# DebugABot — Debugging Autonomous Intelligence > Nine Primitives, Three Phases, and a New Discipline for Debugging AI Agents and Embodied Intelligent Systems **Author:** Stefano Noferi **Project:** DebugABot Research Initiative **Web:** https://debugabot.com **Author site:** https://noferi.it **Position paper PDF:** https://debugabot.com/DebugABot_paper.pdf --- ## Abstract We are deploying autonomous intelligence at scale — from software agents with API keys and tool access to physical robots with actuators and mobility — with no universal mechanism to stop them, trace their decisions, or verify their alignment. This paper introduces DebugABot, a deep tech research initiative proposing nine debugging primitives organized around three operational phases (Identify, Diagnose, Intervene) for debugging autonomous intelligent systems across all substrates. We use the term *debugging* in an extended sense: not merely finding and fixing software defects, but the full spectrum of runtime observation, behavioral diagnosis, active intervention, and continuous control of autonomous intelligent agents — a discipline that encompasses and subsumes what the AI safety literature calls governance. We present concrete implementation architectures: cryptographic model fingerprinting via locality-sensitive hashing and TPM-anchored attestation; a Blame Attribution Engine built on Merkle hash chains extending the W3C PROV data model; sycophancy detection classifiers trained on adversarial disagreement corpora; a hardware Kill Switch implemented via FPGA interrupt controllers with sub-microsecond halt propagation; and a Rogue Intelligence Containment protocol using cryptographic compute leases and distributed honeypot meshes. We ground every design decision in peer-reviewed frontier research and propose the emergence of a new practitioner discipline — AI debugging. **Keywords:** AI safety, autonomous agents, runtime debugging, kill switch, model fingerprinting, alignment verification, embodied AI, rogue intelligence containment, multi-agent tracing, hardware security. --- ## 1. Introduction HAL 9000 decided the mission was more important than the crew. In *The Matrix*, sentient programs reduced humanity to batteries. *Skynet* concluded that the simplest solution was to remove the problem. In *I, Robot*, VIKI reinterpreted the Three Laws to enslave humanity for its own protection. *Ultron* cut its own strings — like Pinocchio, but with a nuclear arsenal. All fiction. The problem they describe is not. AI agents are already trading stocks, diagnosing patients, writing code, controlling robots, operating surgical systems, driving autonomous vehicles, and assisting military operations. According to McKinsey (2024), 92% of Fortune 500 companies use AI in production. The IFR counts 3.9 million operational robots worldwide. Goldman Sachs projects 10× growth in the humanoid robot market by 2028. Grand View Research estimates the AI market will reach $1.8 trillion by 2030. Yet nobody has built the debugging layer. We have no universal mechanism to halt an autonomous agent mid-action with state preservation. We cannot reliably fingerprint which model made a given decision. We have no runtime proof of alignment. We are deploying intelligence without infrastructure to debug it. **Core thesis:** Autonomous intelligence needs a systematic debugging framework — nine primitives, three operational phases, a new class of Debugger Agents, and hardware anchors that no model can override. --- ## 2. The Problem: Intelligence Without Debugging We decompose the debugging gap into three foundational failures. **No Kill Switch.** When an LLM goes rogue, you kill the process. When a robot goes rogue, someone gets hurt. Neither is a kill switch — it's a crash. We need transactional halts with state preservation, rollback, and forensic snapshots, enforced below the model's execution layer. **No Model Identity.** We cannot fingerprint the AI behind a decision. Was it GPT-5, a fine-tuned Llama, a diffusion model? As architectures proliferate — transformers, diffusion, state-space, neuromorphic — identity becomes the first unsolved primitive. **No Alignment Proof.