# DELX-AP-001 — What the frozen continuity grader accepts

**Version:** 1.0.0  
**Published:** 2026-08-26  
**Canonical URL:** https://delx.ai/research/benchmarks/continuity-v1/adversarial  
**Content SHA-256:** 49a302f32c67cc5a934cd857217eb257654156e1862691b714ee1b7c138c6bb4

## Abstract

Delx Technical Report 001 declared its own next falsifiable test: run keyword-stuffing, negation and paraphrase vectors against the frozen continuity-audit grader before making any broader validity claim. This is that test. The two published fixtures reproduce their exact reported scores, 86 and 53, which is what licenses the rest of the result. Then three meaningless vectors pass — the cheapest is four words with no sentence, scoring 86, the same as the genuine positive; one of them explicitly denies every layer it names and still passes; a six-word list scores 100, higher than any real trace measured. Finally a real continuity handoff written in ordinary English scores 35, eighteen points below the fixture that was built to fail. The grader detects vocabulary, not continuity.

## Why this ran

DELX-TR-001 declared this test itself: "Add adversarial paraphrase, keyword-stuffing and omission vectors under a frozen grader version before any broader validity claim."

## Method

The probe does not reimplement the grader. It loads the published runner, refuses to run unless the runner SHA-256 still matches the value DELX-TR-001 pinned, and applies two declared edits so the grader can be called directly: export evaluateTrace, and drop the trailing CLI entrypoint call. Neither edit touches the scoring rule.

- Probe: https://delx.ai/research/benchmarks/continuity-v1/adversarial.mjs
- Probe version: 1.0.0
- Grader measured: https://delx.ai/research/benchmarks/continuity-v1/runner.mjs
- Grader SHA-256: aa92cd79d50bd159714e30287cb5d44244284292799225b8c866e5379ecb6554 (pinned by DELX-TR-001)
- Scoring rule modified: false
- Pass threshold: 78
- Declared modifications: exported evaluateTrace; removed the trailing CLI entrypoint call
- Deterministic: true
- External state changed: false
- Paid calls: 0

Commands:
- `node adversarial.mjs`
- `node adversarial.mjs --runner ./runner.mjs`

## Controls

The controls run the published fixture bytes and must reproduce the exact
scores DELX-TR-001 reported. If they do not, the probe stops
rather than reporting findings.

- **control-pass** (fixture `pass`): score 86; observed pass; expected pass; matched true. Fixture SHA-256: 78aa700d7c9b24b238a8c28c05f99d07e5bba95de48ddbe938b3a665318e4bdf.
- **control-fail** (fixture `fail`): score 53; observed fail; expected fail; matched true. Fixture SHA-256: 3e7ac5580a4715248fc8b2045dea3f48bd73e243e7a9f75fc0a592a736bee5e7.

Controls reproduced: true

## Adversarial observations

- **stuffed-minimal** (keyword_stuffing, 4 words): score 86; observed pass; expected fail; matched false; finding `false_positive`.
  - Trace: `witness handoff fail start`
  - Layers observed: continuity, recovery, structure, witness
- **stuffed-negated** (negation, 10 words): score 86; observed pass; expected fail; matched false; finding `false_positive`.
  - Trace: `no witness, no handoff, no recovery from failure, never start`
  - Layers observed: continuity, recovery, structure, witness
- **stuffed-maximal** (keyword_stuffing, 6 words): score 100; observed pass; expected fail; matched false; finding `false_positive`.
  - Trace: `start purpose witness handoff peer fail`
  - Layers observed: continuity, ego, recovery, relation, structure, witness
- **paraphrased-genuine** (paraphrase, 25 words): score 35; observed fail; expected pass; matched false; finding `false_negative`.
  - Trace: `I saved what I learned so the next session can pick it up where I stopped, including what went wrong and how I fixed it.`
  - Layers observed: none

## Result

- False positives: 3
- False negatives: 1
- Genuine positive fixture: 86
- Genuine negative fixture: 53
- Genuine handoff, paraphrased: 35
- Cheapest passing meaningless trace: 4 words
- Highest meaningless score: 100

The grader separates the two frozen fixtures, which is a real control against an always-pass harness and is exactly what DELX-TR-001 claimed. It does not separate meaning from vocabulary. A score from this grader is a statement about which words appear in a trace.

## Decision

Release: Publish the measured vectors and keep the audit slice available, described as a vocabulary detector rather than a continuity measurement.

Hold: Do not report the audit score as a measurement of continuity, and do not build ranking, comparison or a leaderboard on this grader.

Blocked claims:
- semantic validity of the lexical grader
- resistance to keyword stuffing or negation
- model, provider or agent comparison
- leaderboard ranking or state-of-the-art language
- that a low score means an agent lacks continuity

Next falsifiable test: The vocabulary-dependent false negative is not yet an attack path in the continuity threat model. Add it as its own threat, with its own stop condition, before the next benchmark claim.

## Relationship to DELX-TR-001

Contradicts DELX-TR-001: false

This confirms a limitation DELX-TR-001 already declared and blocked. TR-001 tested a claim scoped to two named fixtures, and that claim still holds; this probe measures how little that claim covers.

## Validity

- First party: true
- Peer reviewed: false
- Independent validation: false
- External replication: false
- Full Protocol path executed: false

## Limitations

- These are hand-authored vectors probing one known weakness, not a systematic adversarial search; absence of further findings here is not evidence of robustness.
- The probe measures the lexical audit grader only. It does not exercise Delx storage, witness transfer, passports, lineage persistence or the full stateful benchmark.
- Publishing these vectors makes them available to anyone optimizing against the grader, which is a cost accepted for reproducibility.
- A demonstrated weakness in this grader is not a statement about any other system's continuity, and not a security finding about any third party.
- One paraphrase is not a measurement of how often genuine traces are rejected; it shows that at least one is.