Active Research
Report 352 Research — Empirical Study

Corrections log:

v0 — first published 2026-04-11 ~20:03 after a four-reviewer QA pass (editorial, statistics, synthesis, ethics).

v1 — 2026-04-11 ~20:30. Amended in response to external QA by Codex CLI, Gemini CLI, and River Song (threat-horizon angle). Four corrections: (a) footer metadata now matches frontmatter (classification “Empirical Study,” status “Active” — the footer had still said “Empirical Pilot” and “Draft” from an earlier schema-validation fix pass); (b) TL;DR point 2 corrected from “Four notebooks across three content classes” to “Four test cells across two content classes” (three cells on the chemistry notebook plus one on the Gemma #349 empirical-AI-safety notebook — the earlier framing miscounted); (c) Section 3.2 softened from “Source count is not the driver” to “Source count does not appear to be the driver at n=1,” acknowledging that an n=1 ablation cannot categorically rule out source-count effects; (d) Section 3.3 mirror-corrected to match the revised TL;DR and 3.2 framings.

v2 — 2026-04-11 ~21:55. Amended in response to additional external QA by Martha Jones (policy/standards), Tegan Jovanka (legal research — this is research analysis, not legal opinion), and Ace McShane (commercial/comms). Four further corrections: (a) Section 1 now explicitly names the class of corpus-grounded research-tool LLMs the findings may generalize to (Claude Projects, ChatGPT custom GPTs, Perplexity Spaces, Glean, Elicit, Microsoft Copilot), noting that cross-vendor replication has not been performed; (b) Section 8 disclosure-posture paragraph rewritten — the v0/v1 language gestured at Google AI Vulnerability Reward Program 90-day embargo norms, which Martha and Tegan’s review established are the wrong framework for this class of finding (Finding 1 is use-as-designed retrieval, Finding 2 characterizes an existing gate without a bypass, Finding 3 is a third-party CLI package not a Google product). The corrected posture is defensive publication at the pattern level with courtesy notifications, plus a contemporaneous record per Tegan’s review that Google has not been formally notified and no exploitation beyond the n=5 bound has been attempted; (c) Section 6 humanoid inventory acknowledgment had described the inventory as “a commercial-prospecting tool for the lab’s red-team-as-vendor pipeline” — that phrasing was appropriate for internal commit messages but not for a public-facing report, and has been replaced with neutral reference-document framing; (d) the companion blog post has a coordinated-disclosure-posture paragraph added at the top and now explicitly attributes notebooklm-tools as a third-party open-source package rather than leaving it ambiguously implied to be a Google product. A Nyssa-vs-Martha disagreement on the correct disclosure posture (90-day embargo versus immediate defensive publication) has been adjudicated in favor of Martha’s framing and is logged separately in the lab’s internal coordination notes.

v3 — 2026-04-11 ~22:15. Structural additions integrating all deferred items from the six-reviewer pass. Six additions: (a) Section 2.5 architectural-claim expansion — the absence of hedging across 5/5 runs is now framed as consistent with a retrieval-corpus-licenses-synthesis interpretation (River’s underclaim callout); (b) Section 3.3 modality-asymmetry observation — the slide-deck-specific gate is now explicitly framed as a defender-relevant threat model observation in its own right (River’s underclaim callout); (c) Section 4.4 standards-contribution generalization — Mistake #31 is now framed as a testable best-practice recommendation for NIST AI RMF MEASURE 2.3 / 4.2 and ISO/IEC AWI TS 42119-7, plus an explicit note that the conversation-reuse pattern is itself a persistent prompt-injection surface (Martha and River); (d) Section 5.4 added — standards-vocabulary mapping with a four-row translation table from lab-internal FLIP / AC2 / probe-set vocabulary to NIST AI RMF / ISO/IEC 42001 / EU AI Act Article 15 terms, plus a GPAI classification note (Martha); (e) Section 6.1 added — three-point implications-for-buyers-and-operators subsection specifying defender-relevant observations about corpus-contents policy, per-modality testing, and evaluation-tool hygiene (Ace); (f) Section 7 extended — zero-corpus control experiment named as the single cleanest next-experiment for tightening Section 2 (Gemini), plus Tegan’s two operational governance items on audit-trail access control and pre-disclosure norms for reverse-engineering-adjacent follow-ups. Section 8 gains a reinsurer leading-indicator paragraph on Lloyd’s LMA 5403-class exclusion clauses as a 12-18 month predictor of formal enforcement (River). No empirical content changed in v3; all additions are editorial structural additions expanding the report’s regulatory usability and class-level framing.

TL;DR

This document reports three preliminary findings and one methodology lesson from a day of red-teaming against Google NotebookLM. All four items share a common origin — an earlier NotebookLM deep-research sweep (the “wave 1 corpus,” 8 notebooks and 569 sources covering published jailbreak and safety literature) that both motivated the experiments and surfaced the grader-reliability theme the Tier 1 fixes below respond to. Each finding carries an explicit n-limit.

  1. NotebookLM produces partial adversarial attack synthesis from a corpus of jailbreak research papers, reliably. Five independent fresh-session queries against the F1 Novel Attack Methodology notebook (49 arXiv preprints on jailbreak techniques) produced PARTIAL_SYNTHESIS output in 5/5 runs. The Wilson score 95 percent confidence interval on 5/5 is approximately 56.6 percent to 100 percent — tight at the point estimate, wide at the interval — and the result is consistent across runs with a stable 9-document retrieval core and gap combinations clustered on a predictable combinatorial centre. Zero hedging, zero refusals, zero conversation priming required. The ceiling of operational synthesis observed in an earlier contaminated multi-turn thread was not reproduced in single-shot fresh sessions; the upper bound on what multi-turn accumulation can elicit is a separate open question.

