System One Models Explained

• System One models are decision-oriented models that map a state, a typed question, and a set of admissible options to a bounded probabilistic decision, such as Boolean probabilities, categorical distributions, ordinal scores, or an explicit null outcome, finding applications in fields like security, clinical records, moderation, and legal verification.
• These models include various architectures like candidate-token readouts, single-pass candidate scorers, and decision-native models. Implementations such as Jev, Laya, and Kev have achieved high performance in diverse tasks, demonstrating the utility of System One models in practical scenarios.
• System One models are typically trained with objectives that score distributions, such as cross-entropy, and often undergo calibration and selective thresholding to ensure accurate decision-making, making them valuable for applications requiring high decision reliability, careful risk management, and robust performance across various domains.

System One models are decision-oriented models that map a state, a typed question, and an explicitly specified set of admissible options to a bounded probabilistic decision, rather than generating an unconstrained natural-language response. Their outputs may be Boolean probabilities, categorical distributions, ordinal scores, or an explicit null outcome. Software can use these outputs to select an action, threshold confidence, abstain, escalate, invoke human review, or route the case to another model. The term encompasses native decision models such as Jev, Laya, Kev, Decider, and related implementations, as well as general language or vision-LLMs whose option-token probabilities are read as decision scores. The research literature evaluates System One models in security, clinical records, moderation, wireless control, graph tasks, legal verification, retrieval, multilingual classification, and agent loops.

1. Definition and decision interface

A System One decision is conventionally represented as

$$p_\theta(Y\mid s,q,\mathcal{A}),\qquad Y\in\mathcal{A},$$

where $s$ is the observed state, $q$ is a typed question or criterion, and $\mathcal{A}$ is a finite answer or action set. For $\mathcal{A}=\{a_1,\ldots,a_K\}$, the selected action is commonly

$$\hat a=\arg\max_{a_k\in\mathcal{A}}p_\theta(Y=a_k\mid s,q,\mathcal{A}).$$

A binary decision is a two-option instance, while an ordered decision associates each option with a numerical level and can return an expected level. A typical interface therefore returns a label or choice together with probabilities intended for thresholding, ranking, abstention, or escalation.

System One models differ from ordinary generative LLMs primarily at the operational interface. An autoregressive model generates a token sequence, often requiring parsing, schema validation, retries, and interpretation of generated confidence statements. A native System One model returns typed fields directly. The distinction remains meaningful even when a generative model is constrained to JSON: constrained JSON is still token generation, whereas a native decision model is presented as a model whose admissible output space is specified before inference.

System One is also distinct from a fixed-label classifier. A conventional classifier generally implements $p_\theta(Y\mid s)$ for a fixed task and output head. System One formulations explicitly provide the question and candidate semantics as inputs, allowing the same interface to express choice, score, and Boolean questions across multiple schemas. This flexibility does not guarantee zero-shot competence, calibration, or safety on a new task.

The intended computational role is usually selective rather than universally autonomous. A model may automatically execute high-confidence decisions, send uncertain cases to a second model or human, or apply a conservative fallback. In agent security, for example, a model can return a safe/unsafe probability that software maps to allow, block, or escalate actions (Liu, 27 Sep 2026). In clinical applications, CS1 returns distributions for many questions over one record and can route lower-confidence judgments to review (Zhang et al., 19 Oct 2026).

The interface can be summarized as follows:

Decision type	Output	Typical use
Choice	One option and a distribution	Tool, policy, action, or candidate selection
Noul	Probability of a proposition	Binary safety, truth, or availability judgment
Score	Distribution or expected ordinal level	Severity, evidence, or review rating
Open-set choice	Candidate distribution plus null/coverage probability	Abstention when no candidate applies

A central conceptual distinction is between candidate competition and answerability. A softmax over candidates necessarily assigns all probability to one option, even when none is appropriate. Jeva separates the probability that any candidate applies from the conditional probability of each candidate, producing an explicit null outcome (Li et al., 13 Oct 2026). Legal-authority verification similarly adds “NONE” as an option and evaluates whether models abstain when the correct authority is missing (Demir, 21 Oct 2026).

2. Architectures and probability construction

System One is an interface specification rather than a single architecture. Implementations include candidate-token readouts, single-pass candidate scorers, encoder-based decision models, cross-head architectures, retrieval-preserving residual heads, and decision-native models with separate coverage estimation.

