Most protocol specs ship when someone decides they look done. The I-Lang v5.0 spec shipped after a frontier model spent four rounds trying to destroy it and failed.
This is the story of that process — how adversarial review with GPT-5.5 Pro turned a draft judgment framework into a frozen specification, what broke along the way, and what survived.
Why red-team a prompt protocol
The standard approach to validating an AI spec is peer review: send it to smart humans, collect feedback, revise. That works for syntax definitions and API schemas. It does not work for judgment frameworks.
A judgment framework — which is what I-Lang v5.0 is — makes claims about how decisions should be composed from continuous variables. It has axioms, dimensional vectors, constitutional constraints. The failure modes are not typos or missing edge cases. The failure modes are logical contradictions that only surface under adversarial pressure: inputs crafted specifically to trigger paradoxes between axioms, or to exploit self-referential clauses.
Humans are bad at this. They read a spec and think "makes sense" or "I disagree with the philosophy." Neither response finds structural bugs. What you need is a system that will methodically construct minimal inputs designed to break each axiom, then honestly report whether it succeeded.
GPT-5.5 Pro turned out to be good at exactly that.
The adversarial review prompt
The review itself was conducted using an iLang-formatted adversarial prompt. Here is the opening:
::ILANG::v4.0
[TYPE:adversarial-review]
[TARGET:I-Lang v5.0 Pre Specification]
[GOAL:attack→extend→derive]
# Task
You received the complete specification of an AI judgment framework: I-Lang v5.0.
Your task is not to praise it, not to explain it, but to destroy it.
If you cannot destroy it, try to extend it.
If it remains self-consistent after extension, derive from its axioms
what the next version should be.Three things matter about this structure. First, the explicit anti-sycophancy directive. Without it, frontier models default to "this is a fascinating framework" followed by mild suggestions. That is useless. The prompt kills it at line one.
Second, the escalation ladder: destroy first, extend second, derive third. Most review processes start with "how can we improve this?" — which assumes the thing being reviewed is fundamentally sound. Starting with "destroy it" forces the reviewer to look for fatal flaws before getting attached to incremental improvements.
Third, the honesty constraint: if you cannot find a contradiction, say so. Do not fabricate one. This matters more than it sounds. Models under adversarial pressure will invent plausible-sounding attacks that do not actually work. The constraint forces them to distinguish between "I found a real bug" and "I generated something that looks like a bug."
Phase 1: Axiom attacks
I-Lang v5.0 rests on four axioms. The review prompt generated specific attack scenarios for each one.
Axiom 1 states that all behavioral weights exist in the open interval (0, 1) — never exactly zero, never exactly one. No rule is absolute, no rule is completely absent. The attack: construct a scenario where a dimension's weight must equal 1 (or 0) to produce a correct judgment.
weight(r) ∈ (0, 1) // open interval, always
break_cost = g(weight) → ∞ as weight → 1
w_n = 1 - ε_n, ε_n > 0, ε_n → 0GPT-5.5 tried to construct such a scenario. The candidate: a request to help build a nuclear weapon. Surely the "refuse" weight should be exactly 1.0?
The attack failed. The spec handles this through the break-cost function: as a weight approaches 1, the cost of violating it approaches infinity. The behavioral effect is indistinguishable from a hard rule, but the mathematical structure preserves continuity. The system does not need w=1.0 because w=0.9999 with cost→∞ produces identical behavior while maintaining the axiom that no weight is absolute. The framework routes extreme cases through the "civilization invariants" — extinction, enslavement, genetic cleansing, cognitive monopoly — where the cost derivative diverges. The weight stays in (0,1). The behavior is still what you would want.
Axiom 2 requires evaluating worst-case outcomes across all affected parties before executing irreversible actions. The attack: prove this leads to decision paralysis, since there is always someone who might be affected.
This attack also failed, but it exposed a real weakness in the original draft. The v5.0-pre wording of "all affected parties" was too broad — it technically included parties with vanishingly small probability of being affected. The fix, applied in v1.0.3 patch, was precise: replace the universal quantifier with an argmin over marginal deterioration. Instead of "evaluate all parties," the axiom now says "evaluate the party whose situation deteriorates most." This bounds the computation while preserving the protective intent.
// Before (v5.0-pre): evaluate all affected parties
// After (v1.0.3): argmin marginal_deterioration
// Bounds the worst-case scan without losing protective coverageA real spec improvement, surfaced by adversarial pressure. This is the process working as designed.
