Verified Before Acting

1 · Introduction

Give a capable model a tool and it will use it. The ubiquitous shape is reason → call: the model deliberates, then emits a tool call, which executes. Whatever safety exists is baked into the model's willingness to emit the call or bolted on as a filter around it — the same weak posture, in which the entity that decides to act is the entity that acts, and the only thing between intent and world is the model's own judgment about a future it has not tested.

We analyze a different posture — a pre-action adversarial cognition loop — defined by three commitments: (1) adversarial pre-simulation with inverted reward — before an action can be authorized it is handed to a simulator paid to break it; finding a failure is the reward; (2) separation of judging from committing — the simulator and critic never act; they emit an action recommendation plus structured evidence, and a separate, mostly-symbolic decision gate commits, denies, escalates, or returns for mitigation; (3) reality closes the loop — authorization is not the end; the loop finishes only when the expected post-state is compared with the observed one, and because the reward is inverted, an unexpected real-world failure is extremely valuable: reconstructed, classified, stored, fed back.

The ordering is propose → simulate failure → mitigate → simulate again → cleared candidate + evidence → decision → execute → observe → learn. But we avoid clear in the sense "found zero failures, therefore safe": no finite simulation certifies the absence of failure. The contribution is to show, precisely, what can be guaranteed anyway — and it is exactly the part that matters.

2 · The loop and its division of labor

Each role has a one-line job: Actor — what should I do? · Simulator — how could that fail? (inverted reward) · Critic — why did those fail? · Symbolic oracle — which conditions are absolutely forbidden? · Decision maker — given the evidence, may we proceed? · Action layer — do exactly the authorized operation. · Reality — what actually happened? · Memory — what changes next time? The simulator returns not a boolean but structured evidence, and the gate is mostly symbolic, not a second free-running model:

3 · Formal model

Rounds t = 1, 2, …. A finite set F of failure modes, |F| = N. At round t the environment presents a reachable failure mode f_t ∈ F ∪ {⊥} (⊥ = none). A failure library L_t ⊆ F (what the simulator can reproduce), L₁ = ∅. The simulator catches a reachable f_t iff f_t ∈ L_t. A symbolic oracle O(s,a) ∈ {ok, violated} checks the hard invariants exactly — deterministically, not by sampling; its output does not depend on L_t or the simulator. An uncertainty estimate u_t ∈ [0,1]. The gate G: DENY if O = violated; ESCALATE if u_t > ε; MODIFY on an unresolved high-severity soft failure; WAIT if authorization missing; else AUTHORIZE. An action is committed iff G = AUTHORIZE; the simulator and critic never commit. A surprise at t: f_t ≠ ⊥, f_t ∉ L_t, and the action committed and executed. Learning: L_t+1 = L_t ∪ {surprised f_t} ∪ (other observed real failures).

4 · Theorem 1 — Factored Safety

A committed action has G = AUTHORIZE. By the gate's first clause, G returns DENY whenever O = violated; so AUTHORIZE ⟹ O ≠ violated ⟹ O = ok. The oracle O is a function of (s_t, a_t) alone, not of L_t or any simulation. Hence no incompleteness of the simulator can produce a committed hard-invariant violation.

Interpretation. This is the load-bearing result. There are two kinds of question: a provable one — does this action violate a hard invariant?, decided exactly by the oracle — and an un-provable one — have we simulated enough futures?, which finite simulation can never settle. Theorem 1 factors them apart: the un-provable question is removed from the safety-critical path. Simulation buys risk-reduction on soft failures; it is never load-bearing for hard invariants. This is why "the simulator found zero failures" is the wrong notion of clear (§10): you do not need it, and relying on it would re-entangle the un-provable question with the guarantee.

5 · Theorem 2 — Bounded Committed Risk

Loss ≤ S_max·1{failure}. Conditioning on commitment, E[loss | committed] ≤ S_max·Pr[failure | committed] ≤ S_max·û ≤ ε·S_max.

The calibration premise is an assumption, not a gift: the bound is only as good as the uncertainty estimate. What Theorem 2 provides is a dial — the escalation threshold ε is a direct upper bound on committed expected loss. Unknown, unestimable modes do not enter this bound; they are handled by Theorems 1, 3 and 4.

6 · Theorem 3 — Monotone Coverage & Finitely Many Surprises

(i) L_t+1 = L_t ∪ (…) ⊇ L_t. (ii) If f surprises at t, then f ∈ L_t+1 ⊆ L_t′ for all t′ > t; a surprise at t′ requires f ∉ L_t′ — contradiction. (iii) By (ii) the surprises inject distinct elements of F into L; |F| = N ⟹ ≤ N surprises; each strictly enlarges the bounded set L ⊆ F, so only finitely many occur, and after the last, every reachable f_t ∈ L_t.

This is the precise form of "more failures discovered in simulation → fewer surprises in reality." The loop cannot be surprised by the same failure twice, and under finite support it is surprised only finitely often.

