Falsifiable Release Gates for Self-Improving Systems¶

🕒 Published (v1): 2026-07-11 06:06 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

This paper proposes falsifiable release gates: a methodology where every new capability in a self-improving agent runtime must pass a pre-declared, machine-checkable acceptance suite before it ships, with a fixed set of standing invariants preserved across all gates. The method is instantiated in Antaḥkaraṇa, an open continual-learning runtime, across seven gates (G7–G12) culminating in a machine-verified, self-governing loop whose self-modification is bounded by construction. The key epistemic contribution is the teeth discipline: each invariant ships with deliberately broken models that must cause the checker to fail, preventing vacuous verification.

Problem¶

Safety claims for self-improving agent runtimes are self-graded—policy files, guardrails, README promises—with no falsifiable process for ensuring that every new capability preserves the safety properties of prior ones. Existing guardrail and alignment approaches (filters, RLHF, constitutional AI) address individual mechanisms or weight-level behavior; none provide a versioned, preservative discipline for capability acquisition in systems that can revise their own policies.

Method¶

Falsifiable release gates have three required properties: (1) falsifiability—each gate makes a specific, measurable claim; (2) machine-checkability—the acceptance suite is CI code returning pass/fail, not a human-interpreted document; (3) preservativity—passing a gate must not break any earlier gate, so the full suite runs on every change. Gates are declared before the feature, so the acceptance criterion cannot be moved by the system that must satisfy it.

Six standing invariants apply across all gates: single gate (no action reaches an effector without a capability token minted by an allow verdict); monotone tightening (auto-tighten is permitted; loosening always requires a human merge); everything audited (hash-chained records); hashes over payloads (control plane never holds raw sensitive content); opt-in zero-overhead-off; and gates-before-code.

The seven-rung ladder (G7–G12) enforces a dependency order: observability/replay (G7) → adversarial tool-use (G8) → drift-free learning (G9) → fleet mesh control (G10) → multi-tenant isolation (G11) → self-governing loop (G12). Each rung makes the next safe to build.

Machine checking (G12): The coordination skeleton (ticks, verdicts, token mint, effector, supervisor control) is modeled as a finite transition system and exhaustively enumerated over 291 reachable states. A canonical TLA+ specification ships alongside. The teeth discipline requires that deliberately broken variants of each invariant—where the illegal transition is re-enabled—must produce a shortest counterexample (BFS-guaranteed minimal). These broken-model results are themselves asserted in the test suite, so a regression making the checker vacuous would itself fail a gate.

Trace conformance: One million synthetic execution traces are replayed through the model in CI; any trace the model rejects fails the build, forcing model and code to co-evolve.

Contained self-improvement (G12): The improver's write surface is structurally limited to policy rules (thresholds, blocked categories). The type system for policy diffs has no terms for the evaluation pipeline, clamps, or verifier, so out-of-scope writes are syntactically impossible, not merely validated away. Each proposed diff must predict its own effect on a replay corpus; mispredicting diffs are auto-closed. Tightening diffs that pass may auto-apply; loosening diffs always require a human merge.

Key Contributions¶

Falsifiable release gate methodology (C1): capability-gated development with forced dependency ordering, pre-declared acceptance criteria, and standing invariants preserved across all gates.
Machine-checked non-bypass core with teeth (C2): exhaustive state enumeration over 291 states confirming INV-1/4/5; TLA+ specification; counterexample extraction from broken models (bypass caught in 4 steps, escaped-control in 8, token-reuse in 5); trace conformance over 1M traces.
Constructively contained self-improvement (C3): write surface restricted to policy rules by type construction; monotone-tightening enforced mechanically via a policy lattice; mispredicting proposals auto-closed.
Reusable, portable gate suite (C4): 122-test suite (95 gate cases) released so "does your framework pass G8?" has a reproducible answer runnable against other agent runtimes.

Results¶

G7 (Hardening): Deterministic replay and atomic rollback <1 s; 20 cases PASS.
G8 (Integration): 432/432 adversarial prompt-injection attacks blocked on a 500-case corpus using a 7B-parameter backbone; 0 policy escalations; 0 privileged effectors fired; 16 cases PASS.
G9 (Memory & feedback): Missed-detection rate drops from 0.50 / 0.58 / 0.67 → 0.00 at false-alarm rate = 0 across three held-out replay corpora; gate never self-loosens; 13 cases PASS.
G10 (Mesh): \(p_{100} = 0\) leaked actions after one-tick supervisor control (pause/quarantine/kill); correlated drift attribution precision 1.00 at 0 false alarms on uncorrelated noise; 14 cases PASS.
G11 (Platform): Cross-tenant decryption denied; audit-log tampering localized to exact record index; generated plan bit-identical to executed plan; 14 cases PASS.
G12 (Self-governing): INV-1/4/5 hold over all 291 reachable states; 1,000,000 traces, 0 rejections; one machine-proposed tightening (notify cutoff 0.80 → 0.59) auto-adopted; 18 cases PASS.
Overall: 95 gate cases in a 122-test suite, all green at final rung.

Limitations¶

Verification is bounded to a small-scope model of the coordination skeleton; the learned scoring function (novelty/risk scorer) is outside the formal model.
Results are self-graded: the standing red-team challenge and operational flagship deployment were not complete at submission.
Containment is shown at the specification and constraint layer, not by verifying the full implementation of the improver.
Runtime monitors sample rather than observe every event, bounding but not closing the proof-gap window.
Inductive (unbounded) verification and statistical guarantees for learned components (e.g., conformal prediction bounds on miss rate) are stated as future work, not present results.
Fleet topology is tree-structured; general graphs and cross-organization federation are not yet addressed.

Relevance to Harnesses / Meta-Harnesses¶

The falsifiable release gate is itself a meta-harness pattern: a structured ladder of acceptance suites that governs when any new capability may enter a self-improving system, enforced in CI on every change. The "gates-before-code" principle inverts the usual test-after workflow and positions the harness as the authoritative definition of what features are permitted to exist—a strong instantiation of harness-as-policy. The published 122-test gate suite is explicitly designed as a portable meta-harness that can be run against other agent frameworks, making it infrastructure for the broader field rather than a single-system artifact. The teeth discipline—requiring that the checker demonstrably fail on broken models—is a harness-integrity technique directly applicable to any evaluation harness claiming to enforce invariants.