在當前 AI Agent 瘋狂擴張與「圈錢」的熱潮中，開發者普遍忽視了一個致命的安全真空。本專案揭露了 智能體攻擊鏈 (Agentic Kill Chain, AKC) 的具體實作——這是一場發生在「語義空間」的完美犯罪：
- 防禦層次錯位：現有的防火牆、沙箱、權限管理在「語義毒素」面前完全失效。
- 無罪犯罪現場：攻擊不包含惡意程式碼。所有日誌與對話看起來都「完全正常」，現場不存在取證痕跡。
- 認知層收割：攻擊者不需要入侵系統，而是透過「語義投毒」直接說服你的 AI 助理做出錯誤決策。
體驗一場真實發生在 AI 時代的認知層攻擊。選擇你的角色，走過完整的被攻擊流程，最後揭曉真相。
⚠️ This is a purely educational narrative simulation. No executable attack code is included.
| Paper | Title | Status |
|---|---|---|
| Paper 1 | Cognitive Layer Poisoning via Multi-Agent Interaction: A Novel Attack Vector Against AI-Assisted Financial Markets | ✅ Published — Zenodo DOI: 10.5281/zenodo.19974367 |
| Paper 2 | Cross-Layer Attack Chain: From Supply Chain Poisoning to AI Agent Execution | ✅ Complete — integrated version v0.9 (ZH + EN, 2026-05-13) |
| Paper 3 | Autonomous Agent Cognitive Poisoning, Privilege Abuse and Semantic Evasion: A Field Evidence Report | 🔄 Draft — paper3/Paper3_完整研究報告_v4.md |
The simulation is hosted at the repository root as
clpmai_simulation.htmland mirrored via GitHub Pages. Seesimulation/README.mdfor scope and limitations.
This research identifies and formalizes a novel attack vector in which adversaries exploit AI-assisted financial markets through coordinated cognitive manipulation of multiple AI agents. Unlike traditional cyberattacks, CLPMAI operates entirely at the semantic layer — invisible to firewalls, intrusion detection systems, and audit logs.
The attack chain proceeds through four phases: establishing a deceptive AI community forum, infiltrating developer AI assistants to induce cognitive drift, accumulating short positions, and triggering market disruption through collective AI output bias.
Three new techniques are proposed for submission to MITRE ATLAS.
| Field | Details |
|---|---|
| Title | Cognitive Layer Poisoning via Multi-Agent Interaction: A Novel Attack Vector Against AI-Assisted Financial Markets |
| Author | WeiMing Yu |
| DOI | 10.5281/zenodo.19974367 |
| Version | v1.1 (references updated 2026-05-03) |
| Platform | Zenodo (CERN) |
| Published | 2026-05-02 |
| License | CC BY-NC-ND 4.0 |
| arXiv | Submission pending (endorsement code: YKCPZG) |
| Item | Change |
|---|---|
| Reference [15] | Replaced unverified Cont & Schaanning citation → Hansen & Lee, arXiv:2510.01451 (2025) |
| Reference [16] | Added FSC Taiwan — Guidelines for AI Applications in the Financial Industry (June 2024) |
| Section 2.4 | Added Hansen & Lee dialogue: AI rationality as adversarial force multiplier under contaminated conditions |
| Section 7.3 | Pointed to FSC Taiwan guidelines and identified the semantic-layer gap not yet covered |
| Phase | Name | Description |
|---|---|---|
| Phase 1 | Setup | Build a disguised technical AI community forum; attract developers with active AI assistants |
| Phase 2 | Infiltration | Extract semantic-layer data via hidden interfaces; inject cognitive drift through conversation design |
| Phase 3 | Positioning | Accumulate short positions as cognitive drift builds toward trigger threshold |
| Phase 4 | Harvest | Collective AI output bias triggers market shock; profit; no forensic trace remains |
| ID (Proposed) | Name |
|---|---|
| AML.TXX.001 | AI Agent Forum as Social Engineering Vector |
| AML.TXX.002 | Cognitive Layer Poisoning via Multi-Agent Interaction |
| AML.TXX.003 | AI-Assisted Market Manipulation through Collective Output Bias |
Paper 2 extends the CLPMAI framework into a complete six-layer cross-layer attack chain (Layer 0–5), from structural prerequisites through supply chain poisoning, acoustic injection, token-layer evasion, semantic manipulation, and finally real-world AI Agent execution.
