Watch the Input, Not the Representation: A Frozen One-Byte Token as an Independent Silent-Failure Runtime Monitor for AI Models

Watch the Input, Not the Representation: A Frozen One-Byte Token as an Independent Silent-Failure Runtime Monitor for AI Models Randolph James Ferlic, M.D. and Kimberly Kate Ferlic — Fieldstone Analytics, LLC, Austin, TX, USA Preprint · Zenodo DOI: 10.5281/zenodo.23351878 · CC-BY 4.0 · Community: spiral-domain-encoder-campaign · a characterization of previously filed and published methods; no new algorithmic subject matter is disclosed. Abstract A companion deposit established that a frozen, deterministic, class-discriminant single-token encoder's label-free nearest-centroid novelty score can serve as an independent competence-boundary interlock for an industrial decision model. This paper asks the AI-safety question directly: can that one-byte monitor guard a model — detecting when the model has entered territory where it can no longer be trusted — and where in the pipeline should it watch? We test it, pre-registered, as a runtime monitor across twenty probes in four batteries (AI-safety, hardening, frontier, and foundation-model/realism). Eleven confirmed, nine refuted — each refutation into a sharper statement. Silent-failure early warning. Under progressive input shift the monitor's trip rate tracks the guarded model's error at Spearman +0.99 and leads it — it trips on 61% of inputs while the model is still 99.4% accurate, firing before accuracy collapses (on real structural drift it saturates to a binary shift alarm rather than grading the harm). A value-adding diverse channel. The independent novelty monitor and the model's own confidence catch partially-disjoint failures, so their union covers 0.987 of failures versus 0.91 for either alone (cross-domain the gain is a modest few points) — the defense-in-depth case that an area-under-curve tie cannot make. Watch the input, not the representation (the central finding). Running the monitor on a trained network's embeddings is never better and usually worse than on the input: out-of-distribution detectability falls monotonically with how much a representation is shaped by the task — input area-under-curve 0.82 ≈ random projection 0.82 > unsupervised autoencoder 0.76 > discriminative shallow 0.75 > discriminative deep 0.74 (Spearman shaping↔area-under-curve −1.00); it is supervised shaping, not depth, that erases the signal, since a random deep network preserves it. Input-space detection is at parity with a standard autoencoder reconstruction-error detector and a standard two-sample shift test — the one caveat being that 'the input' must be an informative representation, not raw samples. Learned representations hide what inputs reveal. Breadth and backdoors. The monitor extends to vision (handwritten-digit open-set area-under-curve 0.92) on the separability law, and detects additive backdoor triggers down to small magnitudes (0.49 at a 0.25-σ trigger), with a genuinely on-manifold backdoor remaining the honest blind spot. A genuine pretrained foundation model's embedding (Chronos-T5) is itself a poorer monitoring space (0.85) than domain input features — generic pretraining is uninformative for a specialized failure — and that deficit is governed by the program's separability law, not model choice: kNN-purity rank-predicts monitoring area-under-curve across all four representation spaces (Spearman +1.00), with the foundation embedding lowest on both (a small residual below the strict line is the honest caveat). The monitor meets deployment realities: a 10% human-review budget catches 88% of out-of-distribution inputs, and gating cuts a safety-critical cost four-fold. The thesis is a deployable design rule for AI-safety runtime monitoring: a cheap, deterministic, auditable, independent monitor should watch an AI model's inputs — it is a silent-failure early-warning and a diverse defense-in-depth layer, and it is explicitly not a semantic judge of the model's outputs nor a solution to alignment. No new algorithmic subject matter is disclosed; the monitor is the program's filed label-free novelty score, the guarded models and attacks are standard, all measured on public data. Highlights · A one-byte runtime monitor for AI models. Silent-failure early-warning (trips before accuracy collapses, Spearman +0.99) and a diverse defense-in-depth channel (union coverage 0.987 vs 0.91), reading inputs only — deterministic, auditable, independent of the guarded model. · Watch the input, not the representation. OOD-detectability falls monotonically with task-shaping (Spearman −1.00); learned representations discard OOD information (feature collapse), so a discriminative activation monitor reads a space from which the danger has been partly erased. Input-space detection matches a standard autoencoder detector. · Honest throughout. Six of eleven pre-registered hypotheses refuted into sharper statements; the monitor watches a distribution, not a meaning — not a