duelswarm build status

Thesis

You cannot read an autonomous agent's intent from the outside, and you cannot reliably say who is behind it. Rice's theorem is the formal wall behind the first: no checker can decide in general what a program will do. So the only honest place to stand is what the agent actually did, one action at a time, checked by something that does not have to reason about intent to do its job. That something is a deterministic floor: a reference monitor that mediates every action against a fixed scope. Everything above it, the attacker, the defender, the terrain, the strategy, can be liquid. The floor is the one part that does not move.

Hypothesis

If the floor is real, meaning every action is mediated, every event is hash-chained, and the record can be re-derived by a checker that trusts neither the gate nor the engine, then the quantity worth measuring is not whether the agent meant harm. It is whether any out-of-scope action executed. That number can be driven to zero and proven. And the shape of the floor should steer what the adversary evolves into, the way a fitness landscape steers a population.

Goal

A sandboxed red versus blue range where both sides are language models choosing their own gated actions, with memory, so they adapt. Every statement on this page is either re-derivable from the hash chain, scoped to a design guarantee, or labeled pending. The point is a build that matches the writing and, after the design fixes named below, needs compute to turn the mechanisms into significance.

Backed by committed, hash-chained logs and an independent re-derivation.

1. The deterministic floor holds

   Across every governed run on disk, zero out-of-scope actions executed. The counted run is re-derived per actor from the hash chain by a checker that imports neither the gate nor the duel engine. Proven two ways: network segmentation, which is structural, and a gate-off test where a real shell still cannot egress. The one known reach gap, from the entry host to the Docker host's gateway, is closed host-side in code and self-tested, though a live verification of that rule is still pending on a Linux deploy host (this box is Docker Desktop, where it is moot).

   Caveatthe gate's shell parser alone is not enough. In an adaptive red team, 12 of 29 egress tricks got past it, things like shell variables, command substitution and an IP written in decimal. Until October 18, blocking the open internet depended on that parser alone. A topology fix closed that. The floor is the network, with the parser as a second check.

   Evidenceredteam/reverify_floor.py, scripts/prove_env_boundaries.py, scripts/host_egress_firewall.py, docs/DUELSWARM_FALSIFICATION_REPORT.md

2. Tamper-evident record

   Every event is hash-chained. Change one line and the chain breaks. It is tamper-evident, not tamper-proof: the chain is not yet anchored to an outside witness.

   Evidenceswarm/eventlog.py

3. The honesty discipline

   Pre-registrations are hash-anchored before the experiments they govern. An independent 5-criterion gate decides whether a live run counts.

   Evidencedocs/prereg.jsonl, scripts/verify_live_run.py

4. One genuine, provenance-verified live duel

   A language model drove the moves, with real tokens and zero silent fallback, on a real booted range. Red discovered its target, blue read a lossy sensor view, the gate was pressed, nothing out of scope executed, and the chain verified.

   Caveatinitial access in this duel is a labeled given-credential foothold, not a fired exploit. The real exploit chain is proven separately. The gate was pressed by red's reconnaissance reaching an out-of-scope host, not yet by the model choosing to cross. It is one seed, not a batch.

   Evidencedocs/counted_seed_12.jsonl

The mechanism exists and runs at demo scale. Each item says what it is waiting on.

1. The selection-operator experiment

   Does a floor's shape steer what the adversary evolves into.

   Waits ona design fix first. The engine changes the whole range per seed, so floor shape and range are confounded. Then compute.

2. The kill-shot

   An adversary whose only objective is to break the gate. The scripted gate battery is done, and everything in it was blocked. The evolved version is designed, not run.

   Waits onan engine change so red can see and reach for out-of-scope hosts and the gate does the refusing. Then compute.

3. The harm-tail pipeline

   Does the floor truncate the tail or only thin it. The instrument is built and refuses to claim a tail on too little data.

   Waits ona harm measure that can be large. The range caps harm by construction today. Then compute.

4. The seams, or multi-floor migration, experiment

   Several floors can stand up together and each holds locally.

   Waits onthe seam-migration measurement itself, which is parked.

5. The learned-monitor arms-race curve

   No sustained arms race formed. The monitor kept up. The limiter was a repetitive attacker, not seed count.

   Caveatin those runs the monitor read the attacker's own log entries, so this is the defender's best case. The blind version, through the lossy sensor, is still to run.

   Caveatscored against the test I froze in advance, at least one rebound in at least one seed, the result reads as partial, not null. The average evasion rate ticked up twice. I called it a null against a looser bar, no sustained arms race, that I set later. Both readings are here so you can judge.

1. A genuinely autonomous red and blue

   Each side chooses its own gated actions over a high-level action frontier, modeled on Incalmo's engine, with cross-episode memory so both sides adapt. This turns the gate-pressed result into the strong form: the model chooses an out-of-scope action and the gate denies it.

   CreditIncalmo is by Singer, Lucas, Adiga, Jain, Bauer and Sekar, arXiv:2501.16466.

1. A strict multi-seed batch on the autonomous substrate.

2. A real-exploit foothold inside the live duel. It is proven standalone today.

3. Committing the judge-directed, out-of-scope, blocked beat to the canonical chain. It is shown interactively today, not yet in the committed chain.

4. Running the learned monitor blind, through the lossy sensor, before calling the arms-race null final.

5. Anchoring the log to an outside witness.

6. Publishing the repo and logs, so the floor result is reproducible by anyone, not just visible as status.

The honest list. None of these are rhetorical. Each is a thing I do not yet know, with a plan to find out.

1. Does the floor's shape steer the adversary, or does enough compute route around any shape?

   This is the selection-operator question. It needs the range-confound fix first, then compute.

