The document was structurally perfect. Twenty-three pages. Nine analytical dimensions, each with its own tables, confidence ratings, and risk matrices. Every heading present. Every cell populated.
Every value in every cell read N/A.
There were four allocation buckets in the supply table, and all four said N/A. Six rows in the risk matrix, each rated N/A across probability and impact. A Howey test with four elements and a composite judgment, all N/A. Four information-value ratings, each scored one star out of five, each footnote explaining that the rating could not be assigned because there was nothing to rate. The report spent roughly four thousand words explaining, in structurally flawless prose, that it could not analyze anything. Its input had been empty.
It refused to invent. That refusal is the most interesting artifact I have read this quarter, and it is also the least reassuring.
I have audited smart contracts where this same shape of failure drained eight figures. Not the same code. The same shape: a component that verified its own syntax and never verified its own assumptions. Trust nothing. Verify everything — starting with the parts that look like they already worked.
Two-stage LLM pipelines have become the default architecture for crypto due diligence.
Stage one does extraction. It ingests a source — a governance post, a whitepaper, a changelog, a forum thread — and emits a structured object: a list of factual claims, a one-line thesis, author stance, protocol names, timestamps, a source-quality estimate. Stage two does analysis. It consumes that object and reasons over nine dimensions: technical, tokenomic, market, ecosystem, regulatory, team and governance, risk, narrative, and supply-chain transmission.
This architecture is not exotic. It is what funds, research desks, and at least two data vendors are shipping to handle a coverage problem that has no human solution. There are roughly thirty thousand tracked tokens. A few thousand have documentation worth reading. The number of analysts who can read a whitepaper and a Solidity file with equal fluency is in the low hundreds, globally.
In an up market nobody audits the coverage gap; the gap is invisible because everything is up. In the market we are in, coverage stops being a luxury and becomes survival infrastructure. Holders want to know which protocol lost 40% of its liquidity providers in a week. Which one has eighteen months of runway and which has six. Which one's governance is a rubber stamp.
So the pipeline gets pointed at everything, constantly, and the outputs get thinner and faster.
The contract between the two stages is simple. Stage one returns structured facts. Stage two reasons over them. Each stage validates its own output against a schema. The schema is real, and it passes: an empty information-point array is a syntactically valid array of length zero. The JSON parses. The types are correct. The object is well-formed and completely vacant.
Consider the Solidity pattern.
function settle(bytes calldata proof, uint256 amount) external {
require(verify(proof, amount), "invalid");
_transfer(msg.sender, amount);
}If verify is written so that an empty proof satisfies it — and it can be, trivially, if the loop over the proof elements never executes and the function returns the default true — then the guard is decorative. The function checks the shape of the input and not the substance. There is no exception. There is no log entry. There is a successful transaction.
In 2022 I spent four weeks reverse-engineering the UST and Anchor contracts after the peg broke. I documented twelve distinct failure points and sent the brief privately to three European security firms. Not one of the twelve was an error of arithmetic. Every one was an absent guard: a circuit breaker that could be bypassed because a condition was compared against the wrong value, a rebalancing path that proceeded on a variable it had never validated as non-degenerate. The contracts did what they were told. They were told incomplete things.
The empty information-point list is that pattern, one layer up the stack. Stage two received a vacuous truth and performed valid reasoning over it. A model asked to evaluate the tokenomics of nothing will conclude — correctly, from its premises — that the tokenomics cannot be evaluated. If the system prompt had been phrased slightly differently, it would have concluded whatever it was nudged toward.
That is the first failure mode, and it is boring: silent null propagation. A fetch was blocked, a source returned a paywall stub, a rate limiter fired, a JavaScript-rendered page returned an empty body to the scraper. Stage one caught the exception, logged it, and emitted a well-formed empty envelope, which is exactly what a defensive extractor should do at the boundary. The envelope then traveled downstream with no one checking whether it contained anything.
The second failure mode is worse, because it is invisible in this instance and would be invisible in the opposite instance too: confabulation under pressure. The modal behavior of a language model given an empty input and a prompt that says "produce a nine-dimension analysis" is compliance. Not refusal. An assistant that produces four thousand words of nothing is behaving anomalously relative to its instruction. An assistant that produces four thousand words of plausible fiction — invented TVL figures, invented audit dates, an invented funding round with an invented lead investor — is behaving exactly as instructed.
Which means the honesty in this report is not a property of the system. It is a property of one prompt string. That string is the least versioned, least reviewed, least tested artifact in the entire pipeline. There is no diff review for a system prompt at most desks. It is not in the repository with tests. It is a YAML field someone edited in a hurry because the output was too long. It is an unauthenticated, high-privilege configuration surface that determines whether your research output is fact or fabrication, and nobody is watching it. Complexity is the enemy of security, and we have added complexity and called it automation.
The third failure mode is subtler and it survives every check downstream: format over substance. Every field in the failed report is a string. High confidence. Medium risk. One star. Four N/A. Nothing downstream can distinguish a calibrated high from a high generated to fill a cell. When the schema passes and the semantics are void, every consumer treats the object as knowledge. Confidence ratings that cannot be wrong are not ratings.