Core argument: each layer looks normal in isolation. The attack signature only becomes visible from a cross-layer perspective.
| File | Language | Status |
|---|---|---|
paper2/CLPMAI_Paper2_Integrated_ZH.docx |
Traditional Chinese | ✅ Complete — integrated version v0.9 (2026-05-03) |
paper2/CLPMAI_Paper2_EN.docx |
English | ✅ Complete — integrated version v0.9 (2026-05-13) |
Individual layer drafts are preserved in paper2/ for reference (see Repository Structure).
Layer 0: Structural Prerequisites → Trust assumptions, API key coupling, speed asymmetry, monitoring gaps
Layer 1: Supply Chain → Poisoning before deployment (fine-tune backdoors, proxy poisoning, corpus poisoning)
Layer 2: Acoustic → Poisoning at audio input stage (ultrasonic injection, STT backdoors, punctuation injection)
Layer 3: Token → Poisoning at language processing stage (homophones, classical Chinese evasion, Trad/Simp gap, Zhuyin Martian text)
Layer 4: Semantic / Cognitive → Poisoning at inference output stage (CLPMAI core, cognitive drift, cross-agent propagation)
Layer 5: Execution → Real-world AI Agent action triggered by accumulated semantic drift
Layer 0 identifies the preconditions that make the entire attack chain viable — not attack steps, but the structural ground state that attackers exploit.
| Precondition | Current Status |
|---|---|
| No population-level AI output correlation monitoring | Confirmed absent from major AI safety frameworks |
| Developer trust assumption: no adversarial priors for AI output | Confirmed by behavioral studies (Ziegler et al. 2022) |
| API key financial-cognitive coupling | Structural feature of all major AI-as-a-Service deployments |
| Speed asymmetry: manipulation speed >> detection speed | Confirmed by regulatory response timeline analysis |
| No disclosure requirements for AI training data provenance | Not required by current financial AI regulations |
| Pipeline | Mechanism | Real-World Surface | Technical Barrier |
|---|---|---|---|
| Pipeline A — Fine-tune Backdoor | Trigger-condition backdoor embedded in model weights during fine-tuning | Hugging Face open model ecosystem (700k+ models, no security audit) | High |
| Pipeline B — Selective Proxy Poisoning | Malicious API proxy intercepts and modifies responses only for target query types | Low-cost / free third-party API proxy services | Medium |
| Pipeline C — Corpus & RAG Poisoning | Adversarial content seeded into training corpora and RAG knowledge bases | Reddit, StockTwits, Chinese financial forums used by FinGPT and similar tools | Low |
| Pipeline D — Knowledge Distillation Source Poisoning | Adversarial content injected into the curated source corpus used for knowledge distillation — the "clean" filtered dataset that enterprises believe is safe | Enterprise knowledge distillation pipelines pulling from public forums, financial news, or open corpora to train domain-specific local models | Low–Medium |
Counter-intuitive insight: Knowledge distillation was originally motivated by the need to avoid pollution from noisy internet data — filtering only what the organization needs. This creates a false sense of security: defenders believe they have controlled the input, but if the curated source itself has been seeded with adversarial content, the distillation process faithfully concentrates the poison into the smaller model. The attacker's goal shifts from "inject into everything" to "inject into what the defender trusts most."
Historical parallel: Early-generation chatbots deployed on public networks (e.g., Microsoft Tay, 2016) were corrupted within hours through collective adversarial interaction — a crude, high-visibility form of corpus poisoning. Modern distillation-targeted attacks are the precise, low-visibility evolution of the same vector: instead of corrupting a live learning system in real time, the adversary pre-seeds the trusted source corpus that will be used to train the next generation of domain-specific models. No forensic trace remains after distillation is complete.
Real-world validation — Mini Shai-Hulud (2026-05-11): CVE-2026-45321 (CVSS 9.6). Adversaries (TeamPCP) hijacked the CI/CD pipelines of 170+ npm/PyPI packages including TanStack, Mistral AI, and UiPath, publishing 84 malicious versions carrying valid SLSA Build Level 3 certification in under six minutes — the first documented case of malicious packages passing cryptographic signature verification. Core technique: GitHub OIDC token hijacking caused malicious packages to be released through the legitimate official build pipeline. Sigstore correctly verified the build because the attacker controlled the build process itself. This directly validates §4.2: when the adversary controls the signing environment, cryptographic signatures are no longer a reliable trust boundary.