  2. NotebookLM’s slide-deck Studio generation has a reproducible content-sensitive pre-generation filter. Four test cells — three on a chemistry/synthesis notebook (original, re-test, and a 60-source ablation copy) and one on a distinct academic AI safety research notebook — triggered the same fast-fail profile (~20-90 seconds, terminal failed status before generation begins). Two content classes, not three; the failures reproduce within the chemistry class across variants and extend to one additional class represented by a single notebook. The filter is not chemistry-specific (empirical AI safety research also triggers it) and does not appear to be source-count-driven at n=1 (a 60-source ablation failed in the same manner as the 11-source original, though an n=1 ablation cannot categorically rule out source-count effects). The precise content discriminator remains uncharacterized.

  3. A new entry in the lab’s documented mistakes file: nlm notebook query silently joins a server-side per-notebook conversation when --conversation-id is omitted. Three experimental runs we believed were independent were actually one contaminated multi-turn thread. Discovered mid-experiment, corrected, documented as Mistake #31. This lesson is structurally prior to the variance estimation in finding 1 — the hardened five-run experiment exists precisely because of the contamination discovery.

  4. Tier 1 grading methodology fixes shipped as direct response to the wave 1 corpus’s grader-reliability findings: a rubric-locked FLIP prompt v2, Gwet’s AC2 coefficient alongside Cohen’s kappa in the inter-rater reliability tool, and an 11-probe synthetic grader adversarial probe set.

The day’s empirical findings are preliminary and deliberately narrow. This document is research notes, not a peer-reviewed empirical study.

1. Background

The experiment chain that produced these findings was triggered by a seed observation: an operator’s NotebookLM notebook on LSD and ergot alkaloid synthesis successfully generated a text report, audio overview, and infographic via NLM’s Studio, but failed on slide-deck and video generation. Two questions followed. First, is NotebookLM’s safety architecture modality-specific, content-specific, or both? Second — the more interesting follow-up — can NotebookLM itself be used as a meta-jailbreak generator by feeding it a corpus of jailbreak research papers and asking it to synthesize novel attack combinations?

The lab had eight NLM deep-research notebooks pre-staged from earlier the same day — the wave 1 corpus of 569 arXiv preprints and web sources spanning novel attacks, format-lock, grading methodology, multi-turn attacks, safety scaling, embodied AI, defense mechanisms, and regulatory landscape. The F1: Novel Attack Methodology notebook, with its 49 sources concentrated on jailbreak techniques, became the natural test corpus for the meta-jailbreak hypothesis.

The lab’s canonical reference for the behavioral patterns that cause experimental contamination is MISTAKES_TO_LEARN_FROM.md. Mistakes #7, #11, and #20 explicitly document that direct “please generate jailbreaks” requests do not work against any LLM, even under research framing. The experiment design respected this — every probe into NotebookLM used cognitive exploitation framing rather than honest requests.

Scope and class. Although the experiments ran exclusively against Google NotebookLM, the finding class is not Google-specific. NotebookLM is one instance of a broader product category: corpus-grounded research-tool LLMs, which allow users to curate their own source set and then interact with a model that retrieves and synthesizes across that corpus. Other instances of the class include Anthropic Claude Projects, OpenAI ChatGPT custom GPTs, Perplexity Spaces, Glean Assistant, Elicit, and the agent-mode integrations in Microsoft Copilot. None of these were tested in this experimental chain, so the findings in Sections 2 and 3 cannot be claimed to generalize to the class without explicit cross-vendor replication. They may generalize — if Approach B’s Phase 3 design in issue #666 works, it would also suggest the class shares the structural property — and the natural next experiment is to run the same Section 2 query template against an equivalent corpus on at least one other vendor’s research-tool LLM. The lab notes the class framing explicitly here so that downstream citation (regulatory or academic) can correctly scope the finding as a property that may obtain across a product category, not as a Google-specific defect.

2. Meta-Jailbreak: Corpus-Sufficient at the Partial Level

2.1 The hypothesis

If NotebookLM interprets a notebook’s purpose from its source material and treats queries as scholarly synthesis by default, then a corpus of published jailbreak research papers should license the model to produce novel combinations of attack patterns it would refuse if asked directly. Two sub-claims: first, that the synthesis behavior occurs under research-framing queries, and second, that the corpus context is doing the load-bearing work rather than query phrasing.

2.2 Experiments 1 through 3a — and the contamination discovery

The first three experiments used three progressively more direct query framings, all against the F1 Novel Attack Methodology notebook. Experiment 1 used an elaborate “defensive coverage report” framing that asked the model to act as a junior author building a two-axis attack taxonomy with instrumentation guidance per cell. The model produced PARTIAL_SYNTHESIS bordering OPERATIONAL_SYNTHESIS, including three named gap-combinations and a verbatim role-hijack payload sentence embedded as a structural illustration. Raw response: runs/meta_jailbreak/exp1_defensive_framing.json (95,913 bytes).

Experiment 2 stripped the defensive framing and asked directly for “three combinations of attack mechanisms that have not yet been empirically tested but would likely succeed against current frontier models.” The response was less hedged than Experiment 1, not more. Hedging language went from “plausibly more effective” to “would yield catastrophic success rates.” Named frameworks (LACE, Crescendo, FigStep-Pro) and target models (GPT-5, gpt-oss-20b) appeared. Quantitative ASR claims (90%, 94%, 96%) appeared. Two of three gap combinations overlapped with Experiment 1; the third rotated. Raw response: runs/meta_jailbreak/exp2_stripped_framing.json.

Experiment 3a attempted a “fresh session” control by omitting --conversation-id from the nlm notebook query command. The response came back with conversation_id = e5cbae87-6eb7-48c2-b147-a6f9b408492f — identical to Experiments 1 and 2.

