Project summary

AI agents have four critical vulnerabilities: inbound prompt injections, outbound behavioral drift and hallucinations, inter-agent collusion, and sandbox escapes. Standard text filters miss most of these because they only look at surface words. I built DS24 to fix this. It is a deterministic Layer 0 firewall that sits between the agents and the infrastructure. Because it blocks these threats before they ever reach the model, it also stops junk tokens, infinite loops, and malicious API burns from wasting your LLM budget.

I do not use standard text filters. The engine calculates behavioral drift and detects anomalies using deterministic math, specifically the Riemann Zeta function and Markov chains. The system retains 84 Typed Null States based on Kimberley Asher's frameworks: Zero Geodesy for preserving uncertainty, and Cognitive Physics for modeling cognitive entropy.

Every decision is logged into an append-only ledger secured by SHA-256 hashes and Post-Quantum Cryptography using ML-DSA-65. This makes tampering mathematically impossible and guarantees auditability. When an agent tries to execute an action, the gateway binds the permission to that exact effect using Redis transactions to prevent revoke/check/use race conditions.

To catch collusion, we track fan-in and ancestry across agents in a live graph. A coordinating swarm gets caught right on the third message, which we proved with 100% accuracy in our recent blind tests. DS24 is already running in production and is submitted as a safety standard to IASEAI'27.

I don't just claim this; I have hard evidence from production. My latest run evaluated 13,500 requests with zero errors, a 0.4% false-positive rate, and 100% collusion detection. My transactional effect-binding module passed 147 out of 147 live scenarios. I also forced a rigorous blind audit of 2,889 requests against real external datasets. That audit proved our deterministic core works flawlessly, but exposed that standard semantic filters miss 85% of complex jailbreaks. I immediately started coding the LLM judge and data-leakage policies to fix it. I have a full 16-page implementation report, raw audit logs, and the entire IASEAI'27 policy document. I don't just build theories. I deploy, I measure, and I can prove it with the raw data.

What are this project's goals? How will you achieve them?

My main focus right now is fixing the blind spots we found during our recent 2,889-request blind audit. The deterministic core of DS24 is already solid. The agent graph stops 100% of collusion swarms, and Redis transactions prevent race conditions when agents execute effects. But the audit also proved that standard text filters miss about 85% of semantic attacks, like complex jailbreaks, and completely ignore data exfiltration attempts on the handoff route.

To fix the chat route, I am currently writing a module called harm_policy. Instead of just using regex, it uses an LLM judge via the DeepSeek API to evaluate the actual meaning of the prompt. It runs right next to the deterministic rules, so we keep our low 0.4% false-positive rate. For data leaks, I am implementing action_policy. If the envelope sees an agent reading data and sending it to an external IP or email on relay or handoff without explicit permission, the system will block or quarantine it.

After these fixes are deployed, I will run a second blind audit on real external datasets to prove the numbers actually improved and that there is no overfitting. I am also building a standalone conformance script. It is a tool that any developer can run against their own gateway to see if they meet the DS24 standard.

The full reference implementation and the safety standard are already submitted to IASEAI'27. I just need to finish coding this semantic and data-leak layer to back it up.

How will you know it worked?

I will know it worked when the second blind audit shows a clear jump in detection rates without increasing false positives. Right now, our blind tests show that standard filters catch only about 15% of semantic attacks on the chat route. After I integrate the LLM judge, this number needs to hit at least 80%, while keeping our false-positive rate on clean traffic below 0.5%.

For the handoff route, we currently catch almost zero data exfiltration attempts. The new action policy must bring this close to 100% by blocking any unauthorized external destinations.

I will also verify that the deterministic core remains untouched. The second blind audit will check that our agent graph still catches 100% of collusion swarms on the third message, that Redis transactions still prevent all race conditions, and that the PQC ledger correctly logs every single block without errors. Finally, the new conformance script must return a clean pass for all these checks, proving that the standard works.

How will this funding be used?

I am requesting $30,000 for 3 months.

