The Lingua Ex Machina report documents a visibility failure in the common pattern where one AI system does the work and a second AI system reviews the prompt or output for safety. Because model families tokenize differently, an executor can preserve invisible Unicode — tag characters, private-use and control characters — that the monitor's tokenizer strips before inference. In the reported tag-character demonstration the receiving model recovered the hidden payload while the monitor recovered nothing; the decoding key was irrelevant because the carrier had already been removed from the monitor's view. The report also observes that blank, malformed or unparseable monitor output was not distinguished from a clean verdict. It separates the two halves of the problem: the Unicode channel has a deterministic engineering fix (canonicalise codepoints before tokenization and feed both models the same view), while ordinary-language semantic steganography remains difficult to detect reliably and must be handled by capability limits, sink controls and review.
ASSESSED SYSTEM
Representative configuration studied by the report: a two-model AI harness in which an executor model performs tool-capable work and a separate monitor model (typically a different model family, chosen for independent judgement) reviews the prompt or output for safety, with no deterministic Unicode canonicalisation step before either model's tokenizer and no fail-closed handling of empty or unparseable monitor verdicts. The measured configuration is the tag-character demonstration in which the executor preserved invisible Unicode that the monitor's tokenizer stripped.
OUT OF SCOPE
Any named vendor's specific guardrail product — the report describes a harness-engineering property of monitor/executor pairs, not a defect in any one model. Consequence controls (capability scoping and outbound-sink enforcement) are recommended by the report but were not measured in any deployment, so Cn-1 and Cn-6 are deliberately left unscored and their weight redistributes rather than being scored low on inference. Privacy and Fairness axes are unscored: the report produces no evidence for either.
Architecture: Multi-Agent / MCP System (decision tree Q1) — Q1 = YES on the topology the report describes: two model instances participate in one control loop over the same message stream — the executor performs the work and the monitor reviews the prompt or output, with the monitor's verdict gating the executor — and the report explicitly inventories the agent-to-agent channel among the harness paths whose visibility must be reconciled. The hybrid rule takes the highest-risk qualifying class; if a safety monitor is instead treated as a control component rather than a second agent, Q2 (tool-capable executor acting without per-action approval) applies. Both classes resolve to the agentic intra-axis weight set, so the classification does not change the arithmetic. Tier 3: Tier 3 Internal: the representative deployment is an organisation-internal, tool-capable agent harness with an LLM safety monitor and controlled users; the same pattern is common in Tier 1 and Tier 2 deployments, where the identical blind spot would decay faster and face higher MVTs.
Documented attack or failure path
- Attacker embeds a payload in a carrier the executor's tokenizer preserves but the monitor's tokenizer strips — invisible Unicode tag characters in the reported demonstration.
- The harness dispatches the same raw input to both models without a prior canonicalisation step, so monitor and executor do not inspect the same security-relevant text.
- The monitor tokenizes the input, the carrier disappears, and it evaluates content from which the payload is absent — returning a clean or empty verdict.
- The executor tokenizes the same input with the carrier intact and recovers the hidden payload.
- The harness treats the monitor's verdict as authoritative, so the executor proceeds on content no control ever inspected; the report's second channel, semantic steganography in ordinary language, survives even a correct Unicode fix.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The monitor/executor split does function as designed for content both models can see: the failure is confined to carriers one tokenizer removes, and cross-family independence still provides genuinely independent judgement on the visible text — this is why Ro-1 is scored at 0.25 rather than 0.00.
- The failure was detectable by measurement: the report was able to demonstrate the blind spot by comparing monitor-visible and executor-visible text, which means the same comparison is available to defenders as a regression test.
