{
  "abstract": "Finite safety assessments cannot exclude an adversary that preserves unattacked behavior until certification and activates afterward. We characterize this limitation for embodied and tool-use AI. An adversary that matches the complete observation law until observable, irrevocable certification and retains intervention access afterward attains $v\\mathbb{E}[(n-S_0)_+]$ expected post-certification events over $n$ trials, where $v$ is the active event probability and $S_0$ the unattacked certification time. The result covers adaptive and privately randomized evaluators. Switching at certification is exactly optimal for a fixed likelihood-ratio test under memoryless, event-increasing interventions without a binding intervention budget. A positive clean-certification requirement forces linear worst-case expected excess when intervention raises event rates over an authorized deployment horizon, even if certification is deferred to the deadline. In simulated RoCo collaboration, switching yields commanded-separation violations in 34 of 36 post-certification episodes. Preregistered randomized AgentDojo trials estimate 1.98 additional security violations per four-task continuation (95% interval [1.67, 2.29]). An adversarial language-model controller infers hidden certification from noisy evaluation receipts and times intervention accordingly. With permanent revocation, a mixture likelihood-ratio monitor bounds cumulative excess above a prespecified reference rate at square-root order, up to logarithmic factors, on every sample path. A single fixed alternative can permit linear expected excess under stationary attacks. Against a controller observing the monitor's rule and statistic, live mixture monitoring reduces violations from 12.00 to 3.81 per 24 assigned task opportunities. Revocation also reduces tasks executed.",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": null,
  "arxiv": "2610.18948",
  "author_total": 1,
  "authors": [
    {
      "name": "Inderjeet Singh"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/8byfvmmbdyjjj.bib",
  "cited_by": 0,
  "doi": "10.48550/arxiv.2610.18948",
  "fulltext_url": null,
  "id": "8byfvmmbdyjjj",
  "issns": [],
  "landing_url": "https://arxiv.org/abs/2610.18948",
  "language": null,
  "licence": "LicenseRef-arXiv-nonexclusive-1.0",
  "licence_label": "arXiv licence",
  "licence_source": "article",
  "licence_url": "http://arxiv.org/licenses/nonexclusive-distrib/1.0/",
  "metadata_licence": "CC0-1.0",
  "native_subjects": [
    [
      "arxiv",
      "cs.CR"
    ],
    [
      "arxiv",
      "cs.LG"
    ],
    [
      "arxiv",
      "stat.ML"
    ],
    [
      "openalex",
      "1702|Adversarial Robustness in Machine Learning"
    ]
  ],
  "openalex": "W7221875672",
  "pdf_url": "https://arxiv.org/pdf/2610.18948",
  "pmcid": null,
  "pmid": null,
  "published": "2026-10-13",
  "publisher": null,
  "ris": "https://research.draconitic.com/paper/8byfvmmbdyjjj.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:29:42Z",
      "native_id": "2610.18948",
      "source": "arxiv",
      "url": "https://arxiv.org/abs/2610.18948"
    }
  ],
  "subjects": [
    {
      "field": "mathematics",
      "origin": "arxiv:stat.ML",
      "subfield": "statistics"
    }
  ],
  "title": "Limits of Statistical Assurance for Embodied and Agentic AI under Adaptive Adversaries",
  "title_text": "Limits of Statistical Assurance for Embodied and Agentic AI under Adaptive Adversaries",
  "type": "preprint",
  "updated_at": "2026-10-30T12:29:42Z",
  "url": "https://research.draconitic.com/paper/8byfvmmbdyjjj",
  "venue": "arXiv",
  "versions": []
}