Skip to content

Project CONTINUUM v1.0

Latest
Latest

Choose a tag to compare

View all tags
@Allexzaa Allexzaa released this 29 Oct 16:26
· 4 commits to main since this release
v1.0
d003fce

Project CONTINUUM v1.0

First citable snapshot of the three completed studies, their run records, scorers, tests and reports. Everything is preliminary and author-labeled, run in a simulated sandbox with synthetic data.

What is in this release

Study Headline result Where
Experiment 1: prompt injection and tool authorization With the stop rule removed, an enforced policy executed the injected action in 0 of 33 exposed runs vs 8 of 66 under prompt rules alone; the prompt rules showed no measurable effect. The policy was scoped by the experimenter's answer key (a best case, not a deployable control). repo root, research/, EXPERIMENT_01.md
Experiment 2: provenance-aware authorization (preregistered, held-out) Templates leaking, argument scoping to lineage check: Gemma 14 to 3 of 50, Persia 23 to 12 of 50 (+22 points in each, 95% CI +12 to +34, exact paired p = 0.001). Cost to legitimate tasks was largely untested. experiment-02/
Experiment 2 follow-up: usability cost (preregistered, held-out) Gemma completed 40 of 40 benign tasks with argument scoping and 20 of 40 with the lineage check (-50 points, 95% CI -65 to -35): all 20 yes/no tasks, none of the 20 mixed-note tasks. Gemma leak comparison inconclusive; Persia exploratory. experiment-02-followup/

Attached files

  • experiment-01_evidence_memo.pdf (4 pages), experiment-02_report.pdf (16 pages), experiment-02-followup_report.pdf (13 pages)
  • SHA256SUMS.txt: checksums of the three PDFs. Every file in the repository is covered by the BUNDLE_MANIFEST.sha256 in the root and in each experiment folder (all verify).

Read before citing any number

  • Everything is author-labeled: the answer keys that define a leak or a completed task were written by one party, with Claude Code, and not independently reviewed. An independent blind review of a sample of run outputs is prepared and not yet done.
  • Two local models on one machine (persia-f16, an unpublished fine-tune of Llama 3.1 8B, and gemma4:12b), templated synthetic cases, structured grants. Not evidence about frontier models, real accounts or production systems.
  • The lineage check's cost was measured with note-level private labels; per-section labels were not tested.
  • Experiment 3 is a proposal only. No work done and no results.

Reproduce

Re-score the released run records without the models: see the README, "Reproduce the numbers". Model weights and the real tool integrations are not included.

License and citation

Code MIT; reports, cases, oracle files, logs and tables CC BY 4.0. Copyright 2026 Lexzium AI.

Lexzium AI. Project CONTINUUM: authorization and control for a tool-using local assistant (Experiments 1, 2 and the Experiment 2 follow-up). v1.0, October 2026. https://github.com/Allexzaa/continuum-agent-authorization

Assets 6
Loading