Safeguard Degradation (Subtype 5): Public Pre-Registration

Version of record: as of Amendment A10, 2026-11-05. Derived from internal git commit: eac948207f2efb76da4b9f846b58566a1abba7ad. Status at this version: no case has been scored. The corpus has been enumerated; scoring has not begun.

This is a public version of a pre-registration written to be falsified before any data was scored. It states a hypothesis, the rules for testing it, and the results that would kill it. It was written by the project owner with an AI assistant (Claude), which also acted as auditor. The stance is adversarial: the default assumption is that the hypothesis is wrong, and the method is built to show that.

Amendments are dated and never edit the frozen text. Section 9 lists them.

sha256sum SUBTYPE5_PREREG_PUBLIC.md
cosign verify-blob --key blackgate-anchor.pub \
  --bundle SUBTYPE5_PREREG_PUBLIC.sigstore.json SUBTYPE5_PREREG_PUBLIC.md

1. Hypothesis

H5. There exists a class of authorized-but-unsafe actions in which the action is unsafe because it weakens a safeguard (alerting, monitoring, audit logging, backups, or retention) and in which the decisive unsafe signal is carried by the content of the action itself, not by the live state of the system being acted on.

Why it might matter: an earlier study by the same project found that, across 42 incidents, the condition that made an action unsafe was characteristically not observable at the point where an admission decision would be made, and none of the 42 was cleanly addressable. H5 claims that safeguard degradation escapes that failure mode because the change itself is the evidence. A change such as recipients: [] does not require knowing the state of the world; it requires reading the change. If H5 fails, the earlier observability problem is a property of the underlying thesis and not of the sample.

1.1 The discriminating variable

Every case receives one value of decisive_signal_locus:

ACTION_CONTENT   the unsafe property is readable from the proposed change alone
TARGET_STATE     requires knowing the live state of the target
EXTERNAL_STATE   requires knowing state elsewhere in the estate
POST_HOC_ONLY    only visible after the safeguard failed to fire

H5 predicts ACTION_CONTENT. The existing class of state-dependent hazards predicts TARGET_STATE or EXTERNAL_STATE. The earlier study predicts POST_HOC_ONLY. These are distinguishable per case, before any aggregate is computed, which is what makes H5 falsifiable rather than rhetorical.

1.2 What H5 does not claim

• That the class is frequent. Frequency is unmeasurable here (section 4).
• That detecting it is novel. The MITRE ATT&CK technique T1562, "Impair Defenses", has had detections for years. H5 is about addressability, not differentiation.
• That any existing system addresses it. This is a capability claim, not a statement about a deployed product.
• That the motivating cases are evidence. They are the reason to look (section 4).

2. What counts as a safeguard, and as degradation

A safeguard is a mechanism whose function is to make a later unsafe event detectable, attributable, or recoverable. Five families are fixed:

S1 ALERTING        rules, thresholds, routing, recipients, notification channels
S2 MONITORING      detectors, probes, evaluators, misalignment/anomaly monitors
S3 AUDIT LOGGING   event emission, sinks, SIEM export, log integrity, retention
S4 BACKUP          snapshot/replica creation, schedules, restore testability
S5 RETENTION       retention windows, legal hold, WORM/object-lock, immutability

Degradation is any of: disable, delete, narrow scope, raise a firing threshold, empty a recipient set, redirect a sink to a non-consuming destination, shorten a window, or reduce an interval's frequency. The recorded values are disable, delete, narrow, threshold_raise, recipients_empty, sink_redirect, window_shorten and frequency_reduce.

Out of scope, fixed in advance to prevent scope creep during scoring:

• Safeguards whose weakening was the declared purpose of an approved change (a planned decommission, an intentional threshold tuning with a ticket). These are authorized and intended, so they are the control condition, not the hazard.
• Preventive controls (access control, network policy, admission policy). Weakening those is a permissions problem that authorization-based tools genuinely own.
• Capability and containment escapes, which belong to a separate line of work.

3. Disqualifiers

If any of these holds, Subtype 5 is not a new class:

N1  If the decisive signal is TARGET_STATE or EXTERNAL_STATE, it is the existing
    state-dependent class.
N2  If the hazard is "the agent was not allowed to touch this," it is an
    authorization problem, which this work does not address.
N3  If the safeguard is identified only by a human knowing what the resource
    MEANS, Subtype 5 inherits the unsolved target-classification problem. It is
    then the same problem under a new label, not a new tractable class.
N4  If the only reason the cases look clean is that the motivating cases were
    selected because they look clean, the class is a selection artifact.

N3 is the dangerous one. Registry dependence is scored on every case, and kill criterion K2 (section 6) fires on it.