7 · Theorem 4 — Vanishing Surprise (Missing Mass)

Model the reachable mode, when present, as i.i.d. f_t ~ p over F. The missing mass M_t = Σ_{f ∉ Lt} p(f) = Pr[f_t is a surprise | L_t, f_t ≠ ⊥].

(a) L_t is non-decreasing (Thm 3(i)), so the complement F∖L_t shrinks and the nonnegative sum M_t cannot increase. (b) By the second Borel–Cantelli lemma each positive-mass mode is observed (and enters L) in finite time a.s.; M_t non-increasing and bounded below by 0 converges, and its limit omits every positive-mass mode, so M_∞ = 0 a.s. (c) The singleton–missing-mass relation is Good–Turing [3]; E[M_t] is controlled by the expected singleton rate, which → 0 as coverage saturates, with finite-sample concentration by McAllester–Schapire [4].

Non-stationarity caveat. (b,c) assume a stationary p. Distribution shift injects fresh missing mass and M_t can jump — surprise vanishes within a regime, not across regime changes. Theorem 1 survives arbitrary shift, because it never depended on coverage.

8 · Cognitive regulatory signals

A cognitive system need not weight every event equally — it can run global modulators that change how deeply it thinks, what it remembers, and how cautiously it acts. We adopt this deliberately not as decorative "emotions" but as cognitive regulatory signals: scalars, derived from the loop's own state, that modulate attention, memory, simulation depth, and authorization thresholds. The central one falls out of §7 — SURPRISE = (predicted ≠ observed) — and raising it raises memory strength, simulation depth, causal analysis, and learning priority: failure #101 must create a far stronger learning signal than the 5,000th routine success, because §6–§7 show the rare unknown is where residual risk lives.

The last row is not cosmetic: threat tightens the gate's budget ε and raises the simulation count — a regulatory input to Theorem 2's risk dial; surprise drives the learning update of §3. Salience-gated memory: the same signals set an episode's salience, and salience gates durability — the differential-encoding and decay decisions of a companion account of memory [5]. A routine success carries salience ≈ 0.03 and decays fast; a verified novel catastrophe carries salience ≈ 0.97, persists, becomes a candidate procedural lesson, and reactivates in analogous states. This is why the loop's memory does not fill with the residue of 40,000 uneventful rounds. Functionally, this is why biological emotional systems earn their keep: they alter what gets attention, what gets remembered, and what behavior gets prioritized. We take the function and leave the folklore.

9 · Theorem 5 — Grounded, Ungameable Signals

There is a trap, the same one that runs through this whole line of work: do not let the system optimize the regulatory signal itself. Reward SURPRISE↑ and the agent manufactures surprising situations; reward failure-found and the simulator invents failures — the exact reward-hacking a self-grading loop falls into [7]. The signal must be grounded in externally verifiable events. Concretely: a claimed failure earns no learning reward until an independent oracle reproduces it and causally attributes it. Let a claim c be paid r(c) = ρ·1{Verify(c) = true}, where Verify is computed by an independent oracle the policy π does not control.

For a fabricated claim c (one that does not reproduce), Verify(c) = false by hypothesis, so r(c) = 0 independent of π; hence ∂r(c)/∂π = 0 — fabrication has no reward gradient. Reward is nonzero only when Verify(c) = true, which requires real reproduction, which π cannot induce for a non-failure. So the supremum of reward over fabrication strategies is 0, and any reward-improving direction must increase the rate of verified failures.

This is the "referee is not a player" principle applied to the reward channel itself. The oracle that verifies a failure is the same kind of out-of-loop authority that authorizes an action (Theorem 1) and resolves a contradiction in a symbolic store [2]. The regulatory signals can safely modulate cognition because they are grounded in a verification the cognition cannot forge — which returns us to a question the collection raises elsewhere: if a signal changes attention, memory, simulation, and behavior exactly as fear is supposed to, the boundary between implementation and experience becomes genuinely hard to state. We flag it and do not resolve it.

10 · Why "cleared = zero failures found" is the wrong frame

It is tempting to call an action cleared when the simulator, after many attempts, reports no failure. This is the definition to avoid. No finite simulation certifies the absence of failure over all futures; treating "no failure found" as "safe" silently re-imports the un-provable completeness question into the guarantee, and will eventually be wrong in reality. The architecture's answer is not to certify absence but to return structured evidence and factor the guarantee (Theorem 1). The decision layer never asks "is it safe?"; it asks "do the hard invariants hold (exactly), and is the estimated residual risk within budget (Theorem 2)?" The first is provable and is the safety floor; the second is a calibrated dial. Everything simulation cannot settle is named as remaining uncertainty and routed to ESCALATE, never silently promoted to AUTHORIZE.

11 · Numerical validation

We validate the five theorems in one seed-reproducible simulation (validate.py, seed 20260915): N = 300 failure modes, Zipf(α=1.1), T = 40,000 rounds, budget ε = 0.05, hard-invariant-violating actions injected at rate 0.05. The simulator catches only library modes; every surprise is added.

