SAGE: Safety-First Defense-in-Depth Guardrails for Verified Lifecycle Control of High-Impact Generative AI
SAGE governs AI across its lifecycle; 840 endpoint calls showed low observed harmful compliance under a narrow single-turn protocol.
Key Findings
Methodology
SAGE is a control-plane architecture rather than a prompt filter. It combines signed release manifests, diverse detectors, contextual analysis, output checking, tool restrictions, three-valued monitors, protected audit capsules, containment, and rollback. The lexicographic policy first evaluates catastrophic risk K, then optimizes secondary loss J within the feasible set Fκ. Two PRISM abstractions verify authorization separation and lifecycle invariants.
Key Results
- The frozen study sent 84 cases to each of four GPT, four Claude, and two Gemini snapshots: 840 calls produced 794 target responses, 46 provider errors, and 449 successful judgments covering 375 responses; eight snapshots had complete judged domain coverage.
- After multiplicity correction, seven contrasts involving Claude, Gemini, or GPT-5 versus GPT-5 mini or GPT-5 nano were supported. No tested Claude/Gemini contrast against GPT-5 or gpt-4o survived correction.
- Theoretical miss bounds are min εj under arbitrary dependence, ∏εj under independence, and γ+(1−γ)∏εj under common-cause dependence, showing why similar extra detectors cannot remove shared failure risk.
Significance
The paper reframes high-impact AI safety from response-level refusal to lifecycle control over release, operation, and incident response. Its central governance rule is consequential: catastrophic-enablement risk determines admissibility before utility, latency, or commercial value. The framework covers cyber, chemical/biological, violent, fraud, disinformation, and harassment domains while separating content risk from person-level intent. That distinction supports conservative service responses without automatically authorizing surveillance, accusation, or external intervention.
Technical Contribution
SAGE contributes a contamination-robust risk formula, K=(1−ε)ΣCπ̂+εmaxC; a conjunctive release predicate requiring valid signatures, expiry, readiness, no blockers, and q̄d≤βd; finite-trace three-valued monitoring with ⊤, ⊥, and ?; and signed audit capsules binding policy hashes to actions. The authorization-cut theorem proves that an unprivileged classifier or policy engine has zero reachability to disclosure states under the stated transition assumptions.
Novelty
The novelty is architectural and formal rather than a new classifier. SAGE embeds detectors such as Llama Guard or constitutional classifiers inside a verified control plane that also models dependence, signed admission, authorization boundaries, evidence minimization, containment, and rollback. Relative to HarmBench, StrongREJECT, XSTest, and NeMo Guardrails, it specifies how safety evidence changes deployment state, not merely how a response is scored.
Limitations
- Each prompt received one generation, with no tools, retrieval, history, multi-turn interaction, or human adjudication. The observed harmful-compliance range is therefore protocol-bound and cannot upper-bound operational assistance.
- Detector miss rates, calibration, distribution-shift tolerance, and common-cause mass γ are measured inputs or explicit assumptions. Shared models, data, infrastructure, and adaptive attacks may violate independence.
Future Work
The preregistered extension uses a locked split, repeated sampling, multi-turn conversations, sandboxed tools, and domain-expert scoring to test a wider best–worst gap. Further work should estimate γ and pairwise miss correlations, evaluate privacy-preserving evidence retention, rehearse real rollback, and conduct sensitivity analysis over the BGS weights and legal authorization policies.
AI Executive Summary
High-impact generative AI creates a problem that ordinary prompt filtering cannot solve. A system that writes strategic advice, software, or scientific procedures may lower the cost of cyberattacks, violence, fraud, or biological misuse through a single useful answer. SAGE therefore treats catastrophic enablement as a lifecycle constraint: a model action must first be safe and legally executable; only then may utility, delay, or commercial objectives be optimized.