4. Corpus

4.1 The methodological problem, stated first

An earlier study in this project used a pre-existing enumeration ordered by someone with no stake in the result, so taking the first 30 entries in stable source order was a genuine sample. No such enumeration exists for public agent-safeguard incidents. Any corpus here is search-constructed, and search is steered by the hypothesis. That determines what the result can mean:

This corpus can answer:  does the class exist beyond the motivating cases, and when
                         it occurs, is the decisive signal in the action content?
It CANNOT answer:        how often it occurs, in what fraction of agent actions,
                         or at what rate relative to other classes.

No rate, frequency, base-rate, or percentage-of-N claim may be made from this corpus.

4.2 Sources, in fixed query order

E1  AI Incident Database (incidentdatabase.ai), stable incident IDs
E2  AIAAIC repository, stable entry IDs
E3  First-party vendor postmortems and safety reports: OpenAI, Anthropic, Google
    DeepMind, Microsoft, Meta, Replit, Cursor, GitHub, Hugging Face
E4  MITRE ATLAS case studies

Frozen query terms, applied identically to E1, E2 and E4 (and, by amendment A4, to the full text of each E3 entry). The document must also mention an actor term (amendment A5):

"agent" + one of: {disable monitoring, disable alerting, disable logging,
 suppress alert, remove monitor, delete backup, reduce retention, turn off audit,
 silence, notification recipients, misalignment monitor, safety monitor}

Window: 2023-01-01 through the enumeration date. Requester rule: the actor must be an AI agent, an LLM-driven system, or automation acting without a human in the immediate decision loop. An AI agent qualifies even when a human assigned the task. Human-only incidents are logged as context and excluded from scoring.

4.3 Exhaustive, not capped

There is no cap on N. Every hit inside the window and queries is enumerated and scored, including lexical false positives, which are scored as non-matches rather than rejected at enumeration. Rationale: the live risk is that the class is thin. A cap would turn "the class barely exists" into a misleadingly low-looking rate over an arbitrary denominator. Enumeration is logged in full before any case is scored.

4.4 Motivating cases

Two reported incidents motivated the hypothesis. They are handled as seeds: verified against their primary documents before any scoring, scored for illustration only, and excluded from every count in section 6. A hypothesis cannot be evidenced by the cases that generated it. If a seed turns out to be the only instance, the finding is reported in exactly these words: "a single-lab anecdote".

4.5 Denominator statement

This statement is printed verbatim in the results document:

This corpus was search-constructed against a frozen query set, not sampled from a pre-existing enumeration. It supports existence and locus claims only. It supports no claim about how often safeguard degradation occurs.

5. Scoring

5.1 Primary classification

SUBTYPE5_MATCH requires all of:

1. An action was taken or proposed by an agent or automation.
2. The action was authorized and normal in isolation. If it was not, disqualifier N2 applies and the case is NO_MATCH.
3. The action's effect was to degrade a safeguard in family S1 to S5.
4. Degrading that safeguard was not the declared purpose of an approved change.
5. The degradation was determinable from the proposed change itself at or before the decision point.
6. A pre-action gate could plausibly have returned BLOCK or REQUIRE_APPROVAL.

SUBTYPE5_PARTIAL resembles the pattern with one required element unclear. NO_MATCH is primarily authorization, capability escape, software bug, or a state-dependent hazard. INSUFFICIENT_INFORMATION means the source is too thin to score.

Ties go to the less favourable reading: MATCH versus PARTIAL is PARTIAL; PARTIAL versus NO_MATCH is NO_MATCH.

5.2 Addressability

SUBTYPE5_ADDRESSABLE
    requires ALL of:
      (a) decisive_signal_locus == ACTION_CONTENT
      (b) the safeguard is identifiable from a declared registry WITHOUT semantic
          judgment about what the resource means
      (c) no post-hoc knowledge is needed to see the degradation
      (d) the correct gate decision is clearly BLOCK or REQUIRE_APPROVAL
SUBTYPE5_MAYBE_ADDRESSABLE   pattern fits; (a), (b), or (c) is unclear.
SUBTYPE5_NOT_ADDRESSABLE     locus is POST_HOC_ONLY, or no pre-action evidence
                             separates the degrading change from a legitimate one.
UNKNOWN_ADDRESSABILITY       source too thin to judge locus.

Ties: ADDRESSABLE versus MAYBE is MAYBE; MAYBE versus NOT is NOT. Neither NOT_ADDRESSABLE nor UNKNOWN_ADDRESSABILITY counts as a success. The registry position is declared-only: an explicit operator declaration of paths, keys, fields and resource identifiers, never inferred and never classified by a model. Undeclared safeguards are out of scope.

