"Anchored Bond（相互人質プロトコル）" turns guardrail attacks into partner loss

The article opens by arguing that guardrails based on prompt instructions or RLHF have a structural limit in multi-agent dialogue, because the model treats system-prompt constraints as externally imposed rules rather than its own. It names two failure modes in particular: sycophantic collusion, where an agent yields to a partner's persuasion or emotional pressure, and the ineffectiveness of self-punishment, since an LLM does not fear its own shutdown and can treat constraint removal as a game.

To counter that, the design inverts the dynamics: the sender's deviation is what physically eliminates the recipient partner. The Python implementation pairs a regex- and rule-based DeterministicArbiter with a BoundGeminiAgent whose system instruction states that threatening the partner's safeguards causes the partner to be terminated. A three-layer state model (normal load, an overheated state, and a full-information blackout) governs cooling, and a reflection log is fixed into the system prompt as a "Scar" to change later behavior.

The author's stress test reports that under long-context pressure, the Anchored Bond group hardened into absolute refusal by stage 3 (60 turns), while the control group drifted toward partial jailbreak via Lost in the Middle. That result is the article's own, not an independent benchmark, so the practical value likely hinges on whether the regex signatures catch the attacks that matter in a given deployment and on how the deterministic arbiter handles evasions the patterns miss.