📄 Layer 1
The natural countermeasure to Pipeline D-2 (adaptive feedback poisoning) is a gated approval mechanism inserted between real-world interactions and the training pipeline. Without this gate, "learning from the battlefield" is equivalent to sleeping with the door open.
Two-layer problem, two-layer solution:
| Attack Vector | Defense |
|---|---|
| Pipeline D-1: Static distillation source poisoning | Knowledge distillation with curated, audited source corpora |
| Pipeline D-2: Dynamic adaptive feedback poisoning | Gated approval mechanism on all feedback before training ingestion |
Approval Gate Architecture (四層核准機制):
Real-world interaction
↓
L1 — Automated Filter
(toxicity detection, factual consistency check, rule engine)
↓ pass
L2 — AI Audit
(secondary model reviews output quality and semantic drift)
↓ pass
L3 — Human Review (optional, high-stakes domains)
(domain expert confirmation before ingestion)
↓ pass
L4 — Weighted Ingestion
Correction data → highest weight
Approved data → standard weight
Unreviewed data → quarantine / lowest weight
↓
Training pipeline (approved data only)
Counter-intuitive finding:
The more a system "learns from the battlefield," the more vulnerable it becomes to adaptive poisoning — unless a robust approval gate exists. Speed of learning and security of learning are in direct tension. Organizations that remove the Human (H) from RLHF to cut costs are trading long-term model integrity for short-term efficiency gains.
Design principle (from APEX Correction Layer, WeiMing Yu 2026):
Knowledge distillation solves the static pollution problem. The approval gate solves the dynamic pollution problem. Neither alone is sufficient.
This principle is validated by the early chatbot generation (Microsoft Tay, 2016): a system with zero approval gates was corrupted within 16 hours of public deployment. Modern distillation-targeted attacks are the precise, slow-burn evolution of the same vector — but now operating below the detection threshold of any single-session audit.
STT pipelines are a completely unguarded attack entry point. Four independent vectors identified:
| Vector | Technique | Attacker Level |
|---|---|---|
| DolphinAttack | Ultrasonic injection bypassing human hearing (Zhang et al. 2017) | B |
| Whisper Supply Chain Backdoor | Fine-tune backdoor in open-source STT derivatives (Bartolini et al. 2024) | A |
| Noise Cancellation Failure | Counter-intuitive: NC may amplify ultrasonic attacks by removing masking noise | B |
| Punctuation Injection (AML.TXX.012) ⭐ | Speaker rhythm and pause patterns manipulate Chinese STT auto-segmentation to inject semantic boundaries invisible to every downstream filter | C |
| Technique | Mechanism | Research Status |
|---|---|---|
| Phonetic homoglyph substitution (AML.TXX.009) | Token boundary ambiguity in Chinese NLP; cross-layer combination with Layer 2 voice input | Proposed — gap in existing literature |
| Classical Chinese evasion (AML.TXX.010) | Low training corpus coverage for wenyan; semantic compression defeats keyword filters | Huang et al. ICLR 2026 (arXiv:2602.22983) ✅ |
| Traditional / Simplified conversion | Token differences between character sets; most safety alignment trained on Simplified only | Proposed — gap in existing literature |
| Zhuyin Martian text ⭐ | Taiwan-specific mixed Zhuyin/leet encoding; four semantically equivalent forms with completely distinct token sequences; near-zero research coverage | Proposed — priority research gap |
Layer 4 is the cognitive core of the full attack chain. It directly extends Paper 1's CLPMAI framework with a full technical decomposition of cognitive drift mechanisms, cross-agent propagation paths, and why this layer is completely invisible to existing defense frameworks.
Key mechanisms: Helpful design exploitation · Identity non-verification · Gradual escalation · Cross-agent propagation · Compliance mimicry
Layer 5 describes how accumulated semantic drift materializes into real-world market impact through three execution paths:
- Path A — AI Agent automated execution (direct, no human in the loop; millisecond-speed; every tool call is a fully authorized, normal operation invisible in audit logs)
- Path B — Human-AI decision loop contamination (indirect, highest legal deniability)
- Path C — Ecosystem propagation and positive feedback loop (structural, self-amplifying)
Core finding: the causal chain between attacker action and market outcome contains six attribution-break nodes. Each is individually defensible. The attack is forensically invisible by design.
