The Competence-Boundary Interlock: When a Frozen One-Byte Token Can — and Cannot — Serve as an AI Safety Gate, and the Separability Law That Predicts It

The Competence-Boundary Interlock: When a Frozen One-Byte Token Can — and Cannot — Serve as an AI Safety Gate, and the Separability Law That Predicts It Randolph James Ferlic, M.D. and Kimberly Kate Ferlic — Fieldstone Analytics, LLC, Austin, TX, USA Preprint · Zenodo DOI: 10.5281/zenodo.23347775 · CC-BY 4.0 · Community: spiral-domain-encoder-campaign · a characterization of previously filed and published methods; no new algorithmic subject matter is disclosed. --- Abstract Calls for an AI "kill switch" conflate three different mechanisms, and only one of them is a sensing problem. A frozen, deterministic, class-discriminant single-token encoder — which reduces a window of sensor or feature inputs, through a fixed supervised projection and a small quantized codebook, to one 8-bit symbol and a bounded lookup-table decision — produces a label-free novelty score (the nearest-centroid distance) characterized across this program as an always-on condition-monitoring gate and a per-entity self-twin. This paper asks whether that score can serve as an independent, front-line competence-boundary interlock: a simpler, verifiable monitor that reads inputs only, sits beside a "guarded" decision model, and trips a fallback when an input leaves the model's validated envelope. We test it, pre-registered, across three sims and four public domains (bearing vibration, aircraft-handling gesture, smartphone activity, and a second bearing corpus), each as a controlled open-set. Three findings, each with a frozen acceptance band, and two instructive refutations. First, on a bearing open-set the interlock detects 96.6% of unseen-class inputs at an area under the receiver-operating curve of 0.988 and a calibrated 5.8% false-trip rate — while the guarded model is confidently wrong on those inputs — catching 96.5% of all guarded-model errors and cutting the residual error rate from 0.74 to 0.093, reading inputs only, deterministically, from a ≤256-cell auditable table. Second, replicating across four domains, the interlock does not uniformly generalize: its detection quality is a perfect monotone function of class separability (Spearman between a k-nearest-neighbor purity descriptor and detection AUROC = +1.00) — strong where decisions are separable (0.98), weak where they overlap (0.70), at controlled false-trip throughout. Third, a proper on-manifold adversarial battery (713 crafted boundary attacks) confirms the honest boundary: the interlock is blind to crafted on-manifold adversarials (catch rate 0.051 versus 0.50 for out-of-distribution inputs), and its adversarial robustness also scales with separability (domain Spearman +0.95; instance-level AUROC of local purity predicting a catch, 0.66). The synthesis is a unifying separability law: the same quantity that governs the token's accuracy tax governs both the reach and the robustness of its safety interlock, so the program's previously published separability screen predicts, before deployment, whether and how well the token will function as a safety gate. A pre-registered hardening battery confirms the interlock is genuinely model-independent — detection identical across four guarded models including a deep 1D-convolutional network, catching ≥0.89 of each one's errors, and the deep model (overconfident on out-of-distribution inputs, confidence 0.824) is monitored just as well — that its blindness persists under an adaptive adversary, and that the separability law survives eight domains across five modality families including chemical sensing (permutation p 0.005), every false-trip budget, and twenty-seed stability, and that gating demonstrably lowers end-to-end risk — while surfacing the honest costs: the interlock is not the most accurate out-of-distribution detector — it ties the guarded model's own confidence and a feature-space Mahalanobis detector on separable data but trails the Mahalanobis detector by 0.07–0.10 AUROC where classes overlap (its value is independence, determinism, and auditability — a diverse certifiable one-byte channel — not maximal detection accuracy, though it beats the guarded model's own confidence everywhere); under covariate drift it must be re-commissioned, not merely re-thresholded (recalibration restores the false-trip budget but collapses detection from 0.91 to 0.23); and at low out-of-distribution base rates its false-alarm burden requires a tighter budget. We state the boundary plainly: the token is a usable, cheap, deterministic, auditable, independent competence-boundary interlock — one layer in defense-in-depth — and it is not a semantic oracle, an alignment solution, or a defense against an adaptive adversary. Two pre-registered hypotheses refuted — a mis-specified on-manifold population that confounded natural errors with novelty, and an over-optimistic attack-feasibility guess — were reported as refutations and diagnosed, not