering noise-robust label correction (F-correction, NPCL), curriculum-based confidence thresholds, and self-reinforcing augmentation loops like LAMBADA and back-translation distillation.

Why it matters: every method in this survey needs an outside source of truth to work at all — a clean trusted subset to estimate a noise-correction matrix, or a known corruption rate to prioritize which samples to prune. There’s no version of these techniques that skips that requirement; you can move where the ground truth has to enter the system, but you can’t remove it. The sharper point is about the metrics the field uses to judge itself: “affinity” and “diversity” scores for augmented data are computed from the same model’s own loss and performance, not any external check. A high-affinity augmentation just means it matches what the model already believes — which is exactly how a systematically wrong dataset can look great on its own scorecard.

🪨