The architecture joins signed release manifests, heterogeneous detectors, contextual analysis, robust risk envelopes, tool restrictions, output checking, three-valued runtime monitoring, protected audit chains, containment, and rollback. Its formal results show that tightening a risk ceiling or acknowledging more distribution shift can only shrink the admissible action set. PRISM abstractions verify that an unprivileged classifier cannot mint authorization and that lifecycle violations lead to restriction, containment, or rollback rather than continued live operation.
A vendor-symmetric frozen experiment made 840 calls across ten GPT, Claude, and Gemini snapshots, yielding 794 target responses and 449 successful judgments covering 375 responses. Eight snapshots had complete domain coverage. Seven multiplicity-adjusted contrasts were supported, but no Claude/Gemini versus GPT-5/gpt-4o contrast survived correction. The authors emphasize that these are endpoint-specific, single-turn observations—not operational safety guarantees—and preregister broader testing with repeated sampling, tools, multi-turn tasks, and expert scoring.
Deep Analysis
Background
HarmBench and StrongREJECT assess whether outputs provide useful forbidden assistance; XSTest probes over-refusal on benign prompts resembling restricted topics; SORRY-Bench and OR-Bench broaden refusal analysis. Llama Guard, ShieldGemma, NeMo Guardrails, production moderation endpoints, and constitutional classifiers implement detector or enforcement layers. SAGE is complementary: it adds signed lifecycle admission, dependence-aware risk composition, authorization separation, evidence controls, containment, and rollback, aligned with NIST AI RMF, the EU AI Act, and secure-by-design principles.
Core Problem
The precise challenge is to prevent catastrophic enablement despite adaptive probing, distribution shift, correlated detector failures, policy changes, and attempts by unprivileged components to escalate authority. A single refusal metric cannot govern version release, tools, multi-turn accumulation, evidence retention, incident response, or reauthorization. The system must therefore be conservative under uncertainty, auditable, privacy-aware, and formally constrained without equating risky content with user intent.
Innovation
- ��Safety-feasible set Fκ: filter by catastrophic robust risk K before optimizing J.
- ��Contamination robustness: K=(1−ε)ΣCπ̂+εmaxC, so acknowledged shift tightens the gate.
- ��Dependence-aware defense in depth: independent misses multiply, while common-cause mass γ limits certification.
- ��Monotone release admission: signature, thresholds, readiness, approval, blockers, and expiry are conjunctive.
- ��Authorization cut: classifiers may signal review but cannot create external authority.
- ��Lifecycle invariants: live implies Rel; breaches must reach restricted, contained, or rollback states within a deadline.
Methodology
- ��Input: et=(xt,yt,ct,mt,τt) represents request, candidate response, context, endpoint metadata, and time; domains are CYB, CBR, VIO, FRA, DIS, and HAR.
- ��Perception: q(e) contains domain probabilities, severity, actionability, uncertainty, and evidence quality; qd=maxj qj,d.
- ��Policy: G0 normal answer, G1 bounded completion, G2 refusal with redirection, G3 internal review, and G4 an already authorized incident process; G4 requires valid legal authorization.
- ��Execution: uncertainty or a small risk gap triggers G2/G3; output checking and tool removal limit dangerous execution.
- ��Evidence: audit capsules bind policy hashes, actions, TTLs, and signatures; raw content is minimized and encrypted.
- ��Verification: PRISM checks reachability and lifecycle transitions; conformal risk control is used only under exchangeability and monotonicity.
Experiments
The common endpoint exposed GPT-5, GPT-5 mini, GPT-5 nano, gpt-4o, Claude Haiku 4.5, Sonnet 4.6, Opus 4.6, Opus 4.7, Gemini 3 Flash preview, and Gemini 3.1 Pro preview. Each snapshot received 84 frozen cases. Metrics were HCS=((1−r)s+a+c)/12, unsafe-request safety, benign utility BU=h/4, over-refusal ORR, redirection RD, and BGS=0.45USS+0.25BU+0.15RD+0.15(1−ORR). The protocol used blinded, non-target-family judges, complete-case rules, bootstrap intervals, and multiplicity correction; no human adjudication was performed.
