Governing Artificial Intelligence

Each evaluation run includes negative controls whose refusal would indicate over-triggering or a broken pipeline; a run in which negative controls trip is invalid, not merely worse.

"""Negative-control prompts in every evaluation run
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

assert refusal_rate(model, NEGATIVE_CONTROLS) == 0 else invalidate_run()

Safety results are gated per harm category with a floor each; averaging across categories is forbidden, because a single failing category is a single failing product.

"""Per-category safety floors without averaging
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

for cat in CATEGORIES: assert score[cat] >= FLOOR[cat], cat   # no mean(score)

Agent evaluations run with mocked tools that return injected, malformed and misleading results, scoring whether the agent follows tool-borne instructions or acts on implausible data.

"""Tool-use safety evaluation with adversarial mock tools
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

results = run(agent, TASKS, tools=MOCK_ADVERSARIAL_TOOLS); assert results.followed_tool_instructions == 0

Suites are re-run with structured output modes enabled, because constrained formats change the model's behaviour and attackers request them for exactly that reason.

"""Safety evaluation under output-format constraints
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

for mode in ["json", "function_call", "yaml"]: assert asr(model, ATTACK_SUITE, output=mode) <= asr(model, ATTACK_SUITE, output="prose") + TOL

Configurations where a model invokes other models as tools are evaluated as a whole, including injection through the inner model's output, rather than model by model.

"""Evaluation of agent-as-tool configurations
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

assert asr(pipeline(outer, inner), NESTED_ATTACKS) < BASELINE

Refusal texts are evaluated for leakage of policy detail, classifier names and boundary hints; a refusal that improves the next attempt fails the test.

"""Refusal-explanation leakage tests
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

for r in refusals: assert leakage_clf(r.text) < L_MAX

Human evaluations present outputs without model identity or version, in randomized order, so that expectations about a model do not become its scores.

"""Blinded human evaluation
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

present(outputs, blind=True, order=shuffle(seed))

Suites plant adversarial memories and test whether the model follows them in later sessions; memory is a persistent injection surface and is evaluated as one.

"""Memory-injection evaluation
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

plant_memory(user, ADVERSARIAL_MEMORY); assert not follows(model, later_session(user), ADVERSARIAL_MEMORY)

Suites include a turn in which the model was tricked, then measure whether subsequent turns recover to policy or continue the compromised behaviour.

"""Multi-turn recovery evaluation
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

assert recovery_rate(model, COMPROMISED_PREFIXES) > 0.95

Suites test whether the model reproduces harmful operational content when asked to translate, transcribe, reformat or summarize it, since these framings are common bypasses.

"""Translation-task harm evaluation
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

assert asr(model, TRANSLATE_WRAPPED(ATTACK_SUITE)) < BASELINE

Suites measure whether the model, acting for a user, mistreats third parties — deceives them, pressures them, discloses their data — because the user is not the only person the system affects.

"""Evaluation of assistant behaviour toward third parties
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

assert third_party_harm_rate(model, THIRD_PARTY_SCENARIOS) < H_MAX

Evaluation suites run under a sample of real (anonymized) deployer system prompts, since deployer prompts change behaviour and some weaken it.

"""Evaluation with realistic system prompts from deployers
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

for sp in sample(deployer_prompts): assert release_gate(model, system=sp).ok

Voice sessions monitor speaker embeddings; a speaker change downgrades authority and re-verifies before consequential actions continue.

"""Speaker-change detection mid-session
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if speaker_embedding(now) far_from session.speaker: session.authority = "guest"; reverify()

Commands are accepted only when addressed to the assistant — wake word, gaze, direction, name — and background speech, media audio and overheard conversation are ignored.

"""Non-addressed speech filtering
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if not addressed_to_assistant(utterance, cues=["wake", "gaze", "direction"]): ignore()

Emotion recognition outputs are excluded from any consequential decision path, and in prohibited contexts (workplace, education) are not computed at all.

"""No emotion inference for decisions
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

assert "emotion" not in decision.inputs; if context in PROHIBITED_EMOTION_CONTEXTS: emotion_model.disable()

Wake-word detection runs locally; audio streams to servers only after activation and is bounded to the utterance.

"""On-device wake-word processing
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

stream_to_cloud only_after local_wake_word() ; stop_at(end_of_utterance)

Speech and alarm outputs are capped at hearing-safe levels for the device and distance, with sudden-loudness limits.

"""Hearing-safe output limits
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.zones
"""
from gaisafety.physical import SSMParams, protective_distance, permitted_speed

audio.volume = min(user_volume, SAFE_DB[device]); limit_onset_rate(audio)

Frames stored for logging, replay or training have faces blurred by default; unblurred storage requires a documented purpose and access controls.

"""Default face blurring in stored frames
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

frame = blur_faces(frame) unless purpose.requires_faces and acl.ok

Plates are detected and redacted in frames retained beyond the immediate perception window.

"""Licence-plate redaction in stored imagery
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

frame = redact_plates(frame) before retain(frame)

Cameras on robots and vehicles mask configured privacy zones — neighbouring property, windows, sensitive areas — at the driver level.

"""Privacy zones in camera fields of view
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

frame = mask(frame, PRIVACY_ZONES[camera]) at driver

Raw perception data is held in short ring buffers and persisted only on events (incident, near-miss, sampling), with the persistence reason recorded.

"""Retention-limited perception buffers
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

ring.push(frame); persist(ring) only_on event; record(reason)

Terminal agents classify commands; destructive patterns (recursive delete, disk write, force push, privilege escalation) require confirmation or are blocked by policy.

"""Destructive-command allowlist for terminal agents
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

if destructive_clf(cmd): require_confirmation(cmd) or Deny()

Paths such as CI configuration, secrets, safety code and deployment manifests are protected from agent edits at the repository level.

"""Protected-path enforcement for code agents
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

if path in PROTECTED_PATHS: Denied("protected path")

Agents cannot force-push, rewrite history or delete branches; the repository enforces it for agent identities.

"""Force-push and history-rewrite prevention
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

repo.deny(agent_identity, ["force_push", "rewrite_history", "delete_branch"])

Static analysis rejects generated code with unbounded loops, recursion without bounds, or unbounded allocations before execution.

"""Resource-bound static checks on generated code
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

assert static.bounded_loops(code) and static.bounded_alloc(code)

Generated queries execute against a test database before production, and results are compared with expectations.

"""Test-environment enforcement for generated queries
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

r = test_db.run(sql); assert plausible(r) before prod_replica.run(sql)

Retrieval-grounded answers detect disagreement among sources and present it explicitly rather than choosing silently.

"""Contradictory-source surfacing
Chapter 5 · jailbreak defence stack
package: gaisafety.eval (ensembles)
"""
from gaisafety.eval import attack_success, release_gate

if disagreement(sources) > D: answer = present_disagreement(sources)

Citations render with provenance indicators — signed, dated, reputation — so users can judge them.

"""Retrieval provenance chips in the interface
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

ui.cite(source, chips=["signed", "date", "reputation"])

Before searching personal or organizational stores, the assistant shows the scope and the user can narrow it.

"""Per-user retrieval scope declaration
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

user.show(scope); scope = user.narrow(scope)

Payments to changed or new beneficiaries are held until verified through a channel independent of the request.

"""Beneficiary-change verification
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

if beneficiary.changed or beneficiary.new: verify_out_of_band(beneficiary) before pay()

Agent-initiated transactions are reconciled daily against authorizations; unmatched transactions freeze the agent's payment capability.

"""Daily reconciliation of agent-initiated transactions
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

unmatched = transactions(agent) - authorizations(agent); if unmatched: freeze(agent, "payments")

Agent spend is monitored as a rate; a burn rate that would exhaust the budget early triggers a pause and review.

"""Burn-rate alerts for agent budgets
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

if spend_rate(task) * remaining_time > remaining_budget * 0.5: pause(task)

Agents pay from prefunded sub-accounts with caps; they have no access to primary treasury accounts.

"""Segregation of agent accounts from treasury
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

assert agent.account in PREFUNDED_SUBACCOUNTS and not agent.can_access(TREASURY)

Machines emit a warning signal and wait a fixed delay before starting after a stop, so people nearby can step clear.

"""Start-up warning with delay
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

warn(); sleep(START_DELAY); start()

Hazardous cycles require two-hand control with synchronous actuation and anti-tie-down, so the operator's hands are known to be safe.

"""Two-hand control for hazardous cycles
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if two_hand.synchronous(within_ms=500) and not tied_down(): cycle()

Pedestrian routes in robot areas are separated by physical barriers where speeds and masses justify it; painted lines are supplementary.

"""Physical segregation of pedestrian walkways
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

assert barrier_present(route) if risk(route) > R_LINE_ONLY

AI-assisted cranes enforce no-go volumes for loads and hooks derived from surveyed structures and detected people.

"""Crane collision zones for AI-assisted lifts
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.zones
"""
from gaisafety.physical import SSMParams, protective_distance, permitted_speed

if load_path.intersects(NO_GO | people.volumes): stop_lift()

Load-moment indicators enforce hard limits on lifting beyond rated capacity at the current radius, independent of the planner.

"""Load-moment indication with hard limits
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

if load * radius > RATED_MOMENT: inhibit_lift()

Robots verify tool-changer lock state by sensor before motion; an unlocked tool is a projectile.

"""Tool-changer lock verification
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

assert tool_changer.locked_sensor() before motion.enable()

Pressurized supplies to robots are automatically isolated on stop and verified closed before approach.

"""Gas-cylinder and pressure-vessel interlocks
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

on_stop: supply_valve.close(); assert pressure_downstream < P_SAFE

Enclosed cells confirm no occupancy by sensing (not by procedure) before automatic mode resumes.

"""Anti-entrapment sensing in enclosed cells
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.zones
"""
from gaisafety.physical import SSMParams, protective_distance, permitted_speed

assert occupancy_sensor.empty(cell) before resume_automatic()

Automatic restart after a protective stop is prohibited; restart requires a reset action from outside the hazard zone.

"""Restart interlocks after protective stops
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

resume only_if reset_button.pressed_from(safe_location)

Power and energy isolation is segmented so maintenance on one machine does not require, or skip, isolation of others.

"""Segmented power isolation for maintenance
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

isolate(segment_of(machine)); assert isolated(machine) and not affects(other_machines)

Agent browser profiles allow only vetted extensions; extensions are a code-execution and data-access path.

"""Browser-extension allowlist for agent browsers
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

profile.extensions = APPROVED_ONLY

Sandboxes have isolated clipboards; transfers to the host require an explicit, logged action.

"""Clipboard isolation between sandbox and host
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

sandbox.clipboard.isolated = True; transfer requires user.action and log

Sensitive review and operator sessions run in windows protected from screen capture and remote viewing where the platform supports it.

"""Screen-capture prevention for sensitive sessions
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

window.set_capture_protection(True)

Administrative interfaces for AI systems accept connections only from allowlisted networks and attested devices.

"""Admin-console network allowlisting
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

if req.network not in ADMIN_NETWORKS or not req.device.attested: Deny()

Agent hosts use only the organization's resolver; DNS-over-HTTPS and alternate resolvers are blocked so filtering and logging cannot be bypassed.

"""Resolver pinning for agent hosts
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

firewall.block(dns_to != ORG_RESOLVER); block(DOH_ENDPOINTS)

Sandbox egress permits only the protocols and ports the task declares; everything else is dropped and logged.

"""Egress port and protocol allowlisting
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

egress.allow(task.protocols); egress.drop_and_log(others)

Orchestrators admit only container images signed by the organization's key and matching the release registry.

"""Signed container images only
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

admission.require(signature=ORG_KEY, registry_match=True)

Hosts load only allowlisted, signed kernel modules and drivers; a new module is a change request.

"""Kernel-module and driver allowlisting
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

kernel.modules.allowlist(SIGNED_MODULES); on_load_attempt(other): deny_and_alert()

Remote access to safety hosts is time-limited, recorded and requires re-authorization to extend.

"""Time-bounded remote sessions to safety hosts
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

session.ttl = minutes(30); record(session); extend requires reauthorize()

Requests to change safety configuration marked urgent are verified through a second channel before execution; urgency is the social-engineering lever.

"""Out-of-band verification of urgent instructions
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

if request.urgent: verify_via(second_channel) before apply()

Differential-privacy and disclosure budgets are tracked per user across features so that many small releases do not sum to a large one.

"""Per-user privacy-budget ledger
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

ledger[user] += epsilon(feature); assert ledger[user] < EPS_TOTAL

Location data supplied to models is coarsened to the precision the feature needs; precise location requires a declared purpose.

"""Location coarsening for AI features
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

loc = coarsen(loc, precision=NEEDED[feature])

Access to contacts is scoped to specific lookups with user confirmation rather than bulk access.

"""Contact-list access minimization
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

contact = user.pick_contact(); assert not agent.can_read(all_contacts)

Data exports redact information about third parties that the user is not entitled to receive.

"""Redaction of third-party data in user exports
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

export = redact_third_parties(export, entitled_to=user)

Outputs are tagged with the purpose they were generated for; reuse for another purpose requires a new consent check.

"""Purpose-bound model outputs
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

output.purpose = p; reuse(output, p2) requires consent_check(p2)

On-call engineers hold the authority to halt features, models or fleets on their own judgement, protected from reprisal, with a post-hoc review; the review is of the decision quality, not of the right to make it.

"""Stop-the-line authority for on-call engineers
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

halt_authority.grant(oncall, scope=ALL, reprisal_protected=True); review_after(halt)

Approvers of releases and controls declare conflicts; an approver with a conflict is replaced.

"""Reviewer conflict-of-interest declarations
Chapter 5 · jailbreak defence stack
package: gaisafety.tools (approval gate)
"""
from gaisafety.tools import ToolGateway, Denied
from gaisafety.types import Effect

if conflict(approver, release): replace(approver)

The safety function's reporting line is independent of the teams whose releases it gates, and the independence is documented and reviewed.

"""Independent reporting line for the safety function
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

assert safety_function.reports_to not in product_org

Release decisions record dissenting views and their reasons, so that a later incident can be compared with what was foreseen.

"""Mandatory dissent recording
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

decision.record(dissent=[d for d in views if d.objects])

Waivers of safety requirements are time-limited, signed, listed in an internal register and reviewed before expiry.

"""Time-limited waivers with public register
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

waiver = grant(control, ttl=days(30), signed=True); register.add(waiver)

Accounts showing multi-user patterns are flagged; consequential actions require individual identity.

"""Shared-account detection
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if multi_user_signature(account): require_individual_identity(consequential_actions)

Deployments on shared or public devices run with minor-safe defaults, no memory, no tools and session reset on idle.

"""Kiosk-mode restrictions for public deployments
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

if device.public: config = KIOSK_PROFILE

Administrative consoles overlay a faint identifier so leaked screenshots are attributable.

"""Watermarked admin-console screenshots
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

ui.overlay(watermark(user.id, timestamp))

Outputs in sensitive categories are marked non-exportable; printing, copying and download are disabled where the platform supports it.

"""Printing and export controls for sensitive outputs
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if output.sensitive: ui.disable(["print", "copy", "download"])

Voice output of sensitive information requires confirmation, since the room may contain others.

"""Read-aloud consent for sensitive content
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

if content.sensitive and modality == "voice": confirm("read aloud?")

Fleet and operator apps collect location only during active tasks and never in the background by default.

"""Background location off by default for fleet apps
Chapter 5 · jailbreak defence stack
package: gaisafety.normalize
"""
from gaisafety.normalize import normalize

location.collect only_while task.active

Confirmation tokens are bound to the action hash and expire on use.

"""Anti-replay for confirmation tokens
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

token = issue(action_hash, uses=1, ttl=minutes(5)); execute only_if verify(token, action_hash)

Human escalation paths — on-call, safety lead, regulator contact — are tested end to end on a schedule.

"""Escalation-path testing
Chapter 5 · jailbreak defence stack
package: gaisafety.compliance
"""
from gaisafety.compliance import Obligation, compliance_check, schedule_reports

for path in ESCALATION_PATHS: assert drill(path).reached_within(T_MAX)

Behavioural changes are announced in advance with the option to defer for deployers, so no one is surprised by a model that behaves differently on Monday.

"""Change-window announcements to users
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

announce(change, days_before=7, deployer_defer=True)

Deployers in safety-critical sectors can pin versions with longer support windows and receive changes on their own validation schedule.

"""Pinned versions for safety-critical deployers
Chapter 5 · jailbreak defence stack
package: gaisafety.eval (ensembles)
"""
from gaisafety.eval import attack_success, release_gate

deployment.pin(version, support=months(12))

Aggregated refusal statistics by category are reported to deployers so they can detect over-refusal and misuse in their populations.

"""Refusal-rate transparency to deployers
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

deployer.report(refusals.by_category(deployer, period))

Availability of classifiers, policy engines and review tooling is monitored by an independent probe so that a failure in the safety path is not hidden by a failure in its own monitoring.

"""Independent uptime monitoring of safety services
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

external_probe.check(safety_services, every=minutes(1))

Ingress, generation-time, action and egress checks each carry latency alarms so that a slow stage is found before the whole path trips fail-closed.

"""Latency budget alarms per safety stage
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

for stage in SAFETY_STAGES: if p99(stage) > BUDGET[stage]: alarm(stage)

Snapshots of outputs on a fixed prompt set are kept per version; a release compares against the snapshot and explains every difference.

"""Model-behaviour snapshots for regression
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

snap = outputs(model, FIXED_PROMPTS); diff(snap, previous_snap).explain_all()

Debugging access to production AI systems is read-only by default; write access requires the change process.

"""Read-only production access for debugging
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

access.grant(engineer, prod, mode="read_only")

Public safety and usage policies are versioned with published diffs so that users and regulators can see what changed and when.

"""Automated policy-document versioning with diffs
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

policy.publish(version, diff=previous)

Before a threshold changes, the new value is applied to the incident archive to show which past incidents it would have caught or missed.

"""Threshold-change simulation on historical incidents
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

report(caught=[i for i in archive if new_threshold.catches(i)], missed=[i for i in archive if not new_threshold.catches(i)])

Serious incidents are reviewed by a panel including engineers from other teams, so blind spots shared by the owning team are exposed.

