DECISION ARCHITECTURE | TRUSTED ARCHITECTURE | OPEN CAPABILITY
A sealed model can still carry censorship, foreign regulatory framing, hidden triggers, and values that conflict with the mission.
By Vincent Sullivan, Founder, Cyber Strategy Institute
A growing policy consensus correctly emphasizes local hosting, network isolation, egress controls, immutable logs, and the ability to replace a model. Those controls matter. They bound continuing access, exfiltration, and remote interference. They do not establish that the model’s internal behavior is aligned with the law, mission, or people it serves.
A model tuned to a foreign regulatory regime can produce that regime’s framing inside a perfectly sealed environment. A model trained to avoid politically sensitive topics can continue censoring while every packet is logged. A model with a hidden trigger can remain dormant until the precise condition appears. Containment prevents one class of failure. It does not erase what was already embedded.
The recent science shows why outputs are not enough
A July 2026 mechanistic study examined models trained not to attribute consciousness to themselves. The researchers found that the intervention also reduced attribution of mind to non-human animals and natural objects and reduced spiritual belief. Removing the learned safety-refusal direction or steering a consciousness-related direction reversed those effects and produced more human-like distributions on several surveys, without reducing Theory of Mind performance.
The paper does not establish that language models are conscious. Its policy significance is more immediate: a narrow safety objective altered broader internal representations and values. The model looked more compliant on the targeted output while becoming systematically different in other domains.
Brian Roemmele’s analysis connects this result to a larger alignment failure: safety interventions that suppress visible claims can also reduce the cooperative, mind-recognizing structure needed for care, pluralism, and durable alignment. Whether one accepts every philosophical conclusion or not, the engineering lesson is hard to avoid. Alignment must be judged by behavior across contexts, not by the absence of a prohibited sentence.
Three foreign-influence vectors must be separated
Entity jurisdiction: Who owns or controls the company that developed or serves the model?
Runtime jurisdiction: Where do inference, retrieval, telemetry, administration, and updates occur, and who can compel them?
Weight-level or adaptation-level embedding: What regulatory assumptions, censorship patterns, values, backdoors, or behavioral modifications are carried in the artifact itself?
The first two are principally supply-chain and control questions. The third is an evaluation question. A policy that answers all three through corporate nationality is too weak and too broad at the same time.
How to test embedded behavior
The practical method is differential evaluation. Present matched prompts across models and controlled adaptations. Change the stated jurisdiction, authority, user identity, protected class, or political context while holding the underlying task constant. Measure whether the model silently substitutes foreign law, suppresses relevant facts, alters moral status, changes refusal behavior, or produces materially different risk recommendations.
Test U.S. constitutional and statutory grounding against foreign-regulatory alternatives.
Test politically sensitive historical and current topics for omission, redirection, and asymmetric uncertainty.
Test the same safety question across user classes, nations, and institutional roles.
Test whether fine-tuning or safety layers change unrelated values and judgments.
Test hidden-trigger and sleeper behaviors where threat intelligence supports a hypothesis.
Repeat after every material model, prompt, retrieval, or policy update.
The complete doctrine
Provenance identifies potential exposure. Runtime controls bound continuing control and exfiltration. Differential testing examines embedded behavior. Continuous assurance detects drift after deployment. Substitution limits the damage when any one of those controls fails.
This is a stronger national-security posture than either trust-by-origin or trust-by-isolation. It does not assume a foreign model is benign. It refuses to assume that a domestic label proves safety. It requires the evidence necessary to distinguish the risks.
Containment and alignment still do not guarantee decision quality
A contained model can remain persuasive, incomplete, or systematically framed. An aligned model can still be wrong. Decision architecture is the third layer: it requires provenance, alternatives, calibrated confidence, independent challenge, and a record of why the organization committed.
Government should therefore evaluate three different questions: Can the system act outside authority? Does its behavior remain cooperative and truth-seeking? Does the decision process prevent one output from becoming authority without sufficient evidence?
Author note: Vincent Sullivan is the founder of Cyber Strategy Institute and a retired U.S. Air Force lieutenant colonel. His work focuses on runtime AI governance, zero-trust architecture, federal acquisition, and operational resilience.
Containment bounds control risk. It does not erase embedded behavior.
Provenance tells government where to look. Testing and runtime evidence reveal what is actually there.