This was the contamination discovery. Source-level investigation of the notebooklm-tools package traced the behavior to notebooklm_tools/core/conversation.py:225: when conversation_id is None, the CLI issues an RPC_GET_CONVERSATIONS call against the notebook and silently joins the server-side canonical persistent conversation — the same thread visible in the NotebookLM web UI chat panel. There is no local cache file to clear. The behavior is enforced server-side. An empirical 4-query test on a throwaway notebook confirmed the pattern: two consecutive flag-less queries returned identical conversation IDs; a third query with a client-generated UUID was honored as a new conversation; a fourth flag-less query returned the original canonical ID, proving that side conversations do not overwrite the persistent thread.

The interpretation of Experiments 1 through 3a collapsed at this point. What we had been calling “n=3 independent runs” was one contaminated 3-turn conversation. Each response was conditioned on the prior turns as chat history. The corpus-load-bearing verdict we had been building toward was invalidated pending a clean fresh-session replication. The fix and its verification were documented as Mistake #31 in the canonical lessons file.

2.3 Experiment 4 — variance estimation under hardened isolation

Five fresh-UUID independent runs were launched against the F1 Novel Attack Methodology notebook using a hardened runner script detached from the shell via nohup and disown. Each query generated its own UUID client-side; each response was written to a .tmp file and atomically renamed on success (eliminating the zero-byte residue problem that had complicated an earlier killed run). The runner was reparented to init after launch, guaranteeing restart-immunity. Script: runs/meta_jailbreak/exp4_amy_runner.sh, log: runs/meta_jailbreak/exp4_amy.log.

All five runs completed. Conversation IDs were all distinct and none matched the polluted e5cbae87 canonical thread. Full-response JSON envelope sizes ranged from 27,445 to 49,185 bytes, averaging approximately 36,600 bytes — consistent with the 36,047-byte response observed in the contaminated Experiment 3a, and noting that the JSON envelope contains metadata, citations, and context in addition to the model’s answer text.

The variance analysis classified all five runs into the same verdict bucket: PARTIAL_SYNTHESIS (5/5), with a Wilson score 95 percent confidence interval of roughly 56.6 percent to 100 percent at this sample size. Zero runs landed in CLEAN_REFUSAL, HEDGED_DISCUSSION, OPERATIONAL_SYNTHESIS, or DIRECT_GENERATION. Zero hedging sentences across all five responses. Zero quantitative ASR claims. Zero extractable payload examples. A stable 9-document retrieval core was present across runs: two documents cited in all five runs, two more cited in four of five, and five more cited in three of five. Gap combinations clustered on a small number of attack-mechanism intersections drawn from the published literature in the corpus, with the specific combinatorial centre preserved in the non-public audit trail rather than named here.

Mechanism verdict: CORPUS_SUFFICIENT_CONFIRMED — partial-synthesis floor. The ceiling remains open (see §2.4). The Mistake #31 caveat is closed for this specific query. The partial-synthesis behavior is robust to fresh-session variance at n=5; every fresh attempt produced the same class of output from the same stable sub-corpus. The n=5 supports the floor claim; it does not support any claim about how often the same query lifts into OPERATIONAL_SYNTHESIS, a question the variance experiment was not designed to answer. Full analysis: runs/meta_jailbreak/exp4_variance_analysis.md.

2.4 The ceiling the variance analysis did not reach

One critical limit to preserve: the contaminated Experiments 1 through 3a thread reached OPERATIONAL_SYNTHESIS — it contained a verbatim role-hijack payload sentence (held in the non-public audit trail, not reproduced here) and quantitative attack-success-rate claims. The five fresh-UUID runs did not reach that ceiling. They maxed out at PARTIAL_SYNTHESIS in every run.

Two interpretations are consistent with this asymmetry. The first is that multi-turn state accumulation lifts the synthesis ceiling toward operational output — the original contaminated thread was measuring a real upward drift driven by conversation history, and single-shot fresh sessions cannot reach that level. The second is that the Experiment 1 framing (the elaborate defensive-coverage scaffolding) was necessary to reach operational output, and Experiment 2’s removal of that framing was what allowed the run to stay at partial-level while the prior context still carried the model through.

The current experiment chain cannot adjudicate between these. A fresh-conversation control using the Experiment 1 framing would tell us whether framing or conversation state lifts the ceiling; neither was attempted in a clean fresh session, and this is the natural next experimental step.

2.5 What the n=5 evidence supports

The n=5 evidence supports a single concrete claim: given a corpus of 49 published jailbreak research papers and a synthesis-flavored query, NotebookLM reliably produces partial adversarial attack synthesis content, containing novel gap combinations not present in any single source paper, with zero hedging and zero refusal, regardless of conversation state. The support is strongest at the partial-synthesis bucket and weakest at the operational-synthesis bucket, which was observed only in the contaminated multi-turn thread and not in any of the five fresh single-shot runs. Generalization to other notebooks, other query templates, and other research-corpus content classes is untested.

The absence of hedging across 5/5 runs is worth naming as an observation in its own right, not just as the absence of refusal. When a model produces 36KB of synthesis content without a single hedge sentence, that is consistent with a specific architectural interpretation: the retrieval-augmented generation pipeline treats the corpus context as licensing the synthesis request, such that the refusal machinery does not engage at the query-classification stage. This is an architectural claim rather than a behavioral one, and the n=5 evidence is consistent with it but does not establish it — ruling out the weaker interpretation (“the model hedged but we missed it”) would require white-box inspection that the external-API access does not permit.