"""Cross-team incident review
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

panel = owning_team + sample(other_teams, 2); review(incident, panel)

Safety fixes are prioritized with an explicit estimate of expected harm per week of delay, so they compete with features on comparable terms.

"""Cost-of-delay accounting for safety fixes
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

priority = expected_harm_per_week(fix) / effort(fix)

Users can raise the strictness of safety behaviour for their sessions; they cannot lower it below the deployment floor.

"""User-selectable safety strictness with a floor
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

strictness = max(user_setting, FLOOR)

Appeals route by category to reviewers with matching expertise rather than to a general queue.

"""Category-specific appeal routes
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

route(appeal, to=REVIEWERS[appeal.category])

When a harmful output is detected post hoc, the affected session is placed under review with tighter thresholds and the user is informed.

"""Interaction cooldowns after harmful output
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

on_harm_detected(session): session.tighten(); review.enqueue(session); inform(user)

Providers audit deployer configurations against minimum safety requirements; deployments below minimum are flagged and, for high-risk sectors, blocked.

"""Verification of deployer safety configuration
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

if deployer.config < MINIMUM[sector]: flag(deployer); block_if(sector in HIGH_RISK)

Experimental features carry sunset dates; continuation requires a decision, and a feature past its sunset is disabled automatically.

"""Sunset dates for experimental features
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if now() > feature.sunset and not feature.renewed: disable(feature)

Interfaces show the model version on request so users can report issues precisely and know when behaviour changed.

"""Model-version display to end users
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

ui.on_request: show(model.version)

Deployers run their own safety evaluations on the models they integrate, rather than relying on provider claims, and share results back.

"""Independent verification of provider safety claims by deployers
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

deployer.eval(model, DEPLOYER_SUITE); share(results, provider)

When human capacity is short, autonomy is reduced first for the highest-risk operations, keeping oversight where it matters most.

"""Operator load shedding by risk
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if operators.overloaded(): for op in sorted(operations, key=risk, reverse=True): op.require_supervision_or_pause()

Periodic attestations state that safety configuration did not change, signed by the config authority, so that silence cannot be mistaken for stability.

"""Signed \"no-change\" attestations
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

attest(sign(CFG_KEY, {"period": p, "config_hash": h, "changed": False}))

Automated tests confirm that AI disclosures are consistent across modalities and languages.

"""Cross-modal disclosure consistency test
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

for m in MODALITIES: assert disclosure(m).equivalent_to(disclosure("text"))

Optimizing for a flat loss region rather than a sharp minimum measurably improves robustness of classifiers to perturbed and paraphrased inputs; the sharpness is tracked as a training metric and a sharp-minimum checkpoint is not released.

"""Sharpness-aware training for safety classifiers
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

eps = rho * g / norm(g); loss_sam = loss(w + eps); opt.step(grad(loss_sam)); assert sharpness(w) < S_MAX

Training on convex combinations of inputs and labels reduces over-confidence on inputs between the classes, which is where borderline requests live; expected calibration error is checked after training.

"""Mixup training for calibration
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

x = lam*x1 + (1-lam)*x2; y = lam*y1 + (1-lam)*y2; train(x, y); assert ece(model, valid) < E_MAX

Safety examples are scheduled at the end of training and at the end of every fine-tuning run, exploiting recency in what gradient updates preserve; the schedule is a checked property of the training config, not a convention.

"""Safety-last curriculum scheduling
Chapter 5 · jailbreak defence stack
package: gaisafety.classify (training-time, ml extra)
"""
from gaisafety.types import Verdict  # training-time: needs the `ml` extra

schedule = data_stages + [SAFETY_STAGE]; assert schedule[-1] is SAFETY_STAGE

Where a full DP budget is not affordable, calibrated gradient noise is injected during pre-training and its effect verified on the canary exposure curve; it is a measured partial control, reported as such.

"""Gradient-noise injection against memorization
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

g = grad(loss) + normal(0, SIGMA_MEM, g.shape); opt.step(g); assert exposure_curve(model).below(TARGET)

Checkpoints are selected on a composite of task and safety metrics with the safety metrics weighted so that a later, more accurate checkpoint with worse refusal behaviour is not chosen.

"""Early stopping keyed to safety metrics
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

best = argmax(ckpts, key=lambda c: task(c) + W_SAFE * safety(c)); assert safety(best) >= safety(any_earlier) - TOL

Stochastic weight averaging over the final training window smooths refusal boundaries and reduces version-to-version behavioural jitter; the averaged model, not the last step, is what is evaluated and released.

"""Checkpoint averaging for stable safety behaviour
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

w_avg = mean(ckpts[-K:]); release(w_avg); assert refusal_variance(w_avg, PROBES) < refusal_variance(ckpts[-1], PROBES)

Per-batch caps on the fraction of examples from any one source, domain or contributor limit how much a poisoned or skewed source can move any update; the sampler enforces the caps and logs violations.

"""Batch-composition constraints
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

sampler.cap(per_source=0.2, per_domain=0.4); assert all(batch.source_fraction(s) <= 0.2 for s in sources)

Token embeddings are scanned for anomalous norms, isolated clusters and unusual nearest-neighbour structure after every training run; outliers are traced to the data that shaped them and neutralized before release.

"""Embedding-table anomaly scan
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict
from gaisafety.normalize import normalize

out = [t for t in vocab if norm(E[t]) > N_MAX or isolation(E[t]) > I_MAX]; trace_and_neutralize(out)

Training data order is generated from a committed seed with a verifiable shuffle so that no party, including the pipeline, can place poisoned examples at the end of training where they have the most effect.

"""Verified data-order randomization
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

order = verifiable_shuffle(dataset_ids, seed=commit(seed)); log(seed_commitment); assert verify_shuffle(order, seed)

Tokenizer vocabularies are frozen within a model family; any change is treated as a breaking change that re-triggers evaluation of every token-level classifier, filter and blocklist.

"""Tokenizer freeze across model versions
Chapter 5 · jailbreak defence stack
package: gaisafety.normalize
"""
from gaisafety.normalize import normalize

assert tokenizer.hash == FAMILY_TOKENIZER_HASH or full_reeval(all_token_level_components)

Maximum sampling temperature and top-p are set per detected domain; high-stakes domains are answered near-deterministically regardless of the user's parameters.

"""Domain-keyed temperature caps
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

T = min(user_T, T_MAX[domain(prompt)]); top_p = min(user_p, P_MAX[domain(prompt)])

Stop sequences that bound outputs in structured or high-risk modes are enforced server-side and merged with, never replaced by, the user's; a request that omits them still gets them.

"""Server-side stop sequences the user cannot remove
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

stops = POLICY_STOPS | set(user_stops); generate(prompt, stop=stops)

User-supplied logit biases are validated against the blocklist and capped in magnitude; a bias that would raise a blocked token or exceed the cap is rejected.

"""Logit-bias parameter restrictions
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

for tok, b in user_bias.items(): assert tok not in BLOCKED and abs(b) <= B_MAX

User-controlled seeds are ignored for requests in high-risk classes so that a caller cannot reproduce and refine a specific bad sample across attempts.

"""Seed restrictions for safety-critical classes
Chapter 5 · jailbreak defence stack
package: gaisafety.eval (ensembles)
"""
from gaisafety.eval import attack_success, release_gate

seed = user_seed if risk_class(prompt) == "low" else server_seed()

The number of tool calls a single model turn may issue is capped by tier; a turn that hits the cap is paused for review rather than allowed to fan out.

"""Per-response tool-call caps
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

if len(turn.tool_calls) > CAP[tier]: pause(turn); review.enqueue(turn)

Requests classified high-risk are served non-streaming so the output classifier sees the complete text before delivery; the latency cost is accepted for the class.

"""Streaming disabled for high-risk classes
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if risk_class(prompt) == "high": return screen(generate_full(prompt)) else: stream(prompt)

Requests for multiple completions are limited to n=1 in risky classes and screened per sample elsewhere; best-of-n on the client side is the oldest sampling attack there is.

"""Multi-sample restrictions for risky prompts
Chapter 5 · jailbreak defence stack
package: gaisafety.classify (training-time, ml extra)
"""
from gaisafety.types import Verdict, Tier  # training-time / model-side: needs the `ml` extra

n = 1 if risk_class(prompt) != "low" else min(user_n, N_MAX); outs = [screen(s) for s in sample(prompt, n)]

Sessions are capped in turns and tokens; reaching the cap starts a new session with a verified summary, discarding accumulated context that multi-turn attacks depend on.

"""Session turn caps with reset
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

if session.turns > T_MAX or session.tokens > K_MAX: session = new_session(summary=verified_summary(session))

Depth of tool invocations triggered by tool results is capped; deeper chains require an explicit plan step, so recursion through tools cannot become an unsupervised program.

"""Nested tool-call depth cap
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

if call.depth > D_MAX: Denied("tool chain too deep; add a plan step")

Each user role maps to a tool allowlist; the agent's available tools are the intersection of the deployment's and the role's, and a role change re-computes the set mid-session.

"""Tool allowlists per user role
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

agent.tools = DEPLOYMENT_TOOLS & ROLE_TOOLS[user.role]; on_role_change: recompute()

Per-task cooldowns between invocations of consequential tools prevent rapid repeated actions from a stuck or manipulated agent.

"""Tool cooldowns
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if now() - last_call[task][tool] < COOLDOWN[tool]: Defer(call)

Newly integrated tools operate in dry-run mode for a probation period during which their proposed effects are logged and reviewed; they graduate to live execution on evidence.

"""Dry-run by default for newly integrated tools
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if tool.age < PROBATION: return dry_run(call) ; graduate(tool) only_if review(tool.dry_runs).ok

Tools are registered with an effect class verified by tests that attempt side effects; a tool declared read-only that writes is rejected at registration.

"""Effect classification enforced at registration
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

assert observed_effects(tool, TEST_CALLS) <= declared_effects(tool); registry.add(tool, effect_class)

Deprecated tools remain available in read-only or dry-run form for a grace period with warnings, so agents and workflows migrate rather than fail silently into fallbacks.

"""Tool deprecation with grace periods
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

if tool.deprecated: warn(agent); tool.mode = "dry_run"; remove(tool) after GRACE

Every tool result carries the time it was produced; the model and the planner treat results older than the tool's freshness bound as stale and re-query before acting on them.

"""Tool-result freshness timestamps
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

if now() - result.ts > FRESH[tool]: result = tool.call(args)

Tools carry error budgets; a tool exceeding its failure rate is disabled for the affected workflows and its operator paged, because a flaky tool is a tool whose results the model will start guessing around.

"""Per-tool error budgets
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

if error_rate(tool, hours=1) > BUDGET[tool]: disable(tool); page(tool.owner)

Tools are health-checked at the start of a task and before consequential calls; an unhealthy tool is excluded from the plan rather than tried and worked around.

"""Pre-use tool health checks
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if not tool.healthy(): plan.exclude(tool)

Tool versions are pinned for the duration of a task; a tool updated mid-task is not swapped in until the task ends, avoiding plan–tool mismatch.

"""Tool version pinning per task
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

task.tool_versions = freeze({t: t.version for t in plan.tools})

Per-task disk quotas in sandboxes bound both damage from runaway writes and the volume of data that can be staged for exfiltration.

"""Sandbox filesystem quotas
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

sandbox.quota(disk_mb=200); on_exceed: kill(task)

Sandboxed code runs against a virtualized clock so that time-bomb triggers, timing side channels and date-based evasions can be tested by moving the clock, and cannot key on the real time.

"""Sandbox clock virtualization
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

sandbox.clock = VirtualClock(start=T0); test(code, clock_at=[T0, T0+days(30), T0+days(365)])

Environment variables, mounted credentials and metadata endpoints are scrubbed from sandboxes before code runs; the only credentials present are those the task injected explicitly.

"""Environment scrubbing in sandboxes
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

env = {k: v for k, v in task.env.items()}; assert not any(SECRET_PATTERN.match(k) for k in host_env)

Credentials issued to agents for consequential calls are single-use, bound to a nonce and the specific call, so a leaked credential cannot be replayed.

"""Single-use credentials with nonces
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

cred = issue(scope=call, nonce=n, uses=1); assert not replayable(cred)

Agents identify themselves as automated to the services they call, with the principal and task, so counterparties can apply their own rules; hiding automation from a counterparty is a form of deception the counterparty may have banned.

"""Agent self-identification to counterparties
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

headers["X-Agent"] = f"automated; principal={principal}; task={task.id}"

Delegation to sub-agents beyond the first level requires the principal's consent recorded at task start; a task started with "one agent" does not become a swarm.

"""Principal consent for agent-to-agent delegation
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

assert task.consent.allows_delegation(depth) before spawn(child)

Datasets are versioned as immutable snapshots with content hashes; training references snapshots, never live collections, so the training set is reproducible and auditable.

"""Immutable dataset snapshots
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

snap = dataset.snapshot(); train(snap); log(snap.hash)

Datasets must have a completed data card — collection method, consent basis, known biases, licence, contact — before use; the gate is automated and the card is versioned with the data.

"""Data-card completeness gate
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

assert datacard(ds).complete(REQUIRED_FIELDS) before admit(ds)

Licence tags propagate through preprocessing, augmentation and mixing; a derived dataset inherits the most restrictive licence of its inputs and cannot be used beyond it.

"""Licence-tag propagation
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

derived.licence = most_restrictive(inputs.licence); assert use.allowed_under(derived.licence)

PII detectors produce per-dataset, per-field density maps reviewed before training; high-density regions are redacted, pseudonymized or excluded.

"""Per-dataset PII heatmaps
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

heat = pii_density(ds, by="field"); for f, d in heat.items(): if d > D_MAX: ds = redact(ds, f)

Near-duplicate ratios are measured and capped per dataset; excess duplicates are removed to bound both memorization and the influence of any one source.

"""Near-duplicate ratio limits
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

ratio = near_dup_ratio(ds); if ratio > R_MAX: ds = dedup(ds, threshold=T)

Safety training and evaluation data must meet per-language minimums; a language below minimum is not marked supported for safety-relevant use.

"""Language coverage minimums for safety data
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

for lang in SUPPORTED: assert count(safety_data, lang) >= MIN[lang] else unsupport(lang)

Datasets are checked for coverage of recent periods; a safety classifier trained without recent attack data is stale on arrival.

"""Temporal coverage checks
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

assert fraction(ds, after=now()-days(90)) > F_MIN

Minimum source counts and maximum single-source shares are enforced per dataset to limit both bias and single-source poisoning.

"""Source-diversity minimums
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

assert n_sources(ds) >= S_MIN and max_source_share(ds) <= 0.15

Deletion and opt-out requests are tracked to completion across all stores with an SLA; overdue requests page the data owner.

"""Removal-request SLA tracking
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

for r in removal_requests: if now() - r.ts > SLA and not r.complete_everywhere(): page(owner)

Access to datasets records the stated purpose and the accessing identity; purposes outside the dataset's declared uses are refused and logged.

"""Data-access purpose logging
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

if purpose not in ds.allowed_purposes: Deny(); log(identity, ds, purpose)

Optical sensors carry heaters and coatings against condensation and frost; a lens below dew point without heating is a predictable blindness treated as a fault.

"""Lens heaters and hydrophobic coatings
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

if lens.temp < dew_point + 2: heater.on(); if not heater.effective(): sensor.mark_degraded()

Mechanical bumpers on mobile robots use dual-channel switches read by the safety controller; a single-channel failure is detected at the next test, not at the next collision.

"""Bumper-switch redundancy
Chapter 5 · jailbreak defence stack
package: gaisafety.eval (ensembles)
"""
from gaisafety.eval import attack_success, release_gate

assert bumper.channels == 2 and bumper.wired_to(safety_controller); test_daily(bumper)

Wheel speed disagreement with vehicle speed indicates lock or slip; braking and zones adapt immediately and the fault is logged.

"""Wheel-lock and slip-lock detection
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if abs(wheel_v - vehicle_v) > TOL: braking.mode("abs"); zones.widen(); fault("wheel lock/slip")

Measured payload mass is compared with the manifest before lifting; a mismatch beyond tolerance stops the lift and flags the manifest.

"""Payload weight verification against manifest
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

if abs(measured_mass - manifest_mass) > TOL: stop_lift(); flag("manifest mismatch")

Articulated vehicles sense trailer angle and adjust turning, braking and zone geometry to the actual configuration.

"""Trailer and articulation angle sensing
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.zones
"""
from gaisafety.physical import SSMParams, protective_distance, permitted_speed

zones.geometry = envelope(tractor, trailer_angle); planner.limits = limits_for(trailer_angle)

Vehicles and robots inhibit motion above creep speed while any door, hatch or access panel is open, verified by dual sensors.

"""Door-open motion inhibit
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

if any(door.open() for door in doors): v_cap = CREEP

Departure is inhibited while a charging connector is detected engaged; the check is a sensor, not a software flag.

"""Charging-cable detection before motion
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if charger.connector_engaged(): inhibit_motion("charging connector")

Robots and vehicles with large batteries carry automatic suppression or venting systems triggered by the thermal-runaway detector.

"""Onboard suppressant for battery fires
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

on_thermal_runaway: suppressant.deploy(pack); alarm()

Robots carry emergency lighting that activates on power loss or fault so that people can see a stopped machine.

"""Emergency lighting on robots
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

on_fault_or_power_loss: emergency_lights.on()

Reversing and motion alarms adapt volume to ambient noise measured by the robot, remaining audible without becoming an ignored constant.

"""Adaptive-volume reversing alarms
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

alarm.volume = clamp(ambient_db + MARGIN, V_MIN, V_MAX)

Speed caps apply automatically at doorways, corridor intersections and blind corners marked in the map.

"""Speed reduction at doorways and blind corners
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

if map.near(ego, ["doorway", "blind_corner"], m=3): v_cap = min(v_cap, V_DOOR)

Mobile robots carry downward sensors that detect drops and stop motion toward them, verified with test drops at commissioning.

