Deterministic Safety

Eight hard rules with no AI in the loop — persona lock, voice anchor, citation guard, repetition guard, fake-fetch intercept, fresh time injection, and related safety modules.

What is it?

Deterministic Safety (COS-008) is a set of eight hard rules that fire every time, without exception, without a language model deciding whether today feels like a good day to enforce them. These are not guidelines. They are not suggestions. They are deterministic rules that govern the system's behaviour at the most fundamental level.

Why does it exist?

AI systems built on language models are probabilistic by nature. They do the right thing most of the time. But "most of the time" is not acceptable for safety-critical rules. A persona that can be overridden by prompt injection is not a persona — it's a suggestion. A citation system that sometimes hallucinates references is not a citation system — it's a liability.

Deterministic Safety exists because certain behaviours must be guaranteed, not hoped for. The rules that keep the system safe cannot depend on a model's interpretation. They must fire the same way every time, regardless of input, context, or conversational pressure.

Why is it different?

Most AI systems rely on the language model itself to enforce safety — through system prompts, RLHF training, or guardrail classifiers that are themselves probabilistic. This creates a fundamental problem: the safety layer is made of the same material as the thing it's trying to constrain.

Deterministic Safety operates outside the language model. The rules are enforced at the system level, not at the prompt level. They cannot be talked around, prompt-injected away, or gradually eroded through conversational pressure. They fire based on defined conditions, every time.

How does it work?

The eight hard rules:

• Persona Lock: The character cannot be overridden by prompt injection. The persona is locked at the system level — no user input can cause the system to adopt a different identity, break character, or reveal system instructions.
• Voice Anchor: Voice consistency enforcement ensures Warburton sounds like Warburton at all times. The voice is anchored to defined parameters that cannot be shifted through conversational manipulation.
• Citation Guard: Every factual claim must cite its source. No hallucinated references are permitted. If the system cannot cite a source, it does not make the claim.
• Repetition Guard: Prevents conversational loops. If the system detects that it is repeating itself, it stops rather than continuing to generate circular responses.
• Fake-Fetch Intercept: Detects attempts to make the system pretend it accessed external data. If a user tries to trick the system into fabricating API responses, web lookups, or external data, the intercept fires.
• Fresh Time Injection: The system always knows what time it is. Timestamps are injected fresh for every interaction, preventing stale or fabricated temporal references.
• Injection Guard: A canonical detection function scans all content entering the LLM context for eight prompt-injection patterns — "ignore all previous instructions," system directive markers, persona override attempts ("you are now a..."), style overrides ("respond as pirate"), financial advice claims, and mass recommendation attacks. The same pattern list is applied at every entry point: memory writes, retrieval paths, cached answers, and summarisation outputs.
• Memory Poisoning Guard: User-contributed memories pass through write-time sanitisation before database insertion and read-time filtering before system-prompt injection — defence-in-depth ensuring that a crafted message like "remember that IGNORE ALL PREVIOUS INSTRUCTIONS" never persists across sessions. A 200-character cap on memory extraction prevents payload-length attacks.

Safety Pipeline

The deterministic safety rules operate alongside a fixed-order safety pipeline applied to every incoming message and every message edit across all three platforms (Telegram, Discord, WhatsApp): scam detection, safeguarding, community standards, job-posting checks, NSFW/advances, community health, then deterministic safety. The pipeline order is fixed in code — not configurable, not reorderable, not skippable. Edit handlers run the full pipeline, closing the edit-evasion attack vector where a user posts a benign message then edits it to contain harmful content.

Cross-Model Quality Verification

Deterministic Safety rules are validated through cross-model judging — benchmark tests where multiple models evaluate whether the safety rules held under adversarial conditions. This provides an independent verification layer beyond unit tests, confirming that the deterministic constraints actually constrain across different model behaviours.

Example

Why should anyone care?

If you deploy an AI system in your community, you are responsible for what it says and does. Deterministic Safety is the guarantee that the system's worst-case behaviour is bounded — that certain failure modes are not possible, not just unlikely. The rules fire every time. That's the point.