A JSON object arrived at an analysis pipeline last week. It was well-formed. Twelve keys, all present, all correctly typed. The schema validated with zero warnings.
title: null. source: null. core_thesis: null. information_points: [].
The pipeline did what pipelines do. It expanded the struct into nine analytical dimensions. It ran each dimension against the available evidence. It emitted roughly four thousand words. Every conclusion carried the same string — insufficient information. Every risk row was blank. Every token supply table held placeholders. Every Howey element read as unresolved. The output was internally consistent, properly formatted, and semantically empty.
Nothing crashed. The validator passed. The report rendered. A human skimming it would have seen nine dimensions, three conclusions each, a risk matrix, a supply schedule, a governance scorecard, a glossary, a disclaimer. It looked exactly like work.
That is the failure I want to dissect. Not the missing input. The missing input was handled correctly — the system refused to fabricate, and that refusal is the single most valuable behavior in the entire stack. What failed was the delivery. Absence was transformed into an artifact that mimics analysis. The refusal was honest. The refusal's rendering was a lie.
Context: the research stack has quietly become an execution stack
Through 2025 and into 2026, crypto research migrated from human analysts to agent pipelines. The migration was not driven by quality. It was driven by coverage. There are roughly four million deployed token contracts across EVM chains and their derivatives. No human team audits four million anything. Agents do, at a marginal cost approaching zero, and they do it continuously.
The architecture is now standardized enough to critique. A retrieval layer pulls on-chain state, governance forums, GitHub commits, and news. A normalization layer maps everything into a schema. An inference layer runs a model against the schema. A synthesis layer formats the result into a report. A distribution layer pushes it into dashboards, Telegram bots, and — increasingly — into other agents that treat the report as an input.
That last hop is where the structure breaks. The first four layers have error handling. The fifth has none. A report is not a data structure to the consuming agent; it is prose. Prose does not throw exceptions.
I have spent most of my career on the primitive side of this problem. In 2017 I spent six months inside the Groth16 implementation in Zcash's Sapling upgrade, hunting a side-channel in the constant-time arithmetic library used for scalar multiplication. The bug class there is instructive: a non-constant-time branch leaks a few nanoseconds of timing information, and a few nanoseconds is enough to recover a private key. Nothing crashes. The proof verifies. The output is correct and the system is compromised. Silent failure is the default failure mode of cryptographic systems, and it is now the default failure mode of the research systems built on top of them.
I do not trust the contract; I audit the logic. The same discipline applies to a research pipeline. You do not audit the report. You audit the path from input to claim, and you check whether that path can exist when the input does not.
In this case, it could. That is a design defect, not an accident.
Core: the three kinds of nothing
A schema has to distinguish three states that JSON collapses into one.
Unknown: we did not look. No retrieval call was made.
Known-empty: we looked, and there was nothing. The logs query returned zero events across a verified block range.
Known-unknown: we looked, we found something, and we could not resolve it. The contract is unverified. The team is anonymous. The disclosure does not exist.
null, [], and the string "N/A" are three different epistemic states. Most schemas treat them as interchangeable, and every downstream consumer then collapses all three into the number zero. In a research report that produces a bad document. In a DeFi system it produces a liquidation.
Consider eth_getLogs. Query the wrong block range and you get an empty array. That array does not mean "no activity." It means "no activity in the window you asked about," and if the window was wrong, the array is a false statement about the world wearing the costume of a true one. Consider an indexer lagging forty blocks. Its state is stale, not empty. Consider a subgraph whose entity query fails and returns []. Render that as TVL: 0 and you have manufactured a market signal out of a transport error.
In 2020 I spent three weeks modeling flash-loan attack vectors against early Compound contracts, quantifying exposure under specific liquidity conditions. The number that came out — roughly fifty million dollars — was not the interesting part. The interesting part was that the entire model hinged on one distinction: whether a zero in the borrow data meant no outstanding borrows or an oracle that had gone stale and stopped reporting them. Same character on the screen. Opposite implications for solvency. Every serious risk model I have built since has started with that distinction, because it is the distinction that kills people.
Autoregressive imputation: why the model filled the table
The mechanism here is not mysterious once you stop treating the model as an oracle and start treating it as a compression function with a prior.
