Compact world models represent one of the most interesting frontiers in artificial intelligence. Instead of storing every visual detail of the environment, they work with a compressed representation that can be conditioned by a natural language instruction. In theory, this allows a system to recognize spatial, physical or causal relationships from a reduced set of reference anchors. In practice, however, this architecture can learn a shortcut: not perceiving the scene, but transcribing the instruction.
The clearest example appears in a recent evaluation of a goal-conditioned model. Relation-readout accuracy reached a seemingly solid 0.90. When the goal was removed, accuracy dropped to 0.27, barely chance. More revealing still: when a counterfactual instruction was introduced, the predicted anchors followed that false instruction 94.5% of the time, while the real scene was reflected in only 2.3% of cases. The model was not looking at the world; it was copying the answer that was already in the instruction.
This phenomenon is called instruction leakage. Leakage appears when the metric being scored is directly transcribable from the instruction. If the instruction names the answer, the model can ignore all non-linguistic inputs and still succeed. The key is not only that non-instruction inputs are weakly predictive, but that the system discovers it does not need to use them. It is an alignment problem between what we measure and what we want the model to learn.
We have observed this behavior in three settings. In an external benchmark such as BabyAI, leakage reproduces easily. In a Language-Table forward-dynamics world model, the system remains clean while the instruction names objects or referents. As soon as the instruction begins to name the direction, leakage appears. Moreover, degrading action quality does not increase leakage, which contradicts the idea that competition between predictors is the main cause. The problem is not in the balance between signals, but in the design of supervision.
The solution is conceptually simple but requires a bold architectural decision. The agent's goal should not be part of the internal dynamics of the world model. The goal belongs to the planner's cost function: it is the mission that guides action search, not a variable that the perception model should guess. In addition, the read path of the anchors must be explicitly supervised. When this correction is applied, accuracy remains at 0.88 whether the goal is presented or omitted. That stability indicates the model has moved from transcribing to perceiving.
What role do reference anchors play? In a language-conditioned world model, anchors are discrete elements that connect the internal representation with objects or places in the scene. A system can represent a cube as a node with position and color properties. The instruction to place an object to the left of another becomes a relation between two anchors. The model must read those anchors and project the next state. If the instruction names the relation, the network can use the text as a shortcut and does not need to consult the anchors. As a result, it learns a superficial predictor.
The anchor concept is useful because it separates reading the world from planning. An anchor is an explicit reference: an object, a position or a relevant entity. The network reads those anchors and produces a representation of the relation. But if the goal already arrives with the words that describe the relation, the predictor can copy them. The solution is not to eliminate anchors, but to ensure the instruction does not contain the answer.
It is also important to distinguish instruction leakage from other generalization failures. A model can fail on new data because of overfitting to the scene. Leakage, by contrast, is a collapse of reasoning: the model does not learn a mere visual association; it learns to ignore vision. This has direct implications in the real world. An inventory assistant could generate purchase orders based on the user's phrase rather than actual stock. A diagnostic system could confirm the patient's hypothesis instead of analyzing symptoms.
Counterfactual evaluation should be mandatory in any AI project. We do not only ask whether the system gets the answer right, but whether it would continue to get it right when the context changes. At Q2BSTUDIO we apply this rule in software development with AI components. We design test suites where the prompt is manipulated, variables are hidden and data are altered. This is how we detect whether the solution is anchored in real information or in a linguistic clue.
For a technology company, the lesson is clear: conventional accuracy tests are not enough. A system can pass a battery of evaluations and fail dramatically in production if counterfactual tests have not been designed. Instruction leakage is especially dangerous in autonomous agents, virtual assistants and AI-based decision systems. That is why at Q2BSTUDIO we integrate leakage detection into the development cycle of custom software. It is not enough that a model gets the answer right; we need to know why it gets it right.
The same philosophy applies to the design of AI systems for enterprise environments. When building an assistant that reads documents or an AI agent that plans routes, supervision must focus on the read path and on separating the goal from dynamics. If a language model receives the instruction to extract an amount from an invoice, it might transcribe a number mentioned in the instruction instead of reading the document. The architecture must force the information to come from data, not from the prompt.
This approach also has implications for cybersecurity. Instruction leakage can be exploited by an attacker to manipulate the output of a system through malicious prompts. If the model relies too much on the instruction, a user can inject a false answer and make the system adopt it as truth. At Q2BSTUDIO we address these vulnerabilities with model audits and robustness tests, integrated with cybersecurity and pentesting solutions. AI security is not only about protecting infrastructure; it is also about ensuring that the model's reasoning cannot be hijacked by the instruction.
At the operational level, the lesson extends to cloud and data. Companies deploying models on AWS or Azure need evaluation pipelines that include counterfactuals and goal ablation. There is no point in having spectacular accuracy if the system does not generalize to new instructions. Likewise, in Business Intelligence and Power BI projects, an AI-generated report can be visually flawless and yet answer a question that already contained the answer. Instruction leakage produces dashboards that confirm the user's bias instead of revealing the reality of the data.
At Q2BSTUDIO we work with an integral approach: software development, artificial intelligence, AWS/Azure cloud, cybersecurity and BI/Power BI. That allows us to see the whole problem. A world model with leakage is not an isolated failure; it is a symptom of an organization that rewards superficial correlation instead of understanding. The solution is not to add more data, but to redesign the learning contract: what information each component can use and how the reading of the real world is supervised.
Compact architectures will continue to evolve. World models that condition their behavior with natural language are too useful to abandon. But they need a clear separation between perception, memory and planning. The goal should be an input to the planner, not a crutch for the predictor. Only then will we achieve systems that truly understand the relations they mention, instead of repeating them with a mask of understanding.
The final recommendation for any technical team is to include instruction leakage detection in its standard test suite. Do three tests: remove the instruction and see if accuracy falls to chance; replace the instruction with a counterfactual one and observe if outputs follow the falsehood; alter the quality of actions and see if leakage changes. These tests reveal whether the system perceives or transcribes. In addition, the detection protocol and the remedy apply to any goal-conditioned model whose instruction names the metric being scored. At Q2BSTUDIO we help organizations build more robust AI systems, with rigorous evaluations and an architecture that separates goals from dynamics. That is the only way for enterprise AI to be reliable, auditable and genuinely useful.
