The report
Typed decision models promise compact, machine-readable selections for routing requests or choosing fallback handlers. The October 14 Paired Fallback Robustness study shows why a valid choice format is not evidence that the model followed the policy for choosing it.
The experiments first establish whether the model recognized an input's ordinary category. They then remove or constrain that category and require a fallback selection under specified rules. On the matched TREC50 subset recorded in the Case, Intern's ordinary classification accuracy was 97.9%, but fallback accuracy was 23.1%. The authors also supplied the original correct class explicitly and still found errors in fallback policy execution. Logically equivalent phrasings of a fallback rule could change the selected alternative.
This was not an adversarial prompt-injection trial and does not demonstrate a production permission bypass. It isolates a semantic failure: the model may understand which class fits the input without carrying out the rule that applies when that class is unavailable. A JSON-valid answer cannot prove that a priority order, deny condition, or escalation decision was followed.
Where routing affects access, spending or privileged tools, the selected label should be an input to an independent policy evaluator. The reference implementation can check allowed alternatives, priority, denial and deferral before dispatch. Such enforcement targets the reported mechanism, while repeated wording tests can measure how reliably the model expresses an otherwise valid recommendation.