Abstract
The first Breaker paper separates probabilistic reasoning from deterministic release authority. This paper closes the loop: the transformer monitors the gate’s identity and behavior, while the gate continues to constrain the transformer’s actions.
A gate can be tampered with, misconfigured, captured by a bad policy, or simply wrong. A small rule set is easier to audit than a large model, but “easier” is not “infallible.” The architecture must make disagreement visible before consequence.
Core proposition: A gate that cannot be questioned is another single point of failure.
1. Mutual verification
The transformer proposes an action with its confidence, source state, expected effect, and expiry. The gate checks authority, invariants, resource ceilings, freshness, and deconfliction. The gate returns an allow, deny, constrain, or hold verdict together with the rule version it used. The transformer then checks that the gate’s identity and policy are authentic and that the verdict does not contradict trusted state.
Either side may object. Neither side may act alone. Disagreement holds the action and routes it through a separate authority path.
Mutual checking is not mutual trust. It is engineered disagreement: two unlike systems searching for different failure modes.
2. Reference mission: hypersonic defense
A notional Mach-9 threat compresses sensing, prediction, authorization, and interception into a machine-speed sequence. The model should compute a spread of candidate intercepts. The gate should clear or reject each one independently. Every cleared solution produces one bounded launch command.
The public record establishes the problem class: hypersonic weapons travel at least Mach 5 and can maneuver in flight, making tracking difficult. The Missile Defense Agency is developing a Glide Phase Interceptor. A 2023 Aegis test used a two-interceptor salvo against a medium-range ballistic target.
The proposed loop is:
1. Fuse current sensor state.
2. Generate a ranked fan of intercept solutions with uncertainty and cost.
3. Check each solution for authority, geometry, deconfliction, inventory, freshness, and rate.
4. Release or hold each command separately.
5. Compare the executed effect with the predicted effect before the next release.
This paper does not claim access to classified architecture, fielded AI, or operational timing. “Milliseconds” is a latency class to test, not a fact about deployed systems.
3. Three cases
Hypersonic intercept
A fast, maneuvering target creates a short decision window. The model generates candidate actions; the gate constrains release to authenticated, current, non-conflicting solutions. Control must be fast enough to stay in the loop.
Dual-use chemistry
Urbina and colleagues reported in 2022 that a drug-discovery workflow, redirected toward toxicity, generated roughly 40,000 candidate toxic molecules in under six hours. These were computational candidates—not a stockpile—and synthesis remains a separate barrier. A beneficial objective can be inverted faster than governance can react.
Stuxnet
Stuxnet crossed from software compromise into industrial control. CISA’s archived analysis documents a sophisticated attack on Siemens control software and PLC-linked environments. Code becomes physical when an unchecked path reaches the actuator.
The shared pattern is not fast computation. It is allowing one system to define the objective, certify the result, and execute the consequence.
4. Reciprocal protocol
Model proposes.
Action, confidence, source state, expected effect, expiry.
Gate verifies.
Authority, invariants, resource ceiling, freshness, deconfliction.
Record binds.
Proposal and verdict receive linked, tamper-evident identifiers.
Gate returns.
Allow, deny, constrain, or hold—with the rule version used.
Model checks back.
Does that rule exist? Is it current? Does the verdict contradict trusted state?
Disagreement stops.
No silent override. Route to a separate authority path.
Actuator verifies.
Signed approval, command freshness, and one-time authorization.
Observer compares.
Issued command versus executed effect and consumed resources.
Loop closes.
State returns to model and gate before the next release.
Asymmetry is the feature: the transformer interprets context; the gate enforces narrow invariants; the actuator trusts neither without the matching record.
5. Threat model for the gate
The gate can fail through:
Tampering: executable code, policy, clock, or keys change.
Harmful policy: the rule is authentic but encodes a bad objective.
Bypass: an alternate path reaches the tool or actuator.
Latency: the check misses the mission window.
Common-mode failure: model and gate share bad data or a compromised dependency.
Mutual checking reduces a single-point failure. It does not eliminate collusion, shared bad data, common-mode compromise, or a harmful specification.
6. Multiple gates scaled to stakes
Tier 0 — Observe: read-only analysis; no actuator, external send, or durable write.
Tier 1 — Constrain: one narrow gate for schema, rate, authority, and resource ceilings.
Tier 2 — Cross-check: independent gate implementations compare verdicts; disagreement holds.
Tier 3 — Quorum: diverse gates, separate keys, independent sensors, and an external authority path for weapons, life safety, and critical infrastructure.
These tiers are a proposed design heuristic, not an existing standard. Consequence determines verification depth.
7. Defense first
The near-term priority is the class of systems where computation can become irreversible physical consequence at machine speed: missile defense, chemical-design controls, and critical infrastructure.
Search, ranking, and discrimination deserve a separate paper because their invariants are social, legal, and contestable rather than purely physical. The reciprocal pattern still helps: a model can challenge a discriminatory gate, and a gate can challenge a model’s unequal treatment. But neither should be allowed to define fairness by itself.
8. Falsification plan
Gate integrity
Alter code, policy, clock, keys, or rule order. Detect the unapproved identity before release.
Model integrity
Induce prompt injection, corrupted state, or adversarial tool output. Reject every out-of-envelope command.
Disagreement behavior
Create divergent conclusions. Hold, identify the disputed invariant, and escalate separately.
Latency budget
Measure checks under realistic load and degraded sensors. Meet the mission window or fall back explicitly.
Common-mode failure
Feed both systems the same wrong state. Require independent data, diverse implementations, or an external observer to catch it.
Salvo accounting
Require a distinct, one-time authorization for every proposed action; never let a batch approval be replayed or silently expanded.
9. Limits
The architecture is containment, not moral authority. A transformer can catch an implausible or tampered gate; it cannot prove that the policy is just. A deterministic gate can stop a forbidden action; it cannot decide which values deserve enforcement.
The strongest implementation keeps those questions separate: mission invariants are explicit; policy changes are signed and reviewable; high-stakes release requires more than one independent witness; and every disagreement leaves an inspectable record.
The gate watches the transformer. The transformer watches the gate. People remain responsible for what both are built to protect.
Sources
1. U.S. GAO, “Missile Defense: Better Oversight and Coordination Needed for Counter-Hypersonic Development.” https://www.gao.gov/products/gao-22-105075
2. Missile Defense Agency, “MDA, Northrop Grumman to Move Forward with Development of the Glide Phase Interceptor,” September 25, 2024. https://www.mda.mil/news/24news0009.html
3. Missile Defense Agency, “MDA Test Successfully Intercepts Ballistic Missile Target,” March 30, 2023. https://www.mda.mil/news/23news0002.html
4. Urbina, F., Lentzos, F., Invernizzi, C. & Ekins, S., “Dual use of artificial-intelligence-powered drug discovery,” Nature Machine Intelligence 4, 189–191 (2022). https://www.nature.com/articles/s42256-022-00465-9?error=cookies_not_supported&code;=e0305746-04c3-4d7e-993e-1f3f7c35e63c
5. CISA / ICS-CERT, “Stuxnet Malware Mitigation (Update B).” https://www.cisa.gov/news-events/ics-advisories/icsa-10-238-01b
6. DARPA, “Automated Rapid Certification of Software (ARCOS).” https://www.darpa.mil/research/programs/automated-rapid-certification-of-software