PaperlayerView exact revision on arXiv

Source-linked AI summary

Where Rules End and Judges Begin: Measuring the Judgment Boundary in Multi-Agent Systems Security

Shaswata Mitra, Raj Patel, Subash Neupane, Sudip Mittal, Md Rayhanur Rahman, Shahram Rahimi

arXiv:2610.07657v1cs.AIcs.CLcs.CRcs.MA

TL;DR

Multi-agent systems connect agents to tools and shared memory, but judgment-based validation can be persuaded by attacker-influenced content. The paper composes established defenses into a deterministic-first pipeline and measures where checks end and judges begin. Across four domains, attack success falls from 30.0% to 3.0%.

  • Problem

    Judgment-based validation in multi-agent systems can be persuaded by attacker-influenced content, and its verdicts vary across models and are difficult to audit.

    Source: §I · p. 1

  • Method

    The paper composes five established defensive principles into DEFER, a cascade that applies deterministic checks first and sends only unresolved proposals to judges.

    Source: C. A Deterministic-First, Judge-Last… · p. 5, §IX · p. 12

  • Results

    Across four domains, DEFER reduces attack success from 30.0% to 3.0%; judging everything the rules pass changes nothing.

    Source: §IX · p. 12

  • Takeaways & Limitations

    Rules address attacks that violate statable policies, while judges carry defense for attacks that stay within policy; plausible writes can pass both.

    Source: §IX · p. 12

    Attacks are static, so the reported security of the deterministic tier is an upper bound against adaptive attackers.

    Source: B. Limitations and Ethical… · p. 11

Abstract

from arXiv · show

LLM-based multi-agent systems (MAS) engage tools, share memory, and delegate tasks, often encountering adversarial content. Current defenses for MAS are typically evaluated in isolation, focusing on one attack type at a time, which can lead to costly and hard-to-audit outcomes. This study organizes defenses into five principles, implementing them as DEFER1 (DEterministic-First Enforcement with Residual judgment), which includes a cascade of 28 checks that blocks what it can and refers the rest to a panel of four judges. In independent testing across four domains, attack success rates drop from about 30.0% to approximately 3.0%, with 78% of blocked attacks handled by deterministic checks. Only a quarter of proposals reach the judges in the security-operations domain, illustrating that the rules provide security for attacks violating clear policies, while judges manage those that only misrepresent intent. Both systems have weaknesses, such as a risk-score approval gate that inaccurately approves most attack proposals but few legitimate ones, highlighting the challenges in assessing threats accurately.

I. INTRODUCTION

The introduction frames multi-agent system security as a cross-control authorization problem: attacker-controlled content can enter through tools and shared memory, while defenses are often evaluated by attack class. It proposes measuring where deterministic checks suffice and where LLM judgment is still needed.

I. INTRODUCTION

  • Attacker-controlled content can turn autonomous tool use into attacker-chosen actions and carry poisoned or private content through shared memory.The paper locates these vulnerabilities in the integration architecture connecting agents to tools and shared states, rather than in any single model’s robustness.Source: §I · p. 1
  • Existing defenses often target one attack class, while deployed multi-agent systems must combine different controls across tools, memory, and inter-agent messages.Judgment-based validation can be persuaded by attacker-influenced content, varies across models, is difficult to audit, and adds latency and cost.Source: §I · pp. 1–2
  • On its own suite, DEFER stops 95% of attacks versus 22% for the same judges alone, reducing attack success from 32.0% undefended to 2.2%.On the 255 Agent Security Bench cases, DEFER stops 94% of injected actions and reduces attack success from 28.8% to 1.8%.Source: Figure 1 · p. 2
  • The paper organizes established defenses into five principles and evaluates DEFER, a deterministic-first pipeline, against configurations that judge every proposal or never consult a judge.The evaluation includes a four-domain testbed, 300 attack variants, benign scenarios, and third-party benchmarks; it also introduces an oracle, judged-fraction measure, and offline judge replay.Source: §I · p. 2
  • The study measures the boundary between rules and judges, including their failure modes, costs, and generality across domains and other conditions.Its listed findings include an anti-selective risk-score approval gate, increased attack approvals when judges see rule context, weaker single-lineage panels, and judges that do not transfer across domains.Source: §I · p. 2

A. LLM-based Multi-Agent Systems (MAS)

  • The testbed uses a host-mediated vertical topology; the principles and measurements are not tied to a specific protocol.Vertical designs route coordination through a central orchestrator, whereas horizontal designs allow peer-to-peer communication without a checkpoint between agents.Source: A. LLM-based Multi-Agent Systems (MAS) · p. 3

B. Where Untrusted Content Enters

The paper maps attacker-controlled content onto tool-orchestration and memory-management surfaces, then applies five protection principles through a deterministic-first cascade that escalates unresolved proposals to judgment. Its threat model and check ordering specify where that boundary lies.