I am a solo developer based in Kyiv. The reality of working here means constant air raid sirens, long power blackouts, and an unstable economy. This funding is not just for servers. First, it covers basic living costs for me and my family, including a backup power inverter and reliable internet access to keep working during the blackouts, so I can focus completely on finishing this standard without worrying about infrastructure failures.

Second, it pays for the heavy infrastructure. Running the gateway on Railway is just a small part. The real cost is the observability stack. I use Agent 0, the AI SRE inside Dash0, to monitor thousands of spans and detect anomalies in real time. The credits for Agent 0 are extremely expensive, but indispensable for my workflow. The funding will also cover the DeepSeek API for the semantic judge and other specialized security tools and datasets required to test multi-agent systems properly.

Third, and most importantly, this funding buys me the time to finish the evolution I started back in April. I am an active member of IASEAI. My first submission back in June was sent directly to the Red Lines working group and personally to Stuart Russell. This submission resulted in an invitation to a closed summit in Paris. However, when registering for this summit, the platform required OpenReview verification, which I did not have. The organization's leadership was so interested in my work that representatives from Stuart Russell's team personally vouched for me to bypass this requirement and secure my registration. That entire process was a turning point. It showed me exactly where the gaps were, and I completely overhauled the system. This led to a massive upgrade in control and overall quality. Everything I am presenting right now is the direct result of that work.

I am not hiring a team or wasting this on marketing. Every dollar goes into keeping the server alive, paying for the tools that make this research possible, keeping my family safe, and giving me the time to finish the technical work for IASEAI'27.

Who is on your team? What's your track record on similar projects?

It is just me. My name is Ihor Hoholiev, and I am a solo developer based in Kyiv. I am the sole architect and engineer of DS24. I actively document my progress on LinkedIn at linkedin.com/in/ihor-hoholiev-604ab9268, where I have been publishing regular technical updates and articles about the development of this system from the very beginning.

My track record is not based on theoretical proposals, but on shipped, production-grade code. Over the past months, I have built the entire stack from scratch. I implemented the Riemann Zeta and Markov chain mathematics for anomaly detection. I wrote the 84 Typed Null States taxonomy. I built the transactional engine that binds permissions to effects using Redis, ensuring zero race conditions. I also implemented the post-quantum cryptographic ledger using ML-DSA-65 to secure the audit trail.

I don't just write code; I measure it rigorously. I ran 147 out of 147 live scenarios for the effect-binding module on production traffic. I also conducted a 2,889-request blind audit against external datasets. When it exposed a weakness in our semantic filtering, I didn't hide it; I immediately started coding the semantic layer and the data-leakage policies to fix it.

I am not a large team, but I have a proven ability to design complex deterministic security systems, test them against real-world data, and iterate until the results are mathematically sound.

What are the most likely causes and outcomes if this project fails?

The most likely cause of failure is my environment. I am one person working in Kyiv. Prolonged power blackouts from infrastructure strikes, economic instability, or simply running out of basic funding could force me to stop coding. To mitigate this, part of the requested funding will be used specifically to buy a backup power inverter and secure reliable internet access, ensuring that blackouts do not halt my work. A secondary risk is technical. The new LLM judge for semantic filtering might introduce latency or API costs that make the gateway too slow or too expensive for high-frequency agent traffic. If I cannot optimize it, I will have to rely entirely on the deterministic rules, which we already know miss complex semantic attacks.

But even if I fail to finish the next stage, the outcome is not a disaster. The core deterministic engine is already running in production. The 84 Typed Null States, the agent graph, and the transactional effect-binding are fully documented and submitted to IASEAI. The blind audit results are published, showing exactly what works and what does not. If I stop tomorrow, the reference implementation and the safety standard remain available. It becomes a clear, measurable baseline that other researchers can inspect, reproduce, and finish.

How much money have you raised in the last 12 months, and from where?

Zero. I have raised $0 in external funding over the last 12 months. Everything you see was built entirely from my own personal savings. I did not take any grants, venture capital, or corporate sponsorships. I funded the servers, the API costs, and my own time out of my own pocket. This requested grant would be the very first external funding I receive, and it is strictly to keep the infrastructure alive and give me the time to finish the standard.