AllotNet — a model certified against a world we designed

AllotNet is the model at the other end of Allot. The study collects how people actually resolve allocation dilemmas; the model has to turn that into something a humanitarian programme can act on — and be auditable while doing it. This is the engineering stage: the architecture is now settled and measured, on data we generated ourselves. What it does not yet have is real data, and that distinction is the whole point of this page.

The problem with building this model at all

Suppose you train a model on real allocation decisions and it reports that one ethical consideration systematically outweighs another, or that some subgroup quietly favours people like themselves. How would you know it is right? There is no answer key. Every output is a hypothesis, and a model that produces plausible hypotheses is indistinguishable from one that produces confident nonsense.

So we did not start with real data. We wrote the answer key first.

A synthetic population was specified in full before any model existed — a hidden structure of moral types, their distribution across cultures and countries, and, deliberately, several biases we would later require the model to find. That specification was frozen, and its numeric consequences were computed and recorded. Then a generator played that population through the study's real production software, session by session, producing five and a half million sessions and 104 million individual decisions.

The model was trained on those decisions and never on the specification. It either recovers the structure that was planted, or it does not.

Five-stage pipeline: designed worlds with the answer key frozen first, a synthetic study of 5.62 million sessions through the production stack, training on one GPU, certification against the frozen targets, and deployment as a single portable bundle. — Figure 1. The certification pipeline. Ground truths are written and verified *before* any model sees data; recovering them is what counts as a pass. Every figure on this page comes from the runs shown here.

What the training actually involved

Three stages, each starting from the last rather than from scratch, and the full battery of checks re-run after each one — so that "we added a capability" can never quietly mean "we broke the part that worked".

The first stage learned the moral core alone: six passes over the full corpus of decisions, on a single GPU, in about ten minutes. For the first 40% of training a deliberately restricted mode is used, which forces the interpretable part of the model to explain the data before the flexible part is allowed to help. This is not a performance trick — it is what keeps the model's conclusions readable afterwards.

The second stage added two capabilities without disturbing the first. Real humanitarian programmes do not collect ethical judgements; they collect household questionnaires — composition, disability, food security, income against a local cost-of-living basket. So a documented encoder maps those standard sector fields into the same space the model reasons in. Alongside it, a second head learned to predict what a specific assistance package would actually change for a household. Both were trained jointly, and the moral core's accuracy came out identical to four decimal places — the point of the exercise.

The third stage retrained the whole thing under emulated 4-bit arithmetic, the native numeric format of current accelerators, so the model is known to behave the same on the hardware a programme is likely to run it on.

Animation: as millions of allocation dilemmas accumulate, seven bars representing the model's learned weights converge onto diamond markers showing targets fixed before training. The criteria are shown as unlabelled ordinals. — Figure 2. Learning the weights. Each bar is one of the ethical criteria; each diamond is the value fixed before training began. As decisions accumulate, the bars converge. **The criteria are shown unlabelled and out of order on purpose** — naming them, or showing which came out highest, would tell a future participant what the study expects to find. That is disclosed in the debrief, and in full when the specification is published.

What came out

Sixteen checks, each with a threshold written down before training. All sixteen passed. The headline results:

The ranking of the ethical criteria was recovered exactly — a rank correlation of 1.000 against the frozen target, across 98 million decisions.
The model's segmentation of the population matched the hidden structure closely, despite segment membership never appearing anywhere in the training signal. It had to be inferred from context alone.
The response head reached 98.9–99.8% of the achievable accuracy on all five outcomes it predicts. That framing matters: the world it learned contains deliberate measurement noise, because a real post-distribution survey does not measure a household's assets exactly. No model can explain that noise, so the ceiling sits well below perfect. We computed where the ceiling is, and the model is at it.
The planner reached 99.4% of what a perfect-foresight oracle achieves with the same budget, and 1.38× a naive equal split.
Under 4-bit arithmetic, the decisions the model would make are preserved: plan ranking correlates at 0.994 and 92% of the top-decile selections are unchanged.

Results dashboard: rank correlation 1.000 for the recovered criteria ranking, 99.4% of oracle allocation, 8/8 and 7/7 designed checks passed, 6/6 runtime parity across three languages, and a list of per-check results. — Figure 3. Results at a glance. Findings that belong to the *answer key* rather than to the model — which criteria came out where, how the planted biases distributed — are withheld while data collection runs. What is shown here are properties of the model.

Two things we found that are worth stating plainly. The model does not merely detect the biases planted in the population — it localises them, attributing them to a specific minority of the synthetic population rather than smearing them across everyone. That is the difference between a finding that licenses nothing and one that can be acted on: an effect you can point to is an effect you can exclude. Which is what the model's default operating mode does — it removes the group and in-group terms entirely, and runs on the ethical criteria alone.

The ordering there is deliberate and it is the ethical core of the design. The model has to demonstrate that it can see a bias before removing it means anything. A model that never represented the bias could not have proved it had removed it.

One model, three ways to use it

The same 23,550 parameters answer three questions of increasing commitment. A programme can stop at any of them.

