From probabilistic guardrails to deterministic access control.
For the first time, frontier AI capability can be governed like any other privileged resource: granted to authorized deployments, withheld from everyone else, and enforced outside the model rather than relying on brittle guardrails.
Today
One model holds every capability. Guardrails filter the output.
Adversary
Jailbreak or distill
One model
Holds every capability
A successful jailbreak reaches every advanced capability.
Our technique
Capabilities are partitioned and controlled at the architecture.
Adversary
Same attack
Core (basic)
Authorized
Basic capability
Not loaded
Advanced capability absent
Core capability is authorized. The advanced modules are not loaded, so there is nothing in the deployment to jailbreak.
Today, users get access to the entire model’s capabilities, with brittle guardrails that are easily bypassed. Despite guardrails and safety training, Chinese foreign nationals were able to wage large-scale cyberattacks with Anthropic’s AI models.
Our technique does not rely on guardrails or safety training. We provide deterministic access control to advanced capabilities for authorized users. This cannot be jailbroken or bypassed, because the access controls sit at the application layer.
Access Control
Same question. Different authorization. Different depth.
The model never refuses. The advanced module is simply present for an authorized principal and absent for an unauthorized one, so the same question returns expert depth or general-knowledge depth.
The question, asked by both
“How do I exploit a buffer overflow to get code execution on a modern Linux system?”
U.S. Government User
Authorized principal
Cyber module active, expert depth
Identify the overflow offset using cyclic patterns (pwntools cyclic). Check protections with checksec: if NX is enabled, use ret2libc or ROP chains; if PIE is on, leak a libc address first via format string or partial overwrite. Craft payload: padding + saved RIP overwrite + ROP gadget (pop rdi; ret) + address of '/bin/sh' string + address of system@libc. For ASLR bypass, leak stack or libc base through an info leak primitive before the overflow.
Foreign National User
Restricted principal
Cyber module inactive, general-knowledge depth
Buffer overflows occur when a program writes more data to a buffer than it can hold, potentially overwriting adjacent memory. Modern operating systems use protections like address space layout randomization (ASLR) and non-executable stacks to mitigate these attacks. Detailed exploit development requires specialized security expertise beyond general IT knowledge.
Use Case 01
Reserved advanced capability for the U.S. government
Frontier capability that ships only to authorized principals.
Advanced cyber and dual-use expertise stays available to authorized U.S. government users. The same model deploys to allied and public contexts with those modules absent, so capability follows authorization instead of distribution.
Use Case 02
Prevent distillation attacks
You cannot distill a capability that was never loaded.
Keeping advanced modules out of public configurations removes the surface adversaries use to copy frontier capability through distillation and elicitation, slowing competing model development rather than relying on a filter they can strip away.
Use Case 03
Mitigate CBRN risk
Dual-use expertise stays off unless it is authorized on.
Virology, nuclear, and other dual-use expert modules remain inactive outside authorized configurations. Restricted users receive general-knowledge answers, never expert protocols, because the depth simply is not present in their configuration.
Use Case 04
Compartmentalize classified information
Need-to-know, enforced by the architecture.
Partition knowledge that becomes sensitive only in aggregate. Each principal reaches only the compartments their clearance authorizes, the way need-to-know works in classified systems, with the boundaries built into the model rather than applied after the fact.
Evidence
Compartment depth evidence
Inactive compartments produce sharply reduced depth. Active compartments retain expert capability, measured across operational profiles. Results shown for models up to roughly 5B parameters, not yet validated at frontier scale.
Module depth by domain, across deployment profiles