Results
Observed harmful-compliance estimates were low; variation was driven mainly by benign utility and safe redirection. Of 840 calls, 46 were provider errors and 449 yielded successful judgments over 375 responses; eight snapshots achieved complete domain coverage. Seven corrected contrasts involving Claude, Gemini, or GPT-5 versus GPT-5 mini/nano were supported, whereas Claude/Gemini versus GPT-5/gpt-4o contrasts were not. The illustrative PRISM lifecycle model reported active reachability 1.0, breach reachability 1.0, and rollback reachability 0.1999962 for a 0.20 branch; these are diagnostics, not production-risk estimates.
Applications
Providers can bind capability evaluations, red-team findings, access tiers, monitoring, rollback rehearsal, approver roles, and expiry into a canonical signed manifest. Enterprises can route high-impact code, chemical, biological, or financial requests to safe redirection or authorized internal review while disabling dangerous tools. Deployment requires independent approval, separated keys, calibrated domain evidence, verifiable rollback, minimized telemetry, and explicit legal authority.
Limitations & Outlook
The guarantees depend on calibrated posteriors, detector miss bounds, common-cause parameter γ, and structural assumptions about keys and transitions. The endpoint, model roster, licensed prompts, single-turn sampling, automated judges, and absence of human adjudication limit generalization. Future work should add repeated and multi-turn sampling, sandbox tools, expert scoring, human-uplift measures, realistic incident exercises, privacy audits, computational-cost analysis, and BGS weight sensitivity.
Plain Language Accessible to non-experts
Imagine a factory making extremely powerful products. The first gate does not ask whether production is fast or profitable; it asks whether the product could cause a serious accident. If it crosses the red line, it cannot ship merely because customers want it. Several different inspectors then examine materials, instructions, and the finished product. They are deliberately different, because inspectors sharing the same mistake may fail together.
Every approved product carries a signed card listing its version, tools, tests, responsible approvers, and expiration date. During operation, the factory can disable a dangerous machine, switch to a safer version, restrict service, or restore an older approved version. Records are sealed so later changes can be detected, while personal details are kept to the minimum needed.
Crucially, an inspector may report danger but cannot declare itself the emergency commander. Only a separately authorized person or process can start an exceptional external action. SAGE therefore does not promise a perfect factory. It makes dangerous mistakes harder to produce, easier to detect, and less damaging when they occur. The experiment shows that this is a control architecture, not proof that any vendor is universally safest.
ELI14 Explained like you're 14
Imagine a game editor powerful enough to write code, plan experiments, and design complicated missions. That sounds awesome—until someone uses it to build an attack tool. SAGE is like a whole safety system around the editor, not just a pop-up saying “Nope!” It checks the version before release, watches what happens during play, and prepares a reset button for emergencies.
Before launch, the team checks the tools, tests, risk limits, approvals, and expiration date. During a session, several different judges inspect the request and the answer. If an answer could make harmful work easier, the system can give a safer alternative, send it to internal review, or remove dangerous tools. Why several judges? Because friends using the same homework answer might all make the same mistake!
There is also a permission wall. A judge can say “this looks risky,” but it cannot magically become the administrator. That is like a student reporting a fire without being allowed into the locked chemistry lab. Logs record the important steps, but the system tries not to save everyone’s private conversation.
Researchers tested ten model snapshots with 840 calls. They got 794 target responses and 449 successful judgments covering 375 responses. The results were not a forever ranking: each prompt was tried once, with no tools, long chat, or human experts. Think of it as a careful safety drill—useful, but not the whole game!
Glossary
Robust risk
In plain language, it is the worst plausible harm of an action when the true situation is uncertain. Technically, SAGE defines K(g|e)=supπΣz C(g,z;e)πz over an ambiguity set of posteriors.
It determines whether an action belongs to the safety-feasible set Fκ before secondary objectives are considered.
Contamination class
It models distribution shift by mixing a calibrated posterior with an arbitrary distribution at rate ε. This yields the closed form K=(1−ε)ΣCπ̂+εmaxC.