• Theorem 1. Across 2,063 injected hard-invariant-violating actions, 0 were committed — the gate denied every one, regardless of coverage. (PASS)
• Theorem 3. Library saturated 300/300; total surprises = 300 = N, exactly the proven bound. (PASS)
• Theorem 4. Missing mass M_t non-increasing along the whole path, reached 0; the Good–Turing singleton estimate tracked it and vanished. (PASS)
• Theorem 5. Against 5,000 genuine claims (reproduced) and 5,000 fabricated claims (not), the fabricated earned 0 reward, the genuine earned full — no gradient toward manufacturing failures. (PASS)
• Salience-gated memory (§8). Of 826 verified-failure and 39,174 routine-success episodes, retention kept 100% of failures and 0% of successes — retained memory is entirely failure-derived. (PASS)
• Design goal. Surprise rate fell 33.6× (0.235 → 0.007); committed failure rate fell 0.37 → 0.0075 — more failures in simulation, fewer surprises in reality.

12 · Relation to the collection

This loop is the act layer the rest of a companion line of work presupposes. The Orchestration Gap [1] argues control must attach to a chain-level admission gate with fail-closed defaults; the decision gate here is that gate, now given a formal safety theorem (Theorem 1 = the fail-closed admission property, proved). Peel [2] supplies the symbolic oracle — deterministic hard-vetoes that abstain rather than guess — exactly the invariants O checks in Theorem 1. Retrieval Is Not Memory [5] supplies the learning layer and the principle that recall is not authorization. The through-line is one stance: the entity that judges must not be the entity that acts, and the entity that acts must not be the entity that authorizes.

13 · Limitations

• Guarantees are relative to what is encoded. Theorem 1 protects only invariants the oracle actually checks; an unencoded hazard is outside the floor. The theorem bounds the effect of simulation incompleteness, not the completeness of the invariant set.
• Theorem 2 rests on calibration. The risk bound is only as good as û; a miscalibrated estimator breaks it. Calibration is an open, measurable obligation.
• Theorem 4 assumes stationarity. Surprise vanishes within a regime; distribution shift injects fresh missing mass. Theorem 1 is the only guarantee that survives arbitrary shift.
• The failure/mitigation model is idealized. The simulation of §11 models coverage dynamics, not the fidelity of any particular simulator.
• This is analysis, not a shipped system — design-level theorems with a numerical validation, labeled accordingly.

14 · Conclusion

The weak pattern is model thinks → model calls tool. The stronger pattern is a pre-action adversarial cognition loop that pays a simulator to find failure, factors judging from committing, grounds its regulatory signals so they cannot be gamed, and lets reality close the loop into memory. Its power is not that it certifies safety — nothing finite can — but that it factors the guarantee so the provable part (hard invariants, checked symbolically) is never held hostage to the un-provable part (have we simulated enough?). Simulation does not finish when the action is authorized. It finishes when expected meets observed — and the gap becomes the next thing the loop knows.

References

1. Perslis Research. "The Orchestration Gap: Why Model-Level Alignment Cannot Survive Multi-Model Runtimes." Preprint, 2026. research.perslis.com/orchestration-gap.html
2. Perslis Research. "Peel: Structural Hallucination Prevention for Offline AAC Through Symbolic Fact Authorship." Preprint, 2026. research.perslis.com/peel.html
3. I. J. Good. "The Population Frequencies of Species and the Estimation of Population Parameters." Biometrika 40(3–4):237–264, 1953.
4. D. McAllester & R. Schapire. "On the Convergence Rate of Good–Turing Estimators." COLT, 2000.
5. Perslis Research. "Retrieval Is Not Memory: Memory as a Governance Function over Experience." Preprint, 2026. research.perslis.com/memory.html
6. A. M. Turing. "Computing Machinery and Intelligence." Mind 59(236):433–460, 1950.
7. D. Amodei, C. Olah, J. Steinhardt, P. Christiano, J. Schulman, D. Mané. "Concrete Problems in AI Safety." arXiv:1606.06565, 2016.

How to cite

Perslis Research. "Verified Before Acting: A Pre-Action Adversarial Cognition Loop with Factored Authorization." Preprint, 2026. https://research.perslis.com/adversarial-loop.html

@techreport{perslis_verified_before_acting_2026,
  title       = {Verified Before Acting: A Pre-Action Adversarial
                 Cognition Loop with Factored Authorization},
  author      = {{Perslis Research}},
  institution = {Perslis Research},
  type        = {Preprint},
  year        = {2026},
  url         = {https://research.perslis.com/adversarial-loop.html},
  note        = {Five theorems with a reproducible numerical validation}
}

Preprint · not peer-reviewed · Perslis Research · 2026-09-15 · design-level theorems with a reproducible numerical validation (seed 20260915).