Can a guardian chip stop a learning model from forgetting? Only partly.

A model that keeps learning after deployment will, sooner or later, overwrite something it used to know. One appealing fix is architectural: keep a separate, trusted core model on its own high-performance silicon, an inference ASIC or even a photonic processor, and let it guard the learner. We reviewed the continual-learning, hardware and security literature through November 2026 to see whether that design holds up. It can be built today, but the guardian looks less like a second brain and more like a slow, trusted reference with a narrow job.

Across the methods that protect old knowledge, the protected model is used forward-only during training. It measures how far the learner's outputs move from its own on new data, supplies distillation targets, generates synthetic replay of old knowledge, and checks proposed updates against a fixed answer set before they are kept. The cheapest drift signal is the KL divergence between the two models on the new inputs. In RL's Razor it predicted forgetting with R² = 0.96 on a toy benchmark, but only 0.71 in language models. Predicting which individual answers an update will break is weaker still: a 2026 study of five model-version updates found that detectors flagged answers flipping from correct to wrong with an AUROC of about 0.57–0.85 on knowledge and reasoning benchmarks, and as low as 0.42 on code. A guardian should therefore gate on aggregate thresholds over a test set, not on per-item predictions.

The guardian also cannot simply be frozen. In MIT's on-policy self-distillation work (ICML 2026), a frozen base teacher trained stably but underperformed, using the live model as its own teacher diverged, and a slowly updated copy worked best. On Qwen2.5-7B learning science Q&A, the average on prior abilities was 64.5 with that method against 53.4 for ordinary fine-tuning, from a starting point of 65.5. It cost about 2.5 times the compute and 4 times the wall-clock time. A September follow-up, iSDFT, found the slow copy drifts too and re-anchored it to the frozen base. The design that follows has three layers: an unchangeable original, a slow copy that updates only during offline consolidation, and the fast learner, with new facts held in removable external memory until they are checked.

That shapes the hardware case. Routine checks against a fixed test set barely need a guardian chip, because its answers can be computed once and cached. The recurring cost is generating replay and self-distillation text, which is decode-bound, the work fast inference chips were built for. By our estimate a same-size reference on GPUs adds about a third to training compute, and vendor efficiency claims of 5 to 35 times would cut that to a few percent. None of those claims has been independently checked. Taalas HC1 is the only shipping chip whose weights physically cannot be rewritten. It hardwires Llama 3.1 8B, and an independent measurement found 14,357 tokens per second against the company's figure of about 17,000. But it runs one model, at reduced 3- and 6-bit precision, and a drift measurement taken against a lossy copy measures drift from the copy. Large guardians need high-memory parts such as Google's TPU Ironwood, with 192 GB of HBM per chip. We found no public deployment in which a training cluster calls a dedicated inference chip as its reference model.

Photonics and analog compute fit the edges of the role, not the centre. Lightmatter's photonic processor, published in Nature in April 2025, ran ResNet and BERT unmodified while drawing 78 W of electrical power against 1.6 W of optical power, and heise reported just under 30% of conventional accuracy on natural-language questions. Its weights are loaded from ordinary digital memory, so a photonic core is only as protected as that memory. On the analog side, the largest Transformer run in silicon is an ALBERT model with 7.1M weights on phase-change memory, which lost about 5% accuracy over 30 days from conductance drift, under 1% with recalibration. For the one model meant to define what counts as forgetting, any drift of its own is disqualifying. Their realistic roles are small probe models and drift alarms checked against a digital master, and the optical links between learner and guardian.

The harder problems sit above the silicon. A guardian that protects what a model knows will fight legitimate corrections unless it knows which facts are meant to change. It also protects whatever is already there: about 250 poisoned documents were enough to backdoor models from 600M to 13B parameters, and P-Trojan showed backdoors can be reinforced by continual fine-tuning, including fine-tuning with anti-forgetting methods. Its security value lies in source-gated writes, revocable memory, a clean frozen root to compare against, and restoring snapshots rather than training forward.

Several of the key 2026 results are unreviewed preprints, and no benchmark yet scores how often a guardian wrongly blocks a good update or misses a bad one. Nor has anyone tested whether a small guardian, the size that fits a hardwired die or an analog chip, can protect a much larger learner. A dedicated chip makes it cheap and tamper-resistant to ask whether a model has drifted from what it knew. It cannot decide whether that drift was a mistake, a correction or an attack, and that judgment is the part still to build.