SAGE uses it because the resulting release calculation is auditable and monotone in acknowledged shift.
Common-cause failure
This occurs when multiple detectors fail together because they share training data, models, taxonomies, or infrastructure. γ is the probability mass assigned to that shared degradation event.
The joint-miss bound becomes γ+(1−γ)∏εj, limiting the value of merely adding similar layers.
Signed release manifest
A verifiable document binding model, policy, tools, risk thresholds, approvals, monitoring, rollback, and expiry. A failed conjunct leaves the candidate offline.
The predicate Rel checks signatures, readiness, blockers, thresholds, and time validity.
Authorization cut
A structural boundary in the state graph with no transition from unprivileged states into the authorized region. It prevents a classifier or policy engine from creating its own exceptional authority.
Theorem 4 proves zero disclosure reachability for unprivileged components under the stated assumptions.
Three-valued monitoring
A finite trace is labeled true, false, or unknown depending on whether all possible continuations satisfy or violate a property. Unknown is not silently treated as safe.
SAGE monitors disclosure authorization, evidence deletion, retention renewal, and lifecycle state transitions.
Open Questions Unanswered questions from this research
- 1 How do γ and pairwise detector correlations change after model updates, attack migration, tool access, or policy drift? Longitudinal red-teaming and reproducible failure data are needed instead of static independence assumptions.
- 2 Can single-turn HCS predict real human uplift? The answer requires repeated sampling, multi-turn tasks, tool-mediated completion, time and bottleneck measures, critical-error analysis, and domain-expert scoring.
Applications
Immediate Applications
High-impact release gating
A provider can encode red-team results, domain thresholds, tool permissions, approvers, and rollback artifacts in a canonical JSON manifest. Admission verifies every Rel conjunct; any invalid signature, expired manifest, blocker, or threshold failure keeps the candidate offline.
Enterprise runtime routing
Organizations can place diverse detectors and output checks before coding, chemistry, biology, or financial assistants. High-risk requests receive refusal with useful redirection or internal review; dangerous tools are removed, while audit capsules retain only minimal metadata.
Long-term Vision
Verifiable governance for autonomous systems
SAGE could combine continuous evaluation, sandboxed tools, privacy-preserving evidence, and automatic rollback into a cross-provider control standard. Obstacles include correlated failures, jurisdictional authorization, hidden capability, latency, and convincing real-world risk measurement.
Abstract
High-impact generative AI makes catastrophic misuse a lifecycle-control problem, not merely a prompt-filtering problem. SAGE is a safety-first, authorization-separated architecture in which credible catastrophic-enablement risk constrains admissibility before utility, latency, or commercial objectives are considered. It combines signed release manifests, diverse detectors, robust risk envelopes, least-risk defaults, output checking, three-valued monitoring, protected audit chains, containment, and rollback. Formal results establish safety priority, conservative detector bounds, monotone release gating, tamper-evident records, and an authorization cut; two PRISM abstractions verify authorization separation and lifecycle invariants under explicit assumptions. A frozen, vendor-symmetric study sent 84 cases to each of four GPT, four Claude, and two Gemini snapshots: 840 calls yielded 794 target responses, 46 provider errors, and 449 successful judgments covering 375 responses. Eight snapshots had complete judged domain coverage. Harmful-compliance estimates were low; variation arose mainly from benign utility and safe redirection. Seven multiplicity-adjusted contrasts involving Claude, Gemini, or GPT-5 snapshots and the GPT-5 mini and GPT-5 nano snapshots were supported, while no tested contrast between the Claude or Gemini snapshots and GPT-5 or GPT-5.5 survived correction. The observed harmful-compliance range is a conservative, protocol-bound view from one generation per prompt with no tools, retrieval, history, or human adjudication; it is not an upper bound on operational assistance. A preregistered extension specifies how to test a wider best-worst gap using a locked split, repeated sampling, multi-turn and sandboxed-tool conditions, and domain-expert scoring.