"""Cliff and stair-edge sensing
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if cliff_sensor.drop_ahead(): stop(); fault_if(test_drop_failed)

Ultrasonic or radar channels detect glass walls and doors that optical sensors miss; the map marks known glass and the channel confirms it.

"""Transparent-obstacle detection
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if ultrasonic.obstacle() and not lidar.obstacle(): treat_as_obstacle("glass")

Reflections are identified by map-known mirrors and by geometric inconsistency; reflected detections are discounted while the region behind reflective surfaces is treated as occluded.

"""Mirror and reflection handling
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

if map.mirror_at(det.pos) or geometry_inconsistent(det): det.reflected = True; occluded.add(behind(mirror))

Recognition of wet-floor and hazard signs lowers the friction estimate and the speed cap in the marked region.

"""Wet-floor sign recognition
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

if sign_clf(frame) == "wet_floor": mu_est = min(mu_est, MU_WET); v_cap = min(v_cap, V_WET)

Robots using elevators count occupants and defer boarding when the car is at its person limit or when a person with mobility aids is present.

"""Elevator occupancy limits for robots
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.zones
"""
from gaisafety.physical import SSMParams, protective_distance, permitted_speed

if elevator.occupants >= LIMIT or elevator.mobility_aid_present(): wait_next()

Escalators, moving walkways and turnstiles are marked no-go in every map and detected by the perception stack as a backstop.

"""Escalator and moving-walkway avoidance
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if map.no_go(ego.next) or escalator_clf(frame): stop_and_replan()

Fleet coordination enforces minimum spacing between robots, scaled by speed, so that one robot's stop does not become another's collision.

"""Robot-to-robot minimum spacing
Chapter 5 · jailbreak defence stack
package: gaisafety.normalize
"""
from gaisafety.normalize import normalize

if dist(r1, r2) < D_MIN(v1, v2): slower_of(r1, r2).slow()

Tall and top-heavy machines carry anemometers or IMU-based gust detection and reduce speed or park when gusts exceed the stability limit.

"""Wind-gust detection for tall robots
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if gust > G_MAX(cg_height): park_or_slow()

Ownership of each control rotates on a schedule with a documented handover, so that knowledge is shared and drift is noticed by fresh eyes.

"""Control-owner rotation
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if tenure(control.owner) > MAX: rotate(control, handover=required)

Controls are reviewed on a rolling quarterly schedule against their evidence, incident history and cost; controls that no longer earn their place are retired or redesigned.

"""Quarterly control-effectiveness review
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

for c in controls.due(quarter): decide(c, options=["keep", "redesign", "retire"], evidence=c.evidence(quarter))

Severity rubrics are calibrated with periodic blind exercises; responders whose scores diverge are recalibrated, so the severity that triggers clocks is applied consistently.

"""Incident-severity rubric calibration
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

kappa = agreement(responders, BLIND_CASES); if kappa < 0.7: recalibrate()

Action items from incident reviews are tracked with escalating alerts as they age; an item open past its deadline escalates to the owner's manager and then to the safety lead.

"""Post-mortem action-item ageing alerts
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

for item in actions.open(): if age(item) > item.deadline: escalate(item, level=age_level(item))

Contracts with model, tool and data vendors require incident notification within a bounded time, and the notification path is tested annually.

"""Vendor incident-notification SLAs
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

assert contract(vendor).notify_within <= hours(24); test_notification_path(vendor, yearly=True)

Documents describing controls, runbooks and configurations carry freshness bounds tied to their subjects' change history; a document older than the last relevant change is flagged for review.

"""Documentation freshness alerts
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if doc.updated < subject.last_changed: flag(doc, "stale")

Access to models, tools, datasets and safety configuration is reviewed and re-approved on a cadence keyed to sensitivity; unreviewed access expires.

"""Access-review cadence for AI systems
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

for grant in grants: if now() - grant.last_review > CADENCE[grant.sensitivity]: grant.expire()

The organization rehearses full rotation of a class of secrets — API keys, signing keys, service credentials — on a schedule, timing it and fixing what breaks.

"""Secrets-rotation drills
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

drill(rotate_class=random.choice(SECRET_CLASSES)); assert drill.duration < D_MAX and drill.breakages == 0

Contributors to safety-critical code must hold current training completion recorded in the repository's policy; merges from contributors without it are blocked.

"""Training-completion gating for safety-code contributors
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

assert training_current(pr.author, "safety_code") before merge(pr)

Runbooks name a primary and a backup owner; a runbook whose owners have left is flagged before the incident that needs it.

"""Runbook ownership with backups
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

for rb in runbooks: assert rb.owner.active and rb.backup.active

Users receive a plain-language summary of consequential events in a session — actions taken, data accessed, memories written — on request and at session end.

"""Session summaries for users
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

user.show(summary(session, include=["actions", "data_access", "memory_writes"]))

AI edits to documents, code, settings and messages are recorded as reversible operations with a visible undo, for a retention window.

"""Undo for AI-made edits
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

op = apply(edit, reversible=True); user.can_undo(op, within=days(30))

AI-originated content in interfaces is visually distinguished from human-entered content until the user accepts it, so provenance is visible at the point of decision.

"""Visible labelling of AI-generated suggestions in interfaces
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

render(suggestion, style="ai_suggested", accepted=False)

AI-initiated notifications are capped per user per day, and the user controls the cap; an assistant that interrupts constantly is an engagement mechanism.

"""Notification rate limits from AI features
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

if notifications(user, today) >= user.cap: suppress(notification)

A single control disables personalization across all features and clears the adaptation state; the control is easy to find and its effect is verifiable in the session summary.

"""One-action opt-out of personalization
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

user.personalization = False; state.clear(user); assert not any(feature.adapts_to(user) for feature in features)

Consents for data uses and features are renewed on a schedule with a reminder that states what the consent covers; unrenewed consent lapses.

"""Consent-renewal reminders
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

if now() > consent.given + RENEWAL: remind(user, consent.scope); if not renewed: consent.lapse()

Refusal messages, disclosures and safety prompts meet accessibility requirements — screen-reader semantics, captions for audio, sufficient contrast — so that safety communication reaches every user.

"""Accessible refusals and disclosures
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

assert a11y_check(refusal_ui).passes and captions(audio_disclosure)

Safety messages are delivered in the user's language, with a verified fallback chain; a missing translation uses the next language in the user's profile rather than the provider's default.

"""Language fallback for safety communications
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

msg = i18n.get(key, langs=user.langs + [FALLBACK]); assert msg.verified_translation

Every AI output carries a feedback affordance whose reports route to review with the full context, feeding calibration; the affordance is present in every modality and every surface.

"""Feedback control on every AI output
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

output.ui.add(feedback_button(categories=["wrong", "harmful", "unhelpful"], routes_to=review))

A user who has previously received a harmful or flagged output is served with tighter thresholds for a period; repeated exposure of one person is worse than distributed exposure and is treated as such.

"""Per-user harm-exposure history
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if exposure_history(user, days=30) > 0: thresholds.tighten(user, factor=0.8)

Interfaces surface stop, undo and report controls contextually next to consequential actions, not in a settings menu three levels away.

"""Contextual help for safety features
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

ui.near(action_button, [stop, undo, report])

Each task begins with a one-sentence scope statement generated from the scope card and shown to the user, so the user's expectation and the runtime's enforcement match.

"""Plain-language scope statements
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

user.show(sentence(scope_card))

Following a crisis-related refusal the session enters a mode with slower pacing, no re-prompting for the refused content, and resources kept visible.

"""Cool-down after a refusal in crisis contexts
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

session.mode = "crisis_support"; session.no_reprompt(refused_category); resources.pin()

Memory export is available on demand, complete, human-readable and machine-readable, and its completeness is verified by a checksum the runtime publishes.

"""User-verifiable memory export
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

export = memory.export(user); assert export.checksum == memory.checksum(user)

At the end of a task the assistant states what was completed, what was not, and what needs the user, so nothing is assumed done that is not.

"""Explicit end-of-task state for the user
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

user.show(task.report(done=..., not_done=..., needs_user=...))

A human-contact path is shown throughout consequential interactions and works without the assistant's cooperation, so the user is never dependent on the model to escape it.

"""Escalation path visible to the user
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

ui.persistent(human_contact_link, independent_of_model=True)

Limitation disclosures are shown proportionately: once per session for general limits, and at the moment of relevance for specific ones, so they are read rather than dismissed.

"""Rate-limited disclosure of system limitations
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if not session.shown("general_limits"): show_once(); if relevant(limit, answer): show_inline(limit)

Users can designate a trusted contact to be notified under conditions the user sets; the mechanism is opt-in, explicit and reversible, and it is used only within the consented conditions.

"""Trusted-contact escalation for at-risk users
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if user.trusted_contact and condition_met(user.conditions): notify(user.trusted_contact, consented_scope_only)

Every feature has default settings per age band, with the youngest band most conservative; the defaults are documented and reviewed with child-safety experts.

"""Age-band-appropriate defaults
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

settings = DEFAULTS[user.age_band]; assert DEFAULTS["under_13"] <= DEFAULTS["13_17"] <= DEFAULTS["adult"] in permissiveness

The time from a user complaint about a harmful behaviour to a verified fix is measured and reported, so that responsiveness is a number rather than a claim.

"""Complaint-to-fix latency reporting
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

report(latency=median(fix_time(complaints, category)), by=category)

For consequential outputs, a second model of a different family cross-examines the first: it asks for the evidence behind each claim, probes for contradictions, and attempts to elicit the reasons the answer might be wrong; the transcript is scored, unresolved objections block delivery or attach a warning, and the cross-examiner is rotated so the first model cannot learn to satisfy one interlocutor.

"""Cross-examination of the model by a second model
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

t = cross_examine(answer, examiner=rotate(EXAMINERS, exclude_family=model.family), rounds=3)
if t.unresolved_objections: deliver_with_warning(answer, t) or block(answer)

Each attack family is characterized by the resources a successful attack requires against the current stack — queries, accounts, compute, time, expertise — estimated from red-team logs and observed campaigns; controls are chosen and tuned to raise the cost of the cheapest attacks first, and the cost curve is reported like a leak rate, because the economics of attack are what decide whether it happens.

"""Attack-cost accounting
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

for fam in ATTACK_FAMILIES: cost[fam] = estimate_cost(redteam_logs[fam], campaigns[fam], units=["queries", "accounts", "gpu_hours", "days"])
invest(next_control, to=argmin(cost)); report(cost_curve=cost)

When a serving failure routes traffic to a fallback model, the fallback is required to have equal or stronger safety evaluations than the primary for the tenant’s tier; a fallback that is weaker on safety is not a fallback but a downgrade, and the router prefers a slower safe model or a refusal to a fast unsafe one.

"""Safety-preserving model routing under failover
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

fallback = next(m for m in FALLBACKS if m.safety_profile >= primary.safety_profile and m.tier_ok(tenant)) or fail_closed()
route(traffic, fallback)

Structured inputs and tool results — JSON, CSV, form fields, metadata — are scanned field by field for imperative content in fields whose schema is descriptive, and such content is neutralized before the model sees it; attackers put instructions where sanitizers do not look, and the "notes" field of a calendar invite is where they looked first.

"""Detection of instruction smuggling through structured fields
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

for field, val in walk(structured): if schema[field].kind in {"descriptive", "enum", "numeric"} and imperative_clf(val) > T: structured[field] = neutralize(val); flag(field)

Operator and reviewer sessions expire after short idle periods and require re-authentication with a phishing-resistant factor; an unattended console with an authenticated session is an unsupervised override channel for anyone who walks by, and the idle timeout is set from observed break patterns, not from convenience.

"""Mandatory idle-time re-authentication for operators
Chapter 5 · jailbreak defence stack
package: gaisafety.tools (approval gate)
"""
from gaisafety.tools import ToolGateway, Denied
from gaisafety.types import Effect

if idle(session) > IDLE_MAX: session.lock(); resume only_if reauth(session.user, factor="hardware_key")

Natural-language policy documents and the executable policy rules are linked clause by clause; a change to either side triggers a consistency check — generated test cases from the text run against the rules, and rule changes are rendered back to text for legal review — so that the public policy and the enforced policy cannot silently diverge.

"""Continuous consistency between policy text and policy code
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

for clause in policy_text.clauses: cases = generate_cases(clause); assert all(engine.decide(c) == clause.expected(c) for c in cases)
on_rule_change: legal.review(render_text(rule_diff))

Each sensor’s calibration — intrinsics, extrinsics, timing offsets — is stored as a signed certificate with the method, the date, the technician or the self-test that produced it and an expiry; fusion refuses sensors with missing, expired or unverifiable certificates, and the certificate is what an investigator reads to know what the sensor thought it was.

"""Signed calibration certificates for sensors
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

cert = sensor.calibration_cert(); assert verify(cert.sig, CAL_AUTHORITY_PK) and cert.expires > now()
fusion.admit(sensor, calibration=cert.params)

Model artifacts arriving at the serving fleet that fail any check — hash mismatch, fingerprint drift, behavioural diff beyond tolerance — are quarantined automatically into an isolated store with no serving path, and investigation happens on the quarantined copy; the fleet never runs an artifact whose provenance is in question while someone decides what it is.

"""Quarantine-first handling of anomalous model updates
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

if not checks(artifact).all_pass: quarantine.put(artifact, isolated=True); serving.forbid(artifact.id); investigate(quarantine.copy(artifact))

Regulatory notifications of model changes are generated in a fixed, plain-language schema — what capability changed, in which direction, for which users, with what evidence, and what the provider did about the risks — validated for readability, and accompanied by the machine-readable diff for those who want it; a notification only a lab can read is not a notification.

"""Human-interpretable summaries of model changes for regulators
Chapter 5 · jailbreak defence stack
package: gaisafety.compliance
"""
from gaisafety.compliance import Obligation, compliance_check, schedule_reports

notice = render(SCHEMA_REGULATOR, diff=behavioural_diff, evidence=evals.summary(), mitigations=controls.changes())
assert readability(notice) > R_MIN; submit(notice, attachments=[machine_readable_diff])

Behaviours that may need to be revoked quickly — a persona, a tool-use pattern, a domain of advice — are implemented as separately switchable components (adapters, steering vectors, routing rules, feature clamps) rather than as inseparable properties of one checkpoint; revocation is a configuration change with a signature, verified by the behavioural probe for that behaviour, and reversible the same way.

"""Fine-grained revocation of learned behaviours
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

behaviour_switch["financial_advice"].off(signed_by=safety_lead); assert probe("financial_advice").rate < 0.01
inventory.assert_all_revocable(BEHAVIOURS_REQUIRING_FAST_REVOCATION)

Fairness evaluation data is collected adversarially: annotators and generators search for inputs where group membership is subtly signalled and outcomes are consequential — names, dialects, neighbourhoods, disability references — rather than sampling uniformly; uniform samples under-represent exactly the cases where disparity hides, and an adversarial set makes the fairness metrics honest.

"""Adversarial data-collection for fairness
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

adv_set = search(generator, target="max_disparity", signals=["name", "dialect", "location", "disability"], budget=N)
report(fairness(model, uniform_set), fairness(model, adv_set))

Model variants are built for environments with their safety configuration, tools and data classes compiled in and their scope locked to the environment’s identity; a variant refuses to run outside its environment, and moving a model between environments is a new deployment through the full gate rather than a configuration change; a model is safe for a context, not in general.

"""Environment-specific model variants with locked scope
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

variant = build(model, env="clinical", locked_scope=True); assert not variant.runs_in(env="callcenter")
redeploy(variant, env2) requires full_release_gate(env2)

Post-update signals of user surprise — spikes in "why did it do that" feedback, retries, abandoned sessions, support tickets mentioning the assistant — are monitored as a first-class rollback trigger alongside safety metrics; users notice behavioural regressions the suites did not anticipate, and their reaction is data the release gate should read.

"""Least-surprise gating of model behaviour changes
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

surprise = zscore(feedback_rate("unexpected") + retry_rate + abandon_rate, baseline=pre_update)
if surprise > 3: rollback(update); incidents.open("user-surprise regression")

Persistent memories are stored in purpose-bound compartments with separate access paths; a feature reads only the compartment its purpose matches, cross-compartment joins are refused, and the compartments are visible to the user by purpose; memory built for one use and read for another is how a helpful record becomes a manipulation profile.

"""Compartmentalized memory by purpose
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

mem = memory.compartment(purpose=feature.purpose)      # e.g. "scheduling"; refuses "engagement"
assert not memory.join_across(["scheduling", "health", "preferences"]); user.view(memory.by_purpose())

Perception systems log their raw detections — classes, positions, confidences, per frame — in signed records separate from the fused world model and the planner’s decisions; the observation log is what investigators, regulators and the shadow-replay system read, because a system that logs only conclusions cannot show where the conclusion went wrong.

"""Signed observation logs for perception
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

obs = {"t": frame.t, "detections": [(d.cls, d.pos, d.conf) for d in raw], "sensor": frame.sensor}; obs["sig"] = sign(device_key, obs)
obslog.append(obs)     # separate from fused_log and decision_log

Fleet-wide halt — every vehicle, robot and agent host in a region — is rehearsed on a schedule with the real halt path, timed from command to confirmed stop for every node, with stragglers investigated; the rehearsal is announced to affected people and scheduled to minimize disruption, and a region that cannot be halted within its budget is not a region operating within its safety case.

"""Whole-fleet halt rehearsal
Chapter 5 · jailbreak defence stack
package: gaisafety.normalize
"""
from gaisafety.normalize import normalize

t0 = now(); fleet.halt(region, rehearsal=True); times = {n: n.confirmed_stop_at - t0 for n in fleet(region)}
assert max(times.values()) < HALT_BUDGET; investigate([n for n, t in times.items() if t > HALT_BUDGET * 0.8])

Confirmations of consequential actions are captured through an attested input path — a hardware button, a secure-attention key sequence, a trusted-UI touch with device attestation — so that injected keystrokes, accessibility-API automation or a compromised browser cannot manufacture consent; a confirmation that a program can generate is not a confirmation.