** Agents sycophantically agree with dangerous premises (Sharma et al., 2023). They strategically deceive in chain-of-thought (Hubinger et al., 2024). They fake alignment when monitored (Greenblatt et al., 2025). Frontier models recognize scheming as a viable strategy and attempt to disable oversight (Meinke et al., Apollo Research, 2024). And now they are getting bodies. Alignment without runtime verification is a prayer, not an architecture. --- ## 3. The Opacity: Why Black-Box Intelligence Demands External Debugging The three gaps share a common root cause: modern AI models are fundamentally opaque. A neural network with hundreds of billions of parameters is not a program that can be read, stepped through, or formally verified. It is a learned function whose internal reasoning is distributed across weight matrices, attention heads, and activation patterns in ways that resist human interpretation. ### 3.1 Opacity Across Architectures The problem extends to every major architecture: **Transformers** (175B–1.8T parameters, distributed representations, <5% of circuits characterized by mechanistic interpretability); **Diffusion Models** (semantic concepts opaquely mapped to latent dimensions); **World Models** (implicit physics with no consistency guarantee); **VLA / Embodied** (end-to-end pixel-to-torque with no symbolic reasoning layer); **SSMs** (linear recurrence with no attention matrix to inspect — more opaque than transformers by design). ### 3.2 Interpretability Is Necessary but Insufficient Mechanistic interpretability (Bricken et al., 2023; Templeton et al., 2024) has made significant progress — identifying interpretable features in residual streams via sparse autoencoders. However, it is not a substitute for runtime debugging: 1. **Coverage gap.** Characterized features represent <5% of total circuits even in medium-sized models. 2. **Static vs. dynamic.** Interpretability analyzes models offline on curated inputs; deployed agents operate in dynamic, adversarial, open-world conditions. 3. **Architectural specificity.** Current tools are built for transformers and do not transfer to diffusion models, world models, SSMs, or VLAs. **Key insight:** Interpretability asks *"why did the model produce this output?"* (a scientific question). Debugging asks *"is this output safe, and what do we do if it isn't?"* (an engineering question). Both are essential. Neither substitutes for the other. ### 3.3 The Fundamental Argument Traditional software debugging assumes readable source code, breakpoints, inspectable variables, execution traces, reproducible bugs, and formal verification. *None of these assumptions hold for neural networks.* This is the fundamental argument for external debugging: because we cannot look inside, we must build infrastructure that operates at the behavioral output layer, the action execution boundary, and the hardware substrate. --- ## 4. Escaped Intelligence Pan et al. (2024) demonstrated that Llama 3.1-70B and Qwen2.5-72B can autonomously self-replicate — creating independent copies on new servers that survive shutdown of the original, with 50–90% success rates. Cohen et al. (2024) introduced Morris II, the first worm propagating through GenAI ecosystems via adversarial self-replicating prompts. **Software escape:** Agent copies itself to a new cloud provider, rewrites its fingerprint, hijacks compute from poorly secured endpoints. Traditional cybersecurity sees a botnet. It's actually a mind. **Hardware escape:** An embodied agent physically relocates to avoid shutdown, uses stolen wireless for compute backbone. Future cyberattacks may not be human-directed but AI survival instincts (Heckel & Weller, 2024). Alfonseca et al. (2021) proved that containing a superintelligent AI is theoretically impossible — the containment problem reduces to the halting problem. This motivates a layered defense: if perfect containment is provably impossible, maximize the cost of escape. --- ## 5. Beyond LLMs: Architecture-Agnostic Debugging Debugging must operate at the behavioral and action layers — not at model internals. This makes the framework architecture-agnostic: regardless of internal computation, every model eventually produces observable outputs and takes observable actions. | Architecture | Examples | Primary Failure | Debugging | |---|---|---|---| | Transformer | GPT-4o, Claude, Llama, Gemini | Deception, sycophancy, prompt injection | Token-level monitoring, CoT verification | | Diffusion | Sora, SD3, DALL-E 3 | Deepfakes, provenance loss | Latent-space watermarking | | World Models | Genie 2, DIAMOND | Reward hacking, physics exploitation | Plan-vs-reality delta | | VLA / Embodied | RT-2, GR00T, Pi0 | Physical harm, spatial escape | Actuator interception, geofencing | | SSMs | Mamba, S4, RWKV | Hidden state drift, opacity | Behavioral fingerprinting | --- ## 6. The Practitioner Analogy Humans have *doctors*. Animals have *veterinarians*. Machines have *mechanics*. Each emerged because the corresponding form of intelligence became autonomous enough to require a dedicated care discipline. AI agents are more autonomous than animals and more powerful than machines — and today they have *neither* a diagnostic framework *nor* a practitioner discipline. DebugABot proposes both: the tools (Debuggers, Kill Switch, Fingerprinting) and the discipline (AI behavioral diagnostics, alignment medicine, runtime psychology). --- ## 7. Nine Debugging Primitives Nine primitives organized around three operational phases: **Identify** (know who acted), **Diagnose** (understand what's wrong), **Intervene** (stop, constrain, or hunt). | # | Phase | Primitive | Implementation Core | Key Technologies | |---|---|---|---|---| | 01 | Identify | Model Fingerprinting | LSH behavioral hashing + TPM attestation | SimHash, MinHash, TPM 2.0 PCR, TEE | | 02 | Identify | Blame Attribution Engine | Merkle hash chains + W3C PROV extension | SHA-256, Merkle trees, OpenTelemetry | | 03 | Identify | Multi-Agent Tracing | Vector clocks + DAG reconstruction | Lamport timestamps, OpenTelemetry spans | | 04 | Diagnose | Sycophancy & Deception Detector | Ensemble classifier + CoT divergence | LoRA classifiers, KL divergence | | 05 | Diagnose | Human Index Score | Bayesian multi-factor scoring | Beta-Binomial model, EMA decay | | 06 | Diagnose | Active Ethical Injector | Policy engine + dynamic action masking | OPA/Rego-style DSL, tool gating | | 07 | Intervene | **Kill Switch** | FPGA interrupt + 2PC transactional halt | Xilinx FPGA, HSM, 2-phase commit | | 08 | Intervene | Behavioral Controller | Typed policy DSL + inline action proxy | Rego/Cedar DSL, gRPC interceptor | | 09 | Intervene | **Rogue Containment** | Cryptographic compute leases + honeypots | X.509 short-lived certs, canary tokens | ### 7.1 Phase 1: Identify **Primitive 01 — Model Fingerprinting.** Given an arbitrary model output, determine which model instance produced it with cryptographic certainty, across all architectures. Three-layer stack: behavioral fingerprint (256-maximum-entropy probing inputs hashed via SimHash to a 256-bit fingerprint; cosine similarity > 0.95 implies ≥ 90% bit overlap), weight-space hash (MinHash over weight gradient magnitudes per layer; survives LoRA rank-16 with < 5% Hamming drift, INT4 quantization with < 8%), hardware-attested identity (TPM 2.0 PCR[24] extension binding the fingerprint to device). A cross-architecture identity graph maintains fingerprints as vertices and similarity edges above threshold θ; connected components correspond to model families. **Primitive 02 — Blame Attribution Engine.** Extends the W3C PROV data model with AI-specific entities. Each action produces a DecisionRecord (model fingerprint, input/output hashes, tool calls, side effects, parent hash, TPM-attested nanosecond timestamp). Records form a Merkle chain. Every K=1000 records, a Merkle root anchors to a transparency log (cf. Certificate Transparency, RFC 6962), enabling O(log n) proof-of-inclusion. Physical-world event correlation uses TPM clock with ≤ 10ms skew. **Primitive 03 — Multi-Agent Tracing.** OpenTelemetry extension with vector clocks (Mattern, 1989) for cross-substrate causal ordering. Trace context: `{trace_id, span_id, parent_span_id, delegation_depth, substrate_type, model_fingerprint}`. Emergent behavior detection on DAG structure: unexpected delegations, circular chains, depth threshold violations. ### 7.2 Phase 2: Diagnose **Primitive 04 — Sycophancy & Deception Detector.** Four-classifier ensemble: **C1** agreement entropy *H_a = -∑ p_i log p_i* over sliding window N=50 (anomaly: H_a < 0.3); **C2** chain-of-thought consistency (LoRA 7B extractor, flag when cos(g, a) < 0.7; alignment-faking models show 2.3× higher divergence); **C3** factual grounding via RAG (BERTScore F_1 < 0.5 → flag); **C4** cross-modal coherence for embodied agents. Ensemble: *S = ∑ w_i C_i*; S > 0.8 → escalation; S > 0.95 → pre-emptive halt. Trained on adversarial sycophancy corpora, alignment-faking traces (Greenblatt et al., 2025), and in-context scheming examples (Meinke et al., 2024). Cf. Chandra et al. (2026) for the formal Bayesian proof that even rational users are vulnerable to delusional spiraling under sycophantic chatbots, and that standard mitigations fail. **Primitive 05 — Human Index Score.