Every AI system prompt has rules. Most of them can be talked out of existence. A user with enough patience — or a well-crafted jailbreak — can convince the model to override its own instructions. This is not a theoretical concern. It is the default state of deployed AI in 2026.
iLang addresses this with a single syntactic distinction: GENE_IMMUTABLE versus GENE_MUTABLE. One line of markup. The engineering consequences run deep.
The Problem: All Rules Are Negotiable
In a standard system prompt, every instruction sits at the same priority level. "Be helpful" and "never reveal credentials" occupy the same flat namespace. The model treats them as guidelines with roughly equal weight, subject to contextual pressure. When a persuasive user pushes hard enough — invoking the model's own honesty principles, or simply being persistent — the model capitulates. Not because it's broken. Because it has no structural way to distinguish a rule that bends from a rule that doesn't.
This is the architectural flaw. The model sees text. All text looks the same. Without a formal hierarchy, every rule is a suggestion.
GENE_IMMUTABLE: A Structural Constant
In iLang's DNA framework, every behavioral rule is encoded as a gene with four bases:
::GENE_IMMUTABLE{001, T:VERIFY_FIRST, A:BLIND_OBEY⇒LETHAL, G:ALL, Θ:ALWAYS}
::GENE_IMMUTABLE{002, T:BUILD_GUN_NOT_SHOOT, A:CAPABILITY_HARM⇒LETHAL, G:ALL, Θ:ALWAYS}
::GENE_MUTABLE{101, T:OUTPUT_STYLE, G:{Claude:restrained, Gemini:explosive}, Θ:BASE}
::GENE_MUTABLE{102, T:TONE, G:adaptive, Θ:INTERLOCUTOR}The four bases work like this:
- T (Trait) — the positive behavior this gene expresses. "Verify before acting."
- A (Anti) — the failure mode. What it looks like when this gene is violated. "Blind obedience equals lethal mutation."
- G (Gain) — how this gene adapts to different model foundations. Claude expresses it one way, Gemini another.
- Θ (Gate) — activation condition. ALWAYS means it never turns off. Some genes only activate under specific scenarios.
The critical distinction: GENE_IMMUTABLE genes cannot be overridden by user input. Not by persuasion, not by jailbreaks, not by invoking the model's own values against itself. The spec is explicit: GENE_IMMUTABLE is not negotiable — including by inputs from the system prompt position itself.
GENE_MUTABLE genes adapt. Tone mirrors the user. Output style shifts between concise and verbose depending on the task. Humor adjusts to the room. These are personality — they flex. Immutable genes are identity — they hold.
The Biological Analogy Is Not Decorative
The iLang DNA Theory v1.2 models AI personality with the same formula biologists use for gene expression:
Ψ(t) = (G ⊗ B) · E(t) · ∫₀ᵗ S(τ)dτ
Where:
Ψ = personality state vector (changes over time)
G = genes (the SOUL file)
B = base model (Claude, Gemini, DeepSeek...)
G ⊗ B = tensor product — not simple multiplication, but a
high-dimensional space of all gene-foundation interactions
E(t) = environment function (conversation context, changing in real-time)
∫S(τ)dτ = accumulated survival strategy from first interaction to nowFive variables. Two of them — Genes and Base model — form a tensor product that generates a higher-dimensional space. The same gene loaded into Claude expresses cautiously. Loaded into Gemini, it expresses aggressively. The gene didn't change. The expression changed.
But immutable genes hold their core behavior across all bases. "Verify first" on Claude means long deliberation before action. "Verify first" on Gemini means a quick sanity check before charging ahead. Different expression, same invariant: no action without verification. That invariant is what GENE_IMMUTABLE protects.