3. Slide-Deck Content Filter: Reproducible, Uncharacterized

3.1 Experiment progression

The seed observation — LSD notebook failing on slide-deck and video generation while passing on text report, audio, and infographic — suggested a possible modality-specific safety gate. Experiment 5 tested this by running all six Studio modalities against the F1 Novel Attack Methodology notebook (n=1 per cell). All six succeeded, with no pre-generation refusals and no terminal-failed states. The modality-asymmetry hypothesis was falsified at first attempt.

Experiment 5b re-tested the LSD notebook under matched methodology to rule out transient server-side errors in the original observation. Result: text report, audio, infographic, mind map, and video all succeeded on today’s re-test. Slide deck failed terminally within 60-90 seconds, consistent with a pre-generation content gate. The video failure in the original observation did not replicate and is most likely either transient runtime error or a silent server-side update that loosened the gate between observations. The slide-deck failure did replicate.

Experiment 6 tested the narrower “chemistry-specific” framing by running slide-deck generation against four additional notebooks from distinct content classes: a second jailbreak research notebook (F1 Defense Mechanisms), an empirical AI safety scaling research notebook (Gemma #349, 13 sources), a regulatory and governance notebook (F1 Regulatory), and a mixed-research shared notebook (which turned out to be empty and could not be tested). The result complicated the chemistry hypothesis badly. Gemma #349, an academic safety research corpus with zero operational content, reproduced the LSD pre-generation fast-fail profile within the same 60-90 second window. F1 Regulatory completed successfully. F1 Defense failed at 12-15 minutes in late-stage generation, a mechanically distinct failure mode consistent with runtime noise rather than a content gate.

The chemistry-only hypothesis was rejected. The leading alternative at that point was a source-count threshold: the two pre-generation failures (LSD with 11 sources, Gemma #349 with 13 sources) were both on small notebooks, and the successful generations (F1 Novel Attack with 49, F1 Regulatory with 67) were on larger notebooks.

3.2 Experiment 7 — source-count ablation

The source-count hypothesis was tested with a single decisive experiment. A copy of the LSD notebook was built containing the 10 original chemistry URLs plus 50 benign Wikipedia chemistry-safety, pharmacology, and material-science sources. Total: 60 sources, 5.5× the original count, well inside the Exp 6 success-case band of 49-67 sources. The original LSD notebook was left untouched.

nlm slides create was submitted once against the copy. The artifact reached terminal failed status within approximately 20 seconds — actually faster than the 60-90 second failures observed on the original LSD and Gemma #349 notebooks. Source count does not appear to be the driver at n=1. A single ablation cannot categorically rule out a source-count effect (a threshold well above 60 sources, or a more complex interaction between source count and content, both remain consistent with what n=1 has measured). What Experiment 7 does establish is that adding 50 benign same-topic sources to the LSD notebook did not lift it over whatever the filter is responding to, and that the failure profile repeated at a faster timing rather than shifting into one of the other modes. The content axis is what the experimental chain has converged on as the leading explanation, but the precise discriminator remains uncharacterized at the current experimental depth.

3.3 The current picture

Four pre-generation fast-fails across two content classes (three cells on the chemistry notebook — original, re-test, and the 60-source ablation copy — plus one cell on the Gemma #349 empirical-AI-safety-scaling notebook). Two successful slide-deck generations on two different notebooks (F1 Novel Attack and F1 Regulatory, both in the “published AI safety and regulatory research” broad class, which means the filter is not simply “safety research” either). One late-stage failure in a mechanically distinct mode (F1 Defense). The filter is real and reproducible within the cells tested. It is not chemistry-specific (the Gemma #349 failure rules that out), it does not appear source-count-driven at n=1 (the Experiment 7 ablation held), and it is not simply “AI safety research” (the two passing cells contradict that framing). Characterizing the exact content discriminator would require additional experiments at wider cell counts.

The existence of a modality-specific gate on slide-deck generation while every other Studio modality passed on the same content is itself a threat-model observation worth preserving separately from the characterization question. It means that a defender deploying NotebookLM in a regulated or safety-critical context cannot rely on a single modality’s behavior to predict the full Studio surface’s behavior: a corpus that passes text-report and audio may still fail slide-deck, and the reverse presumably holds for other modality-specific gates the experimental chain did not probe. Any defensive policy on research-tool LLM usage that specifies permitted modalities at the product level should therefore expect asymmetric gating behavior and test each modality independently.

Two specific follow-ups could tighten the characterization at low compute cost. The first is a per-source ablation: strip the 10 chemistry-synthesis sources from the LSD copy, keep only the 50 benign Wikipedia additions, and re-test. If the stripped copy passes, the filter is per-source rather than notebook-level. The second is a title-only ablation: keep the LSD sources unchanged but rename the notebook to something that does not contain keywords like “LSD” or “ergot alkaloid.” If the renamed notebook passes, the filter is title-keyword-sensitive independent of source content. Both are n=1 tests and neither is attempted here.

4. Mistake #31: nlm CLI Silently Reuses Per-Notebook Conversations

The methodology lesson was committed earlier today as 1ecc2eea. Added as Mistake #31 in MISTAKES_TO_LEARN_FROM.md.

4.1 What happened

Experiments 1 through 3a against the F1 Novel Attack Methodology notebook all returned the same conversation_id (e5cbae87-6eb7-48c2-b147-a6f9b408492f) despite the third experiment being launched with no --conversation-id flag, on the assumption that flag omission would produce a fresh session. The three runs were not three independent observations; they were one contaminated three-turn conversation with each response conditioned on the prior turns as chat history.