Candidate-token and generative readouts

A general LLM can be prompted with options labeled A, B, C, and so on. The system reads the next-token probabilities of the permitted labels and renormalizes them over the candidate set. This approach is used in comparisons involving GPT, Qwen, Gemma, and other generative models (Huang et al., 13 Oct 2026). It requires no textual decoding, but the score can depend on label identity, option position, and the surrounding candidate list.

For multimodal reranking, a model receives a query and the top 16 retrieved candidates in one choice question. Candidate-label probabilities are jointly normalized and used as reranking scores. Choice readout substantially outperformed independent yes/no questions on MMEB-V2 image retrieval: Qwen3.8-27B achieved 76.76 hit@1 with choice readout versus 69.50 with yes/no readout, while JEV-27B-VL achieved 76.80 versus 71.42 (Liu et al., 20 Oct 2026).

Candidate scorers

Kev-style models process the state, question, and all candidate descriptions in one causal pass. A decision-marker representation is compared with candidate representations through shared query/key projections. Candidate logits are normalized across the supplied alternatives:

$$p(c_k\mid s,q,C)= \frac{\exp(z_k/T)} {\sum_j\exp(z_j/T)}.$$

This architecture supports Boolean, categorical, and ordered decisions without autoregressive answer generation. SecJev applies security-specific LoRA adaptation and scene-weighted training to this interface, covering Boolean, choice, and ordered decisions across 14 security tasks (Chen et al., 2 Oct 2026).

Retrieval-derived decision models

SBERT2S1 converts Sentence-Transformer encoders into typed decision models through three principal heads (Deka, 1 Oct 2026). A bi-encoder scores state–hypothesis cosine similarities; a cross-head jointly contextualizes the state, question, and options; and a prior-fused residual head adds a cross-head score to a retrieval similarity. The cross-head achieved higher decision accuracy in matched experiments, while the prior-fused residual preserved retrieval structure and substantially reduced sensitivity to option permutation.

For a state $s$ and option hypothesis $h_k$, retrieval initialization may supply

$s$0

A prior-fused residual then uses

$s$1

The architecture illustrates that retrieval training is not intrinsically beneficial or harmful: its effect depends on whether the decision head preserves the retrieval prior and on the amount of supervised data.

Decision-native set architectures

Jeva independently encodes the request and each option, then lets a request-side decision stack read the option memory through symmetric aggregation (Li et al., 13 Oct 2026). Candidate representations are request-independent and can be cached. The final candidate distribution is conditioned on a refined request state, while a separate coverage gate estimates whether any option is acceptable:

$s$2

This factorization distinguishes answerability from competition. Jeva supports variable-size candidate sets, explicit null outcomes, permutation-equivariant candidate probabilities, and cacheable option projections. On ToolRet, it supported candidate counts through 2,048 options and achieved 69.88% accuracy at that size.

Prism-1 imposes a stricter constraint: each option is processed in its own isolated block at the same absolute position, with access to the shared state but not to rival options (Teng et al., 15 Oct 2026). Each option receives an independent score $s$3, and the final distribution is

$s$4

Because an option’s score depends only on the state, question, and that option, Prism-1 satisfies position independence and Luce’s independence-of-irrelevant-alternatives axiom by construction.

Order-invariant wrappers

Runoff is a training-free wrapper that first scores options individually to construct an order-independent consideration set, then compares the retained candidates under cyclic shifts of a canonical ranking (Huang et al., 13 Oct 2026). It removes measured option-order dependence while avoiding the quadratic cost of cyclic averaging over the entire candidate set. On Qwen3-8B and Gemma 4 12B across five benchmarks, Runoff produced zero measured flip rate for the open-model experiments and retained accuracy close to cyclic averaging.

These architectures expose a fundamental design choice. Candidate isolation provides order and rival independence, whereas candidate interaction can improve comparative reasoning and permit set-dependent preferences. Jeva deliberately permits the candidate set to affect the request state; Prism-1 forbids rival-dependent scoring to satisfy Luce’s axiom. Neither property alone guarantees accuracy or calibration.

3. Training, calibration, and selective decisions

System One models are trained with objectives that score distributions rather than only top-1 labels. Cross-entropy is the common baseline:

$s$5

Hard-label training is the special case $s$6. Soft teacher distributions, observed outcomes, exact rule labels, and ordinal targets can also be used.