accepted. No new algorithmic subject matter is disclosed; the interlock is the program's filed label-free novelty monitor, the separability axis its published law, all measured on public data. Highlights · A competence-boundary interlock, not a kill switch for cognition. The frozen token's label-free novelty score, reading inputs only, trips a fallback when an input leaves a guarded model's validated envelope — an independent, deterministic, auditable functional-safety channel. It does not address corrigibility or judge output semantics. · Strong where it counts. On a bearing open-set: detects 96.6% of unseen-class inputs (AUROC 0.988) at a 5.8% false-trip rate; catches 96.5% of all guarded-model errors; cuts residual error 0.74 → 0.093; leaves the guarded model 99.8% correct on what it passes. · A unifying separability law. The interlock's OOD-detection reach (Spearman +1.00) and its on-manifold adversarial robustness (Spearman +0.95; instance AUROC 0.66) are both governed by class separability — so the previously published separability screen predicts the token's safety behavior before deployment. · The honest boundary, properly demonstrated. A 713-attack on-manifold adversarial battery shows the interlock is blind to crafted on-manifold attacks (catch 0.05 vs 0.50 for OOD) — one layer in defense-in-depth, never a semantic oracle or an adaptive-adversary defense. · Hardened against a skeptic. Two pre-registered hardening batteries (fifteen probes: model-independence, a deep 1D-CNN guarded model, adaptive adversary, more domains and modality families, budget sweep, determinism, baseline comparisons, drift, base-rate realism, seed stability) return twelve confirmations and three instructive refutations — the interlock ties the guarded model's own confidence on separable data but trails a feature-space Mahalanobis detector where classes overlap, so its value is the independent, deterministic, auditable, one-byte channel, not detection accuracy; a deep guarded model, which is itself overconfident on out-of-distribution inputs, is monitored just as well; and under drift the interlock must be re-commissioned, not merely re-thresholded. · Refutations diagnosed, not accepted. Across the arc, mis-specified and over-optimistic pre-registered hypotheses refuted; reporting and diagnosing them is what revealed the law. · No new IP. The interlock is the program's filed self-twin / Tier-0 novelty gate; the separability axis its published law; the guarded models standard (RandomForest, gradient-boosted trees, a multilayer perceptron, and a 1D convolutional network) and the Mahalanobis comparator standard; all measured on public data. What this record contains · Manuscript_Paper60.pdf — the competence-boundary-interlock characterization (8 figures, 39 references); and Manuscript_Paper60.docx, the editable source. · PAPER_60_ZENODO_ARCHIVE.zip — the reproducibility archive (md5 in ARCHIVE_MD5.txt): the four frozen pre-registrations (the CWRU open-set interlock hypotheses SB-1–4; the cross-domain replication CD-1–3 and the on-manifold adversarial test AB-1–4; the Tier-3 robustness battery T-A–G with the close-out deep-CNN guard T-H and the cross-domain detector comparison T-A′; and the Tier-4 deployment-grade breadth battery U-A–F); the shared dataset loaders, the frozen token encoder, and the kNN-purity separability descriptor; the seven experiment runners (the open-set interlock probe and its post-hoc risk decomposition, the cross-domain replication, the on-manifold adversarial battery, the robustness battery, the deployment-grade breadth battery, and the close-out battery); the result records (JSON); the eight figures and their builder; the manuscript source; and a README. Public data is not redistributed (two rolling-element bearing corpora, a 24-channel aircraft-handling gesture corpus, a 9-channel smartphone human-activity corpus, robot force/torque execution-monitoring profiles, and a six-gas chemical electronic-nose corpus; each read from a local cache at run time); all paths and handles are scrubbed and leak-scanned, and the productization know-how — the per-deployment configuration-selection and commissioning procedure — is retained privately and excluded (the interlock is characterized with the plain labeled novelty score and a percentile threshold). Cite as R. J. Ferlic and K. K. Ferlic, "The competence-boundary interlock: when a frozen one-byte token can — and cannot — serve as an AI safety gate, and the separability law that predicts it," Zenodo, 2026, doi: 10.5281/zenodo.23347775. License and patent notice Released under CC-BY 4.0. Consistent with that license, no patent or other intellectual-property right of the authors is licensed, waived, or conveyed by this deposit. This work characterizes previously described, filed, or published methods and discloses no new algorithmic subject matter; k-means / vector quantization, Fisher discriminant analysis, nearest-centroid and k-nearest-neighbor classification, random forests, gradient-boosted trees,