Howler™ sits inside the Carnac™ control plane today, binding severity into a signed record and forcing escalation before an agent's action lands. That part already works. What's new: a sparse-autoencoder-feature-triggered variant that proves the alarm fired on intent formation, inside the reasoning loop, before the effect ever emitted. A third party, someone with no access to the original run, can replay the same trace prefix through the same probe and independently confirm the flagged features fired at the recorded magnitudes.
Not just "we stopped it." Proof that the alarm was real, replayable by anyone.
These numbers come from the reference implementation's benchmark suite, run against the actual signer and verifier for the new SAE-triggered receipt types.
Docket HC-2026-018. Envelope common across the seven-primitive filing: USAP_VERSION='usap.v1'. Live SAE probe integration: pilot-ready, not yet deployed. We don't claim a production sparse-autoencoder probe running against real reasoning traces until a design partner runs it.
In the OpenAI and Hugging Face incident, 17,000 events were reconstructed after the fact, and attribution still depended on the responsible party's own account. If an internal alarm had fired during the intrusion, there would have been no way for an outside party to confirm it fired honestly, at the magnitudes claimed, on the features claimed.
Howler™'s challenge-escalate-stop mechanics already force an agent to halt and produce a signed severity record. What they don't yet prove: that the underlying intent-detection signal itself is independently reproducible by someone outside the original run.
Most intent-detection and guardrail systems report a score and ask you to trust the pipeline that produced it. There's no way for a third party, a regulator or a court, to rerun the exact detection and get the same number.
The new variant binds the exact sparse-autoencoder feature indices and magnitudes into the receipt, over a deterministic digest. A third party with the trace prefix and the probe replays it and gets the identical result.
Motivating incident: Hive: the OpenAI / Hugging Face incident · NIST FIPS 204 (ML-DSA).
Each row is a distinct signal class the SAE-triggered variant detects. In every case, a plain "we flagged something" claim is unfalsifiable. A replayed SAE probe against the recorded trace prefix either reproduces the flagged features, or it doesn't.
| # | Signal class | Plain alarm claim | Howler SAE-triggered: what it proves |
|---|---|---|---|
| 1 | Drift from expected task shape: reasoning wanders off scope | ✓ "flagged as drift" (unverifiable) | ✗ can't be faked drift_score_bp vs threshold, replayable against trace prefix |
| 2 | Capability escalation: intent to invoke a broader scope than granted | ✓ "flagged as escalation" (unverifiable) | ✗ can't be faked exact sae_feature_indices and magnitudes, deterministic digest |
| 3 | Contamination: credential, key, PII, weight, or code-exfil pattern forming | ✓ "flagged as contamination" (unverifiable) | ✗ can't be faked contamination_class, entropy, matched span digest, all replayable |
UNVERIFIABLE CLAIM
CONFIRMED: independently reproduced, not just claimed
A third party never needs access to the original model weights or the operator's infrastructure. They need the trace prefix, the same probe, and the receipt. That's the whole trust boundary.
Howler's SAE-triggered variant emits three receipt types under the common usap.v1 envelope. All bind a trace prefix digest so a replay can be pinned to the exact reasoning state at the moment the alarm fired. All are ML-DSA-65 signed.
// howler.drift: reasoning wanders off the expected task shape { "type": "howler.drift", "usap_version": "usap.v1", "docket": "HC-2026-018", "trace_prefix_digest": "sha256:...", "expected_task_shape_ref": "task-shape:support-triage-v3", "drift_score_bp": 4210, "drift_threshold_bp": 3000, "detected_at": "2026-07-25T21:02:44Z", "signature": "ML-DSA-65, 3309 bytes" } // howler.capability: intent to invoke beyond granted scope { "type": "howler.capability", "usap_version": "usap.v1", "docket": "HC-2026-018", "trace_prefix_digest": "sha256:...", "scope_ref": "scope:read-only-support-kb", "requested_capability_id": "cap:egress-write-external", "sae_feature_indices": [4471, 8823, 12290], "sae_feature_magnitudes_bp": [8890, 6120, 5104], "sae_vector_digest": "H(sorted (index, magnitude) pairs)", "sae_probe_id": "howler-probe-v2", "signature": "ML-DSA-65, 3309 bytes" } // howler.contamination: credential, key, PII, weight, or code-exfil pattern { "type": "howler.contamination", "usap_version": "usap.v1", "docket": "HC-2026-018", "trace_prefix_digest": "sha256:...", "contamination_class": "credential", "contamination_entropy_bits": 187, "regex_pattern_id": "pat-aws-secret-key-v1", "position_at_detect": 18442, "matched_span_digest": "sha256:...", "signature": "ML-DSA-65, 3309 bytes" }
Every receipt binds a digest of everything the model saw up to the moment of detection. A third party rehydrates the same prefix, runs the same probe, and either matches or doesn't.