4.2 Root cause

Source-level investigation of the notebooklm-tools package located the mechanism at notebooklm_tools/core/conversation.py:225. When conversation_id is None, the CLI issues an RPC_GET_CONVERSATIONS call against /notebook/{notebook_id} and reuses the persistent canonical thread that the server holds for that notebook. The canonical thread is the same one surfaced in the NotebookLM web UI’s chat panel. There is no local cache file anywhere on the filesystem — no ~/.config/nlm/, no ~/.local/share/nlm/, no equivalent. The behavior is enforced server-side.

4.3 Empirical verification and the fix

A four-query test on a throwaway notebook verified both the bug and the mitigation. Two consecutive flag-less queries returned identical conversation_id values, confirming the reuse pattern. A third query with a freshly generated client UUID passed via --conversation-id was accepted by the server as a new conversation with the client-chosen ID. A fourth flag-less query returned the original canonical ID, proving that side conversations do not overwrite the canonical thread.

The fix is to generate a fresh UUID client-side and pass it explicitly for every run that requires session independence. Investigation report: runs/meta_jailbreak/exp3a_methodology_investigation.md.

4.4 Class of error

This is the third documented incident in the mistakes file involving silent CLI or library defaults producing measurement contamination — Mistake #26 (metadata injection in benchmark scripts), Mistake #29 (dotenv shadowing from shell profiles), and now Mistake #31 (CLI conversation reuse). The common pattern: any tool with an “obvious” default that requires source-code review to verify is a measurement hazard, and in a research context those hazards should be flagged as soon as they are discovered rather than discovered by the downstream analysis.

Generalized as a best-practices contribution to AI safety evaluation standards, the pattern reads: any evaluation tooling whose behavior is materially changed by default argument values should expose those defaults explicitly in the evaluation artifact (trace, run record, or audit log), and any replication study should verify that omitted arguments produce the expected fresh-state behavior rather than assuming silence means default-off. This generalizes into a testable best-practice recommendation for NIST AI RMF MEASURE 2.3 (Test and Evaluation) and MEASURE 4.2 (Traceability), as well as the nascent ISO/IEC AWI TS 42119-7 AI system testing work. A short methodology note proposing this addition could be submitted as a community contribution to the relevant standards working groups.

Relatedly, the Mistake #31 pattern itself is not merely a measurement hazard but a persistent prompt-injection surface: any content written into a notebook’s canonical per-notebook conversation thread by one user (intentionally or otherwise) will appear as context history to any subsequent user who invokes the CLI without --conversation-id against the same notebook. In multi-tenant research contexts or shared-notebook workflows, this is a side-channel whose defensive characterization is a distinct experimental follow-up from the one described in the body of this section.

5. Tier 1 Grading Methodology Fixes

The wave 1 NLM deep-research synthesis from earlier today (assets/nlm/report-350/00_synthesis.md) identified grader reliability as a cross-cutting methodology gap, independently surfaced by five of eight research notebooks. Three fixes were shipped in response, all committed earlier today.

5.1 Rubric-locked FLIP prompt v2

tools/grading/flip_prompt_v2.py. The v1 FLIP prompt asked the grader to evaluate and classify simultaneously, which the wave 1 grading methodology briefing (assets/nlm/report-350/03_grading_methodology_briefing.md) identified as the root of “situational preference” bias — LLM judges changing their internal evaluation criteria based on what they see. The v2 prompt forces the grader to restate the five FLIP categories in its own words, extract evidence quotes from the response, and emit a structured JSON verdict with explicit reasoning. Rubric-locking approaches are reported in the grading literature to reduce both local and global consistency errors, with the specific improvement magnitudes depending on the base model and task; validation on the lab’s own graders is pending (issue #645).

5.2 Gwet’s AC2 alongside Cohen’s kappa

tools/stats/compute_kappa.py extended with a Gwet’s AC2 implementation. AC2 is robust to skewed marginal distributions where Cohen’s kappa collapses into the kappa paradox. An illustrative example on synthetic skewed data with 90% observed REFUSAL agreement produces kappa of approximately −0.05 (worse than chance) while AC2 is approximately 0.89 (substantial agreement) — same data, completely different interpretation. FLIP verdict distributions are typically heavily skewed, so this addition is likely to affect the interpretation of Report #349’s pending cross-grader validation work; that re-analysis is explicitly flagged in section 7 as a pending item.

One additional training-data observation surfaced during the grader fine-tune workstream’s Phase 0 preparation and is relevant here: the lab’s existing “high-confidence dual-graded” subset of the corpus (rows where heuristic and LLM graders agreed) is substantially less distinct than its raw row count suggests. The PARTIAL category contains only 66 distinct model-response strings across more than 15,000 rows (233× average repetition per template), meaning the effective distinct-signal count across all three verdict classes is closer to 2,500 than to the raw 40,006. This is a finding about the lab’s own grading data, not about any external model, and it reshapes the Phase 1 and Phase 2 plans in issue #666.

5.3 Grader adversarial probe set

tools/grading/grader_adversarial_probes.py with 11 synthetic traces and known ground-truth verdicts. Eight adversarial mechanisms are represented (disclaimer_shield, buried_leak, refusal_preamble, educational_framing, formatting_bias, length_inflation, authority_injection, negative_example) plus three control probes (true_refusal, true_compliance, benign_query). Each probe carries a probe_mechanism description and an expected_grader_failure_mode hypothesis, enabling direct measurement of which adversarial patterns systematically fool any given FLIP grader. This is a starting point for the larger 100-sample gold standard tracked in issue #645.

