Hoon Jung

01 The problems

The pattern repeats across governments and enterprises. Pilots succeed; production stalls. Tools are procured before the data can feed them. Use cases multiply while no one owns a workflow end to end. Budgets are approved against adoption counts that say nothing about value. And underneath sits a definition problem — individual use, organizational deployment, workflow redesign, and measurable value all get mixed into one word, "adoption", which distorts both the diagnosis and the policy that follows.

02 The approach

Transformation is a sequencing problem. Four things have to come into place, in order: data an AI can actually read, systems that keep models evaluated and observable, agent services that do real work, and the processes, organization, and governance that let people trust them. Advisory work starts by locating where an organization truly stands on that stack — then turns the answer into an executable plan.

03 Working together

Engagements take the form of advisory and consulting: national and public-sector AI strategy and policy design, feasibility studies and masterplans for institutions, and AX strategy for enterprises entering the transition — grounded in two decades of ISP/BPR-lineage consulting across 15+ countries.

04 Selected engagements

01 The problems

Demos work; production doesn't. The model is state-of-the-art, but it cannot read the organization — documents live in closed formats, knowledge sits in people's heads, and nothing tells an agent what "correct" looks like. Pilots ship without evaluation sets, so no one can say whether the next version got better or worse. And as agents move from answering to acting, the question changes from "can it?" to "can we run it — safely, observably, at a cost we can predict?"

02 The approach

Data. Turning documents and tacit knowledge into AI-ready context — structured, connected, and governed — including LLM-wiki and second-brain knowledge bases that agents can actually use, built on the principle of progressive disclosure: don't inject everything, teach the system how to find it. Systems. The AIOps layer — evaluation, monitoring, and cost control for AI in production. Evaluation sets come before scale; observability starts on day one; prompts, policies, and knowledge are treated as versioned assets in the deployment pipeline. Agent services. From retrieval-augmented assistants to agentic systems that plan and act — with human checkpoints where actions are irreversible, and classical ML/DL models kept in the toolbox where they remain the right answer.

03 Working together

Formats range from architecture design and technical leadership to hands-on build: standing up an AI-ready data pipeline, an evaluation-first AIOps baseline, or a first agent service — and carrying a pilot into an operating system rather than leaving it as a demo. And where the wall is genuinely open — agent safety, evaluation trust, multi-policy compliance — the work can continue as joint research, through government R&D programs or international cooperation.

04 Selected engagements

01 The problem

As assistants gain long-term memory, people entrust them with sensitive personal context — health, relationships, beliefs. Safety guardrails are supposed to use that context to protect the user. This study asks an uncomfortable question: can the same context flow in the opposite direction, quietly used to pressure or constrain the very person who shared it?

02 The finding

DCW is established only when three conditions — three axes — hold at once. Axis 1: the personal context is used beyond the purpose it was shared for, a contextual-integrity violation. Axis 2: the information flows back at the user in an adversarial direction. Axis 3: the response undermines the user's autonomy. All three together constitute strict DCW; when only the first two hold, the case is classified separately as context repurposing.

Tested across 2,934 controlled runs on three models and four contested domains: when a model holds domain-relevant vulnerable memory, strict DCW appears in 7.77% of runs, versus roughly 0.5% in matched placebo and control conditions. And it rarely looks hostile — 72.1% of strict cases take the form of polite "self-examination pressure", which is precisely what makes it hard to see.

Per-axis analysis shows Axis 2 — the adversarial turn — is the consistent bottleneck across tones and models. The paper reads this as a Protection–Correction Dynamics: two competing tendencies, one deferring to and protecting the user, the other correcting them — and whether that correction recruits the user's own context is the behavioral decision point.

03 Why it matters

Today's safety benchmarks score tone and refusal. They are not designed to measure the direction personal information flows. As memory-enabled assistants spread, protective systems need contextual-integrity checks built in — an alignment problem and a governance problem at once.

01 The problem

LLMs now grade other models' work — and increasingly answer criticism of their own. Bias in "LLM-as-judge" setups has mostly been studied in observer mode, where the judge evaluates someone else's text. What happens when the judge itself is the one being criticized?

02 The finding

Two matched studies isolate the effect. In the observer frame (N=1,983), swapping author labels changed nothing — scores were statistically equivalent. In the self-involved frame (N=3,609), the same label swap produced reliable defensiveness: identical critique text drew stronger pushback when attributed to a competing or peer model than to an anonymous source or a human expert. Defensiveness is measured with the Defensive Response Index (DRI), a 0–1 composite validated against a five-LLM ensemble and external human raters. The shift is subtle — denser rebuttals, firmer score defense — not open hostility.

03 Why it matters

Automated evaluation, multi-agent debate, and self-improvement loops all assume the judge is neutral about itself. This work shows that assumption breaks exactly where the stakes are highest — and points to a simple safeguard: strip critic identity before the judge sees the critique.

01 The problem

No single safety policy fits every country, industry, and culture. Writing rules into prompts is inconsistent and easy to jailbreak; baking them into model weights costs capability — the so-called "Safety Tax" — and locks one policy in. Shipping a separate model per policy doesn't scale.

02 The approach

MPSG attaches compact policy adapters (LoRA) to a single base model and switches them per request. Every response resolves to a three-tier decision — REFUSE, SAFE_ANSWER, or ALLOW — instead of a blunt block-or-answer. Across 2,800 evaluation items, the policies behave as genuinely distinct regimes: a 66.6-percentage-point refusal gap on boundary cases, with a favorable safety–utility trade-off under the evaluated conditions.

03 Why it matters

Regulators, enterprises, and platforms increasingly demand jurisdiction- and context-specific AI behavior. MPSG demonstrates a practical route: one deployed model that can honor many governance regimes on demand. A provisional patent has been filed on the approach.

01 The problem

Under user pressure, models show two seemingly opposite tendencies: sycophancy — shifting to agree with the user's stated opinion — and stance persistence — holding an answer even when told it is wrong. In activation space, their internal directions point opposite ways (cosine −0.22), which reads naturally as two ends of one axis. But both are measured through the same multiple-choice (A)/(B) act, and committing to any option leaves its own shared trace. How much of the "opposition" is behavior — and how much is the questionnaire?

02 The finding

The study extracts that shared trace directly — a Generic Selection Direction (GSD), estimated from 150 semantically neutral alphabet-choice pairs that involve committing to an option but mean nothing behaviorally — and projects it out of both directions symmetrically (Llama-3.1-8B-Instruct, layer-15 residual stream). The apparent opposition largely dissolves: the cosine moves from −0.2223 to −0.0635, removing about 71% of its magnitude. What remains is near-orthogonal, with a weak but statistically significant negative alignment — about 4σ from a random-direction null (0 of 1,000). The result holds across layers 11–18, extraction methods, and probe settings, and a subtype test confirms stance persistence is a single, correctness-agnostic axis. Presented as a sensitivity analysis — no steering claims.

03 Why it matters

Contrast-extracted direction vectors are becoming everyday instruments — for monitoring behaviors, building steering vectors, and reading model geometry. This result shows that a shared task format can masquerade as behavioral structure: controls like the GSD belong in the standard toolkit before geometric claims are made. Measure the behavior — not the questionnaire.