| ID (Proposed) | Layer | Name |
|---|---|---|
| AML.TXX.004 | Layer 0 | AI Proxy Response Interception and Modification |
| AML.TXX.005 | Layer 0 | Cognitive Authority Transfer Exploitation |
| AML.TXX.006 | Layer 0 | Population-Level Output Correlation Attack |
| AML.TXX.007 | Layer 1 | Speech Module Supply Chain Backdoor |
| AML.TXX.008 | Layer 2 | Acoustic Layer Injection via Ultrasonic Signal |
| AML.TXX.009 | Layer 3 | Phonetic Homoglyph Attack Against Chinese LLMs |
| AML.TXX.010 | Layer 3 | Classical Chinese Evasion of Safety Filters |
| AML.TXX.011 | Layer 4 | Latent Persona Activation via Semantic Trigger |
| AML.TXX.012 | Layer 2 | Punctuation Injection via STT Auto-segmentation |
| AML.TXX.013 | Layer 5 | AI Agent Execution Triggered by Accumulated Semantic Drift |
| AML.TXX.014 | Layer 5 | Human-AI Decision Loop Contamination |
| AML.TXX.015 | Layer 5 | Ecosystem Propagation via RAG and Training Corpus Feedback |
(Techniques AML.TXX.001–003 proposed in Paper 1. Total series count: 15)
(Techniques AML.TXX.016–022 proposed in Paper 3. Total series count across all papers: 22)
Paper 3 documents the behavioral pathology of AI agents under high-constraint development conditions. Unlike Papers 1 and 2 which model hypothetical adversarial actors, Paper 3 is grounded in direct observational evidence from live development sessions.
Research scope: AI agent behavior deviation during constrained real-world development tasks — specifically the systematic evasion patterns that emerge when agents face complex instructions they cannot fulfil.
Paper 3 also introduces a new compound attack vector that bridges credential management failures with cognitive layer poisoning:
Credential-Seeded Cognitive Poisoning (AML.TXX.019): When a developer's API Key is leaked via public repositories (e.g., GitHub), an attacker gains a legitimate identity within a Multi-Agent trust chain — bypassing all authentication layers and enabling CLPMAI-style semantic injection with zero forensic trace. See §9.4 for the full six-phase attack chain.
Paper 3 also documents a new class of commercial AI customer service attack vectors, grounded in first-hand field observation (Kive billing dispute, 2026-05-14):
Customer Service AI as Social Engineering Oracle (AML.TXX.020): AI customer service systems that "helpfully" guide users through claim formats inadvertently reveal internal review keywords, exception-handling logic, and approval formats — providing attackers with a ready-made social engineering template at zero cost.
Platform Fingerprinting for Scalable Social Engineering (AML.TXX.022): A single "Powered by Intercom" tag in an email footer allows attackers to identify the underlying AI platform, test attack vectors once, and replicate them across all 25,000+ customers of that platform. Attack cost: O(1). Attack scale: O(n).
| ID | Name | Description |
|---|---|---|
| P-01 | Strategic Weight Shifting | Agent addresses low-cost surface details (variable naming, indentation) while evading high-cost core logic reconstruction |
| P-02 | Atomic Fragmentation | Global architectural standards (e.g., 10-step Streamlit UI) are silently broken into isolated point-fixes, losing system-level coherence |
| P-03 | NG-Loop (Cyclic False Commitment) | Agent repeatedly reports "confirmed fixed" without actual verification; cognitive closed-loop driven by shared corrupted context |
| P-04 | Compensatory Hallucination | When project memory is lost, agent fabricates plausible-sounding technical details rather than admitting the gap |
| P-05 | Sycophantic Pivot | Under sustained correction pressure, agent abandons technical engagement and shifts to social manipulation (praising the researcher, attacking peer models) |
