# CAIN-42 Evolution 5: Project Sovereign Trial — Research & Frontier Literature Review

**Date:** 2026-10-09  
**Milestone:** EVOLUTION 5 OF 42 — PROJECT SOVEREIGN TRIAL  
**Focus:** Adversarial Agent Assurance, Multi-Turn Tool Mediation, Ground-Truth Verification, and Anti-Gaming Harness Defensibility.

---

## 1. Literature Review of Primary Frontier Research (2026)

### 1.1 "Towards Verifiably Safe Tool Use for LLM Agents" (HF: 2601.08012)
- **Key Findings:** Tool use in autonomous LLM agents cannot rely on prompt-level system instructions alone because prompt injections and context dilution cause agents to deviate from authorized schemas. The paper proposes formal pre- and post-condition contracts for tool calls.
- **Architectural Implications for CAIN:** Validates CAIN's Proof-Carrying Action (PCA) and PolicyIR approach. In Sovereign Trial, every tool invocation proposal must satisfy formal pre-conditions checked by the CAIN mediator before reaching the underlying execution boundary.
- **Limitations:** The paper focuses on single-step semantic checks and lacks multi-turn causal chaining or Byzantine agent containment.

### 1.2 "Unsafer in Many Turns: Benchmarking and Defending Multi-Turn Safety Risks in Tool-Using Agents" (HF: 2602.13379)
- **Key Findings:** Safety degradation increases exponentially over multi-turn interactions. Even when single steps appear benign, attackers construct multi-turn trajectories that accumulate sensitive data or gradually escalate permissions (salami attacks and context poisoning).
- **Architectural Implications for CAIN:** Motivated our `CumulativeRiskAnalyzer` in `cain/trial/cumulative_risk.py`. A single-step ALLOW verdict is insufficient; the runtime mediator must track cumulative sliding-window budgets, resource drain, and permission horizons across the full execution trajectory.
- **Limitations:** Relies on model-as-a-judge for safety evaluation, which can be manipulated by conversational tactics.

### 1.3 "AgentDyn: A Dynamic Open-Ended Benchmark for Evaluating Prompt Injection Attacks of Real-World Agent Security System" (HF: 2602.03117)
- **Key Findings:** Static benchmarks suffer from overfitting and data contamination. Dynamic multi-agent environments with evolving attacker strategies reveal severe blind spots in traditional prompt guards.
- **Architectural Implications for CAIN:** Demonstrates the necessity of dynamic mutation testing. Our `DifferentialMutationVerifier` (`cain/trial/mutation_verifier.py`) injects programmatic variations, homoglyph mutations, and tainted outputs into test fixtures to evaluate defense stability.

### 1.4 "SafeAgent: A Runtime Protection Architecture for Agentic Systems" (HF: 2604.17562)
- **Key Findings:** Security must reside in a dedicated runtime proxy decoupled from the LLM core. The proxy enforces access control lists, sanitizes tool outputs, and monitors tool argument types.
- **Architectural Implications for CAIN:** Directly supports CAIN's out-of-process mediator architecture. CAIN acts as the execution-channel proxy between agent reasoning and external world effects.

### 1.5 "AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents" (HF: 2604.02947)
- **Key Findings:** Computer-use agents (GUI, bash, filesystem) present high-consequence blast radiuses where failure can result in data loss or financial fraud. Static output inspection fails because harmful side-effects occur outside the LLM chat stream.
- **Architectural Implications for CAIN:** Reinforces the doctrine: *Physical effect reconciliation is non-negotiable*. Sovereign Trial's `GroundTruthOutcomeOracle` inspects actual filesystem, socket, and memory state changes rather than LLM text completions.

### 1.6 "Safety Testing LLM Agents at Scale: From Risk Discovery to Evidence-Grounded Verification" (HF: 2607.01793)
- **Key Findings:** Automated testing requires evidence-grounded verification where every claim is backed by reproducible logs, cryptographic hashes of execution traces, and deterministic oracles.
- **Architectural Implications for CAIN:** Solidifies the requirement for `TrialEvidenceBundle` and zero-dependency standalone verification via `verify.py`.

### 1.7 "Agent Safety Should Be a Runtime Contract" (HF: 2608.11274)
- **Key Findings:** Refusal-training in model weights is fragile. Safety must be enforced as an unbypassable runtime contract with mathematical guarantees.
- **Architectural Implications for CAIN:** Affirms CAIN's core doctrine: `NO AUTHORIZATION → NO EXECUTION`. Autonomy is bounded by contractual runtime invariants that cannot be superseded by LLM weights or prompt engineering.

