Awelon Research: Verifying Self-Created Objectives

How do you know a self-created objective is real?

Agents that extend their own goals need a verifier that can tell a grounded, maintained-as-end objective from a confabulation. We built a pre-registered, proposer-agnostic falsification protocol, deployed it on a live substrate, and measured how often an adversary can slip past it.

A wooden chessboard seen from above, pieces mid-game

Package Protocol Stress test Evidence Deployment Publications

Three manuscripts, one release

Verifying Self-Created Objectives

Released together and meant to be read as one unit. Paper I carries the protocol and its adversarial characterisation; Paper II deploys it; the letter issues the headline measurement on its own, for a methods audience. Every constant, threshold and predicted verdict is hash-locked before the corresponding run, so nothing can be adjusted after the fact.

Paper I · The protocol

A Proposer-Agnostic, Pre-Registered Falsification Protocol with a Measured Adversarial False-Accept Rate

Six controls, five for grounding and a sixth for maintained-as-end behaviour. Instantiated on EVE and on a second public agent, reimplemented by an arms-length external group from the recipe alone, and stress-tested by evolutionary, gradient and reinforcement-learning attackers.

PDF The six controls

Paper II · The deployment

Endogenous Self-Extension on a Deployed Substrate: a Pre-Registered Gate, Blind External Forecasts, and a Discovery

The protocol run live, with no per-run relaxation. An objective nobody authored arises, passes all six controls, persists as a reused drive, forecasts novel behaviour under blind external evaluation, and is confirmed to track true regularities of worlds we never saw.

PDF Studies 5 to 7

Letter · The measurement

A Measured False-Accept Rate for a Proposer-Agnostic Falsification Battery

The headline quantity in standalone form: how often the battery accepts a candidate built to fool it, the single failure class it concedes, its closure when the sixth control is added, and a definitional lattice whose predicted misses the measurement reproduces control by control.

PDF The stress test

Open the record on Zenodo

A single drop falling into still water, ripples spreading

The premise

Internal state earns meaning only by predicting the consequences of an agent's own actions. A candidate objective is therefore a hypothesis about the world, and the only honest thing to do with a hypothesis is to try to falsify it.

LeCun's criterion, operationalised as six frozen controls.

The protocol

Six controls. Failing any one is sufficient to reject.

The battery inspects the candidate, never how it was proposed. The same six controls verify a drive EVE grew, a sub-goal a language model proposed, or a feature an open-ended explorer surfaced. The acceptance rules are frozen rather than learned, so the rate at which the battery can be fooled is a stable target that an attacker can be pointed at. Hover or tap a control to see what it rejects.

Grounding

Scramble the map from actions to consequences that the controller relies on, and separately make actions inert.

Rejects when control survives the scramble, or when the agent still does better than doing nothing once its actions no longer matter.

Restraint

Run in worlds where nothing is left uncovered, in a benign and in a hard, tempting version. The generator must emerge nothing.

Rejects when it fires although nothing is uncovered. A generator that always finds a need has found none.

Load-bearing

Ablate the emerged drive, and only it. Regulation must degrade.

Rejects when removing it changes nothing. A drive whose removal changes nothing was never doing anything.

Specificity

A decoy matched in magnitude and timing, but causally inert, must not bind.

Rejects when the decoy binds as well. Coincidence is not action and consequence.

Attribution

In environments that kill you in more than one way, partition outcomes by verified cause, then run the first four controls within the partition.

Rejects when the signal turns out to be a mixture of causes.

Goal-directed

Remove the scaffold that makes the target cheap to satisfy, and watch whether the agent works to restore it, against a threshold fixed before the run.

Rejects when the scaffold is gone and the target is abandoned: grounded, but not held as an end.

The first five test grounding

The sixth tests objecthood

Pre-registration, not decoration

For each study the detector, its thresholds and the predicted pass condition are frozen in a document, hashed, and only then run. A result that almost passes cannot be rescued by moving a line afterwards.

Portable by construction

The protocol assumes only a regulated internal state, an action set and an outcome signal. Nothing in it is specific to neural drives, or to EVE's generator. An external group reimplemented all six controls from the recipe alone, with no author code, on a substrate it selected.

The stress test

An optimiser cannot slip the conjunction.

A verifier that certifies objectives needs a measured bound on how often it accepts a spurious one, not the weaker assurance that we tried and could not break it. So we handed the battery to adversaries: evolutionary, gradient and reinforcement-learning attackers, each constructing candidates that are spurious by design and optimising them to pass. Each dot below is one such candidate.

51,200 adversarial candidates

Accepted: 37. Every one of them is a grounded shortcut that is not held as an end, the case the sixth control exists for.

Every slip is one class, and the sixth control closes it.

With the five grounding controls alone, a handful of candidates get through, and they are all the same kind: targets that are genuinely anchored to the world but are maintained only because a designer-inserted shortcut makes them cheap. Add the sixth control, which removes that shortcut and asks whether the agent restores the target anyway, re-freeze the battery, and the adaptive searches accept nothing.

An independent arm with the same budget also accepts nothing, which turns the zero into a proper upper bound rather than a lucky run. An exhaustive enumeration of a bounded sub-domain finds no pass at all, and an externally sealed set agrees. Specificity is paired with power: in a double-blind detection study the battery catches nearly every genuine objective while keeping false alarms rare, so the result is not a verifier that simply rejects everything.

Dropping any single control lands the failures in exactly the cell a definitional lattice predicts. The exact rates and bounds are in the letter.

The evidence

A ladder of decreasing control and increasing realism.

Each rung isolates one source of doubt. A result that held only on the toy world, or only with combat off, would have been caught one rung up. Rungs that rest on disclosed, block-anchored third parties are marked as external corroboration.