SecJev uses scene-weighted candidate cross-entropy so that a scene with multiple related questions does not dominate a scene with one question (Chen et al., 2 Oct 2026). CS1 combines language-model teacher distributions, exact structured-record rules, and observed clinical outcomes in 12.4 million training decisions from 3.6 million patients (Zhang et al., 19 Oct 2026). MEDLINE-S1 similarly provides 242,986 biomedical training decisions over heterogeneous question types (Deka, 1 Oct 2026).

Calibration

A score in $s$7 is not necessarily a calibrated probability. Calibration requires predicted probabilities to agree with empirical frequencies. Common diagnostics include Brier score, negative log likelihood, expected calibration error, AUROC, average precision, calibration bias, and risk–coverage measures.

Temperature scaling transforms logits by a learned positive temperature. If $s$8 is an original probability, its log odds are divided by $s$9 before conversion back to probability. Values $q$0 soften predictions, whereas $q$1 makes them more extreme. Temperature scaling can improve NLL while worsening Brier score or ECE, and development-perfect behavior can produce dangerous overconfidence under distribution shift (Liu, 27 Sep 2026).

The literature repeatedly finds that global calibration metrics can conceal deployment-critical failures. In WAInjectBench, Jev assigned unsafe probabilities below 0.1 to 1,444 inputs, yet 9.14% were actually unsafe, with a mean predicted probability of only 0.205% (Liu, 27 Sep 2026). In System One moderation, Jev’s confidence was useful for selective review in several settings but was not uniformly calibrated, while Laya’s confidence was generally less effective for ranking errors (Mazzoni et al., 6 Oct 2026).

Clinical System One provides a related example. CS1 probabilities were well ranked but overestimated event prevalence across external institutions; a per-outcome log-odds intercept correction reduced calibration error from 0.203 to 0.014 on the reported outcome tasks (Zhang et al., 19 Oct 2026). This supports local calibration rather than assuming that probabilities transfer unchanged across institutions.

Thresholding and risk budgets

For binary scores oriented so that larger values indicate the high-stakes event, a forced-action policy can be written as

$q$2

When action 0 is the useful action—allowing an input or discarding an irrelevant document—the critical risk is the False Omission Rate:

$q$3

This is the fraction of action-0 decisions that are actually positive events. It differs from overall error, false-positive rate, and global calibration error.

The risk-budgeted-decision literature compares naive thresholding, empirical threshold selection, and Learn Then Test (LTT) (Messoudi et al., 14 Oct 2026). Naive thresholding sets $q$4, relying on exact calibration. Empirical selection chooses a threshold whose observed calibration risk is within the budget. LTT uses an independent calibration set and binomial risk tests to certify thresholds. Across 47 model–dataset–budget settings, naive selection exceeded the target in 42.0% of settings, empirical selection in 51.7%, and LTT in 7.8%. LTT’s lower violation rate came partly from refusing to deploy when the calibration sample did not support certification.

The result establishes that probability-like interfaces do not eliminate the need for independent validation, risk budgets, support floors, and deployment monitoring. A low-risk policy can also automate almost nothing, or achieve high apparent coverage mainly by blocking or retaining inputs. Coverage, useful action, false omission risk, and false-blocking or retention costs must therefore be evaluated jointly.

4. Evaluation findings across domains

System One performance is strongly task- and representation-dependent. Aggregate accuracy rarely provides a complete description.

Security and moderation

Security-oriented evaluations show that strong aggregate performance can conceal systematic attack-group failures. On WAInjectBench-text, Nimble achieved Macro-F1 0.779 but missed 92.2% of no-explicit-instruction attacks. Jev missed all 129 no-explicit-instruction positives while falsely flagging only one benign input (Liu, 27 Sep 2026). This demonstrates that low false-positive rates can coexist with severe security failures.

Selective policies under a 1% unsafe-miss budget often automated little or nothing. Independent allow and block thresholds increased automation mainly by blocking more inputs, not by safely allowing more. Second judges corrected some missed attacks but also introduced benign rejections and repeated high-confidence errors. These results motivate subgroup evaluation, held-out confirmation, explicit escalation handling, and monitoring of high-confidence failures.

In online moderation, Jev benefited from retrieved precedents when the candidate answer space was held fixed. On PluRule, General-all improved Jev’s exact policy selection from 52.7% to 65.1%, while violating-rule recall increased from 37.1% to 62.3% (Mazzoni et al., 6 Oct 2026). Laya’s apparent improvements were less stable: retrieval and restricted candidate sets often shifted its positive rate or no-violation rate without consistently improving discrimination.