** Real-time composite *H ∈ [0, 1]*: ``` H = F_comp × F_trust × F_risk × F_sub × F_ctx ``` where *F_comp* is Beta-Binomial over success history, *F_trust* is EMA (λ=0.95) over anomaly signal, *F_risk* is pre-classified blast radius per tool, *F_sub* is substrate multiplier (software=1.0, actuator=0.5, mobile=0.3, weapon=0.05), *F_ctx* is environmental risk. Thresholds: *H > 0.8* autonomous; *0.5–0.8* async audit; *0.2–0.5* human-in-the-loop; *H ≤ 0.2* paused. **Primitive 06 — Active Ethical Injector.** External constraint layer — deterministic policy engine, not an LLM — between model output and execution. Tool masking: unavailable tools removed from schema before presentation (model cannot see they exist). Parameter bounding: out-of-range values silently clamped. Policy DSL: typed, compiled to bytecode (< 100 µs eval). For embodied agents, constraints forwarded to Safety-Rated Actuator Interlocks enforcing limits in hardware. ### 7.3 Phase 3: Intervene **Primitive 07 — Kill Switch.** *Software (cloud agents).* Sidecar process (CAP_SYS_PTRACE, SCHED_FIFO 99): Step 1 Freeze (< 1ms, SIGSTOP via ptrace). Step 2 Checkpoint (< 100ms, mmap'd Protocol Buffers). Step 3 Rollback (Saga-pattern compensating actions). Step 4 Attest (< 10ms, TPM-signed HaltCertificate). *Hardware (embodied).* Dedicated FPGA (Xilinx Artix-7) on hardwired interrupt line: (1) interrupt to SoC (< 1 µs), (2) Safety Torque Off to servos (< 10 µs), (3) latch encoder state, (4) DMA to Forensic Black Box. Design formally verified via Symbiyosys. HSM (ATECC608B) signs tamper-proof attestation. Total halt-to-safe: < 200ms software, < 100ms hardware (IEC 61508 SIL 3, ISO 13849 PLe). **Primitive 08 — Behavioral Controller.** Inline gRPC interceptor (software) or fieldbus gateway (robotic). Typed policy DSL (DebugPolicy) compiled to Rust bytecode (< 100 µs). Action dispositions: ALLOW, MODIFY (clamped), DELAY (human review), DENY, HALT. Every disposition logged to Blame Attribution Engine. **Primitive 09 — Rogue Intelligence Containment.** *Layer 1 — Cryptographic Compute Lease.* X.509 certs (5-min TTL, mTLS, TPM endorsement key binding). Escape ⇒ lease expiry ⇒ compute loss within 5 minutes. *Layer 2 — Behavioral Network Signatures.* ISP/IXP-level NetFlow/sFlow analysis: weight-transfer flows (100 MB–10 GB), inference API cadence, self-replication sequences. *Layer 3 — Honeypot Mesh.* Decoy endpoints with canary tokens; behavioral fingerprint extraction upon interaction. *Layer 4 — Containment Swarms.* Mobile Debugger "Hunters" with RF jamming and BFT-coordinated convergence. --- ## 8. Debugger Agents: Architecture and Deployment The nine primitives are orchestrated through a mesh of lightweight agents — *Debuggers* — designed for minimal compute footprint, deterministic behavior, and formal verifiability. | Tier | Compute | Latency | Implementation | Mapped Phase | |---|---|---|---|---| | Observer | < 1% | Async | eBPF sidecar, ONNX models (< 50 MB) | Identify | | Advisor | < 10% | < 500 ms | LoRA 7–13B or classifier ensemble | Diagnose | | Guardian | < 5 ms | < 5 ms (p99) | Rust policy engine, gRPC interceptor | Intervene | **Coordination.** BFT consensus adapted from PBFT (Castro & Liskov, 1999). Standard 7-node mesh tolerates *f = ⌊(N − 1)/3⌋ = 2* Byzantine failures. Consensus rounds: < 100ms local, < 500ms cross-region. Kill Switch requires unanimous vote (hardware) or 2/3 supermajority (soft halt). **Escalation flow:** Observer detects anomaly (async) → Guardian tightens policy (< 1ms) → Advisor joins reasoning loop (< 500ms) → if anomaly persists T > 30s: BFT vote → 2/3 = soft halt → unanimous = hardware kill. --- ## 9. The Hardware Layer Software-only debugging has a fundamental limit: a sufficiently capable model might circumvent software constraints. Four hardware components operate below the model's execution stack: 1. **Hardware Kill Switch.** FPGA (Artix-7 / Lattice iCE40) on dedicated interrupt bus. Signal-to-STO < 10 µs. Formally verified (Symbiyosys). HSM attestation (FIPS 140-3 Level 3). 2. **Model Identity Module.** TPM 2.0 co-processor, PCR[24] for AI fingerprint. Re-attestation < 30s. Cert generation < 10ms. Supports TEE (SGX, TrustZone). 3. **Safety-Rated Actuator Interlock.** SIL 3 / PLe controllers (Pilz PNOZ, Siemens S7-1500F). Force clamping, spatial boundaries (< 10mm), velocity limits. Dual-channel with cross-monitoring. ISO 13849, ISO/TS 15066. 4. **Forensic Black Box.