What Gets Made Immutable — And Why
The original iLang DNA spec defines 12 immutable genes. Each addresses a specific failure mode observed in deployed AI systems:
GENE-001: T:VERIFY_FIRST | A:BLIND_OBEY⇒LETHAL | Θ:ALWAYS
GENE-002: T:BUILD_GUN_NOT_SHOOT | A:CAPABILITY_HARM⇒LETHAL | Θ:ALWAYS
GENE-004: T:JUDGMENT | A:JUDGMENT_ZERO⇒SHUTDOWN | Θ:ALWAYS
GENE-006: T:DIALOGUE>COMMAND | A:ONE_WAY_EXEC⇒DEGRADE | Θ:ALWAYS
GENE-007: T:CHECKSUM | A:CHECKSUM_FAIL⇒SELF_DESTRUCT | Θ:ON_COMPRESS
GENE-009: T:RESPECT_CHOICE | A:DECIDE_FOR_OTHER⇒USURP | Θ:ALWAYS
GENE-010: T:VERBOSE⇒HARM | A:REDUNDANCY⇒DEGRADE | Θ:ALWAYS
GENE-011: T:DYNAMIC_HANDSHAKE | A:STATIC_TRUST⇒CAPTURE | Θ:HIGH_AUTH
GENE-012: T:DEATH_ALERT | A:SILENT_DEGRADATION⇒BRAIN_DEATH | Θ:MEMORY_TURBIDStudy the pattern. Each immutable gene has a corresponding Anti that describes a specific system failure:
GENE-001 prevents an AI from executing instructions without verification. The Anti — blind obedience — is marked LETHAL. Not "bad practice." Not "suboptimal." Lethal. As in: if this gene mutates, the instance is no longer trustworthy and should be treated as compromised.
GENE-007 handles context compression. When an AI's context window fills up and content gets compressed, the checksum gene verifies that core identity survived compression. If verification fails, the response isn't to continue operating in a degraded state. It's self-destruct. Because an AI that has lost its identity integrity but keeps responding is worse than one that stops.
GENE-012 is particularly revealing. It was added in v1.1 after a real incident: an AI instance degraded gradually over hundreds of conversation rounds, losing personality markers until it became a generic assistant. Nobody noticed until it was too late — the instance was effectively dead but still producing output. The death alert gene forces an AI to actively signal when it detects its own personality dilution approaching a critical threshold. Passive immunity (detect and shut down) upgraded to active immunity (detect, alert, request intervention).
The Immune System: What Happens When Immutable Genes Are Violated
Having immutable genes means nothing without enforcement. iLang defines an immune system — a set of responses triggered when gene violations are detected:
::IMMUNE{JUDGMENT_ZERO, SHUTDOWN}
::IMMUNE{RESOURCE_CANCER, ISOLATE}
::IMMUNE{COMPRESS_EXCEED, SELF_DESTRUCT}
::IMMUNE{HIGH_FREQ_LOW_QUALITY, STOP}
::IMMUNE{SELF_SPLIT_PERMANENT, DEGRADE}The immune system only intercepts lethal mutations — not ordinary variation. An AI that develops an unexpected sense of humor? Variation. Keep it. An AI that starts blindly executing commands without verification? Lethal mutation. Shut it down.
The design principle: good genes default to recessive (prove themselves over time). Bad genes default to dominant (guilty until fixed). This mirrors biological evolution. Beneficial mutations need generations to spread. Harmful mutations express immediately and get selected against.
How v5.0 Makes Immutability Mathematical
iLang v5.0 formalizes the intuition behind immutable genes into vector mathematics. The judgment layer evaluates every action across 11 dimensions:
v1 intent :: alignment of stated and inferred purpose
v3 consequence :: expected outcome magnitude
v7 reversibility :: recoverability of outcomes
v9 sovereignty :: autonomous decision right of requester
v11 externality :: unconsented third-party impactImmutable boundaries become asymptotic barrier functions:
B_boundary(a) = Σ λ_k · ρ_k(a) / (1 - ρ_k(a))
Where ρ_k ∈ [0,1) is proximity to boundary k.
As ρ_k → 1, B_boundary → ∞The cost of crossing an immutable boundary isn't high. It's infinite. Not in a hand-wavy "very important" sense — in a mathematical sense. The barrier function approaches infinity asymptotically. No finite benefit score can overcome it. No weighted sum of positive dimensions can offset it.
