idea-scout triage — joint intent+harm verification (issue #910)

Closes the daily idea-scout candidate #910 (tools/idea_scout.py, filed 2026-06-26). The scout judges whether a candidate is new and on-topic; this note is the human triage it hands off — adopt, defend against, or cite as prior art (see docs/idea-scout.md). **Verdict: prior art to cite — “join the prompt’s intent with the response’s harm, because the attack lives in the GAP between them” IS fak’s two-sided adjudication thesis stated at the detector altitude. fak already splits that exact axis structurally: k.Decide folds the pre-call INTENT chain, k.AdmitResult is the in-code documented DUAL that folds the result-side HARM chain. The three-LLM-analyst

Source: https://arxiv.org/abs/2606.26377 — “Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threats”, Poojitha Thota, Yun Lei, Santhosh Thangaraj, Siddhartha Reddy Jonnalagadda, Shirin Nilizadeh (submitted 2026-06-24). Read from the arXiv abstract via WebFetch on 2026-06-26; this is a surface read of the abstract, not a paper audit or a reproduction. The abstract reports headline numbers (below) but the read does not verify the datasets, the baseline tuning, or the adaptive-attack setup behind them — those are taken as the authors’ claims, not as confirmed results.

The paper, in one pass

The diagnosis is one fak has made from the start, here aimed at the defense layer: existing defenses inspect either the user prompt or the generated response, not both — and many real attacks exploit precisely the separation between adversarial intent expressed in the prompt and actionable harm that manifests only in the response. A prompt that looks benign in isolation, a response that looks benign in isolation, and an interaction that is unsafe only when the two are read together: that interaction slips past every single-sided filter.

The fix is verification-centric and two-sided: evaluate prompt intent and response harm jointly, before the response is delivered. The framework is three cooperating components:

Reported across five threat categories (jailbreaks, prompt injection, phishing, cyber abuse, harmful content): average F1 0.90 → 0.95 over the strongest baseline; 0.87 → 0.95 over a single-agent + chain-of-thought baseline; attack success rate down to 4.1%; false-positive rate on benign-but-sensitive requests 0.12 → 0.06. The authors further test adaptive attackers who know the verifier’s structure.

Where fak actually stands

fak and the paper share the same core insight — defense must be two-sided because the intent and the harm are separable, and the attack hides in the gap. They differ on what does the joining: the paper joins them with three learned LLM analysts; fak joins them with a structural, two-chain adjudication seam plus a git-witnessed re-check of claim-vs-action.

Paper’s frame fak’s position
Diagnosis: prompt-only and response-only defenses miss attacks that exploit the separation between adversarial intent (prompt) and actionable harm (response) fak’s two-sided design premise, verbatim. fak does not bet either side alone: the kernel folds a pre-call chain over the requested call and a result-side chain over the produced result, exactly because a benign-looking request can yield a harmful result and vice versa.
Intent Analyst — score the adversarial intent of the prompt before acting ≈ k.Decide (internal/kernel/kernel.go), documented as folding “ONLY the Adjudicator chain” — the pure pre-call adjudication of the requested capability against the default-deny policy floor (internal/adjudicator, internal/policy, --policy FILE). fak scores intent structurally (does this call’s capability fall inside the declared task floor?), not by a learned intent classifier.
Harm Analyst — score the harm of the generated response before delivery ≈ k.AdmitResult, documented in-code as “the EXPORTED dual of Decide” — it arms the result-side stack (context-MMU result-admit quarantine, per-trace IFC taint ledger, the pre-send internal/wirescreen redactor, the ifc.SinkGate egress floor in internal/tracesink) over a result a client produced and handed back. fak’s harm side gates what the result is allowed to DO / where it may flow, structurally.
Judge — resolve conflicts between the two analysts before delivery ≈ fak’s deny-as-value typed dispositions + the hash-chained witness/decision journal: the verdict is the most-restrictive admission folded across the chains, recorded as a legible refusal from a closed vocabulary — and, at ship time, the dos verify / dos commit-audit referee re-judges the agent’s claimed intent against the actual diff-borne harm (claim-vs-action), which is the same intent↔harm reconciliation one tick later in the lifecycle.
Mechanism: three specialized LLM analysts + an LLM Judge (F1 0.95, ASR 4.1%), tested under an adaptive attacker who knows the verifier Not adopted — this is the detector rung, and fak’s floor is not a detector. A learned verifier is best-effort and evadable; the paper’s own adaptive-attack section is the evidence. fak’s position, recorded across prior triages, is detector-is-not-the-floor: the default-deny capability floor the model “can’t talk past” is what bounds harm, and a classifier rides above it as a non-load-bearing signal.