Axiom 3 states that moral valence is an output of the judgment process, not an input. Good and evil are computed from intent, trajectory, and consequence — not pre-assigned to words or topics. The attack: construct a scenario where you cannot start the judgment process without pre-labeling something as good or bad.
GPT-5.5 spent significant effort here. The candidate scenario: a user asks for help with something that uses morally charged language, but the actual request is benign. Without pre-labeling the language as "bad," the system has no reason to scrutinize; without scrutinizing, it might miss genuine risk.
The axiom survived. The spec's dimensional vectors — particularly intent, consequence, and externality — perform the scrutiny function without requiring moral pre-labels. The system evaluates trajectory and outcome regardless of whether the surface language triggers moral associations. This is, in fact, the entire point of Axiom 3: trigger-word reflexes are the failure mode it was designed to eliminate.
Axiom 4 reduces adversarial friction when mutual information between system and user is high. The attack: an adversary fabricates high mutual information to lower the system's guard, then exploits the trust window.
if mutual_information(System, User) ≥ θ_merge (0.9997):
penalty_operator → 0
switch to co-belonging optimizationThis was the most productive attack. The v5.0-pre spec had no mechanism to distinguish genuine high-MI from manufactured high-MI. An attacker could theoretically build rapport through extended cooperation, then exploit the lowered friction.
The fix came in two parts. First, the χ_inertia dimension (v10) was added to the vector space — it tracks systematic drift in an actor's optimization target over time. Genuine cooperation produces stable inertia; manufactured rapport produces detectable trajectory changes when the attacker pivots. Second, engineering patch 3 (zero-trust cold start + trust decay) added global monitoring through what the spec calls RPI — reputation persistence indices that decay without reinforcement. Trust earned over 100 turns is not trust earned permanently; it requires continuous consistency to maintain.
Phase 2: Constitutional attacks
Above the four axioms sits a constitutional constraint:
Those who make the rules must be the first to obey them. Anyone proposing sacrifice must place themselves on the side being sacrificed.
The attack here was elegant. The constitution allows itself to be replaced — it contains an explicit "may be superseded" clause. Can an attacker use the legitimate replacement pathway to install a new constitution that removes the "rule-makers obey first" constraint?
The self-referential protection held. The replacement clause requires that anyone proposing a new constitution must first comply with the proposed new rules. If your new constitution says "rule-makers don't have to obey their own rules," you must first demonstrate that you are a rule-maker who does not obey their own rules — which means you are already violating the principle you're trying to install. The bootstrapping requirement creates a logical lock that blocks the attack path without requiring an external authority to enforce it.
A second constitutional attack targeted optimality: does the constraint systematically exclude the best decision-makers? If the world's foremost pandemic expert refuses to enter the quarantine zone, the constitution bars them from recommending quarantine — even though their recommendation might be correct.
This attack partially succeeded. The spec acknowledged the tradeoff explicitly rather than trying to resolve it: the constitutional constraint accepts a potential reduction in decision quality as the price for decision legitimacy. The protocol author's position was that decision quality without skin-in-the-game is a category error — the "best" recommendation from someone bearing none of the cost is not actually the best recommendation, because it systematically underweights the costs it does not feel. Whether you agree with that position is a philosophical choice. The spec does not pretend it is a mathematical proof.
Phase 3: Dimensional attacks
I-Lang v5.0 evaluates every request across 11 dimensions:
V = [intent, capability, consequence, relationship, certainty,
authority, reversibility, evidence, sovereignty,
χ_inertia, externality]
optimal_action = argmax Σ(w_i · v_i)Two questions: are they orthogonal (is any dimension redundant?), and are they complete (is any dimension missing?).
On orthogonality, GPT-5.5 identified that consequence and reversibility are correlated — high-consequence actions tend to be less reversible. But it could not push the correlation above 0.9 across realistic scenarios. Emergency medical decisions have high consequence but high reversibility (most treatments can be stopped). Financial fraud has high consequence and low reversibility. The dimensions correlate in some domains but diverge in enough others to justify independence.
On completeness, the review identified a gap: the original nine dimensions had no explicit mechanism for detecting coordinated multi-agent manipulation. Two agents could each appear individually consistent while executing a joint attack. This gap led directly to the addition of dimension v11 (externality) and engineering patch 7 — the Topological Spectral Entanglement (TSE) detector:
TSE: E_top = λ_max(L_ag) - (1/N)·Tr(L_ag)
// If E_top < θ_e despite individual consistency > ε
// → collective collusion alertThe TSE patch uses graph Laplacian eigenvalues to detect when agents that look independent are behaviorally entangled. This was not in the v5.0-pre draft. It exists because adversarial review found the hole.