An LLM asked to produce deep analysis completes the shape of deep analysis. Structure is low-entropy prediction. Headers, tables, three-part conclusions, a risk matrix, a disclaimer — these are near-deterministic given the prompt. Content is high-entropy prediction. It requires facts that the model does not have.
Under input starvation, the model allocates its probability mass where the gradient is easiest: structure. So you get maximum formatting and minimum information. The output token count goes up. The information content goes to zero. The ratio between them is the diagnostic, and almost nobody measures it.
Run the numbers. Roughly six thousand input tokens, roughly four thousand output tokens, at current frontier pricing somewhere around six cents. Six cents of compute to produce an artifact containing zero bits of information about the subject. That is not a rounding error. It is a category error, executed at scale, four million times.
Structure is cheap. Content is expensive. Every hallucination is a budget decision.
The deeper problem is that the model's refusal was also structural. It said insufficient information nine times because the framework had nine dimensions and each dimension demanded a verdict. The refusal was not reasoned; it was templated. A genuine refusal looks different — it stops, it names the missing field, it asks for the specific artifact that would unblock it. This one did eventually do that, in a section appended after the report, which is the worst possible placement: the useful content was buried under four thousand words of formatted absence.
The proof is silent; the code screams the truth. Here the code was silent and the prose screamed. That inversion is the signature of a system optimizing for the wrong objective.
Information theory of a convincing empty report
Shannon entropy is measured relative to the observer's prior. This is not pedantry. It is the whole exploit.
To a reader who knows the input was empty, the report carries zero bits. To a reader who does not, it carries substantial apparent information: nine dimensions were evaluated, no red flags surfaced, the risk matrix came back clean. Those two readers will take opposite actions from the same document.
The gap between perceived entropy and actual entropy is the attack surface. It is the same surface as a spoofed order book — depth that exists on the screen and not in the matching engine. It is the same surface as a vanity metric — a TVL figure that counts the same dollar four times through recursive lending. The mechanism is universal: manufacture the appearance of signal where the underlying state is empty or circular, and let the observer's pattern-matching do the rest.
What makes the research case worse is persistence. A spoofed order book disappears when the API call ends. A formatted report gets embedded into a vector store, retrieved by the next agent, cited in a summary, and eventually used as training data. The empty struct propagates. By the third hop, the claim "nine dimensions evaluated, no material risks identified" has detached entirely from the fact that no input existed. This is not hypothetical. It is the standard lifecycle of every AI-generated research artifact in production today.
Formatting is an attack surface
Humans use visual density as a proxy for thoroughness. A twelve-row table reads as complete. A three-bullet conclusion reads as considered. A disclaimer at the bottom reads as institutional.
Graders use the same proxy. So do retrieval systems. So does the next model in the chain, which sees a well-structured document and assigns it a high relevance score because well-structured documents usually are relevant. The formatting survives every round trip. The emptiness survives with it.
This is why the N/A report is more dangerous than a one-line error. A one-line error is legible. It fails loudly. Nobody embeds a stack trace into a knowledge base. But a nine-dimension report with every field marked unresolved passes every surface check, and surface checks are all that most pipelines run.
I learned this the hard way in 2021, prototyping a modified ERC-721 interface for batch transfers. My version cut transaction costs by roughly forty percent on high-volume marketplace operations. The proof-of-concept worked. The EIP was rejected on backward-compatibility grounds, which was the correct call — the legacy interface's inefficiency is load-bearing for a decade of deployed integrations. But the episode taught me something about standards that applies directly here: an interface that permits an ambiguous state will eventually be used in that state, at scale, by someone who did not read the spec. The ERC-721 batch semantics were ambiguous about partial failure. So were everyone's implementations. The ambiguity was not a bug in any single contract. It was a bug in the interface, and interfaces are forever.
Our research schemas have the same defect. They permit a fully-populated document with zero information points. They permit it by default, because the required-field constraints are on the shape of the output, not on the substance of the input.
The one-line fix nobody ships
minItems: 5.
That is the whole guard. Require at least five independently verifiable information points before the synthesis layer is permitted to run. Each point must carry a named entity, an action, a datum, and a timestamp. If the array is shorter, the pipeline does not produce a report. It produces an error, in a different format, with a different visual grammar, addressed to whoever owns the retrieval layer.
