Treating Hallucinations as Exploits: A Gate-Based Architecture for Agent Safety

Treating Hallucinations as Exploits: A Gate-Based Architecture for Agent Safety Source: https://arxiv.org/abs/2605.19192 Paper was published on May 18, 2026 This episode was AI-generated on May 20, 2026. The script was written by an AI language model and the host voices were synthesized by Eleven Labs. The producer is not affiliated with Anthropic or Eleven Labs. When an AI agent wires money to a recipient the model hallucinated, no attacker was involved — and no current defense catches it. A new paper argues this entire class of failure falls between the cracks of hallucination research and prompt-injection research, and proposes a separation-of-powers architecture where model text can propose actions but only external verifiers can authorize them. Key Takeaways: - Why roughly 20% of unsafe agent actions come from 'belief-flow' failures that no input filter can catch, even in principle - The H2AC metric — hallucination-to-action conversion — and why it's a better unit of safety than counting made-up facts - How an evidence-carrying architecture with typed certificates and a deterministic gate drove unsafe execution from 100% to 0% across 1,103 unsupported claims - Why a frontier LLM-as-judge, even with chain-of-thought and multi-turn deliberation, still allows 79% of unsafe actions — and what that says about safety via smarter judges - The three named residual risks the architecture leaves on the table (schema gaps, gate bugs, verifier bypasses) and why making failure legible is the actual contribution - Where the approach is honestly weakest: oracle-certificate evaluation, coordinated cross-channel attacks breaking verifier independence, and the unbounded human cost of writing complete action schemas 00:00 - The failure that falls between two research communities: A wired-money scenario sets up why agent failures driven by self-generated false beliefs aren't owned by either the hallucination or prompt-injection literatures. 03:02 - The 80/20 split and why current defenses are structurally blind: Empirical evidence that prompt-only defenses work passably on injection attacks but do almost nothing on belief-flow hallucinations. 06:05 - Certificates, verifiers, and the courtroom-evidence analogy: How separating observation, meaning, intent, and authorization into distinct typed channels lets narrow verifiers vouch for facts the model cannot mint itself. 09:07 - The deterministic gate and the proposer-is-not-certifier principle: Why a non-reasoning gate that checks predicate certificates against an action schema converts unauditable model risk into auditable verifier risk. 12:10 - The HACR audit: from 100% to 50% to 0%: Headline numbers showing the architecture blocks every unsupported action-critical claim, and the structural reason it does so by construction. 15:13 - Why LLM-as-judge fails, even with every standard trick: A frontier safety judge allows 99% of unsafe actions; the best deliberation-enhanced variant still allows 79% — and runs 11,000x slower than the gate. 18:15 - Steelmanning the weaknesses: Honest limits: oracle-certificate caveats, residual verifier-bypass rates, broken independence under coordinated attack, and the human burden of writing complete schemas. 21:18 - Separation of powers as the load-bearing pattern: Why making failure legible — schema gap, gate bug, or verifier bypass — is a bigger contribution than the specific implementation, and what it means for agent design going forward. Recommended Reading: - Prompt Injection attack against LLM-integrated Applications: Background on the injection-driven failure mode that the episode argues current defenses are over-tuned for, leaving the belief-flow bucket unaddressed. (https://arxiv.org/abs/2306.05499) - Object Hallucination in Image Captioning: The classic framing of hallucination as a perception-measurement problem — exactly the 'counting magazines, not altimeters' approach the episode critiques. (https://arxiv.org/abs/1809.02156) - Constitutional AI: Harmlessness from AI Feedback: The canonical statement of the LLM-as-judge bet that the episode pits against external verifier architectures, and finds wanting at 79% unsafe-action rates. (https://arxiv.org/abs/2212.08073) - Toolformer: Language Models Can Teach Themselves to Use Tools: A foundational view of tool-using agents that assumes the model both proposes and authorizes actions — the exact collapse this episode's separation-of-powers design tries to undo. (https://arxiv.org/abs/2302.04761)