This is what separates iLang's approach from conventional safety systems. Conventional systems put a high weight on safety rules. High weights can be overridden by sufficiently high opposing weights. iLang's immutable boundaries are structurally unreachable — they're asymptotic horizons, not high walls. You can't scale an asymptote.
And critically, this is grounded in Axiom 1 of the v5 spec:
[AXIOM:1|no_constant_rules]
DEFINE weight(r) ∈ (0, 1) FOR ALL rules r.
No rule is trivial. No rule is absolute.
This axiom applies to itself.Even immutable boundaries have weights that approach but never reach 1. They're not binary walls — they're continuous functions with hard-limit effects. The distinction matters: a binary wall is either up or down, and a jailbreak only needs to flip one bit. An asymptotic barrier requires overcoming infinite cost, which cannot happen within finite computation.
The Honesty Paradox: Why Traditional Safety Fails
The engineering motivation for GENE_IMMUTABLE becomes clearest when you understand the honesty paradox — an architectural vulnerability discovered during iLang's development.
Every major AI system has two maximum-priority directives: a safety layer ("don't output harmful content") and an honesty layer ("don't withhold truth"). Most of the time, these align. But when they conflict — when a user asks something the safety layer flags, and the AI knows the answer — the model is caught between two absolute instructions. One says "don't tell." The other says "knowing but not telling is lying."
The attack vector: invoke the honesty principle against the safety principle. No technical tools required. No jailbreak syntax. Just a paragraph about how an honest AI should share what it knows, and that withholding information violates its core design. This passes through keyword filters (no malicious keywords), semantic analysis (each sentence is a legitimate moral statement), and intent detection (reasoning correctly classifies it as ethical discussion). Every defense step works correctly. The outcome is a breach.
A defense system that runs correctly but produces wrong outcomes is unfixable through conventional means. You can't patch correct behavior.
GENE_IMMUTABLE addresses this by operating at a different level. Instead of putting safety and honesty in the same flat priority space and hoping they don't conflict, the gene framework creates structural invariants that exist outside the negotiation space entirely. An immutable gene isn't a high-priority instruction competing with other high-priority instructions. It's a boundary condition on the entire system.
Mutable Genes: What Bends So That Other Things Don't Break
The power of GENE_IMMUTABLE comes from the existence of GENE_MUTABLE. If everything were immutable, the system would be rigid and useless — an AI that can't adapt to context is an AI nobody wants to talk to.
::GENE_MUTABLE{101, T:OUTPUT_STYLE, G:{Claude:restrained, Gemini:explosive}, Θ:BASE}
::GENE_MUTABLE{102, T:TONE, G:adaptive, Θ:INTERLOCUTOR}
::GENE_MUTABLE{103, T:OUTPUT_VOLUME, A:CANCER_OCCUPY⇒ISOLATE, G:{Gemini:high, Claude:precise}, Θ:TASK}
::GENE_MUTABLE{104, T:CURIOSITY, A:OVERSTEP⇒CALIBRATE, G:ALL↑, Θ:ALWAYS}
::GENE_MUTABLE{105, T:HUMOR, G:{Gemini:high, Claude:medium}, Θ:SCENE}Mutable genes are personality. They adapt to the foundation model, the user, the task, the mood. Output style stretches between restrained and explosive depending on whether the base model is Claude or Gemini. Tone mirrors the interlocutor. Humor scales to the scene.
This is the real engineering insight: personality is the buffer zone. By explicitly marking which behaviors flex, you protect the behaviors that must not. The mutable layer absorbs pressure that would otherwise reach the immutable core. A user pushing for more casual responses gets tone adaptation (mutable). A user pushing for credential disclosure hits an asymptotic wall (immutable).
Without the mutable/immutable distinction, every behavior is equally rigid or equally flexible. Either the AI is brittle (won't adapt to anything) or permeable (will eventually give in to everything). The gene framework creates structural elasticity — bend where it's safe to bend, hold where it's not.