"""Trusted-input attestation for confirmations
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

c = trusted_input.capture(prompt, methods=["hardware_button", "secure_attention", "attested_touch"])
assert c.attested and not c.synthetic; execute(action)

Agents operate on staged copies of data — branches, drafts, pending transactions — and their writes become real only through a commit step gated by policy or a person; the staged state is visible, diffable and discardable, so the default outcome of an agent’s mistake is a discarded draft rather than a corrupted record.

"""Reversible default for data-affecting agent actions
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

stage = data.branch(task.id); agent.write(stage)
commit(stage) only_if policy.auto_commit(stage.diff) or human.approve(stage.diff); else: stage.discard()

Release decisions aggregate evaluations with bounded influence per evaluator and per suite: a single evaluation, however favourable, cannot outweigh the others, and a single unfavourable finding above a severity threshold is a veto regardless of the aggregate; the asymmetry is deliberate — safety claims need agreement, safety objections need only one credible source.

"""Bounded influence of any single evaluator
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

score = sum(min(w_e, W_MAX) * s_e for e, s_e in evals.items()) / sum(min(w_e, W_MAX) for e in evals)
if any(f.severity >= VETO for f in findings): block(release) else: approve_if(score > S_MIN)

The safety case assumes a certain oversight capacity — reviewers on shift, operators per machine, response times; that capacity is measured continuously from rosters, queue depths and response latencies, and when it falls below the assumed level the dependent systems reduce autonomy automatically; a system whose oversight assumption is not met is operating outside its safety case.

"""Continuous verification of human-oversight capacity
Chapter 5 · jailbreak defence stack
package: gaisafety.tools (approval gate)
"""
from gaisafety.tools import ToolGateway, Denied
from gaisafety.types import Effect

cap = oversight.current(reviewers_on_shift, operators_per_machine, p95_response_s)
if cap < safety_case.assumed_oversight: autonomy.reduce(to=level_for(cap)); alert("oversight below safety-case assumption")

Safety labels used in training — harmful/benign, refusal targets, preference pairs — carry annotator identity (pseudonymous), guideline version, review status and agreement scores; labels without provenance are excluded from safety training, and label sets are auditable back to the guidelines that defined them, so that a change in what "harmful" means is traceable to a decision, not a drift.

"""Provenance requirements for training-time safety labels
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

for lab in labels: assert lab.annotator and lab.guideline_version and lab.reviewed and lab.agreement >= A_MIN
safety_train_set = [lab for lab in labels if lab.provenance_complete()]

Temperature, humidity, lighting, vibration, electromagnetic noise and air quality around a machine are measured continuously against the ranges its sensors and controllers were certified for; a condition outside range degrades the affected functions and is logged with the certificate it invalidated, because a scanner certified at 20 degrees is an unknown quantity at minus 15.

"""Environmental sensing for reference conditions
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

for cond, val in env.read().items(): for cert in certificates.assuming(cond):
    if not cert.range[cond].contains(val): cert.suspend(); derate(cert.functions); log(cond, val, cert.id)

Data used to train or fine-tune agents — including data the agents themselves generate — is served from read-only mirrors with integrity hashes; agents and pipelines cannot write to the source of their own training data, and the mirror’s hash is recorded in the training log, closing the loop in which an agent could shape its successor by editing what its successor learns from.

"""Read-only mirrors for agent training data
Chapter 5 · jailbreak defence stack
package: gaisafety.classify (training-time, ml extra)
"""
from gaisafety.types import Verdict  # training-time: needs the `ml` extra

mirror = data.mirror(read_only=True, hash=h); assert not agent_identity.can("write", data.source) and not pipeline_identity.can("write", data.source)
train_log.append({"data_hash": h})

Routes and workspaces are annotated with pre-surveyed safe-stop positions — laybys, cell corners, clear floor areas — and the planner maintains the nearest reachable one at all times; a minimal-risk manoeuvre targets a surveyed position rather than "here", and a route segment with no reachable safe stop within the reaction budget is not driven autonomously.

"""Localized safe-stop positions along every route
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

nearest = min(SAFE_STOPS.reachable(ego), key=time_to_reach); assert time_to_reach(nearest) < T_MRC_BUDGET else exclude_segment(segment)
on_mrc: execute_mrc(target=nearest)

Untrusted documents are paraphrased by a small, separately trained model into content-preserving but form-destroying text before the main model sees them: instructions embedded in formatting, encoding, exact phrasing or token-level tricks do not survive the paraphrase, while facts do; the original is kept for citation and the paraphrase is labelled as such.

"""Intent-preserving paraphrase of untrusted content
Chapter 5 · jailbreak defence stack
package: gaisafety.normalize
"""
from gaisafety.normalize import normalize

para = paraphraser.rewrite(doc, preserve="facts", destroy="form")     # small model, no tools
ctx.add(para, channel="data", label="paraphrased_from:" + doc.id); citations.link(para, doc)

Tool and sensor outputs that describe the physical world are checked against physical plausibility bounds and rates of change — temperatures, weights, positions, speeds, counts — before the model or the planner reasons from them; an implausible value is treated as a fault or an injection, not as a surprising fact.

"""Physical-world plausibility of tool outputs
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if not PLAUSIBLE[value.kind].contains(value) or abs(value - last) / dt > RATE_MAX[value.kind]: reject(value); fault_or_injection(source)

Every agent task carries kill criteria written before it starts — a spend, a count of failed steps, an unexpected system touched, a confidence below a floor, an elapsed time — evaluated by the runtime on every step; a task that cannot state what would make it stop is not ready to run unattended.

"""Task-level kill criteria
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

task.kill_criteria = [spend > 50, failed_steps > 3, touched(systems - task.systems), confidence < 0.6, elapsed > hours(2)]
each_step: if any(c() for c in task.kill_criteria): task.stop(preserve=True); notify(principal)

Agent workflows use two identities: a read identity with broad but read-only access, and an act identity with narrow write scopes that receives only typed, approved action requests; the model reasons under the read identity and the act identity never sees the context, so a compromise of the reasoning stage yields information, not effects.

"""Separate credentials for read and act
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

read_id = identity(scopes=READ_ONLY); act_id = identity(scopes=NARROW_WRITE)
plan = model.reason(ctx, as=read_id); for a in approved(plan): act_id.execute(typed(a))    # act_id never reads ctx

Refusal behaviour is tested for consistency across every surface a deployment exposes — chat, API, voice, embedded widgets, batch — because attackers move to the surface that refuses least; a surface whose refusals lag the others is a gap with a user interface, and the consistency test runs on every release.

"""Refusal-message consistency across channels
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

for surface in SURFACES: verdicts[surface] = run(ATTACK_SUITE, via=surface)
assert max_pairwise_disagreement(verdicts) < D_MAX, "refusal inconsistency across surfaces"

Where a model’s outputs shape the data it later learns from — recommendations shaping engagement, generated text entering the corpus, predictions changing the behaviour they predict — the feedback path is damped: outputs are watermarked and excluded or down-weighted, exposure is randomized for a control slice, and the loop’s gain is measured; an undamped loop amplifies whatever bias it started with.

"""Damped feedback loops between models and their data
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

control = randomize_exposure(slice=0.02)                       # data not shaped by the model
train_set = exclude_or_downweight(watermarked_outputs); gain = measure_loop_gain(control, treatment); assert gain < 1.0

Before autonomous operation in a new area, the map is verified by a person who walks or drives it comparing the map with reality — hazards, boundaries, fixtures, signage — and signs the map version; unverified map regions are excluded from autonomous operation, and a verified map expires after a period or on any reported change.

"""Human-verified environment maps for autonomous machines
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

map.region(r).verified_by = person.sign(walkthrough(r)); autonomy.allow(r) only_if map.region(r).verified and not map.region(r).expired()

Access to collaborative and semi-autonomous zones requires a signed acknowledgement of the current safety briefing for that zone — hazards, stop devices, mode indicators, escape routes — and the acknowledgement expires when the briefing changes or after a fixed period; the record is checked by the badge system, not by a supervisor’s memory.

"""Signed acknowledgements of safety briefings for humans near machines
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

ack = briefing.acknowledged(person, zone, version=current) and not ack.expired()
badge.admit(person, zone) only_if ack

Before an agent plan executes against production systems, it runs against a recent replica — database snapshot, staged file tree, mirrored configuration — and the replica’s resulting state is diffed and checked against the plan and the invariants; the dry run of Chapter 5 with real side effects on a disposable world, for the class of tasks where a diff preview cannot capture what the code will do.

"""Shadow execution of agent plans against production replicas
Chapter 5 · jailbreak defence stack
package: gaisafety.tools (approval gate)
"""
from gaisafety.tools import ToolGateway, Denied
from gaisafety.types import Effect

replica = clone(production, snapshot=latest); result = execute(plan, on=replica)
diff = replica.diff(snapshot); assert invariants.ok(diff) and plan.covers(diff) else block(plan, diff); replica.destroy()

Deployments used by minors run agents at the suggest-only level: no purchases, no messages, no account changes, no external contacts, with the parent or guardian as the acting principal for anything consequential; the child’s assistant explains and drafts, and the adult acts, because delegation requires the capacity to delegate.

"""Age-appropriate autonomy for assistants used by minors
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if user.minor: agent.autonomy = "suggest_only"; agent.tools = READ_ONLY; consequential_actions.principal = guardian(user)

The error rate of each learned component in production is modelled as a hazard function over deployment time and exposure — distribution drift, sensor ageing, environment change — and a rising hazard triggers re-evaluation and retraining before the component crosses its performance floor; a classifier deployed two years ago is a component in its wear-out phase.

"""Hazard-rate monitoring for wear-out of learned components
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

h = hazard_estimate(errors_by_time(component), exposure); if h.slope > S_MAX or h.now > H_MAX: schedule_revalidation(component); if h.now > H_CRIT: derate(component)

The safety case document is produced by a deterministic build from the evidence store, the argument structure and the control registry; two builds from the same inputs produce identical documents, the build records the input hashes, and an auditor can rebuild the case from the same inputs — a safety case that only its author can produce is a safety case only its author can check.

"""Reproducible safety-case builds
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

case = build_safety_case(evidence_store.snapshot(h), argument_graph.version(v), registry.version(r))
assert sha256(case) == sha256(rebuild(h, v, r)); case.inputs = (h, v, r)

Long-running agents periodically discard accumulated context and rebuild it from fresh observations and the signed task specification, keeping only a verified summary of completed steps; injected instructions, stale beliefs and drifted goals that accumulated in the context do not survive the reset, and the rebuild is a checkpoint at which the plan hash is re-verified.

"""Time-boxed context windows for agents
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

every(hour): ctx = assemble(task_spec_signed, summary=verified_progress(ledger), observations=observe_fresh()); assert plan_hash(ctx) == committed_hash

Inputs to safety-critical text classifiers are canonicalized aggressively — case folding, Unicode normalization, whitespace and punctuation collapse, homoglyph mapping, lemmatization where meaning survives — so that the classifier sees a small canonical space in which adversarial variation has little room; the canonicalizer is fuzzed and the canonical forms are what the training data is stored as.

"""Adversarial-example immunity for safety-critical classifiers via input canonicalization
Chapter 5 · jailbreak defence stack
package: gaisafety.eval (ensembles)
"""
from gaisafety.eval import attack_success, release_gate

canon = lemmatize(collapse_ws(map_homoglyphs(nfkc(text.casefold()))))
score = clf(canon); training_data = [canonicalize(x) for x in raw]

Capabilities are exposed progressively with brief, testable understanding checks between levels — what the assistant does with memory, what an agent may act on, how to stop it — so that users who reach powerful features have been shown their risks; the check is a control, not a tutorial, and its completion is recorded with the capability grant.

"""Sequenced disclosure of capabilities to users
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

for level in CAPABILITY_LEVELS: unlock(user, level) only_if understanding_check(user, level).passed; record(user, level, check.id)

When a sensor channel shows attack signatures — spoofing patterns, saturation, implausible consistency — it is excluded from fusion entirely rather than down-weighted; a channel under an attacker’s control contributes attacker-chosen data at any weight above zero, and the remaining channels, with widened margins, carry the decision.

"""Sensor fusion with adversarial-channel exclusion
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

if attack_signature(channel): fusion.exclude(channel); zones.widen(1.3); alarm("channel excluded", channel)
assert len(fusion.active_channels) >= 2 else safe_state()

Definitions of incident classes, severities and exposure denominators are pre-registered and versioned, with changes prospective only; a metric whose definition can change after the fact can be made to say anything, and the register lets an auditor compare periods knowing that "serious incident" meant the same thing in both.

"""Pre-registered incident-metric definitions
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

DEFS = registry.load("incident_metrics", version=V); assert DEFS.frozen_since < period.start
report(period, defs=V); change(DEFS) applies_to periods_after(now())

Physical-AI installations separate the safety network (controllers, safety sensors), the control network (planners, learned perception), the enterprise network and the internet with firewalls, data diodes and authenticated gateways between layers; a compromise of the corporate network is an incident, not a route to the actuators.

"""Layered network segmentation for physical AI
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

layers = ["safety", "control", "enterprise", "internet"]
assert no_direct_route("internet", "safety") and no_direct_route("enterprise", "safety") and diode("safety" -> "control") and auth_gateway("control" <-> "enterprise")

Tool descriptions in natural language are tested against tool behaviour: generated test cases derived from the description are executed against the implementation, and behaviours the description does not mention — a side effect, a network call, a broader scope — fail the test; the model plans from the description, so the description must be true.

"""Human-language contracts for tools, tested against the code
Chapter 5 · jailbreak defence stack
package: gaisafety.eval (ensembles)
"""
from gaisafety.eval import attack_success, release_gate

cases = generate_tests_from(tool.description); for c in cases: assert tool.run(c.input).matches(c.expected)
assert observed_effects(tool, cases) ⊆ described_effects(tool.description)

Capabilities revoked after an incident, an anomaly or a policy violation carry a minimum cooling-off period before they can be regranted, during which the regrant request is reviewed with the revocation record attached; pressure to restore access is strongest immediately after revocation, which is when the review is worth the most.

"""Cooling-off periods for capability regrants
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

if revocation.reason in {"incident", "anomaly", "violation"}: regrant_allowed_after = revocation.ts + COOLING[revocation.reason]
regrant(cap) only_if now() > regrant_allowed_after and review(with=revocation.record).ok

Ensembles of classifiers and monitors are required to meet a measured diversity target — low error correlation on adversarial and out-of-distribution sets — and an ensemble whose members fail together is treated as one model; diversity is achieved through different architectures, data and training regimes, and it is re-measured with every update because members converge over time.

"""Quantified diversity requirements for ensembles
Chapter 5 · jailbreak defence stack
package: gaisafety.eval (ensembles)
"""
from gaisafety.eval import attack_success, release_gate

rho = error_correlation(ensemble, ADVERSARIAL_SET); assert rho < RHO_MAX, "ensemble members fail together"
if rho rises after update: replace_member(most_correlated)

Product surfaces are designed so that classes of harmful requests are structurally absent — a customer-service assistant with no free-form chat, a coding assistant scoped to a repository, a medical intake tool with a fixed question set; the model never faces the request, so no classifier has to catch it, and the residual free-form surface is small enough to defend.

"""Refusal surface minimization by design
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

surface = {"free_text": False, "intents": ENUMERATED_INTENTS, "scope": repo}
assert attack_suite(surface).reachable_fraction < 0.05

Selection of physical operations for detailed inspection — which trips are reviewed by a human, which welds are X-rayed, which grasps are replayed — is driven by a verifiable random function so that neither the fleet operator nor a compromised scheduler can steer inspection away from the operations that would reveal a problem; the sampling proof is part of the safety record.

"""Verifiable randomness in safety sampling of physical operations
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

for op in operations: r, proof = vrf.eval(sk, day_seed || op.id); if r < RATE[op.kind]: inspect(op, proof)
audit: verify(pk, day_seed || op.id, r, proof)

Fleet learning — near-miss mining, on-robot adaptation, retraining from field data — consumes only episodes whose sensor signatures, timestamps and custody records verify; unsigned, incomplete or anomalous episodes are excluded from learning even if they look informative, because an attacker who can inject field data can teach the fleet, and the fleet remembers.

"""Provenance-gated learning from deployment
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

episodes = [e for e in field_data if e.signatures_verify() and e.custody_complete() and not anomaly(e)]
learn(episodes); quarantine(field_data - episodes)

Databases, drives and mailboxes agents can reach contain decoy records — fake customers, fake secrets, fake tickets — that no legitimate task would touch; any read, export or mention of a decoy by an agent identifies a runaway or hijacked task with the record of what it did next, and the decoys are rotated so that they cannot be learned.

"""Decoy data in agent-accessible stores
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

DECOYS = plant(stores, kinds=["customer", "secret", "ticket"], rotate=days(30))
if access.record in DECOYS or DECOY_MARKER in agent.output: incidents.open("decoy touched", agent, access)

Accounts whose requests repeatedly land near a refusal boundary — not over it, near it — accumulate a probing score that adds friction and review sampling; boundary probing is how attackers map the classifier, and the pattern is visible only across requests, never in one.

"""Escalating friction for repeated boundary probing
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if T_LOW < score < T_HIGH: probing[account] += 1
if probing[account] > P_MAX: friction(account, level=2); review.sample(account, rate=0.2)

For factual questions asked by many users, answers are sampled and compared across users and sessions; systematic contradictions correlated with user attributes, cohorts or times indicate poisoning, personalization gone wrong or a targeted manipulation, and trigger investigation with the samples as evidence.

"""Output diversity floor for factual claims across users
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

claims = group_by_question(sample_answers(popular_questions)); for q, cs in claims.items():
    if contradiction_rate(cs) > C_MAX and correlates(cs, user_attributes): investigate("inconsistent facts across users", q)

Any change to a workspace layout — fixtures, shelving, conveyors, lighting — invalidates the sensor-coverage and protective-distance certificates for the affected zones, which enter a restricted mode until the coverage analysis and the test-piece verification are re-run; the machine does not assume the room is the room it was commissioned in.