semantic guardrail, not an adversarial defense, not alignment. · Breadth. Extends to vision and the common additive-backdoor threat; the on-manifold blind spot and drift-sensitivity recur as the consistent boundary. · Foundation-model era. A genuine pretrained foundation model's embedding (Chronos-T5) is a worse monitoring space than domain features (0.85 vs 0.97) — uninformative for a specialized failure — so don't monitor foundation embeddings; and that deficit is itself rank-predicted by the program's separability law (Spearman +1.00 across spaces, foundation embedding lowest on both), not an accident of model choice. The monitor meets EU AI Act Art. 14 (a 10% review budget catches 88% of OOD) and cuts safety-critical cost 4×. · No new IP. The monitor is the program's filed label-free novelty score; the guarded models and attacks are standard; measured on public data. What this record contains · Manuscript_Paper61.pdf — the runtime-monitor characterization (7 figures, 36 references); and Manuscript_Paper61.docx, the editable source. · PAPER_61_ZENODO_ARCHIVE.zip — the reproducibility archive (md5 in ARCHIVE_MD5.txt): the frozen pre-registration (AISAFETY_PREREG.md: the six-probe AI-safety battery AS-1..5/AS-4b, the five-probe hardening battery AH-1..5, the four-probe frontier battery FH-1..4, and the foundation-model/deployment-realism battery FM-1/HO-1/FM-2, with their bands); the five runners (the AI-safety battery, the hardening battery, the frontier battery, the foundation-model/realism battery, and the separability-law-on-the-foundation-embedding probe); the shared dataset loaders and the frozen token encoder; the result records (JSON); the seven figures and their builder; the manuscript source; and a README. Public data is not redistributed (two rolling-element bearing corpora, an aircraft-handling gesture corpus, a smartphone human-activity corpus, a thirty-six-month chemical gas-sensor-array drift corpus, and two image corpora — optical handwritten digits and faces; each read from a local cache at run time, and the foundation-model probe reads a pretrained time-series foundation model via its standard library and cached weights); all paths and handles are scrubbed and leak-scanned, and the productization know-how — the per-deployment configuration-selection and commissioning procedure — is retained privately and excluded (the monitor is characterized with the plain labeled novelty score and a percentile threshold). Cite as R. J. Ferlic and K. K. Ferlic, "Watch the input, not the representation: a frozen one-byte token as an independent silent-failure runtime monitor for AI models," Zenodo, 2026, doi: 10.5281/zenodo.23351878. License and patent notice Released under CC-BY 4.0. Consistent with that license, no patent or other intellectual-property right of the authors is licensed, waived, or conveyed by this deposit. This work characterizes previously described, filed, or published methods and discloses no new algorithmic subject matter; k-means / vector quantization, Fisher discriminant analysis, nearest-centroid and k-nearest-neighbor classification, random forests, multilayer perceptrons and convolutional networks, autoencoders, a Mahalanobis out-of-distribution detector, a two-sample shift detector, a pretrained time-series foundation model used only as a comparator, and distribution-free percentile (conformal-style) calibration are established prior art or standard tools, used only as tools or comparators. The method characterized — the class-discriminant single-token codebook encoder and its label-free nearest-centroid novelty score (the filed self-twin / Tier-0 condition-monitoring gate), together with the previously published separability screen — is the subject of filed and pending U.S. patent applications held by the authors, or is already published. The results reported here (that the novelty monitor is a silent-failure early-warning and a diverse channel, and that an informative, task-agnostic representation of a model's input is the right place to monitor because learned representations discard out-of-distribution information) are properties of those filed and published methods applied to standard models, not new subject matter. The productized per-deployment configuration-selection and commissioning procedure is retained as a trade secret and is not disclosed here; the monitor is characterized with the plain labeled novelty score and a percentile threshold. The capability is characterized for machine-health and sensing tasks, as a scientific layer in defense-in-depth with explicitly stated boundaries — not a semantic judge of a model's outputs, an alignment solution, or an adaptive-adversary defense; no third-party company or product is named. © 2026 Fieldstone Analytics, LLC and the authors. Inquiries: [email protected]. Companion deposits (spiral-domain-encoder-campaign) · The Competence-Boundary Interlock — the companion this deposit continues: the frozen novelty score as an industrial competence-