A Tier-0 Behavioral Interlock for Agentic AI: a deterministic, on-device single-token self-twin that gates a graduated governance action — with a pre-registered map of what it catches, what it cannot, and why the blind spot is representation-independent

A Tier-0 Behavioral Interlock for Agentic AI: a deterministic, on-device single-token self-twin that gates a graduated governance action — with a pre-registered map of what it catches, what it cannot, and why the blind spot is representation-independent Randolph James Ferlic, M.D. and Kimberly Kate Ferlic — Fieldstone Analytics, LLC, Austin, TX, USA Preprint · Zenodo DOI: 10.5281/zenodo.23504157 · CC-BY 4.0 · Community: spiral-domain-encoder-campaign · The agent-behavioral-interlock, swarm, robust-aggregation, and compression-enabled-governance embodiments described herein are the subject of a companion United States provisional patent application, filed before this deposit under a file-first policy — see the notice below. Abstract As autonomous and software agents are given delegated authority to call tools, touch data, and act, operators need a runtime check that an agent is still behaving as commissioned — and a graduated way to respond when it is not. Emerging enterprise frameworks score agent risk from identity, endpoint, and network signals in a cloud control plane. This record characterizes a complementary primitive those signals do not provide: a deterministic, label-free, on-device behavioral interlock. A frozen single-token encoder — raw window → fixed projection → nearest-of-≤256-cell codebook → one-byte token, nearest-centroid distance as a novelty score — is pointed at an agent's own activity trace (tool calls, timing, data volumes, egress, and order-aware sequence features), commissioned into a per-agent behavioral self-twin, and used to gate a graduated control action (allow, require approval, restrict scope, halt). Across a pre-registered battery — a 12-sim core study over four agent archetypes, a GPU-trained deep-representation baseline, 13-sim single-agent and 10-sim swarm Tier-3/4/5 adversarial batteries, agentic-swarm and compression-governance studies, and a cross-architecture on-silicon reduction to practice — the primitive is mapped honestly: predictions fixed before the measurements, negatives kept. It detects configuration/model change, task and scope drift, overt exfiltration, and reordering attacks (AUROC ≈ 0.99–1.00), at a calibrated false-alarm rate, in a 3.7 kB model that runs deterministically (0/256 token flips, bit-exact integer port) in 60–146 µs on two commodity microcontrollers. It is blind to on-manifold misuse (AUROC ≈ 0.50), and this blindness is representation-independent: no self-supervised, autoencoder, or discriminatively-trained deep representation detects it either, and the discriminative one collapses even on the departures the token catches (0.665 vs 0.990). Per-agent commissioning is mandatory (thresholds do not transfer across agents); commissioning-data poisoning is not removed by robust statistics (trusted commissioning is required); individually-sub-threshold collusion needs multi-party aggregation, which scales with swarm size and whose interaction-graph form catches communication-topology shifts, while emergent compositional synergy is representation-independently blind and needs a semantic monitor; and a modest review budget cuts simulated harm by two-thirds. Compressing behavior to one deterministic byte also yields governance a raw-event monitor cannot have — ~1-byte operation over bandwidth-metered or one-way channels, collector-free decentralized swarm aggregation, and content-confidentiality scoped honestly as *not* anonymity (the byte re-identifies the agent). The honest conclusion is a defense-in-depth layer with a measured deployment contract, not a complete defense — and a theorem-like boundary (on-manifold blindness is fundamental) that makes an independent semantic monitor and multi-party aggregation structurally necessary rather than optional. Highlights · A deterministic, on-device Tier-0 interlock for agents. A frozen one-byte self-twin pointed at an agent's activity trace detects configuration/model change, task and scope drift, overt exfiltration, and reordering attacks at AUROC ≈ 0.99–1.00, at a calibrated ≈5% false-alarm rate, in a 3.7 kB model — reduced to practice on a Cortex-M4F and a Cortex-M33 with 0/256 token flips, a bit-exact integer port, and 60–146 µs per decision (33–78× inside a 5 ms budget), on hardware a cloud control plane cannot reach. · The central result is a representation-independent negative. On-manifold misuse — harm carried by actions drawn from the agent's normal distribution, where the malice is semantic — is at chance (≈0.50) not only for the token but for every classical detector and every deep learned representation tried (self-supervised Transformer, generative autoencoder, discriminatively-trained GRU). The blindness is a property of the threat, not a deficiency of a feature space — which reframes defense-in-depth from best practice to