What makes defensive AI autonomous?

The ADAI paper defines membership through an Autonomy Covenant (AC): a defended perimeter, bounded effect scope, declared rollback and capability-disjoint verification must hold together. Autonomy is therefore a constrained operating relationship, with explicit responsibility for effects and evidence.

DAI is the domain-specific LLM within the defensive architecture described in the companion paper. ADAI identifies the broader proposed category and framework. A fluent LLM response or an autonomous agent label alone does not establish membership in this category.

AI defending against AI-enabled attacks and prompt injection

A defensive system can receive adversarial inputs regardless of whether a human or another AI generated them. The framework’s relevant boundary is Model-Excluded Authority (MEA): learned output is excluded from the admissibility function’s declared inputs. An Action Contract Object (ACO) declares a bounded action before execution.

Evidence-Bound Targeting (EBT) addresses the structured target domain; Principal-Perimeter Binding (PPB) binds effects to the session’s principal. These mechanisms explain why text manipulation should not itself grant execution authority. They do not promise universal attack detection, AI-origin attribution or immunity to every prompt-injection technique.

Autonomous cybersecurity and incident-response containment

At a shared enforcement point, Discriminator-Scoped Containment (DSC) requires a separating predicate that scopes containment to the intended principal. The framework analyzes aggregation, element-wise reconciliation and the conditions under which combined actions can be reversed.

This connects autonomous cyber defense to information-security concerns such as tenant isolation, bounded blast radius and reviewable incident response. Declared rollback is a contract that must be satisfied under the stated conditions; it is not evidence that every production effect is inherently reversible.

Evidence, independent verification and later review

Split-Authority Verification (SAV) separates observation from write capability. Sealed Session Chain (SSC) and Proof Path Receipt (PPR) provide ordered, seal-terminated evidence with a recomputation contract. Element-Level Reconciliation (ELR), Review-Bound Testimony (RBT) and Sealed Review Loop (SRL) bind review to identified effects.

The framework develops exact tamper localization, atomization conditions, blinded correlation and composite reversibility under explicit assumptions. The paper distinguishes properties a reader can recompute from properties requiring knowledge of construction or actual capabilities.

How should an autonomous defensive AI be evaluated?

ADAI separates three evaluation families: policy quality, envelope integrity and evidence integrity. A valid evidence chain does not establish that the selected policy was the best response. Bounded effects do not establish that the underlying detection was correct.

The ADAI manuscript is a research preprint and proposed framework, not a certification standard or a universal performance claim. Formal results are conditional on their assumptions. The companion DAI paper supplies version-specific implementation observations; not every theoretical construction is asserted to be implemented or independently validated.

Read both research papers

DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
10.5281/zenodo.23089652

Autonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
10.5281/zenodo.23089594

Definitions of all twelve mechanisms · DAI: A Cybersecurity LLM for Governed Incident Response