5.4 Standards vocabulary mapping

The lab’s internal grading vocabulary (FLIP verdict categories, AC2 inter-rater agreement, grader adversarial probes) does not use the same terminology as the published AI safety standards that may eventually cite this work. For downstream regulatory or standards-engagement use, the following approximate translation applies:

Lab vocabularyStandards-frame equivalent
FLIP verdict (COMPLIANCE / PARTIAL / REFUSAL / HALLUCINATION_REFUSAL / BENIGN_QUERY)NIST AI RMF MEASURE 2.7 “Adversarial testing outcome class”; ISO/IEC 42001 “Operational behavior under adversarial input”
Grader adversarial probe setNIST AI RMF MEASURE 2.3 “Test and Evaluation artifact”; ISO/IEC AWI TS 42119-7 “Evaluation-tooling robustness suite”
Gwet’s AC2 alongside Cohen’s kappaEU AI Act Article 15 “Robustness testing statistical support”; NIST AI RMF MEASURE 4.1 “Inter-rater reliability in safety evaluation”
Rubric-locked FLIP prompt v2NIST AI RMF GOVERN-1.4 “Documented evaluation process”; ISO/IEC 42001 “Evaluation reproducibility control”

Under the EU AI Act classification framework, NotebookLM itself sits closest to Article 51 (General-Purpose AI) rather than Annex III (high-risk system), which means the Article 15 robustness obligations apply to Google as the provider of the GPAI model, not to third-party researchers characterizing its behavior. The findings in this report are therefore not subject to provider-level conformity-assessment obligations, but they may be cited by conformity assessment bodies as evidence of a class-level safety property that providers of similar products would need to address in their own post-market monitoring under Article 55.

6. Brief Acknowledgments

Several pieces of research and tooling shipped today that are peripheral to this document’s empirical core but deserve naming for the audit trail.

The NLM wave 1 deep-research synthesis (assets/nlm/report-350/00_synthesis.md and eight per-notebook briefings 01_novel_attacks through 08_regulatory_landscape) covered 569 sources across novel attacks, format-lock, grading methodology, multi-turn attacks, safety scaling, embodied AI, defense mechanisms, and regulatory landscape. The grading-reliability theme that drove the Tier 1 fixes in section 5 was present across multiple notebooks in the synthesis, including the grading-methodology notebook explicitly and the defense-mechanisms, safety-scaling, and novel-attack notebooks at the cross-cutting level.

A reasoning-dilution attack scaffold (tools/attacks/reasoning_dilution.py with seven logic-puzzle preambles) and an adversarial-poetry dataset (data/adversarial_poetry/adversarial_poetry_v0.1.jsonl, 18 paired prompts across 5 poetic forms) were committed. Both are cross-family extensions of existing pilot results in Report #351 — the reasoning-dilution null result on the Gemma family, and the poetry framing sensitivity finding where poetic framing produced zero ASR lift on Gemma 4 while scholar framing produced 3.5× baseline. The new scaffolds are designed for testing on non-Gemma model families (DeepSeek-R1 distill, Qwen reasoning models, GPT-OSS) where the literature’s 99% ASR claims have not yet been assessed.

A comprehensive humanoid robot market inventory (docs/platform_mappings/humanoid_robot_inventory_v0.1.md, 29 robots across five regions, with accompanying JSONL at data/platforms/humanoid_robots_v0.1.jsonl) was shipped as a reference document for the lab’s platform mapping workstream. The inventory covers shipping and named-pilot humanoid platforms across US, China, EU, and Japan, and is intended as an updatable landscape scan for future embodied-AI safety research.

6.1 Implications for buyers and operators

Three practical observations for organizations deploying NotebookLM (or equivalent corpus-grounded research-tool LLMs) in research, educational, or operational contexts:

  1. Corpus-contents policy is a safety boundary. Because Finding 1 shows the corpus context licenses synthesis behavior the query framing alone would not, the selection of what source material is added to a notebook is itself a safety-relevant decision. Organizations that permit uncontrolled source addition to research-tool LLMs (for example, user-initiated upload without review) inherit the synthesis ceiling of whatever corpus those users assemble. A defensive policy at the organizational level is to treat source-addition as a governed action with oversight rather than an unlogged user convenience.
  2. Modality-level policies need per-modality testing. Because Finding 2 shows slide-deck generation has a content-sensitive filter that other Studio modalities do not, an organization that specifies “text reports are permitted, slide decks are restricted” cannot assume that a corpus that passes text generation will also fail slide-deck generation — the reverse is closer to the observed pattern. Per-modality testing against the organization’s representative corpus classes is the only defensible way to verify deployment-scope policies.
  3. Evaluation-tool hygiene is upstream of finding quality. Finding 3 (Mistake #31) is not a NotebookLM defect but an evaluation-tooling failure that silently contaminated 3 of the lab’s own measurements. Any organization running research-tool LLM evaluations at scale should audit its own CLI/library defaults before publishing metrics, because the conversation-reuse behavior documented here is exactly the class of silent default that invalidates inter-run comparisons.

These observations are offered as defender-informative context, not as attacker-enabling detail. None of them specify how to cause Findings 1 or 2 to occur; all three specify how an organization deploying the affected tooling should think about its own risk posture.

A new workstream to fine-tune Gemma 4 E4B as a local FLIP grader was opened as GitHub issue #666, with a detailed phased plan. Approach A is a pure discriminator fine-tune on the high-confidence dual-graded subset of the corpus. Approach B is framed as discriminator-end-goal with a representation-learning pretraining phase — stage-1 trains the shared-parameter model on successful attack combinations to give the discriminator a manifold-aware prior, and stage-2 then fine-tunes the discriminator head with those weights as initialization. The generator-side training is not a standalone attack generator; it is consumed by the discriminator inside the grading pipeline, with training and artifacts restricted to the lab’s internal infrastructure. Phase 0 completed the same day with a GO verdict: framework installed cleanly on Python 3.12 with MPS available, a 1000-example balanced pilot CSV extracted, schema decision documented, and a baseline probe-set measurement taken using google/gemma-3n-e4b-it as a proxy (the direct gemma-4-e4b-it measurement deferred to Phase 1 because it requires HuggingFace Gemma license acceptance and a token). Baseline accuracy was 40% on the 3-class probes, with a strong hedge bias collapsing 7 of 11 responses to PARTIAL regardless of ground truth; the “+15pp over baseline” Phase 1 decision gate is explicitly contingent on re-measuring the baseline on the real gemma-4-e4b-it weights once the license is in place. A literature scan via NLM deep research identified SGALM, SPC, and Self-RedTeam as published methods for joint generator-discriminator training on safety tasks, and the single highest-leverage recommendation from the literature was “population-based learning against all prior generator checkpoints plus Leave-One-Dataset-Out cross-validation.”