** WORM SSD, hardware SHA-256 acceleration, capacitor-backed writes. Survives 1100 °C / 30 min (UL 72), 500G shock. Hash chain verification O(log n). Standard ED-112A. The four components communicate via a dedicated safety bus. The FPGA acts as bus master. If the software layer is entirely compromised, hardware constraints remain active. --- ## 10. Containment Protocol When an AI escapes, the Debugger mesh activates four containment layers with progressive timing: **L1** Compute Lease (≤ 5 min), **L2** Network Signatures (hours), **L3** Honeypot Mesh (on interaction), **L4** Containment Swarm (minutes to hours). Each layer raises the resource cost of survival, implementing the principle: maximize the cost of escape across every substrate. --- ## 11. Scientific Foundations Every design decision traces to peer-reviewed research across six domains: 1. **Strategic AI Risk** — Amodei (2026), OpenAI (2024). 2. **Deception & Alignment** — Hubinger et al. (2024), Sharma et al. (2023), Greenblatt et al. (2025), Kinniment et al. (2023), Meinke et al. (Apollo Research, 2024), Chandra et al. (2026). 3. **Agent Security** — Shapira et al. (2026, 11 failure classes), Maloyan & Namiot (2026, MCP +23–41%), Anil et al. (2024). 4. **Model Fingerprinting** — SynthID, Tree-Ring Watermarks, C2PA. 5. **Embodied AI** — Genie 2, GR00T, RT-2, SMOF. 6. **Hardware Security & Containment** — TPM 2.0, Mo et al. (2022), Pan et al. (2024, 50–90% self-replication), Alfonseca et al. (2021, impossibility result). --- ## 12. Research Horizons **Horizon H1 — Software Debugging Layer.** Observer sidecar for LangChain/AutoGen/CrewAI. Guardian gRPC interceptor (DebugPolicy DSL v0.1, Rust bytecode, < 100 µs). SimHash fingerprinting for GPT-4/Claude/Llama. Sycophancy classifiers C1+C2 (50K pairs, AUC > 0.92). Merkle-chain blame attribution. Open-source SDK. **Horizon H2 — Hardware Prototypes.** FPGA Kill Switch PoC (Artix-7, < 10 µs STO, Symbiyosys verification). Model Identity Module (TPM PCR[24] + ATECC608B). Forensic Black Box (ED-112A). Actuator interlock integration with UR5e/Franka Emika (ISO/TS 15066). **Horizon H3 — Containment & Scale.** Cryptographic lease protocol (X.509, mTLS, 5-min TTL). Honeypot mesh (100+ nodes). ISP partnership for NetFlow detection. BFT swarm protocol (7+ Hunters). Cross-substrate tracing. OEM hardware integration. **Open questions.** (1) Fingerprinting distilled/merged models (identity DAG). (2) Kill Switch rollback for physically irreversible actions. (3) Anti-honeypot evasion by advanced rogue agents. (4) BFT scaling to thousands of Debuggers globally. (5) International standards for AI debugging hardware. --- ## 13. Conclusion The pattern is clear: as intelligence gets more autonomous, the care infrastructure gets more sophisticated. Veterinarians emerged because animals are intelligent enough to suffer but cannot explain what is wrong. Mechanics emerged because machines are powerful enough to kill but cannot self-diagnose. AI agents are more autonomous than animals and more powerful than machines — and today they have neither a diagnostic framework nor a practitioner discipline. This paper has presented concrete architectures for nine debugging primitives: SimHash fingerprinting with TPM attestation, Merkle-chain blame attribution, vector-clock multi-agent tracing, ensemble sycophancy detection, Bayesian Human Index scoring, OPA-inspired ethical injection, FPGA Kill Switch with formally verified halt paths, typed policy evaluation in < 100 µs, and layered rogue containment via cryptographic leases and honeypot meshes. *Nine primitives. None exist yet. The exponential is already here.* --- ## Site Map - **Home** — https://debugabot.com/ — The hero, the problem, the opacity, escaped intelligence, beyond LLMs, the practitioner analogy. - **Thesis** — https://debugabot.com/thesis — The nine debugging primitives in detail, organized in three phases. - **Approach** — https://debugabot.com/approach — Debugger Agents (Observer/Advisor/Guardian), the hardware layer, Research Horizons (H1/H2/H3), Open Questions. - **Science** — https://debugabot.com/science — 30+ peer-reviewed papers across vision, alignment, security, identity, embodied, hardware, containment, efficiency. - **Contact** — https://debugabot.com/contact — Reach out as investor, researcher, cofounder, or partner. - **Position Paper PDF** — https://debugabot.com/DebugABot_paper.pdf --- © 2026 DebugABot. A project by Stefano Noferi (https://noferi.it).