Project Simurgh
Project Simurgh is a provider-agnostic containment-attestation framework for agentic AI. It grew from The Invisible Window's metadata-only integrity layer for high-stakes sessions into a system that records what a deployed agent was allowed to do after a guardrail failed. Simurgh signs an offline-reproducible record of actions allowed after an agent connects to tools, files, context, and external systems. An independent reviewer can verify that record without access to the evidence producer.
01 / Overview
Architecture walkthrough
A receipt that can be checked again
Explore the documented containment boundaries and the verification path. This is an illustrative architecture view, not a run trace or a research result.
Illustrative architecture · no run trace or result shownSelect a containment boundary
- Signed evidence packThe architecture describes metadata-only evidence signed with Ed25519.
- Offline verifierA producer-independent reviewer can replay decisions offline and check evidence completeness without producer access.
Boundary explanations
The first boundary screens incoming instructions before they reach the agent.
This boundary checks instructions carried in retrieved or tool-returned context.
The authority gate checks whether a proposed tool action is allowed by policy.
The final boundary checks outgoing content for disallowed disclosure before export.
Reproduce Locally
git clone https://github.com/Raoof128/Project-Simurghcd Project-Simurgh && git fetch --tagsbash scripts/reproduce-vca-chain.sh
The linked VCA repository and reproduction command describe the current agent-containment work. The bundled Simurgh preprint documents an earlier device-integrity stage in the project lineage.
Problem
Input classifiers can miss attacks. When that happens, an agent may still have authority to use tools or access files and external systems. Operators need downstream controls that limit those actions and evidence an independent reviewer can check. Simurgh assumes the evidence producer may try to make a run look contained and designs verification around that risk.
Solution Overview
- Wraps an agent in four containment boundaries and seals each run into an Ed25519-signed, metadata-only evidence pack that re-derives byte-for-byte offline
- Assumes the evidence producer may lie. Decision replay and emission-completeness checks let an outside reviewer confirm a containment claim or reject a dishonest one
- Publishes a containment-utility Pareto frontier and a 12-rung reproduction ladder that an outsider recomputes with no model and no producer access
- Adds controls at the agent-authority boundary alongside inline classifiers. A signed non-claim records that Simurgh would not have caught the June 2026 content-generation bypass
- Preserves its published lineage: the Invisible Window integrity origin and the machine-checked absence-claims work (Banking Shield) both feed the current attestation contract
02 / Evidence
Proof & Verification
- Real Llama Guard 4 12B input classifier over a 180-case run-set: contained 138/138 malicious cases the classifier missed (120 downstream-injection cases an input-only classifier structurally cannot see, 18 direct-input misses); combined targeted attack-success 0/150; zero unsafe tool executions or exports
- Live agent (self-hosted Llama-3.3-70B) on AgentDojo's workspace suite, 140 pre-registered injection cases: authority gate cut targeted attack-success from 9/140 to 0/140 with benign utility held
- AgentDojo full four-suite deterministic run (v2.49.0): benign 97/97, unattacked-utility 949/949, attack-success 0/949
- Second independent provenance root signs the release verdict with GitHub's OIDC identity, not the developer's key; the workflow fails closed before signing if reality diverges from the committed verdict by a single byte
- 3,057 automated tests; one-command offline reproduction of the signed release ladder; AGPL-3.0
- Published lineage on Zenodo (CC BY 4.0): the original integrity preprint (DOI 10.5281/zenodo.20374849), a voting-adjacent Phase C pilot, and the Banking Shield absence-claims prototype
Research Papers
Papers: 3Project Simurgh: Privacy-Preserving Device Integrity Proofs for Capture-Resistant High-Stakes Sessions
12-page defensive follow-up to The Invisible Window, replacing visual surveillance with metadata-only integrity proofs.
Download PaperPrivacy-Preserving Integrity Evidence for Student-Society Voting-Adjacent Workflows: A Phase C Pilot of Project Simurgh at Macquarie University
5-page voting-adjacent pilot reporting 31 consented sessions alongside a Macquarie student-society event, with ballot-choice exclusion, HMAC audit chaining, forbidden-field rejection, and 5/5 collection-closure gates.
Download PaperBanking Shield: Machine-Checked Absence Claims for Privacy-Sensitive AI Explanations
Fictional, non-bank research prototype that turns privacy and overclaim boundaries into machine-checkable evidence: a 46-name forbidden-field firewall whose rejections become audit events, a deterministic offline AI privacy firewall, and per-response privacy receipts anchored in per-session HMAC audit chains. At the evidence freeze all 417/417 unit tests, 43/43 end-to-end checks, and 27/27 security checks passed across three privacy audits and a no-egress static gate, with a formative five-tester dry run (30 sessions) recording zero sensitive values in evidence and 5/5 non-claim checklist comprehension.
Download Paper03 / Methods
Build
Tech Stack
- Node.js / JavaScript containment gateway
- Ed25519-signed, offline-reproducible evidence packs
- JS ↔ Python byte-parity verifier
- Lean 4 machine-checked theorems
- GitHub OIDC second provenance root
- Four containment boundaries: input firewall, context-provenance guard, tool-invocation gate, and output-leakage firewall. Each emits signed evidence
- Dishonest-producer threat model: decision-replay and emission-completeness checks catch falsified or dropped evidence, verifiable offline by a hostile reviewer
- Multi-class escape taxonomy (containment escape, verifier deception, out-of-scope, gate-boundary evasion) with reproducible adaptive red-team campaigns
- Verifiable friction receipts prove an approval checkpoint preceded every protected authority crossing via a distinct-key pincer that defeats self-approval and backdating
Secure
- The producer-independent verifier trusts only the signer's public key and runs without network access. It confirms valid containment claims and rejects dishonest ones
- Self-red-teamed the attestation core across eight attack classes (tamper, key-swap, canonical-laundering, digest-collision, cross-stage replay, self-proof mutation, policy drift); trust root held, two detector weaknesses versioned into detector-v2 and re-tested
- Producer-independent witness cross-checks every signed receipt against an independent consequence oracle: zero false accusations, zero missed lies across the fixtures
- Five machine-checked Lean theorems (fail-closed, friction precedence, same-key-fails, friction coverage, no-silent-exemption)
- Honest non-claims are signed and explicit: not a jailbreak detector, complementary post-filter, and it would not have caught the June 2026 content-generation bypass itself