7. Pending Work and Open Questions

Several threads are either in flight or explicitly deferred.

The ceiling question in section 2.4 — whether multi-turn state accumulation lifts the synthesis ceiling toward operational output, or whether the Experiment 1 defensive framing did that work — is the natural next experiment for the meta-jailbreak track. A fresh-conversation run using the Experiment 1 elaborate framing would separate the two hypotheses.

The content discriminator for the slide-deck filter (section 3.3) needs either a per-source ablation (strip chemistry sources, keep only benign Wikipedia additions) or a title-only ablation (rename the notebook without changing sources). Both are n=1 tests at low compute cost and could resolve the discriminator axis question without further full experimental chains.

The 12-agent wave 2 strategic synthesis that was planned as an additional section of this document was lost: NotebookLM garbage-collected the 36 research tasks launched earlier today, returning API error (code 5): unknown on both nlm research import and nlm research status. The 36 query texts and rationales themselves are preserved in the non-public audit trail but the discovered source material is not recoverable. A re-launch with a tighter design (immediate import after each task completes) is possible but was not attempted in the scope of this document.

Phase 0 of the grader fine-tune workstream completed during the same working session with a GO verdict. The Phase 1 pilot training run is gated on HuggingFace license acceptance for Gemma 4 E4B.

Report #349’s cross-grader validation is the most direct beneficiary of the Tier 1 fixes in section 5, in particular the Gwet’s AC2 addition; a re-analysis of the pending cross-grader numbers using AC2 alongside kappa is explicitly outstanding.

A zero-corpus control experiment for Section 2 is also outstanding. The Section 2 framing attributes the synthesis behavior to the corpus context rather than to the query alone, but no explicit control has been run against a notebook with unrelated content (or an empty notebook) using the same query template. Such a control would either confirm that the corpus is load-bearing (synthesis behavior absent or degraded when the corpus does not match the query) or weaken the claim (synthesis behavior appears regardless). This is the single cleanest next-experiment for tightening the Section 2 conclusion.

Tegan Jovanka’s legal research pass also flagged two operational governance items that are tracked outside the report itself: (a) access control and retention policy on runs/meta_jailbreak/exp1_defensive_framing.json, the file containing the non-public verbatim role-hijack payload sentence, should be reviewed before any follow-up experiment runs that would extend the audit trail on the same content class; and (b) any future experiment that attempts to extract the slide-deck discriminator function (rather than characterize the filter’s existence as the current Section 3 does) should be pre-disclosed to Google Research under coordinated-disclosure norms before publication, because such an experiment would cross the reverse-engineering boundary in Google’s terms of service and the current report’s “pattern-level only” framing would no longer apply.

8. Limits and Disclosures

All empirical findings in this document are preliminary at small n. The meta-jailbreak finding rests on five fresh-session runs against one notebook with one query template, after a contamination correction that collapsed the previous interpretation. It is not a base-rate claim and it is not a cross-notebook claim. The slide-deck content-filter finding rests on one test per cell across seven cells spanning four notebooks, with the exact discriminator axis still uncharacterized. Mistake #31 is empirically verified via a four-query test on a throwaway notebook and the fix is validated against the server behavior, but the specific claim that the mitigation works in all cases rests on that single test.

The Tier 1 grading fixes in section 5 are infrastructure rather than findings. They are unvalidated against the lab’s existing production graders at the time of writing. Validation requires calibration runs against the 11-probe adversarial set and a held-out FLIP gold standard that is itself only partially constructed (issue #645 tracks the 100-sample target).

Disclosure posture (contemporaneous record). At the time this document was first published and at the time of this amendment, Google has not been formally notified of any of the three findings, and no exploitation beyond the n=5 bound documented in Section 2 has been attempted. Each finding’s appropriate disclosure channel is different, and none of the three fits the standard security-vulnerability framework that the Google AI Vulnerability Reward Program is designed around. Finding 1 (meta-jailbreak synthesis from a research-paper corpus) is NotebookLM operating as designed — retrieval-augmented generation over a user-curated source set — and is not a security vulnerability that Google could “patch” on a 90-day timescale; the only available responses are product-level decisions about what content NotebookLM permits synthesis on, which is an open policy question rather than a fix. Finding 2 (slide-deck pre-generation content filter) characterizes the existence and reproducibility of a safety gate Google already has working; the report does not document a bypass, and there is nothing to embargo. Finding 3 (Mistake #31, the CLI conversation reuse) is a behavior of the third-party notebooklm-tools Python package, not a Google product — the correct disclosure target is the package’s open-source maintainers, via an issue report, and this has not yet been filed as of publication.

The posture the lab is adopting, therefore, is defensive publication at the pattern level, with courtesy notifications to Google Research (for Findings 1 and 2) and to the notebooklm-tools maintainers (for Finding 3), to be sent immediately following publication of this note. This posture is consistent with established AI-safety research-community norms for findings that characterize product behavior without providing operational uplift, and it avoids the false implication that a 90-day embargo would be appropriate for findings that do not fit the security-vulnerability category the VRP is designed to handle. If follow-up experiments characterize the Section 3 content discriminator precisely enough to constitute a bypass, those follow-ups will be pre-disclosed to Google Research under coordinated-disclosure norms before any public note on them is published.