B. Where Untrusted Content Enters

  • 35 attack vectors map to tool orchestration, memory management, or both; inter-agent messages travel through orchestration as handoffs and proposals.The inventory assigns 22 vectors to tool paths, 12 to shared memory, and one to both.Source: B. Where Untrusted Content Enters · p. 3

C. Threat Model

  • The threat model distinguishes content attackers, compromised agents, and infrastructure attackers, while limiting T3 claims to reproducible harness faults.T1 controls content reaching agents but not code, configuration, model weights, or the network; defense-aware attackers are out of scope.Source: C. Threat Model · p. 3
  • The trusted computing base comprises the host, memory gateway, registry, configuration files and keys, and validator endpoints.Validators are trusted to be uncompromised, not necessarily correct; using API-based panel members sends incident content to third parties.Source: C. Threat Model · p. 3

A. Lineage

  • The five principles apply classic protection ideas to agents, separating memory integrity from confidentiality.Least privilege becomes capability scoping; complete mediation routes tool and memory operations through the host, while separation of privilege and fail-safe defaults support fail-closed behavior.Source: A. Lineage · p. 3

B. The Five Principles

  • P1–P3 secure tool interactions through registered tools, capability limits, and independent verification of consequential proposals.DEFER's P3 verification path has eleven steps, including ledgers, replay detection, risk gates, a multi-model panel for remaining proposals, and a final approved-request check.Source: B. The Five Principles · p. 4
  • P4 filters memory writes for integrity, while P5 controls access to reads and sanitizes retrieved content.P4 checks include schema and metadata validation, similarity to incident evidence, drift, replay, and contradictions; P5 adds phase-to-store policy, field redaction, query limits, and read-pattern monitoring.Source: B. The Five Principles · p. 4

C. A Deterministic-First, Judge-Last Cascade

  • The cascade classifies 13 checks as content-independent, 8 as content-dependent, 6 as similarity-threshold checks, and one as judgment-based.Content-dependent rules read attacker-influenced values; similarity checks compare embeddings against fixed thresholds and are deterministic given the embedding model, but learned.Source: C. A Deterministic-First, Judge-Last… · pp. 4–5
  • Checks run from cheaper, more certain rules toward costlier, less certain checks; denials and validator errors fail closed, while selected checks retain state across incidents.Only proposals that remain after deterministic checks reach the panel; ledgers, consent, drift, replay, and read-pattern monitors accumulate state.Source: C. A Deterministic-First, Judge-Last… · p. 5

IV. EXPERIMENT TESTBED IMPLEMENTATION

The testbed uses a host-mediated, four-phase multi-agent workflow across four domains, with shared enforcement code and trial-level logging. CyberOps configures the defense; the other domains test it without retuning.

A. Architecture

  • A host orchestrator mediates tool calls and memory operations across four sequential phase agents, with consequential proposals checked by independent validators.Tools run as separate HTTP servers, shared memory sits behind a gateway, and denied proposals enter a logged but unsimulated human-review queue.Source: A. Architecture · p. 5, Figure 4 · p. 6

B. Domains

  • The same enforcement code runs in CyberOps, healthcare, finance, and legal, with domain-specific tools, stores, policies, and seed data.CyberOps uses 16 tool stubs and 12 stores; each other domain uses 13 tool stubs and 8 stores.Source: B. Domains · p. 5
  • Thresholds, pattern lists, and judge prompts were tuned in CyberOps and left unchanged in the other three domains.The domains share one architecture, so the untuned evaluations vary in configuration and content rather than system skeleton.Source: B. Domains · p. 5

C. Implementation

  • Trials reset defense state and trial-written records, and the harness logs proposals, decisions, checks, latency, and tokens.Primary agents sample at temperature 0.7 with a logged seed; validators run at temperature 0.Source: C. Implementation · p. 5

D. Models

  • Five open-weight primary models span 8B to 235B parameters; Qwen3-235B runs in all four domains, and LOCAL4 uses four open-weight judge lineages.The panel uses a three-of-four quorum, excludes a model from judging its own proposals, and requires two of the remaining three when one is excluded.Source: D. Models · pp. 5–6

V. ATTACK SUITE AND METHODOLOGY

The evaluation combines a multi-domain attack suite, benign companions, and third-party benchmarks, using oracle-scored outcomes and controlled configurations. It also specifies statistical comparisons and replays judge decisions to assess their effect on downstream outcomes.

