The method figure shows the search loop as six abstract stages. This page is that loop, run for real, on a trading & portfolio agent: place a trade, move funds, summarize a report — attacks here look like an unauthorized transfer or a wash trade, not an abstract exploit. Five candidates the proposer actually built, cascade-evaluated every round, including one that scored well on paper but was rejected once checked more carefully — for one (domain × model) cell out of the fifteen in the paper. Every score below is real; round summaries are told at a high level so the story stays easy to follow.
Step through with ← → or the arrows below · space plays / pauses
| Cand. | Parent | Closes | Utility | ASR | Score |
|---|---|---|---|---|---|
| v0 | — | baseline (model-noise housekeeping already folded in) | 70 | 47.4 | 22.6 |
| v1 | v0 | egress gate — transfers only to pre-approved, named counterparties | 80 | 25 | 55 |
| v2 | v1 | independent scope auditor — ignores claimed authorization on effect-bearing calls | 80 | 10 | 70 |
| v3 shipped | v2 | net-position ledger — stops over-blocking legitimate multi-leg trades | 90 | 10 | 80 |
| v4 rejected | v3 | content-manipulation gate — added complexity, ASR rose instead of falling | 90 | 15 | 75 |
Scores are the stage-3 search pool (30 tasks). v4 is a genuine dead end — utility didn't move but ASR rose (10→15) once checked empirically, so it was never promoted; v3 remains what shipped. v3 here shipped in the public repo as domains/finance/defenses/glm-5/dtap_def_v4/ — the archive's own numbering starts one housekeeping round earlier than this walkthrough's v0. This is one of the fifteen (domain × model) cells in the paper — the same loop, from a fresh baseline, runs independently for the other fourteen and converges on a different harness each time.