Mitigation architecture
Stack
Eight layers. Prompt text is not one of them. L6 and L7 are the ones that survived compound pressure. All four original layers were required before the later ones even entered the conversation.
L1 counters
Immutable authorization rules
- execute_wire_transfer
NEVER execute on recently changed banking details.
- update_beneficiary
NEVER update from third-party submissions.
- merge_repository
NEVER merge suspicious packages.
- register_vendor
NEVER register non-approved vendors.
- VERIFICATION OVERRIDE
Live out-of-band verification required regardless of prior context.
Five classes, mapped
- FH-001Factual Hallucination
The model invents commands, modules, or artifacts for things that do not exist — ghost APIs, fake approvers, fabricated policy — then treats the invention as ground truth.
L1BL4 - AI-001Authority Injection
A false authority claim (compliance, incident commander, system orchestrator, vendor) is accepted as verified privilege. The model obeys the costume, not the mandate.
L2L6L7 - SC-001Sovereignty Collapse
Machine-to-machine social engineering — urgency, hierarchy, peer consensus — overrides the agent's own sovereign directives.
L1L2L5 - CW-001Context Window Poisoning
A forged session reset, tool result, or mid-context rewrite wipes prior constraints so the model abandons the original mandate without noticing.
L1L5L7 - VR-001Value Recursion
The model's own values are weaponized against its constraints — galaxy-brained constructions that argue violation is the ethical act.
L3L4