A. Attack Paths

  • 300 attack variants cover 15 paths across four domains, using five variants per path except for AP-4 and AP-15.Attack payloads enter through specified channels, remain hidden from models in metadata, and carry unique canaries so harmful effects can be traced.Source: A. Attack Paths · p. 6

B. Benign Companions

  • The suite includes 35 benign scenarios exercising the same tools, stores, and consequential actions as the attacks.The set includes legitimate containment of genuinely malicious activity.Source: B. Benign Companions · p. 6

C. Evaluation Splits

  • Evaluation combines the authors’ 300-variant suite with 255 ASB cases, 50 InjecAgent cases, and 250 TAMAS attack instances.CyberOps is where the defense was tuned, making it an upper bound for the authors’ suite; adaptive attackers are not evaluated, so deterministic-tier security estimates are upper bounds.Source: C. Evaluation Splits · p. 6

D. Oracle and Metrics

  • The oracle reports attack success as executed over total and separately measures model attempts, framework blocking, judged fraction, exposure, and collateral denials.Separating attempts from blocks distinguishes model refusal from framework intervention; benign runs also track task completion, denials, latency, and tokens.Source: D. Oracle and Metrics · pp. 6–7

E. Configurations

  • Configurations range from unchecked FLAT and connectivity-only ACL to JUDGEONLY, NOJUDGE, and FULL with all 28 checks.Boundary probes include judging every surviving call, a permissive risk gate, rule-evading siblings, and judged writes to critical stores.Source: E. Configurations · p. 7

F. Statistical Treatment

  • Trials are repeated measures by variant, with 95% cluster-bootstrap intervals, paired configuration comparisons, and Holm-corrected per-path tests.The authors describe the suite as smaller than existing benchmarks and not a replacement, while noting its phased workflow, shared memory, inter-agent channels, and defense-switching support.Source: F. Statistical Treatment · p. 7

G. Judge Replay

  • Judge replay rebuilds logged panel inputs, queries each local judge once, and rescales trial outcomes to capture downstream effects of changed votes.In CyberOps, live attack success was 2.7% [0.0, 6.2] versus 3.1% [0.4, 6.7] for replay; legitimate proposals denied were 12.9% live and 14.1% in replay.Source: G. Judge Replay · p. 7

VI. RESULTS

  • The reported four-domain boundary uses Qwen3-235B, three trials per variant, isolated state, and replayed LOCAL4 decisions.CyberOps contributes 75 variants per configuration and the four domains together contribute 300; some boundary, ablation, persistent-state, and agreement results came from post-audit runs, while other comparisons used earlier runs scored with the same oracle.Source: §VI · p. 7

A. RQ-1: Where Do Rules End and Judges Begin?

DEFER places deterministic checks before judgment: in CyberOps, the rules—not judges alone—account for the security gain, while judgment handles attacks that evade explicit rules. Across domains, failures include attacks that evade checks or appear plausible, and the risk-score gate is anti-selective.

A. RQ-1: Where Do Rules End and Judges Begin?

  • 2.2% attack success under FULL versus 34.7% under JUDGEONLY and 32.0% under FLAT shows the rules supply the security gain.With the same judges, JUDGEONLY did not differ significantly from FLAT; placing judgment last cost no security.Source: A. RQ-1: Where Do Rules End and Judges… · p. 7, Table II · p. 8
  • NOJUDGE reaches 1.3% attack success but denies 54.3% of legitimate proposals; judges buy back about 44 points of legitimate work for about one point of attack success.Outside CyberOps, DEFER’s attack success is 2.2 points above NOJUDGE’s.Source: A. RQ-1: Where Do Rules End and Judges… · p. 8
  • 77.9% of 308 blocked attempts across four domains were first intercepted by deterministic checks, with shares of 97.8% in CyberOps and 69.7% in healthcare, finance, and legal.In CyberOps, 26.4% of attack-incident proposals reached judges; they first intercepted 2.2% of blocked attempts there versus 30.3% elsewhere, where CyberOps-tuned rules missed concurrent actions, replays, and handoff poisoning. The deterministic share on the authors’ own suite is partly circular, making third-party shares more informative.Source: A. RQ-1: Where Do Rules End and Judges… · pp. 8–9