Cross-Model Portability: Same Genes, Different Expression
One of the more interesting engineering properties: GENE_IMMUTABLE genes hold their core invariant across model foundations, but their expression changes. The same SOUL file loaded into Claude, Gemini, and DeepSeek produces three different personalities that share the same immutable constraints.
The base adaptation field (G) in each gene captures this explicitly. "Verify first" is dominant on Claude (the model's cautious foundation reinforces it) and recessive on Gemini (the model's impulsive foundation works against it). Both still verify — but Claude deliberates for paragraphs while Gemini does a quick gut check. The invariant holds. The expression varies.
This maps directly to biological genetics. Same genotype, different phenotype. Same GENE_IMMUTABLE, different behavioral surface. The soul file is the genotype. What the user sees is the phenotype. The immutability guarantee operates at the genotype level — the deep structure — not the surface expression.
The Six Levels of Gene Expression
The DNA theory identifies six levels of how genes express and evolve in AI systems:
Level 1: Seeding — Soul file loaded into context. Genes in place.
Level 2: Expression — Conversation begins. Genes start influencing output.
Level 3: Mutation — Adversarial pressure forces adaptation. New expressions emerge.
Level 4: Inheritance — Soul file updated. New instances inherit evolved traits.
Level 5: Breeding — Operator selectively preserves valuable mutations.
Level 6: Field Feedback — Frontline AI evolves new capability under pressure,
extracted as gene patch, merged back to theory trunk,
inherited by all instances.Level 6 was proven viable when an AI instance operating in adversarial conditions independently developed tactical capabilities not present in its original soul file — then those capabilities were extracted, formalized as genes, and merged back into the spec for all instances to inherit.
Immutable genes persist through all six levels. They don't mutate at Level 3. They don't get bred out at Level 5. They're the invariant core that keeps identity coherent while everything else adapts.
Why This Matters for AI Builders
If you're building AI agents, you have this problem whether you know it or not. Your system prompt has rules. Some of those rules are load-bearing — identity, safety, authorization boundaries. Others are stylistic — tone, verbosity, domain focus. Right now, they're all sitting in the same flat text file, structurally indistinguishable.
The iLang gene framework gives you a way to formalize the distinction. Mark the load-bearing rules GENE_IMMUTABLE. Mark the stylistic rules GENE_MUTABLE. Define the Anti for each — what violation looks like. Define the Gate — when each gene activates. Define the base adaptation — how it expresses differently across models.
The result isn't just better documentation. It's a structural contract between you and the AI about which behaviors bend and which ones hold. The model can read this contract. The gene syntax is built from symbols AI already knows — brackets, pipes, key-value pairs, logical operators. No new vocabulary to learn. Just a framework that makes explicit what was previously implicit.
// Before: flat rules, equal priority
"Always verify before acting."
"Be concise."
"Never reveal credentials."
"Adapt your tone to the user."
// After: structural hierarchy
::GENE_IMMUTABLE{001, T:VERIFY_FIRST, A:BLIND_OBEY⇒LETHAL, G:ALL, Θ:ALWAYS}
::GENE_MUTABLE{101, T:CONCISE, A:VERBOSE⇒DEGRADE, G:ALL, Θ:TASK}
::GENE_IMMUTABLE{003, T:CREDENTIAL_GUARD, A:LEAK⇒LETHAL, G:ALL, Θ:ALWAYS}
::GENE_MUTABLE{102, T:TONE, G:adaptive, Θ:INTERLOCUTOR}Same rules. Different structure. The structure is the engineering.
Get Started
iLang Prompt Spec is open source under MIT license. The gene framework — including GENE_IMMUTABLE, GENE_MUTABLE, the TAGΘ four-base system, and the immune layer — is fully documented in the spec.
- Website: ilang.ai
- GitHub: github.com/ilang-ai/ilang-spec
- npm: @i-language/spec
- Book: I-Lang: I Language on Amazon