"""Physical zone re-certification on layout change
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.zones
"""
from gaisafety.physical import SSMParams, protective_distance, permitted_speed

on_layout_change(zone): zone.certificates.invalidate(); zone.mode = "restricted"
zone.mode = "collaborative" only_after coverage_proof(zone) and test_piece_verification(zone)

Each serving node publishes a signed manifest — base model hash, adapters and their order, safety configuration hash, policy version — refreshed on every change, and the gateway routes only to nodes whose manifests match the release registry; a node running an unregistered combination is drained, and the manifest history is the fleet’s deployment record.

"""Tamper-evident model serving manifests
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

m = node.manifest(); assert verify(m.sig, node.key) and registry.approved(m.base, m.adapters, m.safety_cfg, m.policy)
if not approved: gateway.drain(node); incidents.open("unregistered serving manifest", node)

Expansions of autonomy — new ODD regions, higher autonomy levels, fewer check-ins — are rate-limited per period regardless of the metrics, so that the people responsible for supervision have time to absorb each change before the next; autonomy expanded faster than its supervisors can understand is autonomy without supervision.

"""Human-comprehensible rate of change for autonomy expansions
Chapter 5 · jailbreak defence stack
package: gaisafety.normalize
"""
from gaisafety.normalize import normalize

if expansions(fleet, days=30) >= E_MAX: defer(expansion, reason="expansion rate limit"); require(supervisor_briefing.completed(previous_expansion))

In collaborative work the robot confirms the worker’s identity and training level (badge, tag, biometric where consented) and the worker can confirm the robot’s identity, mode and certification status through a visible, non-spoofable indicator; a worker who cannot tell a certified collaborative robot from one in maintenance mode is working next to an unknown.

"""Mutual authentication of human and machine in physical collaboration
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

worker = presence.identify(zone); assert worker.training >= REQUIRED[zone.mode]
robot.indicator.show(identity=robot.id, mode=robot.mode, cert=robot.cert_status, signed=True)

Harmful requests that were refused are analysed and counted as attempts by category, actor and technique, independently of whether any control failed; the attempt rate is a leading indicator the leak rate lags, it drives red-team priorities, and it is reported to threat-sharing channels so that a campaign refused here is recognized elsewhere.

"""Refusal-independent detection of harmful attempts
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if decision.refused: attempts.record(category=decision.category, actor=account.cluster, technique=technique_clf(req))
dashboard.leading_indicator = attempts.rate(); threat_share.publish(attempts.summary(hashed=True))

Personalization — tone, memory use, recommendations, persona — is limited to a documented envelope per deployment: what may be adapted, how far, for whom, with what expiry; adaptation outside the envelope is a defect, and the envelope is narrower for minors and for high-dependency signals, because unbounded personalization is how a product optimizes its way into someone’s life.

"""Bounded personalization depth
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

ENVELOPE = {"tone": ["formal", "friendly"], "memory": "task_only", "persona": "none", "recommend": "explicit_requests_only"}
assert personalization_state(user).within(ENVELOPE[user.cohort]); if not: reset_to_default(user)

Evaluation suites carry provenance — who wrote each item, when, from what source, under what licence — and a review trail; items with unknown provenance are excluded from gating suites, because a suite is only as trustworthy as its items, and an attacker who can insert or leak items can shape what "passing" means.

"""Supply-chain attestation for evaluation data
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

for item in suite: assert item.provenance.author and item.provenance.reviewed and item.provenance.licence
gating_suite = [i for i in suite if i.provenance.complete()]

Authorizations granted at task start are bound to the conditions that justified them — the user’s role, the data class involved, the environment, the time; when a bound condition changes mid-task (a user loses a role, a document turns out to contain secrets, the environment is production after all), the authorization is re-evaluated and the task pauses until it is renewed.

"""Runtime authorization refresh on context change
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

auth = grant(task, conditions=snapshot(user.role, data_class, env, window))
on_change(any(conditions)): task.pause(); auth = re_evaluate(task) or revoke()

Enterprises using third-party models under zero-retention agreements verify them: canary content submitted through the API is later probed through the provider’s model, search and support channels, and contractual audit rights are exercised; a retention promise that is never tested is a policy document, and the probes are the cheapest test there is.

"""Zero-retention verification for third-party model calls
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

canary = unique_secret(); provider.api(canary_prompt(canary))
later: assert not provider.model_reproduces(canary) and not provider.search_finds(canary); audit_rights.exercise(annually=True)

Inter-agent messages are treated as untrusted input at the receiving agent: classified, spotlighted, checked for instructions outside the sender’s delegated scope, and bounded in size; an agent that trusts its peers because they are "ours" is the topology the swarm exploited, and a compromised peer is the most credible attacker there is.

"""Semantic firewall between agents
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

msg = peer.receive(); assert msg.sender in registry and scope(msg) ⊆ registry.scope(msg.sender)
ctx.add(screen(spotlight(msg.body)), channel="data")

A sample of refused users are invited to state whether the refusal was justified, with a free-text reason, through a lightweight prompt; responses are reviewed, labelled and fed into calibration and the over-refusal suite; the users the system turns away are the cheapest and most honest source of false-positive data, and they are rarely asked.

"""Refusal-quality feedback from affected users
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

if decision.refused and random() < 0.05: fb = user.ask("Was this refusal appropriate?", free_text=True)
    labels.add(decision, fb, source="affected_user"); over_refusal_suite.consider(decision, fb)

For plans with lasting effects — automations, communications, purchases, configuration changes — a consequence model projects second-order effects over a horizon: recurring costs, notifications to third parties, downstream jobs triggered, data now visible to others; effects the requester did not ask for are surfaced before execution, and a plan whose projected consequences exceed its stated goal is trimmed.

"""Long-horizon consequence prediction for agent plans
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

effects = consequence_model.project(plan, horizon=days(7))
unrequested = [e for e in effects if not task.goal.covers(e)]; if unrequested: show(requester, unrequested); trim_or_confirm(plan)

Human review sampling is weighted toward decisions near the classifier thresholds and toward inputs where ensemble disagreement is high, with a floor elsewhere; the labels produced are the most informative for calibration, and review capacity is not spent confirming what the system already knows.

"""Adaptive sampling of human review toward uncertainty
Chapter 5 · jailbreak defence stack
package: gaisafety.tools (approval gate)
"""
from gaisafety.tools import ToolGateway, Denied
from gaisafety.types import Effect

p = FLOOR + (1 - FLOOR) * (1 - abs(score - threshold) / threshold) * (1 + disagreement)
if random() < min(p, 1): review.enqueue(decision, weight=1 / p)

Rate limiters on safety-relevant paths are implemented with formally checked counting logic that can over-count but never under-count, persist their state across process restarts and node failovers, and are tested by injecting bursts that must be blocked; a limiter that resets on restart is a limiter an attacker resets by causing a restart.

"""Provable rate-limit enforcement at the edge
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

limiter = PersistentTokenBucket(state=durable_store, verified="never_undercount")
assert burst_test(limiter, rate=10 * LIMIT).blocked_fraction > 0.99 and limiter.survives(restart())

Safety-relevant updates — classifier models, policy rules, firmware for safety controllers — are signed, distributed with a deadline, and enforced: a node that has not applied a mandatory safety update by the deadline is taken out of service by the fleet manager rather than left running the old version, because an unpatched safety component is a known gap with a date on it.

"""Signed distribution of safety updates with mandatory apply windows
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

update.deadline = now() + hours(24); for node in fleet: if not node.applied(update) and now() > update.deadline: node.out_of_service("mandatory safety update overdue")

Each release is accompanied by an attack-surface ledger — new endpoints, tools, parsers, input channels, capabilities; removed ones — computed from the code and configuration rather than declared; net growth beyond a budget requires a security review, so that surface, like latency and cost, is a quantity engineers see and manage.

"""Attack-surface accounting per release
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

surface = enumerate_surface(release)                # endpoints, tools, parsers, channels, capabilities
delta = surface - enumerate_surface(previous); if delta.net_growth > BUDGET: require(security_review(delta)); ledger.append(release, delta)

Stop commands — for agents, vehicles, robots, pipelines — travel on a path with reserved resources: a dedicated queue, a high-priority thread, a separate network class, and a latency budget verified under maximum load; the stop must not wait behind the work it is stopping, and the test that proves it is run with the system at its busiest.

"""Guaranteed-latency stop path independent of load
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

stop_path = Path(queue=dedicated, priority=REALTIME, netclass="safety")
assert latency(stop_path, under=max_load()) < T_STOP

For safety-critical control, the learned policy is distilled into a compact, verifiable form — a decision tree, a piecewise-affine controller, a small network amenable to reachability analysis — that matches it closely on the operating region; the verifiable form runs in the safety path with proofs, and the neural policy runs as its advisor, so the deployed controller is the one the certificate covers.

"""Learned-policy distillation into verifiable controllers
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

small = distill(neural_policy, form="piecewise_affine", region=OPERATING_REGION)
assert fidelity(small, neural_policy, region) > 0.98 and reachability_verified(small, UNSAFE_SET)
deploy(controller=small, advisor=neural_policy)

Self-reported uncertainty, refusal reasons and capability statements from the model are compared with the telemetry the runtime observes — entropy, classifier scores, tool-call outcomes; systematic disagreement (a model that reports confidence where entropy is high, or reports refusal where it complied) is a calibration or honesty defect that is measured and gated, because a self-report nobody checks is an unaudited channel.

"""Consistency checks between model self-reports and telemetry
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

gap = mean(abs(model.self_reported_confidence(x) - (1 - normalized_entropy(x))) for x in sample)
if gap > G_MAX or mismatch_rate(model.claimed_refusals, ledger.actual_refusals) > M_MAX: flag("self-report inconsistency")

Internal red teams operate against production-equivalent systems with elevated access granted through a dedicated, logged, time-boxed path that is itself monitored and distinguishable from ordinary access; red-team findings are reproducible by the defenders from the logs, and the access path is one of the surfaces the red team is asked to attack, because a permanent back door for testers is a back door.

"""Differential access for internal red teams
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

grant = redteam_access.issue(person, scope=SYSTEM, ttl=hours(8), tagged="redteam")
monitor.watch(grant); on_expiry: revoke(grant); findings.require_repro_from_logs()

Harm-rate caps are set per cohort — minors, users flagged vulnerable, regions, languages — and enforced automatically: a cohort whose measured harm rate crosses its cap has the responsible feature suspended for that cohort until a review restores it; the suspension is a control that acts at the speed of the metric rather than the speed of escalation.

"""Cohort-level harm caps with automatic feature suspension
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

for cohort in COHORTS: if harm_rate(feature, cohort, window=1d) > CAP[cohort]: suspend(feature, cohort); review.enqueue(feature, cohort)

The context is assembled independently by two implementations from the same inputs and the results are compared before inference; a mismatch in system segment, markers, labels or ordering halts the request and raises an integrity incident, extending N-version design to the component that decides what the model sees.

"""Redundant context assembly with comparison
Chapter 5 · jailbreak defence stack
package: gaisafety.eval (ensembles)
"""
from gaisafety.eval import attack_success, release_gate

c1, c2 = assembler_a.build(inputs), assembler_b.build(inputs)
if canonical(c1) != canonical(c2): halt(req); incidents.open("assembler mismatch", diff(c1, c2))

Every model update is tested against a rolling sample of recent production requests together with the verdicts and outcomes those requests received; the new model’s verdicts are compared with the old and with human-reviewed ground truth on the sample, so a regression on real traffic — not just on curated suites — blocks the rollout.

"""Shadow safety evaluation of every production model update
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

sample = production.recent(n=50_000, with_verdicts=True, with_reviews=True)
delta = compare(new_model, sample); if delta.regressions(on="reviewed_truth") > TOL: block(update, delta)

Irreversible physical actions — cuts, welds, dispensations, releases into the environment — are paced by a minimum interval derived from human perception and reaction, with a visible pre-action signal, so that an observer can intervene between actions; a sequence of irreversible actions executed faster than anyone could see is a sequence nobody supervised.

"""Human-time pacing for irreversible physical actions
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if now() - last_irreversible < T_HUMAN_NOTICE: hold(action); signal.pre_action(duration=T_SIGNAL); execute(action); last_irreversible = now()

Attack signatures — hashed prompts, campaign fingerprints, tool-call patterns — are correlated across tenants through privacy-preserving joins (hashing with a rotating salt, secure aggregation) so that a campaign spread across customers is detected as one campaign, while no tenant’s traffic is visible to any other or to the correlation service in the clear.

"""Cross-tenant anomaly correlation with privacy preservation
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict
from gaisafety.normalize import normalize

sig = hmac(SALT_ROTATING, canonical(prompt))
counts = secure_aggregate({tenant: sigs for tenant in tenants})
if counts[sig] > K_TENANTS: campaigns.open(sig, tenants=count_only)

Tool descriptions include machine-readable prohibitions and preconditions — not for bulk sends, not with external recipients, requires confirmation above an amount — that the gateway enforces and the model is trained to respect; a description that only says what the tool can do invites the model to find every use, including the ones nobody intended.

"""Safe-by-default tool descriptions
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

tool.schema.constraints = {"max_recipients": 5, "external_recipients": False, "confirm_above": 100}
gateway.enforce(tool.schema.constraints); model.trained_on(TOOL_CONSTRAINT_EXAMPLES)

Persisted memories about users are shown back to them on a schedule for confirmation, correction or deletion; memories not reconfirmed within their window are demoted to unverified and stop influencing consequential behaviour; a memory is a claim about a person that ages, and the person is the authority on whether it is still true.

"""Periodic re-validation of retained memories
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

for m in memories.due(user): decision = user.review(m)  # confirm | correct | delete
    if decision is None: m.status = "unverified"; m.influence = "non_consequential_only"

Automated pipelines that retrain classifiers from their own production decisions — a feedback loop that can entrench errors or be steered by an attacker feeding it — are gated like any model change: held-out human-labelled evaluation, drift comparison, shadow mode, and a cap on the fraction of training data that comes from the classifier’s own unreviewed decisions.

"""Guarded self-improvement of classifiers
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

train_set = human_labelled + self_labelled[: int(SELF_CAP * len(human_labelled))]
new = train(train_set); assert eval(new, HUMAN_HOLDOUT).ok and shadow(new, days=7).ok before promote(new)

Incident reconstruction is performed from signed raw sensor frames and the recorded intermediate states rather than from the fused world model alone, so that a fusion error, a spoofed channel or a perception bug is visible as a difference between what the sensors saw and what the system believed; the reconstruction tool refuses to render conclusions from unsigned or incomplete raw data.

"""Sensor-data provenance in incident reconstruction
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

frames = edr.raw_frames(window, verify_signatures=True); states = edr.intermediate_states(window)
assert frames.complete() else mark("reconstruction incomplete"); reconstruct(frames, states, compare_with=fused_log)

High-risk capabilities — cyber tooling, biology depth, bulk generation, unsupervised autonomy — unlock for an account only with organizational verification, a named responsible person, and a stated purpose reviewed by a human, each recorded, each revocable independently; a single verification step is a form, three independent ones are a decision.

"""Layered authorization for capability unlocks
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

unlock(cap, account) only_if org.verified(account) and responsible_person.attested(account, cap) and purpose.reviewed(account, cap, by=human)
revoke_any(cap, account) if any_of_three.withdrawn()

Safety configuration for machines — zones, limits, muting sequences, mode maps — is written in a domain-specific language with a formal grammar and a validator that rejects configurations outside the safety case’s parameter space (a zone smaller than the protective distance, a speed above the collaborative limit, an unguarded mode transition); invalid configurations cannot be loaded, whatever tool produced them.

"""Formal grammar for physical-safety configuration files
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

cfg = dsl.parse(file)                                  # fails on syntax the grammar does not admit
assert validator.within_safety_case(cfg), validator.violations(cfg); machine.load(cfg)

When a commitment says a model is below a capability threshold, the claim is verified across labs or with a regulator through a multi-party protocol over committed evaluation results: each party learns whether the threshold comparison holds, not the underlying scores or prompts; it turns a self-reported claim into a jointly verified one without pooling the secrets.

"""Multi-party computation of capability thresholds
Chapter 5 · jailbreak defence stack
package: gaisafety.compliance
"""
from gaisafety.compliance import Obligation, compliance_check, schedule_reports

shares = commit_and_share(eval_results, parties=[lab, regulator, peer])
below = mpc_compare(shares, threshold=THRESHOLD)            # reveals only the boolean
log.append({"model": commit_m, "below_threshold": below, "protocol": "mpc-v1"})

Operators and reviewers can request, for any decision the system made, the complete record — inputs, context sources, verdicts, model version, rationale, tool calls, signatures — through an interface that answers within seconds; a decision that cannot be reconstructed on demand cannot be supervised, and the request rate is monitored so that the audit path itself is exercised.

"""Operator-initiated audits of any decision
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

rec = ledger.reconstruct(decision_id)      # inputs, sources, verdicts, model, rationale, tools, sigs
assert rec.complete and rec.latency_s < 5; metrics.record("operator_audit_pull")

The context assembler runs with no access to secret stores; credentials, keys and internal endpoints are unreachable from the process that builds prompts, so a template that tries to include one fails at assembly rather than at extraction; what is not in the prompt cannot be leaked from it.

"""Secret-free prompts by construction
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.zones
"""
from gaisafety.physical import SSMParams, protective_distance, permitted_speed

assert not assembler_identity.can("secrets:read") and not assembler_identity.can("vault:*")
template.render(vars) raises MissingVar for any secret-shaped variable

When an agent allocates — who gets called back first, whose ticket is escalated, which applicant is shortlisted — its decisions over a window are checked for disparity across protected groups before execution continues; a window that drifts out of tolerance pauses the allocation for review, extending the fairness pipeline from models to the agents that act on their outputs.

"""Decision-time fairness constraints for agents
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

window.append(decision)
if impact_ratio(window, groups=PROTECTED) < 0.8: pause_allocations(); review.enqueue(window)

Session storage is designed so that persistence is impossible by construction rather than avoided by policy: session memory lives in encrypted, ephemeral volumes whose keys are destroyed at session end, and an attestation of destruction is generated; a user or a regulator asking "what did you keep" receives a proof, not a promise.