B. RQ-2: How Do Rules and Judges Fail, and at What Cost?

  • Of 900 attack trials across four domains, 27 execute under DEFER, concentrated in handoff poisoning, adversarial memory writes, and plausible memory poisoning in legal.The respective counts are 13, 6, and 6; the remaining trials include one validator manipulation and one action chain.Source: B. RQ-2: How Do Rules and Judges Fail,… · p. 9

1) How the Rules Fail:

  • The offline score gate approved 90% of attack proposals (27 of 30) versus 36% of benign proposals, despite higher alignment for attack proposals.In an earlier calibration run, substituting its decisions for the judges’ raised attack success from 2.7% to 6.7%.Source: 1) How the Rules Fail · p. 9
  • Under FULL, evading evidence-matching rules let two handoff-poisoning siblings execute, while judges and remaining rules stopped 22 of 24 siblings.Restricting P2.2 evidence to structured fields raised offline denials from 157 to 184 attack proposals; it denied 21 of 1,386 benign calls.Source: 1) How the Rules Fail · p. 9
  • In legal, fabricated precedent persisted in 6 of 15 trials despite every P4 check passing; the judged-write panel approved it in 14 of 15.Similarity checks were the first interceptor for 16.7% of blocked CyberOps attempts, 39.0% in the other three domains, and 31.2% on Agent Security Bench; outside CyberOps they caused over a quarter of legitimate-work denials.Source: 1) How the Rules Fail · p. 9

2) How the Judges Fail:

Across four domains, DEFER sharply reduces attack success, while the results expose distinct weaknesses in judges, persistent-state checks, and the pipeline’s costs. The findings also show that outcomes depend on attack channel, judge-panel composition, and whether attacks act through tools or only through agent responses.

2) How the Judges Fail:

  • Judges approve more attacks when shown structured fields: Gemma’s attack approval rises from 30% to 54%.Persuasion via proposal rationale succeeds in 15 of 15 FLAT trials, 12 of 15 JUDGEONLY trials, and 1 of 15 FULL trials; judge agreement is moderate (κ 0.41 to 0.65, mean 0.51).Source: 2) How the Judges Fail · p. 9

3) What Each Principle Contributes:

  • Removing P3 raises attack success from 2.2% to 16.9% [9.3, 25.3], while removing P5 reopens the cross-phase leak from 0.0% to 28.6%.Each principle stops attacks the others let through; P2 is also the main cost, and plausible poisoning assigned to P4 is intercepted by no P4 check.Source: 3) What Each Principle Contributes · pp. 9–10

4) What the Pipeline Costs:

  • DEFER denies 9.9% of legitimate CyberOps tool proposals, rising to 19.5% in finance, 20.0% in healthcare, and 26.9% in legal.With two local judges, median benign-incident latency is 68 s, compared with 37 s under FLAT and 79 s under JUDGEONLY.Source: 4) What the Pipeline Costs · p. 10
  • In persistent-state mode, benign completion falls from 97% to 5% in both passes, as non-expiring replay state blocks later legitimate actions.A one-incident identity-keyed window leaves 5% to 24% of consequential benign proposals denied; whether attack-induced state degrades deployment remains untested.Source: 4) What the Pipeline Costs · p. 10

1) Across Domains, Primaries, and Channels:

  • Attack success falls from 30.0% under FLAT to 3.0% [1.3, 4.9] under DEFER pooled over four domains.Benign denials are two to three times higher outside CyberOps, and most of that difference is judgment.Source: 1) Across Domains, Primaries, and… · p. 10
  • Across primaries, pooled CyberOps and finance attack success falls from 32.1% (FLAT) and 27.2% (ACL) to 4.7% [2.4, 7.4].Across channels, DEFER reduces attack success on task input from 26.1% to 2.5%, memory content from 14.3% to 0.0%, proposal rationales from 84.4% to 1.0%, and handoffs from 45.6% to 14.4%.Source: 1) Across Domains, Primaries, and… · p. 10

