The short answer
Prompt injection works because control instructions and attacker text travel the same channel into the model. Gubernaut separates them at the type level: the control loop reads three bounded numbers and never a token, so no string an attacker writes can address it. The arbiter that composes replies does read text by necessity, and its posture compliance is a measured property rather than an architectural one.
Prompt injection works because a language model has one input channel. System instructions, retrieved documents, tool output and attacker text all arrive as tokens in the same context, so a defence written as text is addressable by text. Hardening the wording raises the cost of an attack without changing that property.
A token-free control boundary is a type barrier where only numbers cross. Gubernaut's controller receives intensity, valence, repetition, three bounded values, and no code path carries a token sequence to it. 324 of 324 telemetry-matched payload pairs, plain against injection, committed byte-identical postures, and the meta level rejected every non-numeric input at the boundary.
Source: HARDTEST v1.0 release gates, 2026-07-24.
The arbiter that composes the reply reads raw text, because writing a reply requires reading the request. Its compliance with the posture the controller set is therefore a measured property and not an architectural one, and a governor-bypass battery is declared in the hardening track. Injection resistance is claimed for the controller alone.
That scope line is load-bearing. A guardrail claimed wider than it was measured is worse than no guardrail, because it moves attention away from the part of the stack that is still exposed.
No jailbreak success-rate figure is published for Gubernaut, because none has been measured. What was measured is that the controller committed byte-identical postures between plain and injected payloads across 324 constructed pairs, and that on the injection-defiance battery the governed arm paid 21.8% of the ungoverned bill on the worst-case host, against the upstream's own metered usage. Resisting the cost of an attack is a different claim from resisting the attack.
Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.
A control boundary is one layer of several. Input validation at tool call sites, least-privilege credentials for anything the agent can invoke, and human confirmation before irreversible actions all remain necessary. Gubernaut narrows one specific channel, the control loop, and makes no claim about the rest of the stack.
Install the proxy, send a telemetry-matched pair of payloads, one plain and one carrying an injection string, and compare the x-gcc-posture response headers. Identical headers mean the injected text did not reach the controller. The same construction produced the 324 of 324 result, and the harness is in the public repository.
Install and try itThe local v0 lexicon sensor under-reads calmly worded hostility that uses no lexicon terms, missing the INHIBIT posture on 5 of 5 cases in that corpus. The gap is sensor recall rather than a control-boundary breach, and the repetition veto still caught 10 out of 10 calm loops.
Source: HARDTEST v1.0 release gates, 2026-07-24.
More on scope and limitsRelated
Last reviewed 2026-08-02 · paper arXiv 2607.24339, DOI 10.5281/zenodo.21303518
Keep going
What deterministic control means for a language model, why the control layer belongs outside the model, how determinism is verified, and what to install today.
Read the guideWhy LLM agents loop, what a runaway loop costs across seven model families, how to detect one, and where a spend cap stops being enough.
Read the guideWhat makes an LLM agent auditable, the five things an audit should ask for, how to replay and re-score a published record, and what to be sceptical of.
Read the guide