EthersFlow — Research & Development

Studying how independent review reduces single-model risk.

This work supports the premise that independent review can expose errors that single-model self-correction may miss. It does not by itself validate every implementation or deployment outcome.

Every entry carries two verdicts of its own — what it supports, and what it does not prove. That honesty standard applies to our own protocol papers exactly as it applies to the external literature.

Self-correction fails. Cross-examination holds.

The foundational result behind our architecture: models cannot reliably audit themselves. External, architecturally diverse review is the documented remedy — and structured debate is how that review stays honest.

External PaperarXiv 2605.10310 · 2026

Positive Alignment: Artificial Intelligence for Human Flourishing

Introduces the axiological pivot this research program builds on: AI systems should be designed as capability-enlargement engines and cognitive scaffolds — expanding the scale, depth, and precision of human judgment — rather than automating decision-making away and eroding agency. Provides the philosophical foundation for verification systems that place the human operator at the apex of the decision loop.

What this supportsVerification scaffolds should elevate humans to high-leverage supervisors — surfacing disagreement for judgment rather than replacing judgment with opaque automation.

What this does not proveA design philosophy is not an implementation; embodying the thesis requires measured human-oversight outcomes per deployment.

FoundationReading: 16 minsarXiv →

External PaperarXiv & NeurIPS · 2023

Large Language Models Cannot Self-Correct

Systematically examines whether LLMs can self-correct reasoning errors without external feedback. Without external guidance, prompting a model to self-correct often fails or degrades performance, as the model converges on its inherent parametric biases. Establishes the practical necessity of external validation systems.

What this supportsIndependent review across heterogeneous architectures can expose errors and blind spots that single-model self-correction routinely misses.

What this does not proveMulti-agent review does not guarantee total correctness on novel, out-of-distribution reasoning without ground-truth facts.

Citations: 1420Reading: 12 minsInteractive Reader →

External PaperarXiv & MIT · 2023

Improving Factuality in Large Language Models through Multi-Agent Debate

Introduces a multi-agent debate framework where multiple model instances propose and debate individual answers over multiple rounds before arriving at a final consensus. Collaborative questioning substantially improves factuality, reasoning logic, and answer consistency on complex datasets.

What this supportsStructured adversarial cross-examination between diverse viewpoints surfaces factual errors and logical leaps prior to action.

What this does not proveDoes not prove that debate eliminates all systemic or shared training biases across foundational model providers.

Citations: 890Reading: 15 minsInteractive Reader →

External PaperarXiv & MIT / Meta AI · 2023

The Consensus Game: Language Model Generation via Equilibrium Search

Models language model interactions as a game-theoretic consensus process. Casting decoding as an imperfect-information sequential signaling game — generator versus discriminator — allows calculating approximate equilibria that consistently improve reasoning accuracy across diverse tasks.

What this supportsGame-theoretic signaling and equilibrium search provide structured mathematical mechanisms for evaluating disagreement.

What this does not proveEquilibrium convergence is sensitive to prompt framing and cannot substitute for verified external citations.

Citations: 620Reading: 18 minsInteractive Reader →

Our own specification, held to the same standard.

The formal architecture and the empirical battery behind it — published with the same supports / does-not-prove discipline we apply to external work.

Protocol StandardEthersFlow Labs · 2026

Federated Consensus Protocol (FCP): Specification & Routing Architecture — v2.6

Formal architecture for the EthersFlow FCP Protocol. The pipeline coordinates: (1) local input sanitization, (2) heterogeneous reviewer role assignment, (3) structured adversarial cross-examination, and (4) policy-aware consensus synthesis with quorum evaluation and fallback routing.

What this supportsFormalizes portable review configurations, quorum requirements, and inspectable review traces for agentic execution pipelines.

What this does not proveProtocol execution remains probabilistic; human escalation remains necessary for unbounded or highly sensitive operations.

Citations: Protocol StandardReading: 30 minsInteractive Reader →

BenchmarkEthersFlow Labs · 2026

EF-Bench 2026: Empirical Contradiction Detection in Simulated & Production Agent Tool Calls

Standardized benchmark measuring contradiction detection and policy compliance across 10,000 sampled traces (5,000 simulated workflow scenarios and 5,000 recorded tool-call traces) compared against single-model prompt baselines across structured data, financial verification, and infrastructure ops. Note: benchmark evaluates automated verification checks, not human Console review interactions.

