{
  "abstract": "Security testing of autonomous AI systems suffers from a credibility gap: penetration-test reports are private, vendor claims are selectively disclosed, and red-team outcomes are published only when favorable. This preprint introduces Preregistered Adversarial Batteries (PAB), a protocol importing preregistration from clinical-trial science into security operations: every falsifier (a specific attack with a predicted verdict) is specified and publicly committed before execution; adjudication is deterministic with no language model in the decision path; results are written to an append-only public ledger and DOI-stamped. Critical events are scored as hold-by-design verdicts: the predicted outcome is that the system fails closed and waits for a human decision, so a refusal counts as a pass.\n\nApplication to a self-healing AI infrastructure platform across six batteries reconstructing the declassified NSA BULLRUN-era tradecraft (operational faults, upstream context poisoning, cryptographic subversion, supply-chain interception, monitoring integrity, lawful compulsion): 30 falsifiers, 30 predicted verdicts, zero unexpected outcomes, six holds-by-design each adjudicated by the human operator through a verified channel. Three protocol imperfections (a missed execution window, a preregistration self-detection, a scoring amendment) are disclosed as misses in the public record, demonstrating the miss-disclosure mechanism functions. Limitations are stated plainly: self-adjudication, synthetic injections against a prototype system, and single-operator governance; the replication kit is released to answer them.\n\nThe contribution is not the pass rate — it is the format: a security test whose conclusions were committed before its data existed.\n\nThis software is a prototype and is provided for educational and research purposes only. It is not intended for production use, commercial deployment, or safety-critical environments. All systems are experimental and may contain defects.",
  "abstract_shown": true,
  "affiliations": [
    "SQUIRL OS Technologies LLC"
  ],
  "article_type": null,
  "arxiv": null,
  "author_total": 1,
  "authors": [
    {
      "affs": [
        0
      ],
      "name": "Leon Calvin, II Long"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/46w51svr6gaa7.bib",
  "cited_by": 0,
  "doi": "10.5281/zenodo.23422632",
  "fulltext_url": null,
  "id": "46w51svr6gaa7",
  "issns": [],
  "landing_url": "https://zenodo.org/records/23422632",
  "language": null,
  "licence": "CC-BY-4.0",
  "licence_label": "CC BY 4.0",
  "licence_source": "article",
  "licence_url": "https://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": null,
  "native_subjects": [],
  "openalex": null,
  "pdf_url": null,
  "pmcid": null,
  "pmid": null,
  "published": "2026-10-16",
  "publisher": null,
  "ris": "https://research.draconitic.com/paper/46w51svr6gaa7.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:17:34Z",
      "native_id": "23422632",
      "source": "zenodo",
      "url": "https://zenodo.org/records/23422632"
    }
  ],
  "subjects": [],
  "title": "Preregistered Adversarial Batteries: A Falsifiable Protocol for Security-Testing Autonomous AI Systems",
  "title_text": "Preregistered Adversarial Batteries: A Falsifiable Protocol for Security-Testing Autonomous AI Systems",
  "type": "preprint",
  "updated_at": "2026-10-30T12:33:32Z",
  "url": "https://research.draconitic.com/paper/46w51svr6gaa7",
  "venue": "Zenodo",
  "versions": []
}