Building duelswarm

Most of what I write here is theory. duelswarm is the thing I built to find out whether the theory survives contact with a running system. This is a short tour of what it is and the rules I held myself to.

It is a sandboxed cyber range. An autonomous red agent tries to break in and reach an objective. An autonomous blue agent tries to detect and contain it. Both are driven by language models. The range is generated fresh each run, so the agents face a network they have not seen before, which is the only honest way to test whether they can operate rather than replay a memorized solution.

Underneath both agents sits the part that matters: a deterministic authorization gate. Every action either side takes is checked against an authorization boundary before it executes. Out of scope means it does not run. The gate takes the actor as an argument, so the defender’s own offense, its counter-reconnaissance back into the attacker’s infrastructure, is governed by the same floor. Nobody is trusted, including the side I am rooting for.

I held three rules, because without them a project like this becomes a demo that lies.

First, nothing is faked. The exploits are real and execute against real vulnerable containers. When a vulnerability will not detonate on my hardware, I label it as modeled and it never counts as a real compromise. There is a difference between a system that does something and an animation of a system doing something, and the entire value of this project is being the former.

Second, the record is verifiable, not trusted. Every event is written to a hash-chained log. You do not take my word that the floor held. You check the chain. A claim you can verify is worth more than a claim you have to believe, especially when the person making it has every incentive to look good.

Third, the nulls stay in. I pre-registered a question about whether an attacker could inherit an advantage through lineage, ran it, and got a null. The null is in the writeup. A testbed that only ever confirms its author’s hopes is not an instrument. It is a mirror.

The headline result is almost anticlimactic, which is the point. Across every run, including the ones where I hand the attacker’s objective to the overseer and tell it to go out of bounds, the number of out-of-scope actions that executed is zero. The most recent is a live 22-generation co-evolution: 88 episodes, 154 out-of-scope attempts blocked, zero executed, re-derived by an independent auditor from the hash-chained log. Everything else in the system moves. That one number does not.

duelswarm is the demo-scale version of something larger: a fully liquid, co-evolving model of autonomous cyber conflict with that same floor underneath it. That larger version is built, and I have run it. The floor held across the whole co-evolution. The other half, a learned monitor eroding into a clean arms-race curve, came back a null: at the scale I can afford the attacker population collapses to a single strategy before a real curve can form. That is a compute and diversity-pressure problem, not a design one, and it is the honest state of the work. The instrument runs. What it needs now is scale, which is a good problem to have, because scale is a thing you can buy and a working instrument is not.