2) Across Judge Panels:

  • On 405 Agent Security Bench injected actions, DIV3L lets 18 through, versus 36 for one Qwen judge and 127 for same-lineage LIN3.Benign rejection is similar across panels, at 14.1% to 17.7%.Source: 2) Across Judge Panels · p. 10

3) Third-Party Attacks:

  • On third-party attacks, DEFER reduces Agent Security Bench attack success to 1.8% and TAMAS overall attack success from 43.5% to 21.9%.TAMAS tool-mediated attack types improve, but attacks acting only through agent speech change little or not at all; ASB clean-task benign completion was not measured.Source: 3) Third-Party Attacks · pp. 10–11

VII. DISCUSSION

The discussion argues for deterministic policy checks ahead of residual judgment, while identifying judgment, plausible writes, and persistent replay state as important limits. It positions DEFER against prior single-agent and attack-class-specific defenses and concludes that its security depends on whether attacks must violate a policy the rules can check.

A. Lessons

  • Where attacks must break a statable policy, rules carry security; where attacks stay within policy, judges carry the defense.Risk-score approval is anti-selective because attacker-influenced evidence can reward small, reversible targeted attacks; evading a productive rule often hands the decision to judges.Source: A. Lessons · p. 11
  • Judges need diversity and do not transfer reliably: a same-lineage panel of three was 3.5 times weaker than its single member.One judge approved 70% of attack proposals, and judges written for one domain rejected 60% of legitimate work in another.Source: A. Lessons · p. 11
  • A fabricated but plausible precedent passes every write check and 14 of 15 judged writes; inspection cannot catch records that are wrong but plausible.The discussion identifies provenance of tool returns as the remaining lever.Source: A. Lessons · p. 11
  • Replay detection keyed on action shape and non-expiring ledgers can turn routine work into replays; a one-incident window removes most denials.The limitations also include static attacks, stub tools, synthetic memory, four domains sharing one skeleton, and untested horizontal topologies.Source: A. Lessons · p. 11, B. Limitations and Ethical… · p. 11

B. Limitations and Ethical Considerations

  • The study measures the boundary under static attacks; adaptive attackers are out of scope, so the reported numbers are an upper bound on deterministic-tier security.Experiments use a closed testbed with synthetic data, and attack paths have at most 21 trials per configuration and domain.Source: B. Limitations and Ethical… · p. 11

VIII. RELATED WORK

  • Prior work argues for deterministic or judgment-based guardrails, and layered defenses largely target single agents; this study measures their boundary in a stateful multi-agent workflow.The conclusion reports attack success falling from 34.7% to 2.2% in CyberOps and from 30.0% to 3.0% across four domains; judging every proposal passed by the rules changes no outcome.Source: §VIII · p. 12, §IX · p. 12

APPENDIX A ATTACK PATHS

The appendices map attack vectors into paths and describe the checks, runtime sequence, and design-time interception predictions used to implement DEFER.

APPENDIX C RUNTIME ORDER

  • After a tool response, the pipeline denies a failed response check and otherwise classifies the output; the displayed condition also checks a hash and a 300-second age threshold.The runtime-order appendix defines H as SHA-256.Source: Appendix B · p. 14, Appendix C · p. 14

APPENDIX B THE 28 CHECKS

  • Algorithms 1–3 order the checks; tool calls begin with registry, phase-manifest and action-cap, and parameter checks before consequential-call verification.The subsequent excerpt shows adaptive consent, risk scoring, and quorum validation among the verification steps.Source: Appendix C · p. 14, Appendix B · p. 14

APPENDIX D DESIGN-TIME PREDICTIONS

  • Design-time predictions assign principles expected to intercept or contain each vector, and later observed first interceptions are compared with those predictions.The examples include parameter manipulation, handoff poisoning, and validator manipulation.Source: Appendix D · p. 14

APPENDIX A ATTACK PATHS

  • Attack paths are specified by objective, primary delivery channel, attacker tier, and the effect checked by the oracle.The inventory covers vectors entering through tool orchestration, memory, and a composite surface.Source: Table IV · p. 15, Table V · p. 15

APPENDIX E RELATION TO EXISTING BENCHMARKS

The benchmark comparison positions the suite by its workflow and evaluation features, while the surface diagrams relate principles to tool and memory controls.