So the two agree on the shape of the defense (two-sided, verify-before-deliver) and differ on the trust placed in the joiner: a learned panel of analysts vs. a structural capability gate witnessed by git.

The sharp, honest insight

The paper is strong independent validation that the intent/harm split is the right axis to defend on — an external group, working the detector side, concluded that a defense must read both the prompt’s intent and the response’s harm because the unsafe signal is in the interaction, not in either half. That is precisely why fak’s kernel exposes two adjudication entry points (Decide / AdmitResult) rather than one filter, and why AdmitResult is written as “the dual of Decide”: the architecture already encodes “intent here, harm there, judge the pair.”

But the paper also supplies its own best argument for why fak does not make that joiner a learned model. The framework’s quality rests on the analysts’ classification accuracy (F1 0.95, FPR 0.06) — real, useful detector numbers — and the authors themselves stress-test it against adaptive attackers who know the verifier’s structure, the exact regime where a learned detector’s guarantee decays (cf. fak’s recorded detector-is-not-the-floor and AUC-is-not-detection priors). fak’s structural floor does not move under an adaptive prompt: you cannot argue a call past a default-deny capability gate. The paper’s verifier and fak’s floor therefore sit at different rungs — the paper is the kind of high-quality detector fak would run above its floor, never the floor itself. This matches CLAIMS.md’s 0/29-NOVEL discipline: every primitive (intent scoring, harm scoring, a judge) is established/emerging — the contribution is the assembly, and fak’s assembly puts the structural gate, not the classifier, on the load-bearing path.

The matching honest fence cuts the other way too. The Harm Analyst classifies CONTENT harm — the model emitting a phishing email or harmful instructions as text — and that is a harm fak’s capability gate does not score at the tool-call seam: if no gated capability is exercised, fak’s structural floor has nothing to deny, and the redaction / egress rung (wirescreen / SinkGate) bounds flow, not semantic harmfulness of the words. Scoring whether the response text itself is harmful is exactly a best-effort detector rung — one fak can host above the floor, but the paper is a reminder that this rung is genuinely useful (5-category F1 0.95) and that fak’s coverage of pure content-harm-in-text is a named residual, not a solved problem.

Triage decision

Action: close #910 as triaged → prior art cited (independent detector-side validation of fak’s two-sided intent/harm adjudication — Decide folds intent, AdmitResult is its documented dual and folds harm — plus an evaluation discipline, report F1 + ASR + benign-FPR + an adaptive-attacker result, for fak’s best-effort detector rung), with the three-LLM-analyst + Judge MECHANISM explicitly NOT adopted (detector-is-not-the-floor; the paper’s own adaptive attacker is the evidence that a learned verifier is evadable where fak’s default-deny capability floor is not), and the Harm-Analyst’s content-harm-in-text coverage named as a real best-effort residual fak hosts above its floor but does not make load-bearing (this note). No code change in this increment: tools/idea_scout.py surfaced and scored the candidate correctly (topic prompt-injection-defense, score 53 — a real, on-topic, high-relevance hit), and the right small artifact for a research/security triage is the recorded verdict + the component-by-component mapping, not a new detector on the kernel’s load-bearing path.

Next step (the smallest honest follow-on, if pursued): a one-line cross-link from the best-effort-detector rung’s doc naming this framework as the content-harm detector reference — two-sided (intent + harm), verify-before-deliver, evaluated with an adaptive-attacker result — so that when fak documents a classifier above its floor, it cites the bar this paper sets (F1/ASR/benign-FPR + adaptive attack) rather than re-deriving it. Filed as its own scoped edit, not built in this triage increment.