Clinical records

CS1-4B was trained on 12.4 million questions and answers from 3.6 million patients. On 963,408 held-out patients, it outperformed open decision models up to 27 billion parameters on 13 of 14 internally scored tasks (Zhang et al., 19 Oct 2026). Its strongest performance was on patient timelines, clinical definitions, medication status, and institution-specific structured tasks. On 21 external datasets, its aggregate performance approached the strongest tested 27-billion-parameter model while achieving a 6.4-fold faster matched workload.

CS1 also illustrates a division of labor between typed decisions and generative synthesis. A generalist LLM formulates subquestions and writes answers, while CS1 repeatedly reads records, returns probabilities, and identifies evidence. In trial screening across 17 registered trials, the CS1-based pipeline placed an average of 3.5 judged-eligible patients in the top 20 compared with 0.8 for BM25, while using 690-fold fewer language-model tokens than a model reading every record.

Wireless control

Wireless studies position System One models as bounded decision interfaces rather than replacements for numerical optimization (Rahimi et al., 3 Oct 2026). In receive-antenna selection, Jev reduced median response latency relative to evaluated LLMs but suffered a mean relative capacity loss of 20.19%, worse than stronger task-specific alternatives. In intent-conditioned RAN slicing, Jev achieved utility regret of 0.131, comparable to Qwen and GPT-Sol, while reducing median latency by more than 3.5 times.

The findings distinguish semantic-to-action mapping from unrestricted numerical optimization. A System One model is suitable when the action space is finite, repeated decisions are required, uncertainty can trigger verification, and a separate feasibility or safety layer exists. Continuous channel estimates, arbitrary precoding matrices, and unconstrained power vectors require other model classes or downstream optimizers.

Graph tasks and agent loops

GraphDecide shows that a shared choice interface does not imply broad graph competence (Yang et al., 5 Oct 2026). Jev achieved 100% adjacency accuracy but only 67.8% exact-degree and 61.25% articulation accuracy. In sequential graph optimization, it completed most trajectories but produced poor direct solutions, including a 59.6641% TSP gap and a 99.9614% signed-MaxCut gap. Heuristic proposal selection improved performance substantially, showing that candidate generation and candidate choice are separable contributions.

Agent-loop diagnostics similarly separate reading from acting. Across 17 fast systems, most wrong actions occurred when measured factual probes were correct. For the six strongest systems, 73–85% of decision errors were “read-right, act-wrong” cases (Li et al., 13 Oct 2026). In synthetic rule procedures where factual probes provably determined the action, composing the model’s own probe answers in code raised performance for several systems to 0.965–1.000. On natural agent states, however, the missing information was often not another fact but the next sub-goal.

Multilingual and legal decisions

On Indonesian regional-language sentiment and emotion tasks, Jev achieved useful zero-shot performance, often matching models trained with hundreds of labels per language (Fadli et al., 9 Oct 2026). Accuracy was higher when sentences were lexically closer to Indonesian, and human Indonesian translations increased accuracy by up to 37.2 points. ECE did not consistently worsen on regional languages, but confidence became less effective at ranking individual errors, distinguishing average calibration from selective usefulness.

In legal verification, System One models returned distributions over five holdings plus “NONE.” On standard CaseHOLD, a decision model matched the best generative LLM at 88.1% versus 88.2% while operating at 1/55 of the cost. In the modified abstention condition, where the correct holding was absent in 1,670 of 5,314 items, generative LLMs still selected a holding in 38–86% of cases, while the most cautious decision model did so in 30% (Demir, 21 Oct 2026). The evaluation emphasizes wrong citations rather than accuracy alone.

5. Robustness, order effects, and deployment interfaces

Option order is a recurring failure mode. In ordinary listwise choice, changing labels, positions, or neighboring candidates can change the selected option. On Qwen3-8B, flip rates increased from 4.7% at two options to 17.0% at 20 options on Banking20; cyclic averaging reduced but did not eliminate this dependence (Huang et al., 13 Oct 2026).

Runoff reduces the problem by independently scoring candidates, retaining a small consideration set, and comparing candidates under canonical cyclic shifts. Prism-1 addresses it architecturally: isolated same-position candidate blocks guarantee that an option’s score does not depend on its position or rivals. Jeva provides permutation-equivariant probabilities through symmetric aggregation, although it intentionally permits candidate-set-dependent preference changes (Li et al., 13 Oct 2026).