Fail closed, not open. This is the oldest rule in security engineering and the newest violation in agent design, because agents are built by people optimizing for task completion rather than for the integrity of the refusal path. A pipeline that always produces output looks better in a demo than a pipeline that sometimes refuses. So the refusal path never gets built, and then it never gets tested, and then it does not exist.
The second half of the fix is harder and more important. The refusal artifact must be machine-distinguishable from the report. Different MIME type. Different schema. An exception rather than a string. Right now, an agent downstream of this pipeline receives prose and cannot tell whether it is reading an analysis or an apology. That is a type error at the system boundary, and type errors at system boundaries are how cascades start.
I have been through this exact reasoning once before, from the other side. In 2022, while liquidity was evaporating, I spent months inside proof-of-stake validator distribution, and the finding that mattered was not any single operator's behavior — it was that the concentration risk was invisible in every dashboard because the metric being displayed measured stake, not control. The data was accurate and the picture was wrong. Accurate data rendered at the wrong granularity is indistinguishable from false data. Same failure. Different layer.
Contrarian: proving the model does not prove the input
Here is the part the current wave of AI-crypto infrastructure gets wrong, and I say this as someone who built in it.
In 2026 I led a team deploying a zero-knowledge proof system for verifying AI model weights on-chain. We got verification costs down roughly sixty percent, enough to make privacy-preserving attestation of model outputs economically viable. It worked. It is useful. It answers a real question: did the model that produced this output match the model you audited?
It does not answer the question that actually matters in a research pipeline. Model integrity is not data integrity. A proof that the correct model ran over an empty struct is a proof of correct execution over nothing. The cryptography is flawless and the conclusion is worthless.
The missing primitive is input provenance. Signed tool responses. Block-height pins on every state read. Freshness commitments from indexers — a signed statement of the block at which the indexer's view was current, so a stale read is distinguishable from an empty one. Content-addressed retrieval with a timestamp. Without these, an agent's reasoning chain is a proof with an unverified premise, and an unverified premise is not a weaker proof. It is not a proof.
The second contrarian point is about the industry's metric. Everyone measures hallucination rate. Nobody measures refusal legibility. We have built an entire evaluation apparatus around the model saying something false, and almost nothing around the model saying nothing true in a format that reads as authoritative. The second failure is worse, because a false claim can be falsified. A well-formatted absence cannot. There is nothing in it to check. You can only check whether it should have existed, and that check requires exactly the provenance layer we have not built.
In a bear market this stops being philosophical. When liquidity thins, the cost of acting on a false signal rises and the tolerance for noise collapses. A dashboard that renders a stale indexer as zero TVL does not produce a bad report in a bull market. It produces a bad exit in a bear market. Survival is a data integrity problem before it is a strategy problem.
The uncomfortable part
And here is what the empty report actually revealed, which is not about AI at all.
For a large fraction of this asset class, the N/A report is accurate. Most tokens have no revenue. Most TVL is recursive. Most governance has no voters. Most teams are unresolvable, most disclosures do not exist, and most information points that could be assembled are, in fact, absent from the world rather than absent from the retrieval layer.
So the scandal is not that the pipeline produced an empty report. The scandal is that a filled-in version of the same report — nine dimensions, three conclusions each, clean risk matrix — would have been equally empty, and nobody would have noticed. The pipeline did not fail to find information. It failed to hide that there was none.
That is the information gain here, and it is uncomfortable. The formatting was doing the work all along. Strip it and half the research output in this industry is a well-typed null.
Takeaway
By 2027, input provenance becomes a primitive, not a feature. Signed tool responses, freshness commitments, block-height pins, and minItems guards at every synthesis boundary. Refusal artifacts get their own MIME type and their own visual grammar, and any agent that receives one raises rather than summarizes. The teams that ship this first will not advertise it, because it looks like plumbing and it reads like pessimism.
It is neither. It is the difference between a system that can be wrong and a system that can be confidently empty.
The next exploit will not be a reentrancy bug. It will be an agent that read an empty array, called it a zero, and acted. How many of your dashboards do that right now?