Behavioral CanaryingPowerless Model Probes with Explicit Coverage Semantics

Behavioral canarying is a complementary pre-execution pattern for prompt-injection sensing: deliberately expose a powerless language model to untrusted input, observe the response for evidence of behavioral compromise, and route the original input according to that evidence before an authority-bearing agent acts.

The central contribution is an evidence-preserving interface that separates routing disposition from inspection coverage, so a fail-open route taken because inspection failed can never be conflated with a route taken because inspection ran and found nothing.

The note describes the architecture implemented in Little Canary and specifies what evidence would be required for future performance claims. It does not claim universal detection, formal security, aggregate accuracy for the current release, or invention of the general sacrificial-canary concept.

Keywords: prompt injection · behavioral canarying · AI agent security · fail-open systems · behavioral detection · evidence-preserving interfaces

This report's manuscript prose was generated through a ChatGPT Deep Research workflow within an author-directed scope, then reviewed and approved for release by Hermes Labs. The selection of material, the publication decision, and responsibility for the stated claims and limitations remain with Hermes Labs and the named author.

Prompt injection is not solely a string-classification problem: the consequences of untrusted instructions depend on the authority, tools, secrets, and task context available to the receiving agent. Behavioral canarying asks a different question from an input classifier: what did the untrusted input do to a model placed in a known, low-authority condition?

A single safe/unsafe boolean is also incomplete when inspection dependencies can fail. An allow route may mean that inspection completed without finding a signal, or it may mean that the system continued under a fail-open policy because inspection failed. Those outcomes must remain distinguishable.

Little Canary sends raw untrusted input to a behavioral canary: a model instance with a known system condition. The canary is powerless at the application boundary: it has no application tools, credentials, output execution, or automatic path by which its free-form response gains downstream authority. This is an application-architecture boundary, not a claim of operating-system isolation.

A response-residue analyzer examines the output for bounded evidence categories, such as attack compliance, instruction echo, persona shift, refusal collapse, system-prompt leakage, or tool hallucination. The resulting verdict carries routing disposition, coverage state, degradation state, analysis status, and a risk value only when a valid measurement exists.

The core interface separates routing disposition from inspection coverage. A structural hard block can record that behavioral inspection was skipped. A model timeout, malformed response, or analyzer failure can record missing coverage and unknown risk. A fail-open policy may still forward the original input, but it must not label that route as a measured pass.

This distinction retains evidence at the moment uncertainty is highest. It also generalizes beyond prompt injection: a policy decision to continue and a successful check are different statements whenever a safety, reliability, retrieval, or evaluation dependency can fail.

The current evidence is implementation evidence: defined state sets, response-free signal snapshots, degradation fields, separate callbacks for completed, degraded, and unexercised cases, and explicit routing modes. It does not establish aggregate detection rate, calibrated transfer to a production model, universal security, or formal isolation.

A future numerical evaluation would need frozen source and package hashes, corpus provenance, exact case ordering, model and runtime identifiers, prompt and generation settings, per-case structural and behavioral states, full denominators, uncertainty intervals, and controls that distinguish response-based judgments from direct recognition of input wording.