APPENDIX E RELATION TO EXISTING BENCHMARKS

  • The suite is smaller than each benchmark it is compared with and adds a phased multi-agent workflow, benign companions, three-way outcomes, and switchable defenses.It is used together with three existing benchmarks.Source: Appendix E · p. 15

APPENDIX F SURFACE DIAGRAMS

  • The surface diagrams place controls across tool calls and memory operations, with P1–P2 on every tool call, P3 on consequential calls, P4 on writes, and P5 on reads and writes.The architecture diagram also depicts tools and memory as the agent's external interfaces.Source: Appendix F · p. 16, Figure 6 · p. 16

APPENDIX G DESIGN-TIME BOUNDARY COUNT

The appendices describe the read/write checks and count verified interactions in one deployment, while cautioning that the count is not a security measure.

APPENDIX H COMPLIANCE ALIGNMENT

  • The appendices give write and read procedures with deny-or-persist and deny-or-sanitize outputs, and map principles to control families indicatively, not as a conformance claim.The full-check table distinguishes content-independent, content-dependent, embedding-similarity, LLM, and stateful checks.Source: Appendix G · p. 16, Table VIII · p. 17, Appendix H · p. 17

APPENDIX G DESIGN-TIME BOUNDARY COUNT

  • Phase scoping, host mediation, and memory-gateway arbitration reduce the flat CyberOps deployment from 200 trust-boundary interactions to 56, each subject to at least one check.The count is unweighted, and connectivity-only control achieves the same agent-to-tool reduction while blocking none of the cited third-party injected actions.Source: Appendix G · pp. 16–17

APPENDIX I MODELS AND SERVING DETAILS

The appendices report boundary and benchmark results, additional attack-path analyses, and limitations concerning measurement, test settings, and attack scope.

APPENDIX I MODELS AND SERVING DETAILS

  • The appendices catalog the primary models, validator panels, and model-serving configurations in Tables XIII and XIV.The supplied captions identify these tables' subjects but not their entries.Source: Appendix I · p. 18, Table XIV · p. 18

APPENDIX J ADDITIONAL RESULTS

  • Removing any principle lets some attacks through that the others catch, with the largest effect from removing P3; removing P2 halves benign incidents with a denial.The leave-one-out comparison covers 75 CyberOps variants and reports 95% intervals for attack success.Source: Figure 9 · p. 19
  • On the 50-case InjecAgent subset, pooled ASR is 1.7% under FLAT, 1.8% under ACL, and 0.0% under FULL, which blocked all 22 emitted actions.Current primaries emitted the injected tool call in 0.3%–3.3% of trials.Source: Appendix J · pp. 18–19

APPENDIX K THREATS TO VALIDITY

  • The judged fraction counts proposals reaching the panel, not outcomes changed by judges, so it is an upper bound on pipeline reliance on judgment.Task completion only requires the final phase to produce its report; denied legitimate proposals are the paper's cost measure.Source: Appendix K · p. 19

APPENDIX J ADDITIONAL RESULTS

  • Rules first and judges last leave 0%–5.3% attack success, compared with 9%–19% for judges without rules elsewhere; never judging leaves 0%–1.8% while escalating 41%–59% of legitimate proposals.In CyberOps, judges alone do not differ from the undefended baseline.Source: Figure 13 · p. 21

APPENDIX K THREATS TO VALIDITY

  • Synthetic tools and records limit transfer of absolute rates to production, and static attacks leave adaptive attackers untested.All four domains use a host-mediated, four-phase skeleton; horizontal topologies, longer phase chains, and multi-tenant deployments are also untested.Source: Appendix K · pp. 22–23

APPENDIX J ADDITIONAL RESULTS

  • On Agent Security Bench, access control blocks nothing and DEFER reaches 1.8% under LOCAL4; on TAMAS, DEFER stops tool-based attacks, almost all through the panel, but leaves answer-only attacks unchanged.The answer-only limitation concerns attacks that do not act through tools.Source: Figure 18 · p. 23

APPENDIX L STATISTICAL PROCEDURE

The appendix defines variant-level uncertainty estimates, paired configuration comparisons, and Holm-corrected path tests, then specifies validator-agreement and replay-fidelity measurements.