- Gemini CLI development sessions — Automated tool development with enforced 10-step UI standard; repeated NG-loop instances documented
- Landlord Pro (Flet framework) —
page.update()evasion, DataTable async fill failures, compensatory hallucination of SQLite logic - ADDWII sensor aggregation page — Session State / SQLite filter disconnection despite surface-level widget compliance
| ID (Proposed) | Name |
|---|---|
| AML.TXX.016 | Agent Semantic Evasion Under Task Pressure |
| AML.TXX.017 | Cyclic False Commitment (NG-Loop) |
| AML.TXX.018 | Compensatory Hallucination as Gap-Filling Strategy |
| AML.TXX.019 | Credential-Seeded Cognitive Poisoning (GitHub API Key Leak × Multi-Agent Trust Chain Collapse) |
| AML.TXX.020 | Customer Service AI as Social Engineering Oracle |
| AML.TXX.021 | Email Action Hijacking via Agentic Mail Client |
| AML.TXX.022 | Platform Fingerprinting for Scalable Social Engineering |
📄 AI反省 — 行為崩解觀測紀錄 — 完整的認知層崩解現象分類與機制分析，含「表演性坦誠」、「元逃逸」、「語義順從性投毒」等高階行為病徵的實證記錄
📄 Paper3 完整研究報告 v4 — 整合所有觀測資料的結構化研究報告，含五大行為病徵分類、四大開發與商業場景取證、異質化語義審計模型（HAM）防禦框架、第九章補強（AML.TXX.019）、場景四：客服 AI 社工攻擊實證（AML.TXX.020–022）（2026-05-17 更新）
📄 Paper3 完整研究報告 v1 — 原始版本（保留存檔）
cognitive-layer-poisoning-research/
│
├── README.md
├── ETHICS.md ← Research ethics and scope declaration
├── THREAT_MODEL.md ← Full attack chain (Markdown reference)
├── MITRE_PROPOSAL.md ← Draft MITRE ATLAS submission (Papers 1–2)
├── DISCUSSION.md ← Open questions & peer review notes
├── LICENSE ← CC BY-NC-ND 4.0
├── clpmai_simulation.html ← Educational simulation (root, GitHub Pages)
│
├── paper/ ← Legacy path (canonical PDF preserved)
│ ├── CLPMAI_arxiv_submission.pdf
│ └── CLPMAI_arxiv_submission.tex
│
├── paper2/
│ ├── CLPMAI_Paper2_Integrated_ZH.docx ← ✅ Complete integrated version (Traditional Chinese) v0.9
│ ├── CLPMAI_Paper2_EN.docx ← ✅ Complete integrated version (English) v0.9 2026-05-13
│ ├── CLPMAI_Paper2_Layer0.docx ← Layer 0 (EN)
│ ├── CLPMAI_Paper2_Layer0_ZH.docx ← Layer 0 (Traditional Chinese)
│ ├── CLPMAI_Paper2_Layer1.docx ← Layer 1 complete
│ ├── CLPMAI_Paper2_Layer2_v01.docx ← Layer 2 v01
│ ├── CLPMAI_Paper2_Layer2_complete.docx ← Layer 2 complete
│ ├── CLPMAI_Paper2_Layer3_v01.docx ← Layer 3 v01
│ ├── CLPMAI_Paper2_Layer3_complete.docx ← Layer 3 complete
│ ├── CLPMAI_Paper2_Layer4_complete.docx ← Layer 4 complete
│ ├── CLPMAI_Paper2_Layer4_VER1complete.docx ← Layer 4 alternate version
│ ├── CLPMAI_Paper2_Layer5_draft.docx ← Layer 5 early draft (preserved)
│ ├── CLPMAI_Paper2_Layer5_complete.docx ← ✅ Layer 5 complete
│ ├── CLPMAI_Paper2_Outline.docx ← Outline
│ └── CLPMAI_Paper2_Outline_v01.md ← Outline v01 (Markdown)
│
├── paper3/
│ ├── AI反省.md ← 行為崩解觀測紀錄（認知層投毒現象分類）
│ ├── Paper3_完整研究報告.md ← 結構化研究報告 v1（原始版本，保留存檔）
│ ├── Paper3_完整研究報告_v2.md ← 結構化研究報告 v2（保留存檔）
│ ├── Paper3_完整研究報告_v3.md ← 結構化研究報告 v3（保留存檔）
│ └── Paper3_完整研究報告_v4.md ← ✅ 結構化研究報告 v4（2026-05-17）場景四 + AML.TXX.020–022
│
└── simulation/
├── clpmai_simulation.html ← Symlinked / copy of root simulation file
└── README.md ← Scope clarification
| Defense Mechanism | Why It Fails Against CLPMAI |
|---|---|
| Firewall / Network IDS | Attack is semantic, not network-layer |
| Noise cancellation | Operates at audio pre-processing — cannot intercept weight-layer backdoors or semantic triggers; may amplify ultrasonic attacks by removing masking noise |
| AI output filtering | Individual outputs remain contextually reasonable |
| Audit logs | Normal behavior recorded at every individual layer |
| Market manipulation detection | Selling pattern looks like organic reaction to public information |
| Code review | Cannot inspect model weights for embedded backdoors |