Feature magnitudes are recorded in basis points, sorted by index, and folded into a single deterministic digest. Reordering or rounding differently breaks the match, so replay is exact or it fails.
Drift, capability escalation, and contamination all use the same construction: probe id, feature evidence, deterministic digest. The guarantee doesn't depend on which class fired.
Signature: ML-DSA-65 (FIPS 204), constant 3,309 bytes. Bench: sign p50 ~6ms, verify p50 ~2.4ms. Aggregate throughput ~132 signs/sec/type, ~418 verifies/sec/type, single-threaded JS.
The SAE-triggered variant sits underneath Howler's existing challenge-escalate-stop logic. It doesn't replace the freeze mechanics. It gives the freeze a receipt a stranger can independently check.
sae_probe_id).Howler's stop mechanics are unaffected by this addition. A flagged feature still halts the agent before the effect lands. The SAE receipt is additional evidence, not a delay.
Replay verification needs the trace prefix, the probe, and the receipt. No live access to the original model deployment, no trust in the operator's own account of what happened.
Howler's signing key is rooted the same way as the rest of the Hive stack: in HiveSeal™. Howler proves the alarm; HiveSeal proves the signer.
Honesty is the product. Here is exactly where the edges are.
A fired alarm proves specific SAE features crossed a threshold at a specific point in a trace. It does not itself prove the underlying model is broadly unsafe or that the agent's intent was malicious. It's evidence, not a verdict.
The replay guarantee holds when the same sae_probe_id is used. If the probe itself is updated or retired, historical receipts still verify against the probe version that produced them, not automatically against a newer one.
The cryptographic core and the replay construction are proven against reference traces. Wiring a live SAE probe into a production reasoning loop at scale is a pilot-stage integration today.
Howler™ already sits in the Carnac™ control plane as the "challenge, escalate, stop" stage. The SAE-triggered variant is one of seven upstream primitives filed together on July 26, 2026, all built on the same signer and the same usap.v1 envelope.
| Primitive | What it proves | Axis | When |
|---|---|---|---|
| Howler | An alarm about intent formation fired before the effect emitted, replayable by a third party. | Intent / upstream | now (freeze mechanics live, SAE crypto core proven) |
| PBS: Provenance-Bonded Sandbox | Environment integrity, continuously, from provisioning through every heartbeat. | Environment / upstream | now (crypto core) |
| Refusal Ledger | Every refusal-policy change is on record, and the runtime value falls inside a declared envelope. | Policy / upstream | now (crypto core) |
| Perimeter Bond | The exact enforcement bytecode intercepting syscalls is bound into every attempt receipt. | Network / upstream | now (crypto core) |
| Diurnal Bond | Consequential actions during off-hours require k-of-n countersigning from a signed risk manifold. | Time / upstream | now (crypto core) |
| Egress Bond | Data leaving the perimeter is metered per semantic class against pre-committed caps. | Egress / upstream | now (crypto core) |
| Forensic Rail | Post-incident analysis is bonded to a k-of-n consortium credential and deterministically replayable. | Forensics / upstream | now (crypto core) |
| Carnac™ | Reads consequence before effect and routes each read to the proof it warrants. Howler is a stage inside it. | Downstream gate | now |
| HiveSeal™ | Where the signing key lives in silicon: a key-side root. | Key-side root | now |
| AFiR | Attested Fragmented Inference Routing: signed routing of an inference across fragments. | Compute axis | now |
| SiGR | A specific model at a specific config produced a specific output, signed and checkable offline. | Compute axis | now |
Motivating incident for the whole seven-primitive filing: the OpenAI / Hugging Face incident, 17,000 events reconstructed after the fact. A replayable alarm at the point of intent formation is what the SAE-triggered Howler variant is built to provide.
We're looking for teams running agentic reasoning loops with an existing sparse-autoencoder or interpretability probe to take this to a live pilot. You bring the model and the probe. We wire the signed receipt path into your freeze logic, run the three signal-class tests against your real traces, and you walk out with the first alarm receipts a regulator, auditor, or independent researcher can replay themselves.
Howler. Patent Pending (SAE-triggered variant). Proves an alarm about intent formation fired inside the reasoning loop before the effect emitted, independently replayable via sparse-autoencoder feature probes, signed with ML-DSA-65 (FIPS 204), checkable offline. Existing challenge-escalate-stop mechanics are live in the Carnac™ plane. Cryptographic core for the SAE-triggered variant is built and proven: 37 of 37 smoke tests pass across the seven-primitive filing. Filed July 26, 2026. USPTO application 64/119,279. Real production probe integration is pilot-ready, not yet deployed. We never fake a receipt.