Defense in Superposition: Deferred Collapse of Configuration, Threat State, Deception, and Model State in Autonomous Network Defense

Earlier live-network soaks of the TACET network defense platform traced several measured errors to one habit: the platform settled on a single answer before it had the evidence to choose one. It ran one configuration per detector, recorded each actor’s furthest attack phase as a label that could only rise, showed the same decoys to every observer and counted every trained anomaly model as working. An audit found that 40 of 61 of those models returned the same score for every input. This paper describes superposition, the approach we adopted for all four decisions. The platform keeps several candidates, updates them from the same observations, lets one act and commits only when a stated evidence test is met. We describe shadow detector branches that run alternative configurations on the same live events with no path to the network, a per-actor hidden Markov model whose belief in an attack decays when the actor goes quiet, decoys assigned to one observer so that use by another reveals shared reconnaissance, and tests that stop degenerate models from counting as coverage. We explain why we built self-mutation and why it required superposition, and we describe how a winning branch is promoted through the attested mutation plane of the previous paper, including a second signing authority bound to a measurement of the decision code. The mechanisms are implemented. We report a 70-day soak in which detection across all families except low-and-slow scanning was 91.7 percent after rescoring, the go-dark gate pinned non-attacker addresses 13 times on false corroborating evidence, and one innocent host drew about 420 isolation recommendations because a spoofing playbook treated a device with no attestation agent as having failed attestation. The superposition mechanisms themselves await a live evaluation. As the last paper in the series, it also includes a complete reference description of the platform.