Publications

Notes, with the numbers attached.

Governance you can check starts with research you can check. Each note carries its methods, its benchmarks, its uncertainty, and — twice so far — the result that contradicted what we expected. Notes are numbered, dated, and corrected in place rather than quietly.

RN-004

Catching the agent that turns: detecting AI gone rogue

An autonomous agent, given the wrong instruction, starts probing and attacking a system it was never authorised to touch. We detect it two independent ways — the offensive kill-chain in its behaviour, and attack tooling in its content — and the content detector reaches 0.993 AUROC, catching 97% of payloads clean and 98% obfuscated at a 0.4% false-positive rate, where a regex WAF sees a third. Two independent signals, each one explained.

Agentic AIIntrusion detectionAI security9 min read
RN-003

Coordinated agent fleets share a config, not a clock

We built a detector for coordinated AI fleets on two signals — shared behavioural fingerprint and synchronised timing — and it scored 0.97 precision in simulation. On 1,677 real GitHub instances it scored 0.00. The timing signal is at chance for agent fleets and works for humans: coding agents are demand-driven, so they share a config but no clock. What we changed, and why the failure was more useful than the success.

Agentic AICoordination detectionNegative results9 min read
RN-002

How we hunt financial crime — including the experiments that failed

Our detection strategy in five decisions: think in networks, layer five detectors that cover each other's blind spots, validate on external ground truth, and chase the representation instead of the model — the move that took an interpretable, dependency-free forest from 0.70 to 0.956 on IBM AMLSim, matching published GNN results, at 81% precision on a top-0.1% review budget.

Financial crimeGraph intelligenceModel validation11 min read
RN-001

Detecting AI agents without training on a single agent

We model the human behavioural manifold on public GitHub activity and score everything against it — no agent labels, no watermarks, no classifier to go stale. Out-of-time AUROC 0.80–0.82 on event metadata, 0.91 on long-form text, and a counterintuitive finding: 'machine-like' priors invert on real data.

Agentic AIAnomaly detectionOne-class learning10 min read

Notes are published as the work matures, and amended in place with a dated correction when someone shows us we are wrong. Each one answers — or fails to answer — a question on the research agenda. To review a draft, reproduce a benchmark, or challenge a result, take part.