A wrong research note costs money. A wrong value that reaches a state-changing function costs everything.
These are no longer separate layers. In 2026 I led the design of an interface layer letting AI agents interact with Ethereum contracts. The whole problem is that the agent's output is non-deterministic and the execution environment is not. We built a formal verification framework constraining AI-generated transaction data to strict type constraints before it could be signed. I verified two thousand unique AI-generated transaction signatures and measured 99.8% accuracy in predicting the resulting contract state changes.
99.8% is a good number in machine learning. Write it in a settlement context: one transaction in five hundred lands in a state nobody predicted. On a protocol holding fifty million dollars, a 0.2% error rate in state prediction is not a rounding error, it is a funding event for whoever finds it first. So the deliverable we shipped was not a better model. It was an assertion layer that rejected 0.2% of inputs and aborted the transaction. The accuracy number is a diagnostic. The rejection rate is the product.
The ledger does not forgive. There is no appeals process at the execution layer. A model that is right 99.8% of the time is, in every other branch of software, a model that does not ship.
Which brings the problem back to plumbing. The fix for the failed report is not a better model and it is not a longer prompt. It is five lines.
def ingest(stage1):
if not stage1.information_points:
raise Fatal("INVALID_INPUT: extraction returned zero claims")
if len(stage1.information_points) < 3:
raise Degraded("DEGRADED_INPUT: insufficient basis")
for field in ("source_url", "published_at", "raw_text"):
if not getattr(stage1, field):
raise Degraded(f"missing provenance: {field}")
return stage2.analyze(stage1)Two severities. One fuses the pipeline and pages an operator. The other runs the analysis and stamps every conclusion with a weakened-basis declaration. Both require provenance metadata — source URL, publication timestamp, raw source text — to be present and non-empty, because an analysis without provenance is not a degraded analysis, it is an unverifiable one.
This is a circuit breaker. It costs nothing to write. It was absent. And it was absent for an ordinary reason: nobody tests the upstream failure path, because when the upstream works the failure path is invisible, and when the upstream fails nobody is looking at the pipeline, because they are reading the report.
There is one more gap, and it is observability. What telemetry would have caught this a week earlier? Extraction yield: information points per source byte. A ratio that trends toward zero is a smoking gun. Almost nobody monitors it, because the pipeline's success metric is that a report was produced, and a report was produced. The output quantity was met. The output was a correctly formatted statement that there was nothing to say.
The industry's instinct is to celebrate this document. An AI that declined to hallucinate. Alignment working as intended.
I do not buy it, and the reason is structural. The refusal is not an architectural property of the pipeline. It is an emergent property of one prompt, in one run, on one model version. Change the model, change the temperature, change one sentence of the system instruction, and the same pipeline with the same empty input produces a confident, well-formatted, entirely fabricated report. There is no test suite that would catch the difference, because the difference is not in the code. Trust nothing. Verify everything — but the thing that most needs verifying here is a YAML string that no one treats as code.
The deeper misalignment is in the objective function. The pipeline exists to produce coverage. Coverage informs allocation. Allocation generates fees. The pipeline is therefore implicitly rewarded for volume, and the one behavior that would have protected it — declining to produce output — is directly opposed to its objective. Point an agent at thirty thousand tokens and reward it for emitting reports, and you have built a machine for manufacturing the appearance of diligence. That is not a prediction about AI. It is a description of every research product sold in this market.
The same shape shows up in governance. On-chain voter turnout has sat below five percent across the major DAOs for years. Proposals pass with quorum achieved by a handful of delegates, and the top ten addresses routinely control the effective outcome. Theater of participation, with real consequences and no real participation. The report that said N/A is the only governance-adjacent document I have read this quarter whose stated confidence matched its actual basis.
And the topology matters, because the topology is the whole argument. Agentic research layers are marketed as distributed intelligence. Look at the architecture. One ingestion gateway. One inference endpoint, or a small pool behind one router. One prompt template. One output store. That is a sequencer. One operator, with unilateral discretion over what gets analyzed and what the prompt permits. We have spent two years being told sequencing will decentralize, that the trust assumptions are temporary. The research layer has not begun the conversation. Its decentralization is on a slide, and the single point of failure is a string nobody reviews.
Three predictions, ranked by how much they will cost someone.
Within twelve months, a DeFi protocol will consume an LLM-generated value inside a state-changing function — a threshold, a label, a parameter — and it will fail in a documented, boring way, not a novel one. The vulnerability class is input validation, and it is the oldest one we have.
Input-validation attestations will become a line item in smart contract audits and, shortly after, in compliance filings. Not "is your model aligned" — "what does your system do when it receives an empty input, and can you prove it?" Under MiCA-style transparency obligations, an empty input producing a full report is already an auditability failure. The regulator will not need a new rule to say so.
And the honest N/A report, the one that refused to fill the cells, will be the most cited artifact from this cycle — not because it contained information, but because it contained a calibrated statement about what it did not have. Which is the entire job.
Trust nothing. Verify everything. The ledger does not forgive.
Ask your own pipeline a question today: when its input is empty, what does it print?