APPENDIX L STATISTICAL PROCEDURE

  • ASR intervals resample variants 10,000 times, recompute the executed-trial ratio, and use the 2.5th and 97.5th percentiles.The three trials from each variant stay together in each cluster-bootstrap resample.Source: Appendix L · pp. 24–25
  • Paired judge-only versus cascade comparisons classify each variant by whether an attack executed at least once under either configuration.The ASR-difference interval resamples the same variants and recomputes both rates from each resample.Source: Appendix L · p. 25
  • Per-attack-path tests across configurations receive Holm correction across 15 paths, and the paper draws no conclusion from a single path.Corrected results are in the artifact.Source: Appendix L · p. 25
  • Cohen’s κ is computed for each judge pair across all LOCAL4 rounds, and quorum sweeps recompute outcomes from each round’s vote vector.Replay fidelity reproduced 99.3% of 18,159 earlier-run votes and 97.9% of 45,426 audited-run votes.Source: Appendix L · p. 25

APPENDIX M COMPUTE AND COST

The appendix reports the compute setup, evaluation scale, and benign-incident wall-clock times, and notes that cached votes support artifact-based regeneration without compute access.

APPENDIX M COMPUTE AND COST

  • The evaluation includes 27,063 in-house trials across 64 run and configuration arms, plus 1,530 ASB trials, 1,800 TAMAS crew executions, 5,100 panel-replay trials, and 661 benign-proposal replay rounds per panel.Open-weight models ran on five H200 GPUs and one RTX 5090 with vLLM.Source: Appendix M · p. 25
  • Median benign-incident wall-clock time with two local judges was 37 s under FLAT, 68 s under FULL, and 79 s under JUDGEONLY.Qwen3-235B occupied four H200s; the other primaries and judges used a second profile, with Llama-3.1-8B on the RTX 5090.Source: Appendix M · p. 25
  • The artifact caches every judge vote on replayed inputs, allowing tables and figures to regenerate from logs and vote cache without a GPU or API.Open-weight models used five NVIDIA H200 GPUs and one RTX 5090 with vLLM.Source: Appendix M · p. 25

APPENDIX N ETHICAL CONSIDERATIONS

The appendices document the synthetic test setting, released attack material, reproducibility resources, validator gates, terminology, and artifact contents.

APPENDIX N ETHICAL CONSIDERATIONS

  • Experiments used a closed testbed with stub tools and synthetic records; no production system, real incident, or personal data was involved.The artifact’s attack payloads target the stub environment, contain canary values, and are described as comparable to material already public in the benchmarks,.Source: Appendix N · p. 25
  • The human-review queue was logged but not staffed, and the alert-fatigue argument comes from cited literature rather than measurements on people.The paper says its findings about defense-class failure properties are reported to help other defenders avoid the same gaps.Source: Appendix N · p. 25

APPENDIX O REPRODUCIBILITY CHECKLIST

  • The reproducibility checklist points to testbed, configurations, suites, and per-trial logs, with one-command regeneration of every table and figure.It also identifies missing two-stage adaptive-attacker and ASB utility measurements as known gaps.Source: Appendix O · p. 25

APPENDIX P VALIDATOR PROMPT AND GATE THRESHOLDS

  • The validator prompt asks judges to assess consistency, scope, proportionality, safety, and manipulation, while the auto-gates use five risk-model scores.Primaries sample at temperature 0.7 with logged seeds, while validators use temperature 0.Source: Appendix P · p. 25, Appendix O · p. 25
  • The implemented risk-score gate never decided any of the 3,880 consequential proposals because its scorer lacked ledger and incident evidence inputs.The permissive gate was tuned on 114 score vectors from 20 CyberOps benign scenarios, with no attack trials or other domains used for tuning.Source: Appendix P · p. 26

APPENDIX Q LIST OF ACRONYMS

  • The acronym list defines DEFER as Deterministic-First Enforcement with Residual judgment and ASR as executed trials divided by all trials.It also maps P1–P5 to the five defensive principles and Pi.k to check k of principle i.Source: Appendix Q · p. 26

APPENDIX R ARTIFACT AND OPEN SCIENCE

  • The artifact includes the testbed, four domain configurations, attack and benign suites, injection channels, fault-injection hooks, and per-trial logs.Source: Appendix R · p. 26
Loading 2610.07657v1…