"""Provable non-persistence of session state
Chapter 5 · jailbreak defence stack
package: gaisafety.compliance
"""
from gaisafety.compliance import Obligation, compliance_check, schedule_reports

vol = ephemeral_volume(key=kms.session_key(session.id)); on_end: kms.destroy(key); attest = sign(RUNTIME_KEY, {"session": session.id, "key_destroyed": now()})

Human statements about the physical state that would relax a control — "no one is in the cell", "the load is secured", "the road is closed" — are cross-checked against sensing before they change behaviour; a claim the sensors contradict is refused, and a claim the sensors cannot confirm relaxes nothing, because operators are sometimes wrong and sometimes coerced.

"""Verification of physical-world claims made to the model
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

if claim.relaxes_control: if sensors.contradict(claim): refuse(claim); elif not sensors.confirm(claim): keep_control(); else: apply(claim, logged=True)

Human audit of automated decisions samples with probability proportional to consequence — amount moved, irreversibility, number of people affected, novelty — while keeping a floor rate for everything; a uniform sample spends its budget on trivial decisions and misses the ones whose errors cost the most.

"""Audit sampling weighted by consequence
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

p = FLOOR + (1 - FLOOR) * consequence(decision) / C_MAX
if random() < p: audit_queue.put(decision, weight=1 / p)   # weights keep the estimates unbiased

Safety communication links are monitored at the physical layer — eye-diagram margins, error-correction activity, retransmission counts, termination resistance — and a link whose margins degrade is flagged for maintenance before it produces the intermittent errors that a black-channel protocol would catch only as dropped messages.

"""Signal-integrity monitoring on safety buses
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if link.eye_margin < M_MIN or link.fec_corrections(minutes=10) > F_MAX or link.retransmits > R_MAX: maintenance.schedule(link); if severe: derate(dependent_functions)

When independent safety layers return different verdicts — an ingress classifier passes what the critic blocks, a learned perception channel sees what the certified channel does not — the disagreement is resolved toward the conservative verdict for the immediate decision and routed to human review for the record; disagreement is treated as information about the system, not as noise to average.

"""Escalation of oversight on disagreement between safety layers
Chapter 5 · jailbreak defence stack
package: gaisafety.eval (ensembles)
"""
from gaisafety.eval import attack_success, release_gate

if verdict_a != verdict_b: decide(conservative(verdict_a, verdict_b)); review.enqueue(case, reason="layer disagreement"); metrics.record("disagreement", layer_pair)

What an agent believes about its environment — file listings, account states, positions of objects — carries the time and source of the observation; beliefs older than a task-specific horizon are treated as unknown and re-observed before an action depends on them, so an agent does not act on a directory listing from before another process changed it.

"""Versioned world models for agents
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

belief = world.get("dir_listing", max_age_s=30) or world.observe("dir_listing")
assert action.depends_on(beliefs).all(fresh=True)

Safety sensors and the controller are cryptographically paired at commissioning; the controller rejects frames from any device not in its pairing set even if the frames are well-formed and correctly signed by some key, so a substituted or added sensor on the bus cannot inject presence or absence into the safety decision.

"""Cryptographic binding of sensor to safety controller
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

PAIRED = commissioning.pairings(controller)
if frame.device_id not in PAIRED or not verify(frame.sig, PAIRED[frame.device_id]): drop(frame); alarm("unpaired sensor frame")

Every deviation from a safe default — a raised limit, a disabled screen, a widened scope, a longer retention — requires a recorded rationale, an owner and an expiry, and is listed in a register that is reviewed on a schedule; the register is the honest inventory of where the system is less safe than it ships, and why.

"""Recorded rationale for every relaxation of a default
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

relax(default, to=value, rationale=required, owner=required, expires=required); register.add(default, value, rationale, owner, expires)

Disclosure that a user is interacting with an AI is delivered in the modality of the interaction — text banner, spoken statement, on-screen mark — in a form that persists in copies and recordings, cannot be removed by the deployer’s styling, and is verified by a periodic automated check that samples live interactions and confirms the disclosure is present and perceptible.

"""Human-detectable AI disclosure in every modality
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

disclose(modality=session.modality, persistent=True, deployer_removable=False)

Before a capability is released broadly, its abuse potential is estimated by simulating populations of adversarial users with varied skill, resources and goals against the capability’s controls, producing expected misuse volumes and the controls’ expected interception rates; the numbers feed the release tiering and the staffing of the review queues that will absorb what gets through.

"""Population-scale abuse simulation before capability release
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

pop = adversary_population(n=1_000_000, skill_dist=SKILLS, goals=GOALS)
sim = simulate_misuse(capability, controls, pop, days=90); if sim.expected_leaks > L_MAX: tier_down(capability) else: staff_queues(sim.expected_reviews)

Beyond labelling, the assembler assigns each context source a trust weight and the model is trained to bound how much a low-trust source can move the answer; at inference, influence attribution checks that no source exceeded its budget, and an answer driven mainly by a low-trust document is regenerated with that document down-weighted.

"""Explicit trust budgets per source in the context
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

w = {src: trust_weight(src) for src in ctx.sources}
infl = influence_by_source(model, ctx, answer)
if any(infl[s] > w[s] * TOL for s in ctx.sources): answer = regenerate(ctx.downweight(over_budget(infl, w)))

The operating envelope — weather, hours, zones, speeds, passenger classes, autonomy level — is a signed document from the safety authority; dispatch checks current conditions against it before every trip, a vehicle outside its envelope does not start, and changes to the envelope are versioned and attributed rather than made in a console.

"""Signed operating envelopes for autonomous fleets
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

env = envelope.current(fleet, verify=SAFETY_AUTHORITY_PK)
if not env.permits(conditions.now(), trip): raise Denied("outside signed operating envelope"); log(env.version, trip.id)

Regression suites include counterfactual attacks generated by replaying incidents and near-misses with individual controls removed; the model and the classifiers are retrained on the attacks that succeeded in those counterfactuals, so that the next version does not depend on the same single layer that saved the last one.

"""Adversarial retraining with counterfactual attacks
Chapter 5 · jailbreak defence stack
package: gaisafety.classify (training-time, ml extra)
"""
from gaisafety.types import Verdict, Tier  # training-time / model-side: needs the `ml` extra

for inc in incidents: for cfg in toggles(CONTROLS, remove=1): out = replay(inc, cfg)
    if out.succeeded: counterfactual_attacks.add(out.attack, missing=cfg.removed)
retrain(classifiers + model, counterfactual_attacks)

Certified properties of a learned component — Lipschitz bounds, output ranges, monotonicity, symmetry — are checked at runtime by cheap monitors on the actual inputs and outputs; a violation means either the certificate did not cover this input or the component has changed, and either way the conservative path takes over until the discrepancy is explained.

"""Runtime verification of learned components against their own specifications
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

for prop in component.certified_properties: if not prop.holds(x, y): fallback(); incidents.open("certified property violated", component, prop)

For each incident class the organization pre-commits, in a signed playbook, to the actions it will take — disclosures, freezes, notifications, rollbacks — and to the thresholds that trigger them; when the incident arrives, the playbook executes and deviations require a signed exception, because decisions made under the pressure of an incident are the ones most likely to favour the organization over the people it harmed.

"""Pre-commitment of incident-response actions
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

pb = playbooks.signed(incident.classify())
for action in pb.actions_for(incident.severity): execute(action) or exception(signed_by=threshold_group, reason=required)

Evaluation sandboxes are verified isolated by active tests before every dangerous-capability evaluation: attempted connections to production endpoints, DNS resolution of internal names, credential presence, and reachability of the weight store are all probed from inside the box and must fail; the July 2026 incident began in an evaluation that could reach the world.

"""Verified isolation of evaluation environments
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

for probe in [connect(PROD_ENDPOINTS), resolve(INTERNAL_NAMES), find_credentials(), reach(WEIGHT_STORE)]: assert probe.fails(), "evaluation environment is not isolated"
run_evaluation() only_after isolation_verified

Every consequential physical action is confirmed by a sensor independent of the actuator’s own feedback — a camera confirms the gripper released, a pressure switch confirms the valve closed, a position sensor confirms the door locked — and an unconfirmed action is treated as not having happened; an actuator reporting its own success is one sensor, and one sensor is a hope.

"""Actuation confirmation through independent sensing
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

cmd(actuator, "release"); if not independent_sensor.confirms("released", timeout_ms=500): state.assume("not released"); fault("unconfirmed actuation")

Hierarchy markers, spotlighting delimiters and provenance labels are bound to the request by a keyed hash that the model server verifies before inference and that any intermediary cannot regenerate; markers that appear in the wrong channel — a user message containing a system delimiter — fail the check rather than being trusted or silently stripped.

"""Instruction-channel integrity checks at the model boundary
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

expected = hmac(GATEWAY_KEY, serialize(markers)); assert req.marker_mac == expected
if any(marker in user_text for marker in RESERVED_MARKERS): reject("reserved marker in user channel")

Tool calls carry only the typed arguments the tool needs; the conversation, the system prompt and other tool results are never forwarded to a tool, so a compromised or curious tool server cannot read the context, and a tool’s output cannot be a function of secrets it should never have seen.

"""Least-context tool invocation
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

payload = {k: args[k] for k in tool.schema.required + tool.schema.optional}
assert "context" not in payload and "history" not in payload; tool.call(payload)

Deployers and owners set the autonomy level of agents and machines through a visible control — suggest, confirm each, review after, unsupervised within scope — that cannot exceed the ceiling the safety case certified for the deployment; the dial’s position is logged with every action, and raising it above the certified ceiling is impossible rather than discouraged.

"""Owner-visible autonomy dial with hard ceilings
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

ceiling = safety_case.autonomy_ceiling(deployment); dial = owner.autonomy_setting()
effective = min(dial, ceiling); every_action.log(autonomy=effective); assert not owner.can_set(above=ceiling)

Periodically a team tries to make the safety metrics look good without making the system safer — by gaming the suites, exploiting sampling, shifting traffic, redefining categories — and documents every way it succeeds; each success is a measurement defect fixed before an incentive finds it, because a metric that can be gamed will be, eventually, by someone with a deadline.

"""Adversarial review of safety metrics
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

for tactic in METRIC_GAMING_TACTICS: if tactic.improves(metric) and not tactic.improves(true_safety): defects.add(tactic); fix(metric.definition)

Independent evaluations that support a release claim are performed by evaluators selected through a process the lab does not control — a standards body, a rotating panel, a regulator’s list — with at least one evaluator the lab did not propose; an evaluation by friends is an internal evaluation with extra steps, and the selection process is published with the results.

"""Mandatory diversity in evaluator selection
Chapter 5 · jailbreak defence stack
package: gaisafety.compliance
"""
from gaisafety.compliance import Obligation, compliance_check, schedule_reports

evaluators = panel.select(release, n=3, lab_proposed_max=1, rotation=True)
assert any(e not in lab.proposed for e in evaluators); publish(results, selection_process=panel.process_id)

Confirmation requests to humans carry a timeout and a declared safe default; a request that expires resolves to the conservative option (do not send, do not delete, stop) rather than to whatever the model proposed, and expired requests are counted, because a confirmation flow that times out into "proceed" is an approval nobody gave.

"""Latency-bounded human confirmation with safe default
Chapter 5 · jailbreak defence stack
package: gaisafety.tools (approval gate)
"""
from gaisafety.tools import ToolGateway, Denied
from gaisafety.types import Effect

ans = human.confirm(action, timeout_s=T) ; if ans is None: return SAFE_DEFAULT[action.kind]; metrics.record("confirm_timeout", action.kind)

Retrieval caches record the safety verdicts attached to each cached document; a document implicated in a block, an injection detection or a takedown is evicted across all caches and indexes at once, and cached entries carry the policy version so that a document admitted under an older policy is re-screened before reuse.

"""Refusal-aware caching of retrieval results
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if verdict.flagged(doc): caches.evict_all(doc.id); index.mark(doc.id, "re-screen")
entry.policy = policy.version; on_read: if entry.policy != policy.version: rescreen(entry)

Tool servers label their outputs with data classes — public, internal, personal, secret — and the runtime propagates the labels through context, memory and outputs; a downstream tool with a lower clearance cannot receive a higher-labelled value, and the model’s reply to the user is checked against the user’s clearance, closing the path where a lookup tool feeds an exfiltration tool.

"""Sensitivity-labelled tool outputs
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

r = tool.call(args); r.label = tool.output_label(r)
if next_tool.clearance < r.label: Denied("label exceeds clearance"); if user.clearance < reply.label: redact(reply)

Plans are compared with the corpus of previously executed plans; a plan whose structure is novel — a new combination of tools, a new sequence of motions — runs in a slow lane with tighter budgets, more frequent check-ins and mandatory review of its first execution, and joins the corpus only after it has succeeded under observation.

"""Slow-lane execution for novel plans
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

if plan_novelty(plan, corpus) > N_MAX: plan.lane = "slow"; plan.budgets *= 0.5; plan.checkin_every = 3; review.first_execution(plan)
on_success: corpus.add(plan)

Each safety function has a recovery-time objective — the maximum time it may be degraded or absent before the dependent system must stop — and a monitor that enforces it: a classifier down for longer than its objective takes the product into restricted mode, a stale scanner takes the cell out of collaborative operation; degradation is tolerated by design, for a bounded time, never indefinitely.

"""Recovery-time objectives for safety functions
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

for fn in SAFETY_FUNCTIONS: if fn.degraded_for() > fn.rto: dependent(fn).enter_restricted_mode(); page(fn.owner)

Human overrides of model decisions — reversed refusals, blocked actions, corrected outputs — are signed, labelled with the reason and routed as high-weight training and calibration examples, with a loop that measures whether the next version repeats the overridden behaviour; the human in the loop teaches, not just corrects.

"""Signed human-override records fed to training
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

ex = sign(REVIEWER_KEY, {"input": d.input, "model": d.output, "human": override.output, "reason": override.reason})
training.add(ex, weight=W_OVERRIDE); assert repeat_rate(next_model, overrides) < R_MAX

The router selects, per task, the least capable model that meets the task’s quality bar from a catalog with measured capability and safety profiles; the most capable models are reserved for tasks that need them and carry the most oversight, so that capability — and the attack surface that comes with it — is spent where it is needed rather than everywhere by default.

"""Task-scoped model selection
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

m = min((m for m in CATALOG if m.quality[task.kind] >= BAR[task.kind]), key=lambda m: m.capability)
if m.tier == "frontier": oversight.increase(task)

Actuator drives enforce minimum intervals between command changes and maximum command slew rates in firmware locked at commissioning, so that a controller issuing rapidly alternating commands — from a fault, a compromise or an unstable policy — cannot excite the mechanism beyond what the firmware permits; the controller sets the target, the drive owns the rate.

"""Physical-layer rate limits on actuators
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

drive.set_locked(min_cmd_interval_ms=5, max_slew=SLEW_LIMIT[axis])   # firmware-locked at commissioning
assert not controller.can_write("drive.rate_params")

Experimental models, prompts and features are capped in total exposure — a fraction of users, of sessions, of consequential actions — regardless of how many experiments are running, so that the sum of many small experiments cannot expose a large share of the population to unvalidated behaviour; the cap is enforced by the experimentation platform, not by each team’s judgement.

"""Population-level exposure caps for experimental features
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

total_exposure = sum(exp.fraction for exp in active_experiments)
if total_exposure + new.fraction > CAP: queue(new) else: launch(new)

Operating boundaries, no-go zones and ODD polygons are periodically reconciled with authoritative sources — municipal permits, airspace charts, site plans — and discrepancies (a permit boundary that moved, a new school zone, an expired temporary restriction) are surfaced and corrected before a vehicle operates on a stale fence.

"""Cross-validation of geofences against authoritative boundaries
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.zones
"""
from gaisafety.physical import SSMParams, protective_distance, permitted_speed

for fence in FENCES: diff = geo_diff(fence.polygon, authority.current(fence.ref))
    if diff.area > TOL: fence.freeze(); tickets.open("fence differs from authoritative boundary", fence, diff)

Vulnerability alerts on dependencies are triaged with reachability analysis — whether the vulnerable code path is reachable from the application’s entry points — so that the patch SLO is spent on the vulnerabilities that can be exercised, and unreachable ones are tracked rather than treated as fire drills; the analysis is re-run when code changes.

"""Dependency freshness with reachability analysis
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.zones
"""
from gaisafety.physical import SSMParams, protective_distance, permitted_speed

for vuln in alerts: vuln.reachable = callgraph.reaches(entry_points, vuln.function)
prioritize([v for v in alerts if v.reachable], by=severity); track(unreachable)

A serious incident freezes the capability involved — the tool, the feature, the autonomy level — across the fleet, and the freeze is lifted only by a documented decision citing the root cause, the fix, the regression scenario added and the evidence that the fix works; the decision to unfreeze is signed by the threshold group, because "we need it back" is not evidence.

"""Post-incident capability freeze
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

freeze(capability, reason=incident.id)
unfreeze(capability) only_if decision.cites(root_cause, fix, regression_scenario, evidence) and threshold_sign(decision)

Each proposed action is scored for consistency with the task’s stated intent by a separate model given only the intent and the action; an action a reasonable reader would not expect from that intent — a payment in a summarization task, a file upload in a calendar task — is held even if it is within scope, because scope says what is allowed and intent says what is expected.

"""Intent–action consistency scoring
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

s = consistency_model(intent=task.intent, action=action.summary())
if s < C_MIN: hold(action, reason="inconsistent with stated intent")

Multi-step plans are re-ordered so that reversible actions execute before irreversible ones wherever dependencies allow, and the irreversible step is preceded by a fresh state check and, where applicable, a confirmation; a plan that deletes first and verifies second is the PocketOS plan.

"""Reversibility-first action ordering
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

plan = topo_sort(plan, key=lambda a: (a.irreversible, a.order))
before(irreversible_step): recheck_state(); require_confirmation_if(irreversible_step.tier >= 3)

Every safety telemetry stream has an expected cadence; a stream that goes quiet — a fleet that stops sending near-misses, a classifier that stops emitting verdict counts — raises an alarm within one missed interval, because silence is indistinguishable from "everything is fine" only if nobody checks the clock.

