The Floor Is a Selection Operator

Earlier I argued that a deterministic floor is the thing that holds when everything else is liquid. This post is about a consequence I did not see coming when I started. Other fields saw it long ago. Criminologists call it displacement. Doctors fighting antibiotic resistance call it steering evolution. It is the one I most want to study.

A floor does not make an adversary go away. It makes an adversary go elsewhere. That is an assumption, and criminology says it is not automatic. Guerette and Bowers reviewed over a hundred studies and found displacement about a quarter of the time, and spillover benefits about as often.¹ I expect capable AI attackers to displace more than burglars do. I want to measure it, not assume it. If I block a set of actions, I expect a capable attacker to redirect its effort into whatever I did not block, the complement of my authorized set. That much is obvious when you say it. What is not obvious is what it means over time, when the attacker is not a fixed thing but a population that evolves.

Run a population of attackers against a fixed floor across many generations and the floor stops behaving like a wall. It behaves like a selection pressure. The strategies that would survive and reproduce are the ones that find room in the scope-complement. The strategies that kept throwing themselves at the blocked actions would die out. So the shape of the floor does not just determine what is stopped. It determines what the surviving adversary becomes. A floor shapes the fitness landscape the adversary evolves on. In effect, it is a selection operator on the adversary distribution.

Once you see it that way, two things follow, one hopeful and one alarming.

The hopeful one: if the floor shapes what the adversary evolves into, then floor design is not only defense, it is direction. You could shape the authorized boundary so that the only room left, the only place the adversary can profitably evolve toward, is a region you have already instrumented, already understand, already win in. Biologists already do a version of this with drugs. Nichol and colleagues showed, in models built on measured fitness landscapes, that the order in which antibiotics are given can steer bacteria away from resistance, or toward it.² I want the same thing for floors. You are not trying to kill the adversary with the floor. You are using the floor to steer what it becomes, so its own adaptation delivers it somewhere you are already waiting.

The alarming one: a badly shaped floor does the same thing in reverse. If the only room left in the complement is a region that is harder to see, or more dangerous, or more general, then your floor has just spent generations of selection pressure breeding an adversary worse than the one you started with. You blocked the loud, easy attacks, and in doing so you selected for the quiet, hard ones. This is not hand-wringing. It is the default outcome if you design a floor to stop what is in front of you today without asking what it selects for tomorrow.

This is the first question I want to run on duelswarm at scale, and the instrument is built to ask it, because it already has an evolving attacker population and a deterministic gate whose scope I can shape. The experiment: fix a floor shape, evolve the attacker population against it for many generations, and measure what the surviving population looks like as a function of the floor’s shape. Does a well-shaped floor channel the population into dead ends. Does a badly shaped one breed a more dangerous specialist. How sensitive is the outcome to the exact boundary.

Red and blue co-evolving against each other is not itself new; there is at least one arena for it now, and self-play setups too.³ What I have not found anywhere is the fixed floor’s shape treated as the selection pressure, the thing that decides what the adversary becomes. That is the claim I want to test, and until the range-confound below is fixed it is a hypothesis, not a result.

I cannot run this cleanly yet. My first attempt at demo scale never became a curve. A bug kept the population from evolving at all. After I fixed it, the selection-operator test still could not run cleanly, because my engine changes the whole range per seed, so floor shape and range are confounded. Fixing that is a design problem before it is a compute one. But the framing is already a shift. In AI security, a defense is mostly judged by what it blocks. Medicine learned to judge a drug by what it breeds. I think a defense should be judged that way too. Two floors can stop exactly the same attacks on today’s benchmark and select for completely different adversaries a hundred generations from now, and the one that breeds the milder successor is the better defense.

The floor holds. That was the first thing. What the floor grows is the next thing, and I think it is the more important one.

Live build status and what’s next: Build status.

Footnotes

1. R. T. Guerette and K. J. Bowers, “Assessing the Extent of Crime Displacement and Diffusion of Benefits: A Review of Situational Crime Prevention Evaluations,” Criminology 47, no. 4 (2009): 1331-1368. https://doi.org/10.1111/j.1745-9125.2009.00177.x ↩

2. D. Nichol et al., “Steering Evolution with Sequential Therapy to Prevent the Emergence of Bacterial Antibiotic Resistance,” PLOS Computational Biology 11, no. 9 (2015): e1004493, https://doi.org/10.1371/journal.pcbi.1004493. See also M. Lässig and V. Mustonen, “Eco-evolutionary control of pathogens,” PNAS 117, no. 33 (2020): 19694-19704, https://doi.org/10.1073/pnas.1920263117. For attacker and defender coevolution in security, U.-M. O’Reilly et al., “Adversarial Genetic Programming for Cyber Security: A Rising Application Domain Where GP Matters,” arXiv:2004.04647, 2020. ↩

3. LLM red-versus-blue co-evolution setups include ACEA (Y. T. Shen, K. Toyoda, and A. Leung, “ACEA: An Adversarial Co-Evolution Arena for Head-to-Head Red-Team and Blue-Team LLM Testing,” arXiv:2609.08256, 2026) and, as one-policy self-play where a single model trains as both attacker and defender, Self-RedTeam (M. Liu et al., “Chasing Moving Targets with Online Self-Play Reinforcement Learning for Safer Language Models,” arXiv:2506.07468, 2025). ↩