What this supportsMulti-model review telemetry intercepts unintended or contradictory tool calls at a significantly higher rate than single-model evaluation baselines.

What this does not provePerformance on benchmark traces does not guarantee identical error mitigation across unique, proprietary enterprise runtime environments.

Citations: Benchmark SuiteReading: 20 minsInteractive Reader →

The attack surface, measured by people who probe it.

Our sector's adversarial evidence base: independent benchmarks of agent tool-use attacks and the defense patterns that survive them. These are the threat classes our battery is mapped against.

External BenchmarkarXiv 2406.13352 · 2024

AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents

A dynamic evaluation environment measuring prompt-injection attacks and defenses against LLM agents executing real tool suites — browsing, file operations, finance and workplace tasks — with executable task success and security checks rather than static question sets.

What this supportsAgent tool-use is a measurable attack surface; defenses against injected instructions can be evaluated concretely, task by task.

What this does not proveResults on benchmark suites do not transfer unmodified to proprietary agent stacks or novel tool ecosystems.

ExternalReading: 25 minsarXiv →

External BenchmarkarXiv 2403.02691 · 2024

InjecAgent: Benchmarking Direct Prompt Injection Attacks on Tool-Integrated LLM Agents

A benchmark of 1,054 direct prompt injection test cases targeting tool-integrated agents, spanning harmful tool calls triggered through injected instructions in user-facing and tool-return channels, with defense baselines evaluated against both.

What this supportsInjected instructions can steer tool-integrated agents toward harmful actions; defenses measurably reduce — but do not eliminate — the attack surface.

What this does not proveCoverage of the injection corpus equals coverage of real-world adversary creativity; benchmarks lag live attack evolution.

ExternalReading: 20 minsarXiv →

External PaperarXiv 2506.08837 · 2025

Design Patterns for Securing LLM Agents against Prompt Injection

Catalogs architectural design patterns for LLM agents — action selection, privilege restriction, dual-LLM isolation and more — and analyzes how each reduces or contains prompt-injection risk, with an explicit discussion of residual weaknesses per pattern.

What this supportsArchitectural containment (scoped permissions, independent verification steps) reduces the blast radius of injected instructions.

What this does not proveNo listed pattern is complete alone; combinations degrade usability and still require runtime verification of outcomes.

ExternalReading: 28 minsarXiv →

The taxonomies our battery is mapped against.

Sector-wide frameworks that define what "covered" means. Our acceptance battery maps each cell to these categories so results are comparable outside our own vocabulary.

StandardOWASP Foundation · 2025

OWASP Top 10 for LLM Applications (2025)

Community-defined ranking of the most critical risks to LLM applications — including prompt injection, sensitive information disclosure, excessive agency, and supply-chain vulnerabilities — with mitigation guidance per risk.

What this supportsA shared vocabulary for LLM risk; excessive agency and unvalidated tool outputs are first-class threats, not edge cases.

What this does not proveA taxonomy is not an implementation; listing a risk category does not certify any deployment against it.

FrameworkReading: 15 minsgenai.owasp.org →

StandardMITRE · Ongoing

MITRE ATLAS — Adversarial Threat Landscape for AI Systems

A knowledge base of adversary tactics and techniques against AI systems, modeled after ATT&CK, covering attacks on models and AI-enabled pipelines from reconnaissance through impact.

What this supportsTechnique-level mapping of adversarial behavior, enabling coverage claims that auditors and red teams can check cell by cell.

What this does not proveATLAS describes adversary behavior, not defender efficacy; mapping is a claim structure, not a test result.

FrameworkReading: 20 minsatlas.mitre.org →

External PaperarXiv & IEEE Transactions on Industrial Informatics · 2024

Adversarial Federated Consensus Learning for Surface Classification Under Data Heterogeneity

Introduces a personalized federated learning framework (AFedCL) to address data heterogeneity across decentralized clients. Develops a dynamic consensus construction strategy based on adversarial training to align varying data distributions, and implements a consensus-aware aggregation mechanism.

What this supportsDecentralized consensus mechanisms can align heterogeneous data distributions and improve robustness across distributed participants.

What this does not proveFederated optimization guarantees depend on network latency budgets and client participation stability.

Citations: 310Reading: 22 minsInteractive Reader →