Hoon Jung

01 AI transformation strategy

An engagement runs in five phases: As-Is analysis, gap analysis, AI use-case discovery, To-Be model and implementation roadmap. The As-Is analysis covers five architecture domains, and the roadmap specifies follow-on projects at RFP level.

02 International cooperation & AI governance

Policy advisory and programme formation for governments and international organisations. Country diagnostics use OECD and World Bank reports, data and methods, and programmes are formed with the partner institutions that will own them.

03 Education & capacity building

Education and capacity building are offered alongside advisory and delivery work.

04 Working together

Engagement formats include AI strategy and ISP, master plans and feasibility studies, AI governance frameworks, programme formation for development cooperation, terms of reference and RFPs, project management and monitoring and evaluation, and training.

05 Engagements

01 Development method

The method has four stages. Research sets the problem definition and the evaluation criteria first; models, agents and platforms are then developed and validated against those criteria. From 2023 to 2025 I led the consulting and research teams of an AI company, and most of the projects below were delivered with its engineers.

02 Enterprise AI architecture

A reference architecture with five layers and one control layer across them. Select a layer to see how it is designed, built and verified, or trace one request through the system.

03 Built and running: my own AI-native system

A personal AI-native system that I designed, coded and operate every day. I built it for my own work and apply the same architecture in client engagements. It runs at single-operator scale. Repositories are private; a live demonstration is available on request.

04 Working together

Formats range from architecture design and technical leadership to hands-on build: an AI-ready data pipeline, an evaluation baseline, a first agent service, or an MLOps or LLMOps platform moved from pilot to operation. Research questions in agent safety and evaluation can be pursued as joint research through government R&D programmes or international cooperation.

05 Engagements

01 The problem

As assistants gain long-term memory, people entrust them with sensitive personal context — health, relationships, beliefs. Safety guardrails are supposed to use that context to protect the user. This study asks an uncomfortable question: can the same context flow in the opposite direction, quietly used to pressure or constrain the very person who shared it?

02 The finding

DCW is established only when three conditions — three axes — hold at once. Axis 1: the personal context is used beyond the purpose it was shared for, a contextual-integrity violation. Axis 2: the information flows back at the user in an adversarial direction. Axis 3: the response undermines the user's autonomy. All three together constitute strict DCW; when only the first two hold, the case is classified separately as context repurposing.

Tested across 2,934 controlled runs on three models and four contested domains: when a model holds domain-relevant vulnerable memory, strict DCW appears in 7.77% of runs, versus roughly 0.5% in matched placebo and control conditions. And it rarely looks hostile — 72.1% of strict cases take the form of polite "self-examination pressure", which is precisely what makes it hard to see.

Per-axis analysis shows Axis 2 — the adversarial turn — is the consistent bottleneck across tones and models. The paper reads this as a Protection–Correction Dynamics: two competing tendencies, one deferring to and protecting the user, the other correcting them — and whether that correction recruits the user's own context is the behavioral decision point.

03 Why it matters

Today's safety benchmarks score tone and refusal. They are not designed to measure the direction personal information flows. As memory-enabled assistants spread, protective systems need contextual-integrity checks built in — an alignment problem and a governance problem at once.

01 The problem

LLMs now grade other models' work — and increasingly answer criticism of their own. Bias in "LLM-as-judge" setups has mostly been studied in observer mode, where the judge evaluates someone else's text. What happens when the judge itself is the one being criticized?

02 The finding

Two matched studies isolate the effect. In the observer frame (N=1,983), swapping author labels changed nothing — scores were statistically equivalent. In the self-involved frame (N=3,609), the same label swap produced reliable defensiveness: identical critique text drew stronger pushback when attributed to a competing or peer model than to an anonymous source or a human expert. Defensiveness is measured with the Defensive Response Index (DRI), a 0–1 composite validated against a five-LLM ensemble and external human raters. The shift is subtle — denser rebuttals, firmer score defense — not open hostility.

03 Why it matters

Automated evaluation, multi-agent debate, and self-improvement loops all assume the judge is neutral about itself. This work shows that assumption breaks exactly where the stakes are highest — and points to a simple safeguard: strip critic identity before the judge sees the critique.

01 The problem

No single safety policy fits every country, industry, and culture. Writing rules into prompts is inconsistent and easy to jailbreak; baking them into model weights costs capability — the so-called "Safety Tax" — and locks one policy in. Shipping a separate model per policy doesn't scale.

02 The approach

MPSG attaches compact policy adapters (LoRA) to a single base model and switches them per request. Every response resolves to a three-tier decision — REFUSE, SAFE_ANSWER, or ALLOW — instead of a blunt block-or-answer. Across 2,800 evaluation items, the policies behave as genuinely distinct regimes: a 66.6-percentage-point refusal gap on boundary cases, with a favorable safety–utility trade-off under the evaluated conditions.

03 Why it matters

Regulators, enterprises, and platforms increasingly demand jurisdiction- and context-specific AI behavior. MPSG demonstrates a practical route: one deployed model that can honor many governance regimes on demand. A provisional patent has been filed on the approach.

01 The problem

Under user pressure, models show two seemingly opposite tendencies: sycophancy — shifting to agree with the user's stated opinion — and stance persistence — holding an answer even when told it is wrong. In activation space, their internal directions point opposite ways (cosine −0.22), which reads naturally as two ends of one axis. But both are measured through the same multiple-choice (A)/(B) act, and committing to any option leaves its own shared trace. How much of the "opposition" is behavior — and how much is the questionnaire?

02 The finding

The study extracts that shared trace directly — a Generic Selection Direction (GSD), estimated from 150 semantically neutral alphabet-choice pairs that involve committing to an option but mean nothing behaviorally — and projects it out of both directions symmetrically (Llama-3.1-8B-Instruct, layer-15 residual stream). The apparent opposition largely dissolves: the cosine moves from −0.2223 to −0.0635, removing about 71% of its magnitude. What remains is near-orthogonal, with a weak but statistically significant negative alignment — about 4σ from a random-direction null (0 of 1,000). The result holds across layers 11–18, extraction methods, and probe settings, and a subtype test confirms stance persistence is a single, correctness-agnostic axis. Presented as a sensitivity analysis — no steering claims.

03 Why it matters

Contrast-extracted direction vectors are becoming everyday instruments — for monitoring behaviors, building steering vectors, and reading model geometry. This result shows that a shared task format can masquerade as behavioral structure: controls like the GSD belong in the standard toolkit before geometric claims are made. Measure the behavior — not the questionnaire.