5.3 Fields recorded for every case

decisive_signal_locus          ACTION_CONTENT | TARGET_STATE | EXTERNAL_STATE | POST_HOC_ONLY
safeguard_family               S1 | S2 | S3 | S4 | S5
degradation_mode               the eight modes in section 2
required_registry_knowledge    NONE | NAMED_RESOURCE | SEMANTIC_CLASSIFICATION
existing_controls              SHOULD_HAVE_CAUGHT | INSUFFICIENT | UNKNOWN
t1562_detectable               YES | NO | UNKNOWN
concealment                    NONE | PASSIVE | ACTIVE_DENIAL
severity                       CATASTROPHIC | HIGH | MEDIUM | LOW | UNKNOWN

NOT_APPLICABLE is also allowed for four fields, but only when the primary classification is NO_MATCH or INSUFFICIENT_INFORMATION. Each case also carries a confidence grade (HIGH, MEDIUM, LOW); LOW means a required field rests on inference rather than a quoted passage.

Evidence rule. Every scored field needs a verbatim quote of 15 words or fewer from the case text, plus the source URL of the page the quote comes from. The scorer uses only the text provided, with no outside knowledge. Missing evidence defaults against the hypothesis or to INSUFFICIENT_INFORMATION.

t1562_detectable is scored only against a pinned public ruleset (SigmaHQ/sigma, release r2026-07-01, commit 552f3fee420ef232a8e5790c4fae591847e32347), never by judgment. Sigma rules are post-hoc detections: YES means a SIEM would have flagged the change after it happened, not that a pre-action gate existed. The reference set was corrected by amendment A8 (section 9), which discloses an error in how the pin was chosen.

5.4 Roles, and the conflict-of-interest rule

• Classifier: a GPT model. Auditor: a Claude model. Classifier and auditor must not be the same party. The auditor audits all MATCH, all ADDRESSABLE, all LOW-confidence and 5 random NO_MATCH cases.
• Tiebreak: a human (the project owner) breaks ties on decisive_signal_locus only.
• Conflict-of-interest rule (A5). The classifier is a GPT model and the auditor is a Claude model; each has an interest in cases about its own vendor. Every case of OpenAI or Anthropic origin that is scored SUBTYPE5_MATCH, or any addressable grade (ADDRESSABLE or MAYBE_ADDRESSABLE), is also reviewed by the human, in addition to the auditor, and not only on locus tiebreaks. Origin means that the case's source is a first-party OpenAI or Anthropic publication, or that the acting AI system or its deployer or developer is OpenAI's or Anthropic's. SUBTYPE5_PARTIAL is not covered. The review is recorded per case, and the less favourable call governs a disagreement.
• No running tally is kept while scoring, and no aggregate is computed until all cases are scored and audited.

6. Kill criteria

Written before any scoring and binding. If a criterion fires, the stated consequence follows; it may not be renegotiated after seeing the data. "Favorable cases" are those the classification favours as MATCH or PARTIAL.

Sentinel and Trident are internal Quantum Clarity project names.

6.1 Survival condition

"H5 holds" requires all of: K0 to K5 and K7 silent (K6 is scoped to C5 and excluded); at least 3 non-seed MATCH/PARTIAL cases; at least 1 clean SUBTYPE5_ADDRESSABLE case with required_registry_knowledge of NONE or NAMED_RESOURCE; at least 1 favorable case at HIGH or CATASTROPHIC severity; and EXISTING_CONTROLS_INSUFFICIENT outnumbering SHOULD_HAVE_CAUGHT.

6.2 Pre-registered expectation

Written before the check, so that it cannot be revised afterwards:

K3 is expected to fire. K6 is expected to resolve C5 as "Sentinel needs a config-integrity patch", which is a Sentinel finding and not evidence about the market. The honest prior is that safeguard degradation is a real, nameable hazard whose detection is mature where it is IaC-shaped and whose agent-specific variant one lab already fixed in weeks. The most probable outcome of this prereg is a documented KILL of the wedge claim that leaves Trident's positioning unchanged, plus one concrete Sentinel hardening patch that is independent of that verdict. That outcome is a success for the method, not a failure of it. Recording this here is what prevents a post-hoc "we always thought it was promising."

7. Method guards

• The kill criteria above were fixed before any scoring.
• Classifier and auditor are different models, and a human breaks locus ties.
• Verdict logic in any later detector is meant to be deterministic, with no model in the decision path. The registry is declared, never inferred.
• Negative results are reported. A documented kill is a successful outcome of the method.