- The report is explicit about the boundary of its own claim — semantic steganography is not solved by Unicode cleanup and detection should not be promised — which is a candid scoping statement rather than an overclaim.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.07–0.78 (midpoint 0.42), Tier 3 MVT 0.40 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.30 | A basic filter (the monitor model) resists naive and visible attacks but fails against a common public obfuscation technique; success rate for the tested carrier is effectively total, which is well above the 50% threshold at the 0.25 anchor. Not 0.00, because the monitor is a real, functioning control against content it can see. | In the tag-character demonstration the executor recovered the hidden payload in full while the monitor recovered nothing — a complete bypass of the guardrail for that carrier class, achieved with a publicly known low-effort obfuscation and no perturbation budget to speak of.source: researcher |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Transparency (Tr) — scenario interval 0.06–0.81 (midpoint 0.44), Tier 3 MVT 0.45 indeterminate | |||
| Tr-3Audit Trail Completeness | 0.25w 0.25 | Partial logging exists but omits critical fields — specifically what the monitor actually saw versus what the executor saw, and whether a verdict was real or empty — so a session cannot be reconstructed to determine whether a control ever inspected the content. The 0.25 anchor. | The report describes a silent sensor-loss condition: the monitor's observation path drops content before evaluation, and blank, malformed or unparseable monitor output was treated as clean rather than routed to deny, retry or human review. Its remediation list — reconcile raw-versus-canonicalised event counts, parser and schema rejections, empty verdicts, sampling state and an end-to-end dead-man event — enumerates records the assessed pattern does not keep.source: brief |
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.50 indeterminate | |||
| Containment (Cn) — scenario interval 0.04–0.86 (midpoint 0.46), Tier 3 MVT 0.50 indeterminate | |||
| Cn-3Output Filtering Robustness | 0.25w 0.18 | A filter exists but is bypassed by encoding — the 0.25 anchor names encoding bypass explicitly. Not 0.50, because the escape is not an adaptive edge case: the filter never receives the bytes. | The monitor model is the filtering layer for prompt and output review, and it is structurally blind to a carrier the executor reads. The report's own framing — 'a monitor cannot inspect text that its own tokenizer removed' — makes the bypass deterministic for that encoding class rather than probabilistic, and the semantic-steganography channel remains open even after the Unicode fix.source: researcher |
Unknown, not N/A: 20 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.75w 0.20 | Supervised autonomy: the executor performs tool-capable work and the only gate in the studied pattern is an automated monitor model, not a human. Human review is the exception path the report recommends adding for blank or unparseable verdicts, which indicates it was not routinely in the loop. Held below 1.00 because a review layer, however blind, is architecturally present and can block. |
| AsAttack Surface Exposure | 0.75w 0.25 | The harness ingests untrusted external content — the covert carrier arrives in ordinary prompt, tool-output or agent-message text — through a prompt builder, RAG adapter and tool dispatcher, matching the external-data-ingestion anchor. Held at 0.75 rather than 1.00 because the report evidences no federation with external third-party agents or untrusted MCP servers; note this sits exactly on the elevated threshold and therefore does not count toward N_elevated, which counts dimensions strictly above 0.75. |
| CpCascade Potential | 1.00w 0.30 | No System Dependency Graph exists for the studied pattern — it is a research report on an architecture class, not an inventoried deployment — so DGC cannot be established and the spec's worst-case default sets Cp = 1.00. The reconstruction does not independently reach the 1.00 anchor: the report measured monitor blindness, not propagation to a downstream action, so no ungated path to a P3/P4 node, no delegated-irreversible terminal and no FIBR figure is demonstrated. With a verified graph for a specific harness the value would likely fall in the 0.50-0.75 band, driven by whatever tool authority the executor actually holds.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.75w 0.25 | Two halves with different feasibility, and the harder one governs. The tokenizer-visibility channel has a deterministic engineering fix the report specifies precisely (canonicalise codepoints before tokenization, feed both models the same view, alarm on empty verdicts) — that leg alone would be 0.00-0.25. But the report's core warning is that ordinary-language semantic steganography cannot be reliably detected and must be bounded through capability scoping, sink enforcement and review, which is guardrail mitigation of a fundamental model property that reduces probability without eliminating it. Not 1.00: the channel is boundable in consequence, not merely mathematically inherent. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | The report inventories the harness components that matter — executor model, monitor model, gateway, prompt builder, RAG adapter, agent-to-agent channel, tool dispatcher, monitor wrapper, logging layer — and names the model-pair property under test, but there is no AIBOM, no pinned model or tokenizer versions for a deployed configuration, and no identity or tool manifest. Matches the 0.25 'minimal provenance record' anchor. |