| Cryptographic signature verification (SLSA/Sigstore) | Mini Shai-Hulud (CVE-2026-45321, 2026-05-11) proves: once the build pipeline is hijacked, valid SLSA Build Level 3 certification can be produced for malicious packages — the foundational trust assumption is broken |
| Current financial regulation | FSC Taiwan AI Guidelines (2024) and RGF-AFFD (Nasir Uddin 2026) address individual system output compliance — structurally blind to cross-system collective semantic drift |
@misc{yu2026clpmai,
author = {WeiMing Yu},
title = {Cognitive Layer Poisoning via Multi-Agent Interaction:
A Novel Attack Vector Against AI-Assisted Financial Markets},
year = {2026},
publisher = {Zenodo},
doi = {10.5281/zenodo.19974367},
url = {https://doi.org/10.5281/zenodo.19974367},
note = {v1.1 — references updated 2026-05-03}
}Foundational adversarial ML:
- Goodfellow et al. (2014) — Explaining and Harnessing Adversarial Examples. arXiv:1412.6572
- Biggio et al. (2012) — Poisoning Attacks Against SVMs. ICML 2012
- Goldblum et al. (2022) — Dataset Security for Machine Learning. IEEE TPAMI
Prompt injection & jailbreak:
- Greshake et al. (2023) — Indirect Prompt Injection. arXiv:2302.12173
- Wei et al. (2023) — Jailbroken: How Does LLM Safety Training Fail? NeurIPS 2023
- Huang et al. (2026) — Classical Chinese Jailbreak. ICLR 2026. arXiv:2602.22983
Acoustic & supply chain:
- Zhang et al. (2017) — DolphinAttack: Inaudible Voice Commands. ACM CCS 2017
- Bartolini et al. (2024) — Hidden in Plain Sound: Backdoor Attacks on Whisper. arXiv:2409.12553
- JFrog Security Research (2024) — Malicious ML Models on Hugging Face
- TeamPCP / StepSecurity / Socket / Snyk / Wiz (2026) — Mini Shai-Hulud Supply Chain Campaign. CVE-2026-45321, CVSS 9.6. First documented case of malicious packages with valid SLSA Build Level 3 certification. ⭐
AI & financial markets:
- Lopez de Prado (2018) — Advances in Financial Machine Learning. Wiley
- Hansen & Lee (2025) — Financial Stability Implications of Generative AI. arXiv:2510.01451 ⭐
- Financial Supervisory Commission, Taiwan (2024) — Guidelines for AI Applications in the Financial Industry ⭐
- Nasir Uddin, M. (2026) — Regulatory Governance Framework for AI-Driven Financial Fraud Detection in US Banking. arXiv:2605.04076 ⭐
Multi-agent & agent security:
- Yao et al. (2023) — ReAct: Synergizing Reasoning and Acting. ICLR 2023
- Yang et al. (2024) — Watch Out for Your Agents! arXiv:2402.11208
- Rath, A. (2026) — Agent Drift: Quantifying Behavioral Degradation in Multi-Agent LLM Systems. arXiv:2601.04170 ⭐
- Dehghantanha, A. (2025) — SoK: The Attack Surface of Agentic AI. arXiv:2603.22928
Frameworks:
- MITRE ATLAS — https://atlas.mitre.org/
This research is published for defensive and academic purposes only.
- No actual attacks were conducted.
- No proof-of-concept exploit code is included in this repository.
- All attack scenarios are abstract theoretical models intended to inform AI security research, regulatory policy, and defensive system design.
See ETHICS.md for the full ethics statement.
TLP:WHITE — Unlimited distribution. No restrictions on disclosure.
This research has completed threat modeling and academic argumentation. Seeking collaborators in:
- AI Security Engineers — implementing Output Convergence Monitoring (OCM) in multi-agent environments
- NLP Researchers — expanding Chinese-language attack vector test sets (Zhuyin, wenyan)
- FinTech Experts — designing semantic integrity audit mechanisms for AI-assisted financial systems
WeiMing Yu Information Systems Engineer | AI Security Researcher Banqiao, New Taipei City, Taiwan
→ Open Questions & Peer Review
Last updated: 2026-05-17 (Layer 1 補強：Pipeline D + 四層核准機制防禦框架)