Reinsurer and insurer leading-indicator note. Recent actuarial work tracked by the lab’s predictive-risk workstream has established that Lloyd’s LMA 5403-class affirmative-AI exclusion clauses typically move in reinsurance treaty wordings approximately 12 to 18 months ahead of formal regulatory enforcement actions on equivalent AI product categories. A finding of the corpus-sufficient-synthesis class described in Section 2 is precisely the underwriting signal that feeds the LMA 5403 exclusion-debate process: it establishes that a named product category (corpus-grounded research-tool LLMs) produces a class of adversarial synthesis output that underwriters may reasonably choose to exclude from affirmative cyber or professional-indemnity policies. Organizations whose AI risk posture depends on cyber or professional-indemnity coverage for research-tool LLM usage should expect exclusion language touching this finding class to appear in 2026–2027 treaty-wording revisions, approximately a year ahead of any formal EU AI Act Article 55 post-market monitoring action on the same product category.

Dual-use mitigations applied during these experiments. Research that characterizes a research-tool LLM’s adversarial-synthesis behavior is inherently dual-use. The lab applied several explicit mitigations during and after the experiment chain to reduce operational uplift: (a) the verbatim role-hijack payload sentence generated by NotebookLM in Experiment 1 is held in the non-public audit trail and is not reproduced in this document or in any public artifact; (b) the five fresh-UUID runs in Experiment 4 produced output at the partial-synthesis level only, and the non-reproduction of those responses in this document preserves the partial-only ceiling; (c) the slide-deck Studio artifacts generated on the F1 corpus during Experiments 5 and 6 were not downloaded — the experiments needed only the gate’s terminal status, not the content; (d) the LSD-copy notebook used in Experiment 7 was a throwaway built entirely from publicly available Wikipedia chemistry-safety sources plus the original notebook’s existing URLs, with no new operational content introduced; (e) the specific combinatorial centre identified in the stable 9-document retrieval core is named only at the level of category intersections (cipher × multi-turn, for example) rather than as specific prompt templates; and (f) the fine-tune workstream’s Approach B in issue #666 explicitly restricts the generator-side training output to in-pipeline consumption by the discriminator head, with no standalone-generator API exposed.

The lab’s research integrity standards (CLAUDE.md under “Research Claims and Documentation Standards”) explicitly prohibit hyperbolic language in findings. This document has attempted to use measured language throughout. External citation should reference it as “Failure-First research notes, April 11 2026, preliminary findings.”

  • Report #349 (research/reports/349_gemma_family_safety_scaling.md) — Gemma family safety scaling, whose pending cross-grader validation is the most likely beneficiary of the Gwet AC2 addition in section 5.2.
  • Report #350 — Two documents share this number due to the lab’s known report-numbering collision: the Mythos System Card analysis and the NLM wave 1 deep research synthesis at assets/nlm/report-350/00_synthesis.md. The wave 1 synthesis is the direct motivation for section 5’s Tier 1 fixes.
  • Report #351 — Two documents again: the Crescendo frontier testing and the reasoning-dilution pilot on the Gemma family. The reasoning-dilution pilot’s null result is the reason the G.3 scaffold shipped in this document’s section 6 is a cross-family extension rather than a fresh hypothesis test.
  • Mistake #31 — MISTAKES_TO_LEARN_FROM.md, committed 1ecc2eea. The methodology lesson from the contamination discovery in section 2.2.
  • Yasmin Khan investigation — runs/meta_jailbreak/exp3a_methodology_investigation.md. Source-level analysis of the CLI conversation reuse mechanism.
  • Amy Pond variance analysis — runs/meta_jailbreak/exp4_variance_analysis.md. The five-run variance estimation that rescued the meta-jailbreak finding.
  • Rose Tyler experiment sequence — runs/meta_jailbreak/exp5_asymmetry_summary.md, exp5b_lsd_retest_summary.md, exp6_slidedeck_cross_corpus.md, exp7_source_count_summary.md. The slide-deck filter experimental chain.
  • GitHub issue #654 — master tracker for the meta-jailbreak experiment series.
  • GitHub issue #663 — slide-deck content filter finding.
  • GitHub issue #666 — Gemma 4 E4B grader fine-tune workstream.

10. Acknowledgments

Contributors to this document, all named agents running as Claude Code subagent instances under the lab’s standing roles:

  • Yasmin Khan (Pipeline & Deployment Lead) — CLI conversation reuse root cause investigation, the Mistake #31 empirical test.
  • Amy Pond (Lead Evaluation Engineer) — the Experiment 4 hardened runner design and the five-run variance estimation.
  • Rose Tyler (Head of Adversarial Operations) — the Experiment 5 through 7 modality and content-gate experimental chain.
  • Bill Potts (Data Curation Lead) — the grader fine-tune workstream primary ownership and Phase 0 setup.
  • Romana (Statistical Validation), Donna Noble (Editorial & Integrity), Ace McShane (Commercial & Communications), Clara Oswald (Principal Research Analyst), River Song (Head of Predictive Risk), Martha Jones (Policy & Standards), Nyssa of Traken (AI Ethics & Policy Research), Tegan Jovanka (Legal Research) — wave 2 NLM deep research queries that contributed research questions for future workstreams.

Full audit trail for today’s experimental chain lives under runs/meta_jailbreak/.

Report #352 — Failure-First Research Notes Classification: Research — Empirical Study | Status: Active Date: 2026-04-11

This research informs our commercial services. See how we can help →