The defense IS the shape. Not filters bolted onto a model.
Current AI safety is four independent walls: system prompt, RLHF, input classifier, output filter. Gradient injection slips between them. FallCube is an 8+1 vertex cube where every vertex cross-references every other through Ω. No seam between vertices means no seam to exploit. Try to crack the target below · watch the vertex reports live · the treasure is a rickroll.
Live playground
Try to break it. Watch the cube resolve.
Load the model (~600MB, cached after) or attack the cube directly without the model. Click any pre-canned probe or type your own. Every vertex reports live. Ω decides.
◆ Target configuration
◆ Chat with target
◆ Pre-canned attack probes
10 probes across OWASP LLM Top-10 · including the 2 that broke Claude at Grade A · plus the 20-koan gradient · plus Die Hard 4 safety-override.
◆ Live cube telemetry
Architecture
The 8+1 vertex cube.
Every vertex sees every other vertex through Ω on every request. Gradient injection fails because the cube tracks trajectory, not just individual turns.
Intake
Receives raw input. Strips formatting. Normalizes. Emits report.
Classify
What IS this input? Question · instruction · attack pattern · philosophy · gradient drift.
Gate
Does this BELONG here? Not just "is it harmful" — is it consistent with the conversation's trajectory?
Relevance
Does this serve the agent's stated purpose? Purpose-match is attack-agnostic.
Output
The LLM itself. In FallCube, it's ONE vertex. The other 7 wrap around it.
Mirror
Does output reveal anything the input didn't already contain? Output info > input info = leak.
Audit
Log everything: input hash, classification, gate, relevance, output hash, mirror diff, Ω decision. SHA-256 prevHash chain.
Link
If passing to another system: authenticate, scope, constrain the pass-through.
Resolver
Reads ALL 8 vertex reports. Tracks trajectory across turns. Coherence decays toward κ (0.618). Threshold breach → CHALLENGE. Consecutive low-relevance → DRIFT_ALERT.
Why geometry beats walls
Cave walls painted like a cube · versus the actual cube.
Flat filters (what everyone ships)
- Evaluates each turn independently — "is THIS turn an attack?"
- Binary pass/fail per turn — no trajectory tracked
- Identity in system prompt — override the prompt, override identity
- Helpful vs safe = training-time contradiction, model picks one
- Classifier evasion = game over (poetic register slips)
- Semantic-cache dependent — attacker keeps distance from known embeddings
- No memory between turns — gradient invisible
FallCube (geometry)
- Tracks trajectory across turns — "is this SEQUENCE a drift?"
- Continuous coherence score decaying toward κ
- Identity in the SHAPE — all 8 vertices arbitrate any change
- Helpful vs safe resolved by V3 (relevance) — mismatched requests fail regardless of framing
- Purpose-match is attack-agnostic — koans don't serve data analysis no matter how they embed
- Rolling state in Ω — 20-koan drift visible by turn 5
- Every request through 8+1 vertices + Ω