What is DAI, and how is its LLM structured?
DAI is the LLM described in the DAI paper; ADAI is the proposed Autonomous Defensive Artificial Intelligence category and formal framework described in the companion paper. The names identify different levels: a specific model and defensive system, and a category with explicit membership conditions.
The public manuscript describes a BPE tokenizer, a causal Transformer and training on the system’s own outcome-verified transcripts. The learned path narrates the observed outcome. Model output does not adjudicate admissibility or acquire execution authority. The public research describes the architecture; this site does not distribute proprietary source code or model weights.
How does DAI support cybersecurity incident response?
An episode starts with signal curation and target extraction from declared structured fields. It proceeds through a reviewed playbook and an Action Contract Object (ACO), then deterministic admissibility and bounded network-edge execution. A verifier with disjoint capabilities observes the result, and a hash-linked session chain seals the evidence.
Scheduled review, element-level reconciliation and declared undo complete the response lifecycle. Principal-Perimeter Binding (PPB) and Discriminator-Scoped Containment (DSC) address scoped containment at shared enforcement points. The paper explains how aggregation under a rule budget must preserve the identity needed for reconciliation.
Can a defensive AI protect against attacks involving other AIs?
AI-assisted attacks and adversarial text motivate a crucial boundary: text generated by an attacker or a defensive model must not become unrestricted infrastructure authority. In the described architecture, Model-Excluded Authority (MEA) excludes learned output from admissibility inputs, and Evidence-Bound Targeting (EBT) constrains target extraction to a declared structured domain.
This is relevant to prompt injection and manipulation of model outputs because a fluent instruction is not an execution permission. It does not establish that DAI can identify the origin of every attack, defeat every hostile model or eliminate all incident-response errors. Policy quality, construction assumptions and provider capabilities still matter.
What can an information-security team verify?
Split-Authority Verification (SAV) uses a verifier without write capability. Sealed Session Chain (SSC) and Proof Path Receipt (PPR) describe ordered evidence and a recomputation path. Element-Level Reconciliation (ELR), Review-Bound Testimony (RBT) and Sealed Review Loop (SRL) connect later review to identified evidence and effects.
An externally recomputed receipt addresses evidence integrity; it does not independently prove every architectural property or the quality of the chosen response. DAI §8.10 discusses a target-provenance limitation. Formal assumptions, measured cases and implementation observations must be read separately.
What results do the papers report?
The DAI paper reports observations for its stated system version and measurement period, including a containment episode lasting 887 ms across twelve turns and two provider round trips, plus external receipt recomputation. The companion ADAI framework separates policy quality, envelope integrity and evidence integrity into three evaluation families.
These are the manuscript’s reported measurements, not a promise for every deployment or attack. Both editions are research preprints by Hiago Kin Levi, Decripte; public repository listings and links do not constitute peer review or independent endorsement.
Read both research papers
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
10.5281/zenodo.23089652
Autonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
10.5281/zenodo.23089594
Definitions of all twelve mechanisms · ADAI: Autonomous Defensive AI with Bounded Authority and Evidence