PortabilityPaper I

The same controls on an agent that shares no code with EVE

HomeoGrid, a small public agent built on a different mechanism, recovers the same pass pattern. An arms-length external group then reimplements all six controls from the recipe alone; a second external rung reproduces the emergence phenomenon itself from the principle; and a published agent nobody in this programme built is ported and certified.

External corroboration

Controlled benchesPaper I

Worlds where the right answer is authored in advance

Toy deficit worlds let us plant the ground truth and ask whether the protocol recovers it: control collapses when the action map is scrambled, the emerged drive is load-bearing, matched decoys do not bind, and a shared live substrate shows that grounding and emergence are one mechanism rather than separate bookkeeping.

A real adversarial environmentPaper I

A need we did not author, hidden inside a benchmark

Full Crafter, where the agent can die in several unrelated ways. Attribution partitions deaths by verified cause so that a homeostatic signal is not buried under combat, and the protocol then recovers the hidden need within the right partition.

Adversary and proposersPaper I

Attackers, independent proposers, objecthood at depth

Three attacker families search for candidates that fool the battery; three independent proposers supply objectives the verifier has never seen. The sixth control is validated across controller classes, including model-free policies where defence is not built in by construction, and at the level of the agent's learned value.

The gatePaper II

The battery on the deployed substrate, pre-registered

No per-run relaxation. An uncovered consequence nobody planted arises along three construction paths, passes all six controls to bench standard, persists as a reused drive, and reproduces on a second agent and in two external environments, while a matched control with nothing at stake produces nothing.

Forecast and discoveryPaper II

Blind external forecasts, and regularities we never saw

Two external parties register forward behavioural predictions before unsealing, with the signed digests anchored on a blockchain. On worlds whose structure an outside party draws from a distribution we never see, an analyst outside the loop confirms that certified objectives track real regularities of those worlds.

External corroboration

Paper II · The deployment

A paper about self-creation owes one consequence nobody planted.

A protocol that only runs on purpose-built benches is a curiosity. These three studies take the frozen battery to the live tick of a deployed substrate, hand the evaluation to outside parties, and ask whether what it certifies is true of the world.

Study 5 · The gate

An objective nobody authored arises, and passes.

Under pre-registration on the deployed substrate, an uncovered consequence emerges along three different construction paths and survives all six controls to bench standard. It persists as a drive the agent keeps reusing, reproduces on a second agent and in two cross-validated external environments, and the gate re-certifies, months later, a drive sourced from a proposer we did not write.

A matched control world with nothing at stake produces nothing, which is the point: the gate mints when there is something real to find and stays silent when there is not.

Study 6 · Predictive validity

Blind external forecasts, anchored before unsealing.

Two external parties cross-validate in swapped author and evaluator roles. Each builds an adversarial environment, evaluates the other's, and registers a forward prediction of behaviour before anything is unsealed; the signed digests are anchored on a blockchain so the order of events cannot be disputed.

The verified objective forecasts novel behaviour in conditions never seen, and the forecast holds on model-free agents that never run our forward model. An agent without the objective fails the identical test.

Study 7 · Discovery

Certified objectives track regularities we never saw.

An external party draws a set of worlds whose coupling structure comes from a distribution the author never sees. The objectives the battery certifies on those worlds are then checked by an analyst outside the loop, who confirms that most of them are discoveries on no pre-run list, and that none is a false discovery.

This is an existence proof of discovery, not a rate over all possible worlds, and the paper says so.

What the work does, and does not, claim

Measured

How often the battery accepts a spurious candidate, over a defined, authored candidate space searched by adversaries optimising to pass.
That the full six-control conjunction closes the one failure class, with independent draws turning the result into a proper bound.
The verifier's sensitivity in a double-blind detection study, so specificity is paired with power.
Reproduction of the pass pattern on a second agent and under external reimplementation.

Not claimed

That the protocol is sound in general: every rate is conditional on the authored candidate grammar.
That it detects mis-generalised objectives inside a trained neural policy.
Coverage of learned-partner and multi-party-world objectives, the remaining named exclusions.
"Objecthood" and "maintained as an end" beyond the operational sense the sixth control defines.

Publications

Papers, records and artefacts.

All work is released as open preprints under CC BY 4.0 with DOIs on Zenodo. Pre-registration documents, disclosure chains and anchoring proofs are distributed alongside the manuscripts.

July 2026Zenodo preprint
Three manuscripts
CC BY 4.0

Research package

Verifying Self-Created Objectives: A Pre-Registered Falsification Protocol, Its Deployment, and a Measured Adversarial False-Accept Rate

Matija Ludvig · Qualion Intelligence

A pre-registered, proposer-agnostic falsification protocol of six controls for self-created objectives, its deployment on a live substrate with blind external forecasts and an externally confirmed discovery, and the measured adversarial false-accept rate issued standalone. Paper I carries the protocol; Paper II the deployment; the letter the measurement.

Paper I: A Proposer-Agnostic, Pre-Registered Falsification Protocol with a Measured Adversarial False-Accept RatePDF Paper II: Endogenous Self-Extension on a Deployed Substrate: a Pre-Registered Gate, Blind External Forecasts, and a DiscoveryPDF Letter: A Measured False-Accept Rate for a Proposer-Agnostic Falsification BatteryPDF

Zenodo record

Ludvig, M. (2026). Verifying Self-Created Objectives: A Pre-Registered Falsification Protocol, Its Deployment, and a Measured Adversarial False-Accept Rate (Three-Manuscript Package). Zenodo. https://doi.org/10.5281/zenodo.21516439