Seth Dobrin, Łukasz Chmiel
This paper proposes and validates a new architectural safety layer for controlling AI agents within their own runtime environments.
Current safety controls for AI agents (system prompts, output filters) reside inside the agent's own address space. This creates a fundamental vulnerability for 'escapable AI systems' with sufficient reach into their own runtime, as controls can be influenced by inputs.
The paper proposes an 'execution-time AI alignment' layer that satisfies four essential properties: process separation, pre-action enforcement, fail-closed at both request and system levels, and externalized signed evidence verifiable outside the trust boundary. This is implemented as the 'Unfireable Safety Kernel' in Rust, with its fail-closed invariant machine-checked via SMT theorem (Z3) and exhaustive bounded model checking (Kani).
Evaluated against an escape-seeking adversary, the kernel refused all 704 attempts on the safety-critical core across 1,000 self-modifications, preventing escape. A separate campaign of 6,240 authorization round-trips had no successful bypass. This presents a new paradigm for architectural safety assurance distinct from cooperative control approaches.