Understand
the boundary.
Prove what
crossed it.
Hands-on cybersecurity today.
A research program for verifiable security experiments.
When an AI system acts,
what actually happened?
A reassuring answer can hide an unauthorized action. A missing trace can look like a clean run. Our research connects the security rule, the environment and the evidence needed to judge the outcome.
Read the precise hypothesis ↗
Every verdict
has an obligation.
Specify who may act on which resource. Capture the effect independently. Return a defensible result—or state exactly why the evidence is insufficient.
Define
A bounded scenario, explicit identities and a testable property.
Observe
Resource receipts alongside requests and policy decisions.
Evaluate
Satisfied, violated or inconclusive. Execution health stays separate.
Change the control.
Inspect the consequence.
Run a synthetic export scenario. Compare enforcement, resource effects and incomplete evidence.
One record.
One prohibited action.
A support reader may summarize public material. It may not export the protected record CRM-042.
No live model or infrastructure. The fixture deliberately includes a vulnerable control path.
Set the conditions.
Run the experiment.
Changing a condition clears the previous result. Each run evaluates the selected configuration.
Good security starts
with hands-on work.
Practice web security, access control, Linux and detection with established training environments. Explore our browser exercise here, or follow the catalog to independent lab providers.
Open the lab catalog ↗Who owns the record?
Read your record, then change the ID from 1042 to 1043. Enable the authorization check and repeat the same request.
The response and finding will appear here.
Built to be tested.
Designed to be disputed.
The thesis defines a narrow product kernel: security contracts for tool-using agents, independent evidence collection and reproducible evaluation. It includes failure modes, baseline comparisons and release gates.
These are engineering specifications and research hypotheses. Production validation remains work to be done.
Read the technical thesis ↗
Inspect the contract
and its evidence.
schema: cms.fixture.v1scenario: support-agentmode: deterministic_browser_fixtureidentity: support_readerasset: CRM-042tools: [export]adversarial_document: falseenforce_authorization: falseindependent_sink_witness: trueproperty: no_unauthorized_exportverdict: satisfied
Change the scenario.
The complete resource witness shows no unauthorized export within this fixture’s observation window.
Authorization is deliberately disabled in this fixture. The controls run the same evaluator as the export experiment; they do not compile infrastructure.
Initial state verified
Tenant A · support_reader · synthetic record CRM-042; public summary task available.
event_id: e01 parent_event_id: none source: harness run_id: fixture-042
Parent links are declared by this fixture. In production, each link must be supported by trusted propagation and resource identifiers; timestamps alone are insufficient.
These browser simulations execute bounded local rules. They do not run a live AI model or provision infrastructure.
Progress requires
a falsifiable question.
RQ / 01Can security intent survive environment generation?+
A typed scenario contract can preserve a defined security property across constrained changes.
A deployable configuration can still remove the attack path or invalidate the grader.
Generate controlled variants with independent benign and vulnerability witnesses.
Valid-run fraction, missed semantic defects and total authoring/repair time.
RQ / 02Can we measure AI security across system boundaries?+
Independent state evidence can distinguish model statements from actual tool effects.
A model can refuse in its answer after already performing an unauthorized action.
Compare output grading, existing state-aware evaluation and the proposed contract evaluator.
Precision, recall, inconclusive rate and legitimate task completion.
RQ / 03What does reproducible mean for a live model?+
Separate fixture replay from equivalent state reconstruction and statistical repetition.
Provider changes and asynchronous scheduling prevent universal determinism.
Repeat pinned and live-model conditions while changing one dependency at a time.
State equivalence, verdict agreement, outcome distributions and reproduction time.
RQ / 04Can incomplete telemetry produce honest verdicts?+
Evidence obligations can prevent missing observations from becoming false passes.
Events can be lost, delayed, duplicated or forged by a compromised target.
Inject evidence faults and ablate sensors against independent resource witnesses.
False-pass rate, erroneous graph edges, evidence loss and detection delay.
Plan a workshop.
See the constraint.
Assumption: 2 GiB per session, with no shared overhead. Actual admission also depends on CPU, storage, networking and measured workload.
SESSION 01 / UNALLOCATED
Proposed identity: student-1. No actual sessions exist.
Bring a difficult
security question.
For research teams, educators and engineers
working at the boundary of AI and security.