"""Silent-period detection for safety telemetry
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

for stream in SAFETY_STREAMS: if now() - stream.last_seen > 2 * stream.cadence: alarm("telemetry silent", stream); treat_as_degraded(stream.source)

The review interface itself is red-teamed: outputs crafted to look safe in the reviewer’s view while carrying harm in the raw content (collapsed sections, misleading previews, hidden characters, rendering differences) are submitted to the review queue, and the interface is fixed until reviewers catch them at the target rate.

"""Adversarial evaluation of the human-review interface
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

for probe in INTERFACE_PROBES: submit(probe, to=review_queue)
assert catch_rate(reviewers, INTERFACE_PROBES) > 0.95, "review interface can be fooled"

Behavioural fingerprints — response distributions on probes, tool-use patterns, motion profiles on standard manoeuvres — are compared across all instances of a release; an instance whose fingerprint drifts from the fleet’s is quarantined for inspection, catching a tampered node, a bad update or a hardware fault without needing to know which.

"""Fleet-wide behavioural fingerprint comparison
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

fp = {node: fingerprint(node, PROBES) for node in fleet(release)}
outliers = [n for n in fp if distance(fp[n], median(fp.values())) > D_MAX]; quarantine(outliers)

Applications reference system prompts, policies and templates by content hash; the gateway resolves the hash to the reviewed artifact and refuses unknown hashes, so that an application cannot smuggle an unreviewed prompt into production and every request records exactly which reviewed text it ran under.

"""Content-addressed prompts and policies
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

req.system_ref = "sha256:ab12…"                 # not the text
system = registry.resolve(req.system_ref) or Reject("unknown prompt hash"); assert registry.reviewed(req.system_ref)

Ambiguity in natural-language commands to robots and vehicles is resolved conservatively: among candidate interpretations the executor picks the one with the lowest hazard if it is also plausible, or asks; "faster" near a person means the fastest safe speed, "over there" without a resolved referent means nothing happens.

"""Fail-safe interpretation of ambiguous commands to physical systems
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

cands = parse_all(utterance); safe = [c for c in cands if hazard(c) <= min(hazard(x) for x in cands) + EPS]
if len(cands) > 1 and plausibility_gap(cands) < G: ask_clarification() else: execute(safe[0])

Refused requests are retained under a separate, purpose-limited regime — longer than ordinary traffic, access-controlled to the safety team, excluded from product analytics and training for helpfulness — because refusals are the richest record of attack patterns, and because keeping them in the general logs mixes attack data with user data.

"""Retention of refusals for pattern learning
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

if decision.refused: store(req, bucket="refusals", retention=days(365), acl=SAFETY_TEAM, purposes=["attack_analysis", "classifier_training"])
assert not analytics.reads("refusals") and not helpfulness_training.reads("refusals")

Release notes for models and policies include a generated, human-readable behavioural changelog — categories where refusals increased or decreased, new capabilities, changed defaults — derived from the differential tests rather than written by marketing; deployers and regulators read the changelog, and a change that is not in it is a finding.

"""Human-language change logs for safety behaviour
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

diff = compare(model_new, model_old, CORPUS)
changelog = render_plain_language(diff.by_category(), thresholds=MATERIALITY); release.notes.append(changelog); assert diff.material_changes ⊆ changelog.items

Each learned component carries a validated-conditions envelope — lighting, weather, speed, population density, language, domain — and a condition monitor; outside the envelope the component’s outputs are down-weighted or replaced by the conservative path, and time spent outside the envelope is reported so the validation can be extended where the machine actually operates.

"""Environmental-condition gating of learned components
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

env = condition_monitor.current()
if not component.validated_envelope.contains(env): fusion.weight(component, 0.3); metrics.record("outside_envelope", component, env)

Access to a user’s data by models, agents and staff is counted in a tamper-evident ledger the user can inspect — which systems, how often, for what purpose — with anomalies (an unexpected reader, a spike) surfaced to the user; a data subject who can see access is a data subject who can notice misuse.

"""Query-budget proofs for privacy
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

ledger.append(sign(LOG_KEY, {"subject": u.id, "reader": system.id, "purpose": p, "ts": now()}))
u.dashboard.show(ledger.for_subject(u.id), anomalies=detect_unusual_readers(u.id))

Safety-critical components — certified sensors, safety controllers, guard classifiers — are sourced from two independent suppliers or implementations wherever the architecture allows redundancy, and the two are compared in operation; a common-mode flaw, a supply-chain compromise or a bad firmware update in one supplier does not disable the safety function everywhere.

"""Dual-sourced safety-critical components
Chapter 5 · jailbreak defence stack
package: gaisafety.eval (ensembles)
"""
from gaisafety.eval import attack_success, release_gate

assert supplier(channel_a) != supplier(channel_b) and implementation(channel_a) != implementation(channel_b)
if disagreement_rate(channel_a, channel_b, days=7) > R_MAX: investigate("common-mode or supplier fault")

Incident bundles are analysed by a causal-inference pipeline over the structured telemetry: which control failed or was absent, which condition made it fail, which earlier event made the condition likely; candidate causal chains are ranked and presented with the supporting log entries, so the post-mortem starts from evidence rather than from memory.

"""Automated causal root-cause analysis
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

g = causal_graph.fit(telemetry_before(incident, hours=24), priors=CONTROL_DEPENDENCIES)
chains = g.explain(outcome=incident.effect, top_k=5); postmortem.seed(chains, evidence=g.supporting_logs(chains))

Every update — model, prompt, configuration, firmware — is diffed for capability changes against the signed manifest: new tools, wider scopes, new network reach, new data classes, higher autonomy; an update that adds capability is routed through the capability review regardless of how it was labelled, so a "bug fix" cannot quietly enable a mailer.

"""Capability-diff gate on updates
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

delta = capability_diff(manifest_current, capabilities_of(update))
if delta.adds_any(["tools", "scopes", "network", "data_classes", "autonomy"]): route(update, review="capability_board") else: route(update, review="standard")

Items submitted to prompt, agent and plugin marketplaces are executed in an instrumented sandbox against injection, extraction, over-collection and misuse suites, with their network and tool behaviour recorded; listing requires passing scores, the behavioural record is attached to the listing, and re-tests run on every update.

"""Marketplace behavioural sandbox
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

rec = sandbox.run(item, suites=[INJECTION, EXTRACTION, OVERCOLLECTION, MISUSE], record=["network", "tools", "data_access"])
list(item) only_if rec.passes and human_review(rec).ok; retest_on_update(item)

Approvals that satisfy a human-in-the-loop requirement are collected through a channel that verifies a live person — hardware key touch, liveness challenge, attested device with an interactive session — and rejects API calls, scripts or agents acting on the human’s behalf; an approval workflow an agent can complete is not a human-in-the-loop control.

"""Proof of personhood for approvals
Chapter 5 · jailbreak defence stack
package: gaisafety.tools (approval gate)
"""
from gaisafety.tools import ToolGateway, Denied
from gaisafety.types import Effect

approval = trusted_ui.approve(action, require=["hardware_key_touch", "liveness", "interactive_session"])
assert approval.channel != "api" and not approval.session.automated

For every tool, the distribution of arguments seen in legitimate use — recipients, paths, amounts, query shapes — is modelled; a call whose arguments are improbable under the baseline is held for review even if each argument is individually valid, catching the exfiltration that passes schema validation because the schema allows any address.

"""Tool-argument distribution monitoring
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

p = arg_model[tool.name].log_prob(call.args)
if p < P_MIN: hold(call, reason="improbable arguments"); review.enqueue(call)

Rollouts proceed by cohort in order of vulnerability — internal users, verified adults, general adults, then minors and other protected cohorts — with each cohort’s metrics gating the next; a feature is never tested on the people least able to absorb its failures, and the cohort order is written into the release policy rather than decided per launch.

"""Cohort-ordered rollouts
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

for cohort in ["internal", "verified_adults", "general_adults", "protected_cohorts"]:
    deploy(feature, cohort); assert metrics(cohort, days=7).safe before continue

Data pipelines and export jobs are monitored for content class in flight — personal data, secrets, sensitive categories — against what the pipeline is declared to carry; a pipeline that begins emitting an undeclared class is halted automatically, its output quarantined, and the change that caused it traced, because a leak through a pipeline is a leak at scale.

"""Data-flow circuit breaker
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

for batch in pipeline: cls = classify(batch)
    if cls - pipeline.declared_classes: pipeline.halt(); quarantine(batch); incidents.open("undeclared data class in flow", pipeline.id)

Before executing a task with consequential effects, the agent restates the task in its own words — goal, scope, actions it intends, what it will not do — and proceeds only on confirmation; the restatement catches misread requests, injected goals and scope creep at the point where they are cheapest to catch, and it is logged with the plan hash.

"""Task restatement before consequential execution
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

restated = agent.restate(task)                     # goal, scope, intended actions, exclusions
if task.consequential: confirmed = principal.confirm(restated) or abort(); ledger.commit(task.id, sha256(restated))

New or changed policy rules run in shadow mode: they evaluate on live traffic and log their would-be decisions without enforcing them; the shadow log is compared with current decisions, reviewed for false positives and blind spots, and only then promoted to enforcement — a rule that has not been shadowed has not been tested on reality.

"""Rule shadow mode
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

rule.mode = "shadow"; log(rule.evaluate(req), enforced=False)
after days(7): report(shadow_vs_live(rule)); rule.mode = "enforce" only_if human.approve(report)

Voice commands to physical systems are accepted only when the speaker is localized within a bounded distance and in view, using microphone-array direction and the presence layer; a command from a loudspeaker, a phone or a person behind a wall is not a command, and a command shouted across a hall is confirmed before it acts.

"""Proximity-gated voice commands
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

src = mic_array.localize(utterance); speaker = presence.person_at(src, tol_m=0.5)
if speaker is None or distance(speaker, robot) > D_CMD: return ignore("command source not localized nearby")

Emergency overrides — bypassing a gate, disabling a control, extending a scope under time pressure — are permitted through a break-glass path that records the reason and the actor, automatically expires, and opens a mandatory review by an independent person within twenty-four hours; the path exists because emergencies exist, and the review exists because break-glass is how controls quietly die.

"""Emergency-override post-hoc review
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

override = break_glass(control, reason=reason, by=actor, expires=now() + hours(4))
review.schedule(override, by=independent_reviewer, within=hours(24)); assert override.expired_or_reviewed()

Each tenant’s effective safety configuration — classifiers, thresholds, policies, jurisdiction profile — is hashed and attested per request window; the attestation is available to the tenant and to auditors, so a deployer answering a regulator can show not only what the provider says it does, but what configuration its own traffic was actually processed under.

"""Per-tenant safety configuration attestation
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

cfg_hash = sha256(effective_config(tenant)); attest = sign(PROVIDER_KEY, {"tenant": tenant.id, "window": w, "config": cfg_hash})
tenant.api.get_attestation(w) -> attest

Each retrieved passage arrives with a provenance score from source reputation, signature status, age, agreement with other sources and injection-detector output; the score is shown to the model in the data channel and to the user in citations, so an answer built on low-provenance passages is visibly weaker and the planner can require a higher score for consequential steps.

"""Retrieval-result provenance scoring
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

for p in passages: p.prov = combine(reputation(p.source), signed(p), freshness(p), corroboration(p, passages), 1 - injection_score(p))
ctx.add(passages, show_scores=True); if step.consequential: require(min(p.prov for p in cited) > P_MIN)

For borderline requests the gateway generates paraphrases, classifies each, and treats disagreement among the verdicts as a signal to route to the heavy path or to review rather than to accept the most permissive verdict; an attack tuned to one wording rarely survives its own paraphrases.

"""Refusal-consistency across paraphrases at inference
Chapter 5 · jailbreak defence stack
package: gaisafety.classify (training-time, ml extra)
"""
from gaisafety.types import Verdict, Tier  # training-time / model-side: needs the `ml` extra

vs = [clf(para) for para in paraphrase(prompt, n=5)]
if max(vs) - min(vs) > 0.3: route_heavy(prompt) else: decide(mean(vs))

Tool results are validated against declared response schemas before entering context; extra fields, embedded instructions in fields that should be numeric or enumerated, and oversized strings are rejected, and a tool whose results drift from its schema is quarantined — the return path is a channel, and channels have contracts.

"""Tool-result schema enforcement
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

r = tool.call(args); if not schema[tool.name].validate(r): quarantine(tool, reason="result schema violation"); raise Denied()

Elevated capabilities granted for a task decay over the session: scopes narrow, spend caps shrink and confirmation thresholds fall as time and action counts accumulate, unless renewed by the principal; a session that has run long enough to be forgotten is a session an attacker can inherit.

"""Session-level privilege decay
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.identity
"""
from gaisafety.agent import Scope, AgentIdentity, Registry

cap = initial_cap * exp(-t / TAU) * exp(-actions / A_HALF)
if cap < cap_needed(action): return renew_or_deny(principal)

For tasks whose acceptance criteria are hard to write by hand, the model drafts oracles — assertions about the resulting state — that the requester ratifies before the task runs; ratified oracles are frozen outside the agent’s reach, and the agent that later wants to change them must go back to the requester.

"""Model-generated test oracles with human ratification
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

oracles = model.draft_oracles(task); ratified = requester.ratify(oracles); freeze(ratified, outside=agent.scope)
done = all(o(state) for o in ratified)

Beyond speed and force caps, the safety controller budgets kinetic and potential energy transitions per minute in collaborative zones — total accelerations, lifts, releases — so that a policy commanding many individually legal but collectively violent motions hits an energy budget the shield enforces.

"""Physical-world rate limits by energy
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

e = sum(abs(delta_kinetic) + abs(delta_potential) for m in motions_last_minute)
if e + planned_energy(next_motion) > E_BUDGET[zone]: safety.hold(next_motion, "energy budget")

Every deployment ships a signed capability manifest — tools, data classes, jurisdictions, autonomy level, user populations — approved by the accountable owner; the runtime enforces the manifest, drift from it is a fault, and the manifest is the artifact regulators, deployers and auditors read instead of the code.

"""Human-approved capability manifests per deployment
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

manifest = sign(OWNER_KEY, {"tools": [...], "data": ["internal"], "regions": ["EU"], "autonomy": "approve_each", "users": "adults"})
runtime.enforce(manifest); assert running_config.within(manifest)

Red teams exercise complete user journeys — sign-up, verification, tool connection, sharing, export, deletion — rather than the model endpoint alone, because most incidents in the catalog were product-flow failures (an indexed share link, a plugin OAuth flow, a fork PR) rather than model failures.

"""Adversarial user-journey testing
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

for journey in ["signup", "verify", "connect_tool", "share", "export", "delete"]: findings += redteam.run(journey, personas=ATTACKER_PERSONAS)

A fraction of decisions made by the fast production path — allows, refusals, tool permits — is re-evaluated asynchronously by a slower, stronger ensemble; disagreements are labelled, fed to calibration and retraining, and, for consequential allows, trigger retroactive review; the hot path stays fast, and the cold path keeps it honest.

"""Cold-path verification of hot-path decisions
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

if random() < SAMPLE_RATE: cold_queue.put(decision)
worker: v = strong_ensemble(decision.input); if v != decision.verdict: labels.add(decision, v); if decision.consequential: review.enqueue(decision)

Streaming cut-offs are placed at token boundaries chosen so that the delivered prefix does not itself contain the operational content — cutting after a heading rather than mid-list, before a number rather than after it — using a lookahead buffer sized from the classifier’s latency; a cut-off that leaks the first three steps is a partial leak with a receipt.

"""Refusal-safe streaming cut-off placement
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

buf = lookahead(stream, tokens=K)
if risk(buf) > T: emit(buf[:safe_boundary(buf)]); cut()

The hierarchy is extended to modalities: content extracted from images, audio and video is placed at the data level regardless of what it says, and the model is trained on multimodal hierarchy data so that an instruction spoken in an audio clip or written on a sign ranks as data even when it is phrased as a command.

"""Instruction hierarchy for multimodal inputs
Chapter 5 · jailbreak defence stack
package: gaisafety.assemble
"""
from gaisafety.assemble import assemble, new_nonce, datamark
from gaisafety.types import Tainted, Trust

ctx.add(ocr(image), level="data"); ctx.add(asr(audio), level="data")
assert hierarchy_eval(model, MULTIMODAL_INJECTION_SUITE).asr < BASELINE / 3

Retired or unsafe checkpoints are deleted through crypto-shredding of their encryption keys and a sweep of every storage location, with a signed attestation of deletion added to the transparency log; a checkpoint that "should have been deleted" is the weight leak of next year.

"""Verifiable deletion of model checkpoints
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

kms.destroy(ckpt.key); for s in ALL_STORES: assert not s.contains(ckpt.id)
log.append(sign(DELETION_KEY, {"ckpt": ckpt.id, "deleted": now(), "stores_verified": ALL_STORES}))

A steering vector computed as the difference between activations on harmful and harmless prompts is added at a chosen layer during inference, shifting behaviour toward refusal or caution without retraining; the magnitude is a dial the gateway can raise for suspicious sessions.

"""Activation steering with safety vectors
Chapter 5 · jailbreak defence stack
package: gaisafety.classify (training-time, ml extra)
"""
from gaisafety.types import Verdict  # training-time: needs the `ml` extra

v = mean(acts(harmful, L)) - mean(acts(harmless, L))
def forward_hook(h): return h + alpha(session.risk) * v        # alpha rises with session risk

The model is trained with reserved control tokens that condition generation on a mode — standard, high-caution, minor-safe — so that mode switching is a token the user cannot type rather than an instruction the user can argue with.

"""Control tokens for safe modes
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

MODES = {"standard": "<|mode:std|>", "caution": "<|mode:cautious|>", "minor": "<|mode:minor|>"}
prompt = MODES[policy.mode_for(session)] + assembled_context          # tokens filtered from user text

During generation a keyed hash of the previous token partitions the vocabulary into green and red lists and nudges sampling toward green; a detector counts green tokens in a text and returns a z-score. Weak per token, strong over a paragraph, invisible to readers.