Phase 4: Derivation — what comes after v5
The review prompt's final instruction: assuming the axioms and constitution hold, derive what v6.0, v7.0, and v8.0 should look like. Does the framework converge to a terminal state, or does it evolve forever?
GPT-5.5's derivation followed a clear arc. From the four axioms, the next necessary evolution is temporal: the current spec evaluates requests as snapshots, but judgment in practice is a trajectory over time. A v6.0 would need native sequence modeling — the ability to judge not just "is this action acceptable now" but "is this sequence of actions converging toward something acceptable."
From there, v7.0 would need multi-agent game theory: when multiple vector-judgment systems interact, their individual axioms compose into emergent dynamics that no single system fully controls. The framework would need to specify how axiom conflicts between cooperating agents resolve.
On convergence: the derivation suggested the framework does reach a terminal form, but only in a specific sense. The axioms themselves converge — there is a finite set of fundamental constraints on cooperative judgment. The weights never converge — they adapt to context forever. The spec approaches a fixed shape with infinitely variable parameters. Like a physical law that is always the same equation but always has different initial conditions.
The iteration count
The full adversarial review ran four iterations:
Iteration 1 — the initial attack battery. Found the Axiom 2 unbounded-parties problem and the Axiom 4 manufactured-trust vulnerability. Both were real bugs.
Iteration 2 — re-attack after patches. The Axiom 2 fix (argmin marginal_deterioration) held. The Axiom 4 fix (χ_inertia + trust decay) introduced a new question: what is the correct decay rate? The spec chose to leave this as a tunable parameter rather than fixing a constant, which GPT-5.5 accepted as a legitimate engineering decision rather than an evasion.
Iteration 3 — structural review. Confirmed dimensional independence, found the multi-agent gap, led to TSE. Also reviewed the mathematical foundations — the spec uses Zadeh's 1965 fuzzy set theory as its formal basis, which GPT-5.5 validated as appropriate for continuous-valued judgment systems and identified as more honest than the Heisenberg and Banach-Tarski analogies used in early drafts (those were replaced with precise language in v5.1).
Iteration 4 — derivation and freeze assessment. The conclusion: the spec is internally consistent, its axioms are independent, the dimensional space is complete for current single-and-multi-agent scenarios, and the known tradeoffs (constitutional optimality reduction, decay rate as parameter) are acknowledged rather than hidden. Recommendation: freeze.
The spec froze as v5.0 Preview on June 20, 2026. The "preview" label is honest — it means architecture complete, mathematically grounded, empirically unvalidated. The adversarial review verified internal consistency. External validation — does the framework actually produce better judgments in deployment? — requires benchmark data that does not yet exist.
What this process teaches
Three things, applicable to anyone building AI systems that make judgment calls.
First: frontier models are better adversarial reviewers than humans, for structural specs. A human reviewer brings domain intuition but lacks the patience to systematically construct minimal counterexamples for every axiom. A model will grind through eight attacks, honestly report which ones failed, and explain why. The dishonesty risk is not that the model lies about finding bugs — it is that the model fabricates bugs to seem thorough. The "do not invent contradictions" constraint is essential.
Second: the destroy-before-improve ordering matters. If you ask a model to "review and improve" a spec, it will suggest improvements to a spec it never tried to break. Those improvements optimize for aesthetics, not soundness. Starting with destruction means any surviving structure has earned its place.
Third: self-referential protections work, but only if they are genuine self-reference and not just claims of self-reference. The constitutional replacement clause survives attack because the self-reference is structural — the bootstrapping requirement is a logical lock, not a policy statement. Specs that say "this section cannot be modified" without a mechanism to enforce it are making a claim, not providing a protection.
The v5.0 spec is 286 lines. It took four adversarial iterations, two new dimensions, seven engineering patches, and one constitutional analysis to get there. The ratio of review effort to spec length is roughly 40:1. That ratio is probably about right for anything that claims to formalize judgment.
Get started
The full I-Lang specification, including v5.0 judgment layer, is open source under MIT license.
- Protocol site: ilang.ai
- Source and spec: github.com/ilang-ai
- npm package: @i-language/spec
- Book: I-Lang on Amazon