Animation of four coupled blocks: an intake form feeds an auditable axis encoder, which feeds both a moral core of experts with a context gate and an outcome head predicting the effect of a plan; both converge on a cycle planner. — Figure 4. One parameter bundle, one shared vocabulary. The intake encoder is a written specification rather than learned weights, so it can be read and argued with. Note what is *not* connected: the context gate — the part that models whose preferences are being applied — is deliberately not wired to the outcome head. Whether aid improves a household's food security cannot depend on who is looking at the household.

A needs reading. Encode a household's questionnaire into the ethical criteria. No judgement, no ranking — just a structured statement of what this household lacks and how severely. Useful on its own for assessment.
Who should be served first. A ranking across a caseload, with the reasons attached: each decision carries the specific factors that drove it, so a caseworker can see why one household came above another and disagree with it in writing. This runs in the model's default mode, with group effects excluded.
A distribution cycle. Given a population and a fixed budget, decide for each household which modality (cash, voucher, or in-kind), how much of their shortfall to cover, how often to pay, and for how long — maximising need actually closed per unit of budget. The rules that constrain this (how a basket is costed, how household size adjusts an amount, what top-ups apply) are configuration, not code, so a programme can encode its own country working group's decisions rather than inherit ours.

Animation of budgeted planning: candidate household plans plotted by cost against predicted welfare gain, selected households highlighted as the budget fills, reaching 1.38 times a naive equal split and 99.4% of an oracle allocation. — Figure 5. Planning a cycle under a budget. Each point is the best admissible plan for one household; the planner selects greedily on predicted value per unit of cost until the budget is spent. In the reference run it reached 99.4% of what a planner with perfect foresight achieves — a measure of search quality, not of real-world effect.

Inference is deliberately small. The whole model ships as a single 600 KB file, and four independent implementations — Python, Java, C, and Rust — consume it and are certified against the same reference traces. Three of them have no dependencies at all. A programme running this does not need a GPU, a Python environment, or a network connection; scoring a household takes microseconds on a laptop.

Every system that automates judgment can make two errors — and they almost never cost the same. One rule, and write it into your contracts: the system may build a queue for human review. It may not reject anyone on its own. Mark Nowak, DIHAD 2026, Dubai, 24 August 2026

That rule is the reason the ranking mode exists separately from the planning mode, and why every decision carries its drivers. A queue a person can work through, and argue with, is a different artefact from a verdict.

What this does not establish

Every number above comes from a world we designed. That is what makes them checkable, and it is also exactly what limits them. The model has demonstrated that it can recover a moral structure end to end when the structure is known. It has not demonstrated knowledge of human values, and it has not demonstrated anything about real programme outcomes.

The response head learned a simulator. That simulator's mechanisms come from published field evidence — how transfer frequency affects consumption against savings, how cash and in-kind trade off against market functionality, how effects persist after a programme exits — but a mechanism drawn from a paper and parameterised by hand is a hypothesis about the world, not an observation of it. The checks confirm the model recovered the hypothesis. They say nothing about whether the hypothesis is true.

There is also a limitation we surfaced from our own background research rather than from a critic, and it cuts against this architecture. The synthetic corpus is 104 million observations against 23,550 parameters, which is a regime a neural model suits well. The real study will yield a few thousand comparisons per participant cohort — four orders of magnitude less. At that scale, the literature is clear that a hierarchical Bayesian choice model would likely beat a neural one on data efficiency, on honest uncertainty, and on interpretability. So the real-data path is to fit both and compare them, with the comparison declared in advance rather than chosen after seeing which won.

The next stage needs real data, and only real data. The architecture is settled: the encoder, the moral core, the response head, the planner, the evaluation harness and four deployment runtimes all exist and are measured. What is missing is not engineering. The moral core has to be retrained on the study's actual participants, and the response head on real post-distribution monitoring from a partner programme — and then the same sixteen checks re-run, and published whatever they say, including if the answer is that the architecture does not transfer.

That is the sequence this programme committed to from the start: collect the human judgement first, build the model to be accountable to it, and fix the model's limits in advance. It supports allocation decisions. It never computes a "minimum necessary" level of survival, never rations knowledge or medicine for institutional convenience, and is never optimised to reduce anyone's decline.

Governance

A system that helps decide who receives essential assistance is high-risk under the EU AI Act (Annex III 5(a)), and the obligations that follow — human oversight, decision logging, technical documentation, a fundamental-rights impact assessment — are not a compliance layer bolted on afterwards. They are why the model is built the way it is. The interpretable core is 120 numbers a person can read directly; every decision the planner makes carries the factors that drove it; and the mode that excludes group effects is the default, not an option.

Two of the ethical criteria are switched off entirely by default when the model is pointed at real household data. Turning either on is a decision for a programme's ethics review to make in the open, not a setting an engineer flips.

Technology changes our work fastest where a mistake costs a wasted trip. Where a mistake costs a person their aid, it must change slowly. The last word must stay with a human being — a human you can ask: “why?” Mark Nowak, DIHAD 2026, Dubai

The code is Apache 2.0 and the documentation and artefacts CC‑BY‑4.0. Publication follows the study's pre-registration: the repositories stay private while data collection runs, because they contain the study's scoring key, and are released alongside the specification and the first dataset. The inference runtimes carry trained weights rather than the answer key, and are the part that can be released first.

Read the study behind it → ← Back to case studies