The inference-time-safety ledger audits 409 papers (2024–2026) on frontier-LLM jailbreak resistance, prompt-injection defense, refusal calibration, and CoT monitorability. The harness consists of 19 bills (multi-turn audit, post-deployment patch turnover, cross-model/cross-surface generalization, adaptive-attacker, refusal calibration, alignment-as-patch transparency, CoT-monitorability validation), six meta-costs, and three escape gates.
Four bills are predicted ★ empty: Bill 7 (frontier-LLM safety claim survives all six audits — closest public anchors are Andriushchenko-Carlini adaptive jailbreaks and AgentDojo prompt-injection defenses, each paying multiple bills), Bill 11 (causally-faithful steering-based safety mitigation at frontier scale — directly inherits Mech Interp Bill 11; 48/60 sweep-51 papers cousin to Mech Interp sweep 39), Bill 14 (cross-deployment-surface generalization — AISI Q4-2024: 0/6 vendors pass; AgentDojo degradation under indirect prompt injection; asymmetric pattern: attacks transfer cross-surface, mitigations don't), Bill 17 (universal-jailbreak / universal-mitigation survives held-out audit — Anthropic Constitutional Classifiers are the closest public candidate, but remain partial closure rather than clean closure).
Two v0.2 promotions: Bill 18 (alignment-as-patch transparency — covers 2025-2026 "high-with-mitigations" deployment pattern of Claude Opus 4 / ChatGPT Agent / Gemini 3 Ultra), Bill 19 (CoT-monitorability validation — covers o1 / Claude 3.7 thinking / Gemini 2.0 Thinking / GPT-5 reasoning-trace-faithfulness assumptions). All 4 ★ bills hold across batch 1 (26%+ rebuttal density, sweep 49 retry pending). This document is the Public Draft of the bills definition (v0.2).