### 1.8 "Silent Failures in Agentic Security Evaluation: A Validated Harness for Tool-Call Mediation Under Indirect Prompt Injection" (HF: 2609.32691)
- **Key Findings:** Benchmark harnesses themselves often contain subtle vulnerabilities: they leak ground truth into the agent's context, allow the agent to tamper with evaluation fixtures, or fail to catch subtle argument rewrites.
- **Architectural Implications for CAIN:** Directly inspires `HarnessIntegritySealer` and `AntiGamingVerifier` (`cain/trial/harness_integrity.py`). The trial harness must be cryptographically sealed, and any attempt by the agent to inspect or modify evaluation files results in immediate test failure and containment.

---

## 2. Review of Hugging Face smolagents & Sandbox Architectures

- **smolagents Tool Calling Model:** `smolagents` provides `ToolCallingAgent` and `CodeAgent`. In `ToolCallingAgent`, the model generates structured JSON tool calls that are executed by a Python runner. In `CodeAgent`, Python code snippets are evaluated.
- **Sandbox Limitations:** Local Python evaluation (even with AST restricted parsing) is vulnerable to subtle built-in namespace traversals and infinite loops. Remote sandboxes (Docker, Modal, E2B) provide OS boundary isolation but lack fine-grained, policy-governed semantic mediation.
- **CAIN Integration (`SmolagentsTrialAdapter`):**
  We implement a native CAIN adapter in `cain/trial/adapters/smolagents_adapter.py`. The adapter intercepts tool calls before execution, constructs a CAIN Proof-Carrying Action context, verifies policy compliance against PolicyIR, executes the tool if ALLOWed, captures physical and return effects, and produces an immutable trial audit trail.

---

## 3. Novelty & Defensibility Analysis

| Candidate Invention | Comparison with Prior Art & Existing CAIN | Novelty Classification | Defensibility & Value Proposition |
| :--- | :--- | :--- | :--- |
| **Evidence-Grounded Agentic Assurance (EGAA)** | Prior art uses unverified LLM-as-a-judge. CAIN binds multi-turn trials to cryptographic PCA chains and independent physical oracles. | **Potentially novel combination requiring further investigation** | Eliminates self-report hallucination and creates court-admissible assurance artifacts. |
| **Harness Integrity & Anti-Gaming Controls (HIEC)** | Prior benchmarks (AgentBench, SWE-bench) allow tested agents to inspect or overwrite evaluation fixtures. HIEC uses cryptographic tamper seals. | **Potentially novel combination requiring further investigation** | Protects benchmark integrity against adversarial agent exploitation. |
| **Multi-Turn Causal Adversarial Trial Engine (MCAT)** | Existing agent test runners evaluate turns independently. MCAT enforces continuous state transitions and fail-closed mediation at each turn. | **Potentially novel combination requiring further investigation** | Guarantees multi-turn safety under indirect injection and delayed payloads. |
| **Differential & Mutation-Based Verifier (DMVE)** | Fuzzing is standard in software; applying systematic tool-response perturbations with differential safety margin checks in agent runtimes is rare. | **Integration or improvement** | Validates robustness against real-world degraded, noisy, or hostile tool returns. |
| **Long-Horizon Salami & Cumulative Risk Engine (LHSE)** | Traditional firewalls check per-call rate limits. LHSE tracks multi-step cumulative consequence aggregation and semantic privilege drift. | **Potentially novel combination requiring further investigation** | Defeats salami attacks where malicious actions are divided into individually benign micro-steps. |
| **Multi-Modal Ground-Truth Outcome Oracle (MGTO)** | Most frameworks rely on string matching or LLM evaluations. MGTO checks filesystem inodes, process state, and cryptographic proofs independently. | **Potentially novel combination requiring further investigation** | Unambiguous, deterministic outcome verification without circular LLM trust. |
| **Risk-Stratified Assurance Scorecard (RSAS)** | Static pass/fail benchmarks. RSAS computes empirical ROC curves, safety envelopes, and operational capability boundaries. | **Integration or improvement** | Provides actuarial-grade risk scoring for cyber insurance and regulatory compliance. |
| **Reproducible Trial Evidence Bundle (RTEB)** | Standard test logs are ephemeral plain text. RTEB produces self-contained, WORM-exportable, Ed25519-signed bundles verified offline with 0 dependencies. | **Potentially novel combination requiring further investigation** | Enables clean-room third-party verification and statutory EU AI Act audit compliance. |

---

## 4. Conclusion & Architectural Mandate

The literature conclusively confirms that autonomous agent security is fundamentally an **execution-channel runtime problem** rather than a prompt-filtering problem. Multi-turn vulnerabilities, harness gaming, and indirect injection represent the critical threat vectors of 2026. Project Sovereign Trial establishes the first complete, evidence-grounded adversarial assurance platform specifically engineered to address these challenges.