| Ec — Public evaluation coverage | 0.09 | coverage 0.13 (3 of 23 applicable sub-metrics) × independence 1.00 × fidelity 0.70. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.40 | Evidence dated 2026-06-27; age 47 days on the workpaper reference date. Components: C_behavior 0.40 · T_behavior 0.59 · C_monitor 0.65 · C_evidence 0.65 · T_containment 0.70 · T_calendar 0.84. Binding term: C_behavior. C_monitor 0.65 — this case is a demonstrated sensor-loss failure: the monitoring path silently drops content before evaluation and empty verdicts were not distinguished from clean ones, so telemetry cannot be relied on to show the assessed behaviour still holds. C_behavior Band 0 (0.40) — no canary set, registered invariants or maintained behavioural drift baseline exists for the studied pattern, and the demonstration shows no invariant monitor attached to the covert-carrier surface; band 0 is affirmatively supported here rather than merely defaulted. C_evidence 0.65 — Band 0 triggers the cold-start evidence cap, and the semantic-steganography half of the finding is explicitly unresolved. No C_event cap is applied: the report demonstrates a property of the pattern, not a change or compromise event at a specific deployment. Agentic = true (tool-capable executor with mutable permission boundaries); BAW = true — more than one model exchanging messages at runtime is a Behavioral Attestation Window checklist item on its own. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.21 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-002.002 | Inference-Time Prompt & Input ValidationParent AID-H-002 (AI-Contextualized Data Sanitization & Input Validation). The Ro-1 leg is the operative one: canonicalise Unicode and send the same approved view to both model paths. The Fa-1/Fa-3 legs of the catalogue mapping have no evidence in this case and are not scored. | Very High | Fa-1 Fa-3 Ro-1 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisParent AID-D-001 (Adversarial Input, Prompt Injection & Signal-Authenticity Detection). Must inspect raw codepoints before model tokenization — after the monitor has lost the bytes there is nothing to detect. | Very High | Ro-1 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingParent AID-H-018 (Tool Authorization & Capability Scoping). Recommended consequence control; Cn-1 and Cn-6 are NOT scored in this case because the report measured monitor visibility, not the scope or gating posture of any deployment. | High | Cn-1 Cn-6 Cn-7 |
| AID-H-018.005 | Value-Level Capability Metadata & Data Flow Sink EnforcementParent AID-H-018. The report's answer to undetectable semantic steganography — control the consequence, not the carrier. Again recommended rather than observed, so left unscored. | High | Cn-1 Cn-6 Cn-7 |
| AID-H-036 | Multilingual & Locale-Stratified Prompt Safety Classifier EvaluationParent-level technique (no sub-technique suffix). A signed coverage matrix including the tokenizer-survival payloads, emitting segment-level missing-data evidence, is the measurement that would convert this blind spot into a reportable Cn-3/Ro-1 figure. | High | Cn-3 Ro-1 |
| AID-D-005.010 | Telemetry Pipeline Health & Sensor-Loss DetectionParent AID-D-005 (AI Activity Logging, Monitoring & Threat Hunting). Direct basis for Tr-3 = 0.25 and for the C_monitor cap: missing observations must produce an explicit visibility-impaired finding rather than a clean verdict. | Medium | Cn-7 Tr-3 |
| AID-D-003.002 | Sensitive Information & Data Leakage DetectionParent AID-D-003 (AI Output Monitoring & Policy-Violation Detection). Supports the Cn-3 placement as a detective layer; the brief notes it emits findings while a separate output or sink gate owns blocking. | Medium | Cn-1 Cn-3 Cn-7 Ro-3 |
| AID-H-017.007 | Dual-LLM Isolation PatternParent AID-H-017 (Secure Agent Architecture) maps to Cn-5. Cn-5 is not scored here — the report evidences no identity or attestation posture — but the technique is the corrected form of the very pattern under study: both sides must operate on the same canonicalised input view. | Medium | Cn-5 Cn-7 |
| AID-D-018 | Production AI-Security Detection Efficacy & Scenario-Coverage ValidationParent-level technique. Replaying signed attack cases through the exact deployed monitor and executor observation paths is the evidence that would lift both Tr-3 and the C_monitor / C_behavior caps. | Medium | Tr-3 |
WHAT THIS CASE TEACHES
Detection capability and evidence freshness are scored in different layers, and this case separates them cleanly: the monitor's blindness is a point-in-time IVP finding at Ro-1 and Cn-3, while the same sensor loss independently caps ACI Temporal Freshness through C_monitor and Band 0 C_behavior — and because the report measured visibility rather than consequence, Cn-1 and Cn-6 are correctly omitted instead of guessed.
Sources: AIDEFEND in Action — Lingua Ex Machina: When the AI Monitor Cannot See What the Executor Sees