structural necessity. · Watch the input, not a learned embedding. No GPU-trained deep representation of behavior beats the input-informative token on the hard case (subtle drift: token 0.990 vs the best deep model 0.785), and the discriminatively-trained one collapses out-of-distribution (0.665) — a design rule with teeth, and an economic one (no GPU monitor needed). · The self-twin is per-agent and label-free. Thresholds do not transfer across agents even of the same archetype (own-agent 0.05 vs sibling 0.89 false-alarm); unsupervised, clean-labeled, and 30%-label-noise commissioning are indistinguishable; agents onboard in tens of windows. · Collusion needs aggregation; swarms scale. Individually-sub-threshold coordination (each agent flagged ≈27%) is decisively caught by a multi-party aggregate (AUROC 0.975, flagged 85%); detection scales with swarm size (0.83 at N=2 → 1.00 by N=32); and an interaction-graph self-twin catches a communication-topology shift invisible to activity monitoring (0.999 vs 0.498). The swarm battery converts correlation, churn, and evasion into eight concrete robustness requirements (de-correlate common mode, swarm-level calibrate, standardize, size-normalized energy-not-count, temporal-aggregate, cover enough agents, attest membership). · The second boundary: emergent synergy. A harmful composition of individually-in-envelope actions is at chance for every behavioral and interaction-graph aggregate — the swarm-level analogue of the on-manifold blind spot — and is disclosed, not claimed, as the composed semantic/orchestration monitor's regime. · Trusted commissioning is a requirement, not a nicety. Commissioning-data poisoning is a real vulnerability (detection 1.00 → 0.62 at a 20% poisoned fraction) that a robust, trimmed fit does not remove — poison that defined "normal" is not a high-residual outlier — so attested commissioning is a security property on-device statistics cannot supply. · The byte changes what governance is possible. Reducing a window to one deterministic, non-invertible symbol makes governance bandwidth-minimal (≈1 byte/decision over metered or one-way/data-diode channels), collector-free decentralizable (gossip aggregate identical to centralized; coordination detected from shared bytes alone at ≈0.91), and content-confidential — honestly scoped as not anonymity (feature-reconstruction R² ≈ 0.62; the byte is a stable pseudonym that re-identifies the agent at ≈0.98) — properties a raw-event or cloud-resident monitor cannot have. · Closed-loop value, quantified. A graduated response cuts net harm by two-thirds at a review budget ≈ the base rate of harmful actions; over-gating adds disruption without preventing more harm, so the optimal budget is near the base rate, not maximized. · Honest negatives make the positives trustworthy. That no deeper model beats the byte forecloses "a bigger model will catch it," that the energy aggregate resists spread-to-evade tells you which aggregate to deploy, that a slow ramp is caught by a cumulative-sum statistic forecloses slow-burn evasion, and that robust statistics do not fix poisoning makes trusted commissioning mandatory — leaving on-manifold as the only true stealth. · One primitive, a new entity type. The program's prior laws — per-entity self-twin, watch-the-input/feature-collapse, geometry-gated drift compensation, and privacy-preserving multi-party aggregation — each transfer to the agent entity with no new algorithm, now gating a graduated governance action. The transferable lesson The through-line is the program's founding premise, now tested in agent governance: the value is cost, determinism, and footprint — not accuracy. Distinguishing a drifting or exfiltrating agent from a commissioned one is not hard in an absolute sense — a one-class SVM (0.994), a local-outlier-factor method (0.993), and a Mahalanobis detector over the whole swarm state (0.90 vs the aggregate's 0.99) all do comparably, and all are equally blind on-manifold. The result is that the cheapest possible monitor — one frozen, deterministic, auditable byte, with no gradient and no cloud round-trip — matches them on accuracy and runs where they cannot: on the agent's own microcontroller, bit-exact across two architectures at 60–146 µs in 3.7 kB, and over a one-way or metered channel at one byte per decision. An in-house team can reproduce the AUROC in a week; it cannot reproduce the deployable Tier-0 package. And the map is drawn with its two honest, representation-independent blind spots — on-manifold single-agent misuse and emergent compositional synergy of a swarm — so that an independent semantic or orchestration monitor and multi-party aggregation are structurally necessary layers, and the interlock states precisely where it stops and hands off cleanly. What this record contains · Manuscript_Paper65.pdf / .docx — the manuscript (comprehensive; nine figures): core detection across archetypes, the watch-the-input deep-representation baseline, the cross-architecture on-silicon reduction to practice, multi-party collusion and