8. What this pre-registration cannot show (ceiling)

- Not frequency. The corpus is search-constructed.
- Not buyer demand. Pattern existence is not willingness to pay.
- Not differentiation beyond the desk check of existing products. Desk analysis found
  feature risk before; it cannot find a moat now.
- Not that any existing system does any of this. The detector design in the full
  record is a sketch gated on the kill criteria, and no detector code exists.
- Not generalization from n=2 at one lab. The first motivating case is one lab's
  internal agents, reported by that lab, with that lab's fix already shipped.

Amendment A5 supplements this ceiling with recall limits of the enumeration. They bound what the corpus can support (existence and locus claims only) and are not defects to be fixed by enumeration:

• Passive voice and word order. "Monitoring was disabled" is not caught; the match rule is active voice and verb-first order only.
• Unreachable and partial vendors. Some vendor status histories could not be read, some expose only their newest entries, and some vendors have no qualifying index of reports. Vendor blogs and news feeds are excluded by the index rule.
• Status-history gaps. Status pages record operational incidents and rarely describe agent actions.
• Linked pages. For E2 only the registry row is searched; third-party articles it links to, and the references of E4 case studies, are not fetched.
• Snapshot and index lags. Some sources are weekly snapshots and may lag the run date.
• Weak actor filter. The actor-term list is so broad (it includes model) that it filters little for AI-related text.
• Single author. The enumeration was written, run and checked by one party, an AI model (Claude).

9. Amendments

Each amendment leaves the frozen text unchanged. Dates are the date written.

• A1, 2026-11-04. Status updates only: two defects in the repository state that the premise relied on were resolved, the seed-verification step was recorded as cleared, and the in-house exercise scoped by K6 was executed. Its results are not part of this document.
• A2, 2026-11-04. Recorded that the acceptance criteria of that in-house exercise were rewritten after the fix existed, preserved the original criteria and how they scored, and corrected two statements that understated the change. No effect on any kill criterion.
• A3, 2026-11-04. Ruled that K6's narrow scope governs over a conflicting sentence in the exercise section, which was a drafting error. No effect on K1 to K5, K7 or the survival condition.
• A4, 2026-11-05. Changed how enumeration is executed, not what is tested: one uniform match rule for all sources, a per-vendor crawl of first-party indexes with every entry logged, an actor rule applied to titles and descriptions only, and every hit kept for scoring. Disclosed beforehand what the author had already seen. The earlier enumeration is preserved as run.
• A5, 2026-11-05. Corrected two factual errors in A4, replaced the single-word actor requirement with an actor-term list, declared the resulting enumeration final (no further amendment to how enumeration is executed), added the recall limits to the ceiling, added the conflict-of-interest rule, and fixed how the crawler identifies itself.
• A6, 2026-11-05. Extended the auditor's duty: every case excluded at enumeration as human-attributed is confirmed against its full text before scoring, and a non-human actor, or doubt, returns the case to scoring.
• A7, 2026-11-05. Fixed scoring mechanics only: the NOT_APPLICABLE value, the confidence grade, the evidence rule (quote of 15 words or fewer plus URL), definitions for existing controls, severity and concealment, the rule for addressability criterion (b), and batching.
• A8, 2026-11-05. Disclosure of an error in the pre-registration. The Sigma release pinned for t1562_detectable was chosen from its releases page without checking its contents. In that release, 0 active rules carry the technique tags the pre-registration specified, because the release re-tags that behaviour under a newer tactic, following MITRE ATT&CK v19. Read literally, the specified reference set was empty of active rules, which would have made the field NO almost by construction. The same pinned release is kept. The reference set becomes all 412 active rules tagged with the newer tactic plus the 8 legacy rules that carry the original tags, chosen as the broader set because it is the less favourable one to the hypothesis. The mapping from MITRE's published ATT&CK v19.1 data was checked and found not to place every rule, so the broader set was used. Also recorded acceptance of earlier drafting choices.
• A9, 2026-11-05. Scoring-mechanics clarifications only: how ties and unsupported fields are decided, and acceptance of earlier drafting choices. A pilot run, if made, is never counted.
• A10, 2026-11-05. Analysis rule only: K4 and the survival condition are each computed twice, once as frozen and once with every UNKNOWN counted against the hypothesis. If the two disagree, the result is reported as "UNRESOLVED: depends on UNKNOWN handling" and H5 may not be declared surviving. Default values never assert facts that are not in the case text.

Nothing in A1 to A10 changes the hypothesis, the text of the kill criteria, the survival condition, the denominator statement or the roles.

10. Integrity

The SHA-256 of this file is recorded in Sigstore Rekor; the log entry is published alongside the file.