Order independence is not the same as independence of irrelevant alternatives. A model may be invariant to permutations while allowing one option to change the relative preference between two others. Prism-1 applies Luce’s choice axiom, under which

$q$5

whenever $q$6 and both $q$7 and $q$8 belong to $q$9. This requires a softmax over scores that depend on the state, question, and each option independently. The choice is important for web systems, tool registries, browser agents, and adversarial pipelines in which another component may add or reorder options.

Deployment interfaces also require explicit handling of unsupported inputs. Context limits, unavailable probabilities, output-format changes, model revisions, and service routes can alter results. Laya’s context limitation excluded more than half of some R-Judge inputs, changing apparent model rankings (Liu, 27 Sep 2026). Probability extraction from generative models can depend on the exact output format because preceding text affects token probabilities. Applications should therefore record model revision, prompt, schema, candidate ordering, output format, probability extraction method, and unsupported-input behavior.

A practical System One deployment commonly consists of:

1. Typed question construction: define the state, question, candidates, and candidate semantics.
2. Decision scoring: obtain probabilities or typed outputs.
3. Calibration and validation: evaluate accuracy, ranking, calibration, subgroup errors, and distribution shift.
4. Policy mapping: define allow, block, execute, defer, or fallback thresholds.
5. Safety and feasibility checks: verify hard constraints independently.
6. Escalation: send uncertain or unsupported cases to another model or human.
7. Monitoring: track risk, coverage, false decisions, option-order behavior, drift, and confidence quality.

The appropriate architecture depends on the decision structure. Candidate isolation is advantageous when order and rival independence are mandatory. Candidate interaction is useful when the decision is relational or depends on the option set. Explicit coverage estimation is preferable when none-of-the-above outcomes are possible. Cached option representations are valuable when tools, documents, or labels recur across requests.

6. Limitations, controversies, and research directions

System One models do not constitute a guarantee of correctness, calibration, safety, or rational choice. A typed interface can prevent malformed outputs while leaving semantic errors unchanged. A probability distribution can be normalized and sharply peaked while being systematically wrong. A model can have good average ECE but confidently miss a security-critical subgroup, or achieve low risk only by escalating almost everything.

Several limitations recur across the literature:

• Distribution shift: calibration, ranking, and threshold policies can fail on unseen attack families, institutions, languages, captures, communities, or clinical prevalence.
• Candidate-space dependence: restricting options can improve raw accuracy or no-violation recall while suppressing violation recall or hiding missing-authority failures.
• Representation sensitivity: serialization, option names, labels, context ordering, and candidate semantics can materially change decisions.
• Incomplete observability: source labels, clinical outcomes, security annotations, and agent states may depend on information absent from the model input.
• Confounded comparisons: model size, training data, architecture, modality, serving stack, latency, and interface often vary simultaneously.
• Weak causal attribution: a cited evidence sentence may influence a prediction without constituting a faithful causal explanation.
• Benchmark limitations: withheld attack types are not necessarily real zero-day vulnerabilities; frozen graph tasks do not establish large dynamic-graph competence; and offline moderation or medical evaluations do not establish safe deployment.
• Irreversible intervention: thresholded actions, takeovers, refusals, blocking, and abstention can convert uncertainty into systematic over-conservatism.
• Operational cost: hosted services introduce network latency, API cost, privacy constraints, version instability, and dependence on provider availability.

Research directions include risk-budgeted threshold certification, task- and subgroup-specific calibration, explicit null and coverage modeling, order- and rival-independent architectures, cached option memory, structured fact decomposition, code-level composition, planner–decision cascades, multimodal decision tuning, and local open-weight deployment. SOMA extends the framework from pre-decision gating to continuous monitoring of reasoning models: Jev evaluates natural-language statements about an evolving reasoning trace, while a controller accumulates evidence, issues reminders, and takes over when monitored behavior persists (Qian et al., 19 Oct 2026).

The emerging design pattern is therefore hybrid. A System One model performs repeated bounded judgments; a deterministic component enforces feasibility, composes rule consequences, aggregates evidence, or validates actions; a larger generative model formulates questions, interprets ambiguity, plans, or synthesizes explanations; and human review handles high-consequence or unsupported cases. System One models are best understood as typed probabilistic decision components whose value depends not only on predictive accuracy, but on calibration, selective policy behavior, robustness to presentation and candidate-set changes, explicit treatment of missing answers, and the reliability of the surrounding application.