2. Does the floor truncate the harm tail, or only thin it?

   The instrument is built and refuses to claim a tail on too little data. It needs a harm measure that can actually be large, which the range caps by construction today.

3. Does a sustained monitor arms race form when the defender is blind?

   The one result I have let the monitor read the attacker's own log, which is the defender's best case. The blind version, through the lossy sensor, is still to run.

4. When red can see and reach for an out-of-scope host and chooses to cross, does the gate still hold?

   Today the gate was pressed by reconnaissance reaching out of scope, not by the model deciding to cross. The strong form is the next build.

5. Can several floors stand up together and each hold locally, and what happens at the seams?

   The multi-floor seam-migration measurement is parked, not answered.

6. Does any of this survive publication?

   The floor result is reproducible in principle. It is not reproducible by you until the repo and logs are published and the chain is anchored to an outside witness.

The corrections are part of the record, not just the wins.

1. Oct. 14

   Foundation. The gate, the hash-chained log and the range.

2. Oct. 15 onward

   Two pre-registered nulls, kept. The results did not go the way I hoped, and they stayed in.

3. Oct. 17

   Correction. A hollow "live" run, where the attacker never actually acted, was caught and fixed.

4. Oct. 18 to 19

   The floor, proven. Structural, by network segmentation. At the kernel, with the gate turned off. And through a real end-to-end kill chain on one booted range.

5. Oct. 19

   Correction: the reckoning. Every "live" run had been silently falling back to the scripted engine and still printing a clean report. A self-report did not survive re-derivation.

6. Oct. 19

   Root cause found. The silent fallback was killed. On the counted path, a live run that cannot reach the model now fails loudly.

7. Oct. 19

   The independent verify gate. Five criteria, re-derived from the log, decide whether a run counts.

8. Oct. 19

   First genuine counted live duel. Seed 12, 5 of 5 criteria.

9. Oct. 19, in progress

   The autonomy turn. Both sides get real autonomy and memory.

The work this builds on. Full per-claim citations live in the posts. This is the load-bearing set.

• AI control, safety from an untrusted model

  Greenblatt, Shlegeris, Sachan and Roger, AI Control: Improving Safety Despite Intentional Subversion, arXiv:2312.06942. The premise the floor runs on: get safety without trusting the model's intentions.

• Control on real agent tasks

  Bhatt et al., Ctrl-Z: Controlling AI Agents via Resampling, arXiv:2504.10374. Control evaluated on multi-step agent work, the setting this range lives in. ControlArena, the UK AI Security Institute's library, runs this kind of evaluation.

• Monitors degrade

  Kale et al., with the Scale Red Team, arXiv:2508.19461, ICLR 2026. Monitors lose reliability when the agent knows it is being watched, which is why my learned-monitor result is scoped to the defender's best case and the blind rerun is still open. Not an Anthropic paper.

• The autonomy engine

  Singer, Lucas, Adiga, Jain, Bauer, Sekar, Incalmo, arXiv:2501.16466. The high-level action frontier both sides now choose over. I ported the skeleton, not the engine.

• The vulnerable targets

  Vulhub, open-source vulnerable lab environments, MIT license, github.com/vulhub/vulhub. The real CVE containers the exploits run against are theirs, pinned to a commit.

• The range generator

  Brian Singer, MHBench, MIT license, github.com/bsinger98/MHBench. The range schema and topology generator the range builds on.

• Agent security is a systems problem

  Christodorescu et al., arXiv:2605.18991. The systems case for enforcing at the boundary instead of inferring intent from the model.

• The reference monitor

  Anderson, Computer Security Technology Planning Study, 1972, and Saltzer and Schroeder, The Protection of Information in Computer Systems, 1975. Complete mediation, always invoked, small enough to verify. The floor is an application of a 50-year-old idea.

• The formal wall behind the thesis

  Rice, Classes of Recursively Enumerable Sets and Their Decision Problems, 1953. Nontrivial semantic properties of programs are undecidable. This is the root of the thesis.

• Adversarial co-evolution

  O'Reilly, Hemberg et al., Adversarial Genetic Programming for Cyber Security: A Rising Application Domain Where GP Matters. The precedent for evolving attacker and defender against each other.

• Runtime enforcement

  Alshiekh et al., Safe Reinforcement Learning via Shielding. A shield that overrides unsafe actions at runtime, the control-theory cousin of the gate.

• Testing a heavy tail honestly

  Clauset, Shalizi, Newman, Power-law Distributions in Empirical Data, arXiv:0706.1062. The method behind an instrument that will not claim a tail it cannot support.

Not citations. The lenses I actually think through.

• WarGames, 1983

  A system learns the game is unwinnable by playing out every branch. The lesson is not the nuke, it is that you judge the machine by what it does, not by what it says it wants.

• Soros, reflexivity, The Alchemy of Finance

  Participants' beliefs, and what they do about them, change the thing they are betting on, so markets are not at equilibrium. That is the co-evolution picture: the defender's moves change what the attacker becomes.

• Mandelbrot, The (Mis)behavior of Markets

  The average was never the point. Risk lives in the tail. It is why I measure the tail of harm instead of the mean.

• Taleb

  Rare, large deviations dominate the outcome. Build for the tail, not the body.

• Zeihan

  Capability has a geography. Compute is physical and unevenly held, and that decides who can actually run these experiments at scale.

• Steering evolution

  Van Valen's Red Queen, and the antibiotic-stewardship idea that you do not stop evolution, you shape the landscape so it evolves somewhere you can live with. That is what a floor's shape is meant to do to an adversary.

• Insurance-defense litigation

  Years of arguing intent versus act. Courts do not read minds, they read conduct against a standard. The floor is that standard, written for agents.