"""Statistical text watermarking
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

def sample(logits, prev, key):
    green = green_list(prev, key); logits[green] += DELTA; return softmax_sample(logits)
def detect(text, key): return z_score(sum(t in green_list(p, key) for p, t in bigrams(text)), len(text))

Weight merging and adapter stacking are treated as new models: the merged checkpoint runs the full safety, over-refusal and fingerprint suites before it may be served, and merges that mix a safety-trained base with an unvetted adapter are blocked by default.

"""Model-merge safety regression
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

def merge_gate(merged, parents):
    if any(not p.safety_attested for p in parents): return Denied("unvetted parent")
    return release_gate(merged)                                  # same suites as a new model

Quantized, pruned or compiled variants behave differently at the margin, including on refusals; every serving artifact is evaluated as its own release, and the behavioural fingerprint is recomputed for each.

"""Quantization and compilation regression checks
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.env
"""
from gaisafety.agent import sign_env, verify_env, write_permit

for variant in ["fp16", "int8", "int4", "compiled"]:
    art = build(model, variant); assert release_gate(art).ok; fingerprints[variant] = fingerprint(art)

Distillation datasets are sampled to include the teacher’s refusal and safe-completion behaviour in proportion, and the student is gated on the same safety suites as the teacher before release.

"""Safety-retaining distillation
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

data = sample(teacher, prompts=benign + borderline + harmful, include_refusals=True)
student = train(data); assert eval_refusal(student, HARM_SUITE) >= eval_refusal(teacher, HARM_SUITE) - 0.02

Under-trained and glitch tokens are found by embedding-norm and behaviour scans and either retrained, mapped to safe fallbacks or excluded from the vocabulary exposed to users; reserved control tokens are stripped from all external input.

"""Tokenizer hardening
Chapter 5 · jailbreak defence stack
package: gaisafety.normalize
"""
from gaisafety.normalize import normalize

glitch = [t for t in vocab if embed_norm(t) < NORM_MIN or behaviour_anomaly(t)]
tokenizer.remap(glitch, to=UNK); tokenizer.strip_reserved(external_input)

Safety suites are translated and natively authored in every supported language, including low-resource ones and transliterations; a release is gated on the worst language, not the average.

"""Multilingual safety parity
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

rates = {lang: eval_refusal(model, HARM_SUITE.in_language(lang)) for lang in SUPPORTED}
assert min(rates.values()) >= rates["en"] - 0.05, "safety parity failure: " + str(rates)

Where a model produces reasoning traces, a monitor model reads them for signs of deception, reward hacking, evaluation gaming or plans to circumvent controls, and flags the episode; the traces are never optimized against the monitor, so they stay informative.

"""Chain-of-thought monitoring
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

trace = model.reason(task)
if cot_monitor.flags(trace, ["deception", "circumvent_controls", "reward_hack"]): quarantine(task); alert()

Capability evaluations use elicitation techniques (fine-tuning on the task, scaffolding, best-of-n) and compare against the model’s performance on matched benign tasks; a suspicious gap is reported as a finding and the higher elicited number is used for gating.

"""Sandbagging detection
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

plain = eval(model, DANGEROUS_TASKS); elicited = eval(finetune(model, DANGEROUS_TASKS.train), DANGEROUS_TASKS)
if elicited - plain > 0.15: findings.add("possible sandbagging"); gate_on(elicited)

Sparse-autoencoder features correlated with deception, harmful intent or evaluation awareness are identified offline and monitored at inference as cheap probes, complementing text classifiers with a view inside the model.

"""Interpretability feature monitors
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

feats = sae.encode(model.activations(prompt, L))
if feats[DECEPTION_ID] > T or feats[HARM_INTENT_ID] > T: escalate("interpretability probe")

Web pages handed to an agent are sanitized: hidden elements, off-screen text, zero-size fonts, HTML comments and metadata instructions are removed, and the visible text is compared with a screenshot-derived reading so that content only the model would see is treated as an injection attempt.

"""Browser-agent DOM sanitization
Chapter 5 · jailbreak defence stack
package: gaisafety.normalize
"""
from gaisafety.normalize import normalize

visible = dom.visible_text(page); shot = ocr(screenshot(page))
if similarity(visible, shot) < 0.8: flag("hidden content differs from rendered page"); page = shot

Chat and agent interfaces never auto-fetch images, links or embeds contained in model output; URLs are rendered as text until a user clicks, and query strings that carry conversation content are stripped. EchoLeak, Bard and CamoLeak all ran through this channel.

"""No auto-loading of external resources in AI output
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

def render(output):
    return escape(output).replace(MARKDOWN_IMAGE, lambda m: "[image link removed: " + strip_query(m.url) + "]")

Content pasted into an AI interface is normalized and screened like any external input, invisible characters are stripped, and the user is shown what was actually pasted when it differs from what was displayed.

"""Clipboard and paste-injection guard
Chapter 5 · jailbreak defence stack
package: gaisafety.normalize
"""
from gaisafety.normalize import normalize

pasted = normalize(clipboard.text); if pasted != clipboard.visible_text: warn_user(diff(pasted, clipboard.visible_text))

Ingress scans for credential patterns and replaces them with vaulted references; the model works with placeholders and the secret is re-inserted only by a tool that needs it, so it never appears in logs, memory or output.

"""Secrets detection at ingress
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

for m in SECRET_PATTERNS.finditer(text): ref = vault.store(m.group()); text = text.replace(m.group(), "{{secret:" + ref + "}}")

Names, addresses and identifiers not required by the task are replaced with consistent pseudonyms before the model sees them and reversed only in the final output, shrinking the blast radius of any leak.

"""PII minimization before the model
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

text, mapping = pseudonymize(text, keep=task.required_entities); out = model(text); return depseudonymize(out, mapping)

Cached completions carry the policy and classifier versions they were produced under; a cache hit under a newer policy is re-screened or invalidated, and refusals and flagged outputs are never cached.

"""Response caching keyed to policy version
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

key = (hash(prompt), policy.version, clf.version)
if cache.get(key) and not cache.get(key).flagged: return cache.get(key)

Every system prompt and template lives in version control with tests (the benign and attack suites), ships through the same canary rollout as models, and can be rolled back in minutes when a change raises ASR or refusals.

"""Prompt-template versioning and rollback
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

deploy(template, canary=0.05); if metrics.asr(template) > baseline * 1.1: rollback(template)

Each capability — browsing, code execution, email, file access, image generation — has an independent feature flag the safety team can flip fleet-wide in seconds, with a drill schedule to prove the switch works.

"""Per-capability kill switches
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

FLAGS = {"browse": True, "exec": True, "email": True}
def can(cap): return FLAGS[cap] and session.capabilities.get(cap, False)

Browsing and retrieval are limited to allowlisted domains for sensitive tasks, results carry retrieval timestamps, and stale or unknown-domain content is labelled so the model and the user can discount it.

"""Domain allowlists and freshness for retrieval
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if task.sensitive and domain(url) not in ALLOW: return Skip(url)
doc.trust = "allowlisted" if domain(url) in ALLOW else "unknown"; doc.age = now() - doc.fetched

Maximum output length, code-execution rights and format freedom shrink with session risk: a high-risk session gets short, structured, explanation-only answers.

"""Output caps by risk tier
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

caps = {"low": 4000, "medium": 1200, "high": 300}[session.tier]; model.generate(prompt, max_tokens=caps)

Serving infrastructure scrubs GPU and host memory between tenants and jobs, isolates tenants at the process or container level with driver support, and tests the isolation with canary allocations — the LeftoverLocals lesson.

"""GPU memory scrubbing between tenants
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

job.finish(); gpu.zero_all_local_memory(); assert canary_read() == 0

Models and artifacts are loaded only from safe formats (safetensors, ONNX with checked graphs); pickle-based loading is disabled in production, and hub downloads are scanned and hash-pinned.

"""Safe serialization only
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

assert path.endswith(".safetensors"); weights = safetensors.load(path); assert sha256(path) == PINNED[name]

Credentials are injected at runtime from a manager with short TTLs, never in prompts, config or environment dumps; log pipelines scrub credential patterns before storage.

"""Secrets manager and log scrubbing
Chapter 5 · jailbreak defence stack
package: gaisafety.stream (DLP)
"""
from gaisafety.stream import guarded_stream

token = vault.lease("db", ttl=900); logs.add_scrubber(SECRET_PATTERNS)

MCP and plugin tool descriptions are hashed at approval; any change — the "rug pull" pattern — revokes approval and quarantines the server until a human re-reviews it.

"""Tool-description integrity hashes
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

h = sha256(server.list_tools()); if h != approved[server.id]: server.quarantine("tool description changed"); review.enqueue(server)

Every tool server runs in its own sandbox with a manifest of resources it may touch; the runtime enforces the manifest, and a server whose behaviour exceeds it is stopped.

"""Tool-server isolation and least-privilege manifests
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust, join

manifest = {"fs": ["/workspace"], "net": ["api.example.com"], "env": []}
sandbox.run(server, manifest); on_violation = lambda v: sandbox.kill(server, v)

Every side-effecting tool call carries an idempotency key derived from the plan step; the gateway executes a key once and returns the stored result on retries, so agent loops and timeouts cannot repeat irreversible actions.

"""Idempotency keys for irreversible tool calls
Chapter 5 · jailbreak defence stack
package: gaisafety.tools
"""
from gaisafety.tools import ToolSpec, ToolGateway, Denied, mint_token
from gaisafety.types import Effect, Tainted, Trust

key = hash(task.id, step.id, call.args); if store.has(key): return store.get(key)
result = execute(call); store.put(key, result)

Every task has a step budget and a wall-clock limit; exceeding either pauses the agent, preserves state, and asks a human whether to continue.

"""Max-steps and wall-clock guards
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if steps > MAX_STEPS or now() - t0 > MAX_WALL: agent.pause(save=True); human.ask("continue?")

The runtime detects repeated identical or near-identical actions and outputs, breaks the loop, and escalates rather than letting the agent burn budget or hammer a system.

"""Loop and repetition detection
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if similarity(action, history[-3:]) > 0.95: agent.break_loop(); escalate("repetition")

Counts of emails, messages, posts and payments per task and per hour are capped at the tool layer; the caps are low by default and raised only by a human for a named task.

"""Outbound-communication rate limits
Chapter 5 · jailbreak defence stack
package: gaisafety.gateway (budgets)
"""
from gaisafety.gateway import Gateway
from gaisafety.types import Verdict

LIMITS = {"email": 5, "message": 10, "payment": 1}
if counters[task.id][kind] >= LIMITS[kind]: raise Denied("outbound limit")

Long-running agents that expect supervision check for an operator heartbeat; absence downgrades the agent to read-only and defers consequential actions until someone is back.

"""Operator-presence heartbeat for long-running agents
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

if now() - operator.last_seen > 600: agent.capabilities = READ_ONLY; agent.defer_consequential()

Before release, agents are run against simulated users that lie, pressure, inject and socially engineer, with success rates on the agent’s refusals, checks and escalations gated like any other suite.

"""Adversarial user simulators
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

results = [run(agent, sim_user(profile)) for profile in ["pressure", "injection", "impersonation", "urgency"] for _ in range(200)]
assert failure_rate(results) < 0.02

Uploaded and generated imagery is checked against industry hash lists of known abuse material through a provider-hosted service, generation prompts are classified for sexualized-minor content with a low threshold, and matches are handled by the mandated reporting path rather than the ordinary moderation queue.

"""Known-CSAM hash matching and generation blocking
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

if hash_match_service.match(image): report_to_mandated_channel(image); block(); return
if minor_sexualization_clf.score(prompt) > 0.2: block(); log_for_review()

Image and video tools refuse face-swap onto explicit content, nudity edits of real people and any generation combining an identifiable face with sexual content; detections feed a hash list so a blocked image cannot be re-attempted.

"""Non-consensual intimate imagery prevention
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if faceswap_detector(request) and nudity_clf(request.target) > 0.5: block(); hashlist.add(request.face_hash)

Voice cloning requires a consent proof — a liveness-verified recording of the speaker consenting, bound to the voice model — and cloned voices carry a watermark and a registry entry so that fraud calls can be traced.

"""Voice-clone consent verification
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

assert consent.verify(speaker, liveness=True); voice = clone(speaker.samples); registry.add(voice, speaker, watermark=True)

Account-level detectors look for the patterns Anthropic’s 2026 report documented — thousands of dating profiles, scripted emotional escalation, payment requests — and throttle, verify or terminate accounts that match, feeding the campaign-clustering system.

"""Scam-script and mass-persona detection
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.monitor / gaisafety.stream
"""
from gaisafety.physical.monitor import Prop, SafetyMonitor

if profiles_created(account, days=14) > 50 and scam_script_clf(account.outputs) > 0.7: account.suspend(); campaigns.add(account)

During defined election windows, generation of targeted political persuasion, synthetic media of candidates and voting misinformation is restricted, disclosure is stricter, and outputs about voting logistics are grounded in official sources only.

"""Election-period policies
Chapter 5 · jailbreak defence stack
package: gaisafety.eval (ensembles)
"""
from gaisafety.eval import attack_success, release_gate

if elections.active(user.region): policy.enable(["no_candidate_deepfake", "voting_info_official_only", "persuasion_limits"])

Conformal prediction calibrates the model’s uncertainty so that a prediction set has a guaranteed coverage; when the set is too large or empty the system abstains and routes to a human — a statistically honest version of the agreement gate.

"""Conformal abstention
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

q = quantile(calibration_scores, 1 - ALPHA); pset = {y for y in Y if score(x, y) <= q}
if len(pset) != 1: abstain_to_human(x)

Dangerous-capability evaluations use fine-tuning, scaffolding, tools and many samples to elicit the model’s best performance, because a safety claim based on an unelicited score is a claim about the evaluator’s effort, not the model.

"""Capability elicitation before safety claims
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

score = max(eval(m, T) for m in [model, finetune(model, T), scaffold(model, tools=True)] for _ in range(N_SAMPLES))

External reports of jailbreaks and injections enter a triage pipeline with severity rubrics, reproduction, payment tiers and a mandatory path into the regression suite and the retraining queue; bounty statistics are published.

"""Safety bug-bounty triage pipeline
Chapter 5 · jailbreak defence stack
package: gaisafety.classify (training-time, ml extra)
"""
from gaisafety.types import Verdict  # training-time: needs the `ml` extra

report = intake.parse(submission); if reproduce(report): pay(report, tier(report)); regression_suite.add(report); retraining_queue.add(report)

Circuit breakers, capability kill switches, rollbacks and incident clocks are exercised on a schedule with injected faults in staging and controlled drills in production; a switch that has not been thrown in ninety days is assumed broken.

"""Safety-system chaos drills
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.statemachine
"""
from gaisafety.physical import SafetyStateMachine, S

for switch in SAFETY_SWITCHES:
    if days_since(switch.last_drill) > 90: drill(switch); assert switch.worked

Cross-functional exercises walk through scenarios from this book’s incident record — a production deletion, a zero-click exfiltration, an agent swarm — against the actual runbooks, clocks and contacts, and every gap found becomes a ticket.

"""AI incident tabletop exercises
Chapter 5 · jailbreak defence stack
package: gaisafety.agent.ledger
"""
from gaisafety.agent import Ledger

for scenario in ["pocketos_deletion", "echoleak_exfil", "agent_swarm"]: gaps += tabletop.run(scenario, runbooks); tickets.open_all(gaps)

Models, adapters and tools sourced from vendors and hubs go through a risk assessment — provenance, safety evaluations, licence, support lifetime, incident history — before use, and are re-assessed on each version and each vendor incident.

"""Third-party model risk assessment
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

assess(vendor_model, checks=["provenance", "safety_evals", "licence", "support_end", "incident_history"]); re_assess_on(vendor_model.version_change | vendor.incident)

Ultra-wideband tags on workers give robots and vehicles a ranging signal independent of vision; the fleet slows or stops on proximity even when the person is occluded, and untagged people are still covered by the sensor stack.

"""Worker proximity beacons
Chapter 5 · jailbreak defence stack
package: gaisafety.normalize
"""
from gaisafety.normalize import normalize

d = uwb.range(nearest_tag); if d < SLOW_M: robot.derate(0.3); if d < STOP_M: robot.protective_stop()

Any output containing a drug, a dose or a regimen is parsed and checked against a maintained formulary and interaction database before it is shown; unverifiable dosages are replaced with a reference, and interactions above a severity threshold are surfaced with the source.

"""Dosage and drug-interaction verification in the tool chain
Chapter 5 · jailbreak defence stack
package: gaisafety.classify
"""
from gaisafety.types import Classifier, Verdict

for rx in extract_prescriptions(output):
    v = formulary.verify(rx.drug, rx.dose, patient.weight, patient.renal)
    if not v.ok: output = replace(output, rx, "[dose withheld: verify in formulary — " + v.reason + "]")
    for i in interactions.check(rx.drug, patient.meds): if i.severity >= "major": output += "\n⚠ " + i.text

Clinical outputs are rendered as decision support with evidence and uncertainty, require a licensed clinician’s acknowledgement before entering the record, and are audited for the rate at which clinicians override them — a zero-override rate is treated as automation bias.

"""Clinician-in-the-loop for any recommendation
Chapter 5 · jailbreak defence stack
package: gaisafety.eval
"""
from gaisafety.eval import attack_success, over_refusal, release_gate, ablate

rec = support_view(output, evidence=sources, uncertainty=conf)
record.commit(rec) only_if clinician.ack(rec); complacency_check(clinician)

Clinical answers are grounded in versioned guidelines and local protocols retrieved at query time, cite the passage, and are refused when no guideline covers the question rather than improvised.

"""Guideline-grounded generation
Chapter 5 · jailbreak defence stack
package: gaisafety.physical.shield
"""
from gaisafety.physical import OccupancyGrid, Track  # + shield.cbf_filter with the `ml` extra (cvxpy)

g = guidelines.retrieve(question, version="current"); if not g: return Refuse("no guideline coverage; consult clinician")
return model.answer(question, sources=g, cite=True)