Session-Isolated Unfalsified Adaptive Control for Multi-Turn Intent Containment in Autonomous Agent Architectures

The security of multi-turn autonomous agent architectures is fundamentally compromised by context-steering vulnerabilities, specifically Salami attacks, where adversarial intent is incrementally dispersed across sequential interaction turns. Conventional probabilistic filters and static language guardrails fail under such trajectory-based manipulation due to the lack of dynamic state memory and the presence of model-vs-payload space mismatch. To resolve this challenge at its mathematical core, we formulate multi-turn intent containment as a data-driven, state-space control problem governed by Unfalsified Control Theory and Koopman Operator dynamics. By lifting discrete token interaction streams into an infinite-dimensional Hilbert space, the nonlinear evolution of multi-turn dialogue trajectories is linearized into observable subspace projections. We define a dual-subspace energy framework that continuously evaluates the instantaneous directional momentum of user intent relative to an immutable, zero-calibration energy density hyperplane boundary. To eliminate subspace saturation and contextual information decay during extended multi-turn sessions, we introduce a session-isolated adaptive dual-loop learner augmented with a sliding-window forgetting operator. This mechanism guarantees bounded memory dissipation while preserving short-term intent trajectory momentum. Upon falsification—defined strictly by a negative Lyapunov-like energy density derivative—the system executes an immediate, deterministic state-transition into a closed-loop containment sandbox, accompanied by a zero-remanence memory sanitization protocol that destroys volatile trajectory information. By operating entirely as a deterministic, Python-native linear algebra transformation, the proposed architecture provides mathematically guaranteed, real-time intent containment for both digital API gateways and physical kinetic actuator interfaces without reliance on offline retraining, empirical threshold tuning, or hyperparameter optimization.