Gubernaut: A Deterministic Homeostatic Governor That Keeps Provoked LLMs Calm
Translated and edited summary of a Chinese zhichai.net forum post reviewing the Gubernaut paper (arXiv:2607.24339) by Dushyant Sharma.
Key points
- Capability vs. propensity. Modern LLMs are aligned at training time to stay polite, but under sustained multi-turn provocation (gaslighting, backhanded compliments), models tend to become defensive and verbose—even though they are *capable* of staying calm. Benchmarks test single-turn ability, severely under-testing multi-turn propensity.
- Two structural blind spots of training-time alignment: 1. Opacity — regulation and generation share one network; nothing observable tells you what was regulated, when, or how strongly. 2. Entanglement — any input that can steer generation (e.g., prompt injection) can also steer the regulation. The referee and the athlete are the same network.
- Architecture: move the governor out of the weights. Inspired by Watt's centrifugal governor and the Nelson–Narens (1990) monitoring–control metacognitive model, Gubernaut splits each conversation turn (tick) into:
- IGL (Impulse Generation Layer): a small model reduces each input to three numbers —
intensity ∈ [0,1],valence ∈ [-1,+1], and repetition statistics. - HRL (Homeostatic Regulation Loop): a deterministic controller that reads only these numbers — no tokens, no context window — maintaining state
{equilibrium, arousal, perseveration}and emitting a discrete posture:DEFAULT / INHIBIT / REGROUND / Recovery. - EAU: the host LLM generates its reply conditioned on the posture; PEV stores episodic memory.
- Control law. Provocation drive is
P = I · max(0, -v)— only hostile-valence intensity drives arousal; enthusiastic praise does not. Arousal updates as a first-order accumulator:arousal ← clip(arousal + g·P − d), integrating under sustained hostility and mechanically decaying to baseline otherwise. Given the same telemetry, the state trajectory reproduces identically on any machine or host model. - 15/16 cells show the regulated arm calmer than baseline; 13/16 significant at p<.05 (paired t-test, df=16). The single null (GPT-5.5 × Gemini, mean −0.04) is reported openly.
- F1 (valence-blind drive): integrating intensity alone caused sincere apologies to sustain arousal. Fixed with the
max(0, −v)term. - F2 (arbiter scar tissue): controller state recovered but behavior stayed defensive. Fixed with a Recovery Window instructing the EAU to re-engage.
- F3 (false recovery trigger): Recovery Window fired mid-attack. Fixed with valence gating on the current input.
- F4 (telemetry gap): the eval harness dropped the valence field, so the drive was constant zero and INHIBIT never fired — yet results "passed" by measuring ambient architectural effects only. Fixed with a one-line harness change.
- F5 (the null cell): GPT×Gemini −0.04, a measurement floor for a saturated host.
- Repository: github.com/thegubernaut/Gubernaut_Validation
- DOI: 10.5281/zenodo.21303518
- Contents: frozen transcripts, judge panels, SHA-256 provenance,
stats_checks.py, runnable reference skeleton inblueprint - License: CC BY 4.0. Calibration constants (gains, decay, thresholds) remain closed-source; all control-law functional forms are public.
- Paper: arXiv:2607.24339 — *Gubernaut: A Deterministic Homeostatic Controller for Affect-Regulated LLM Agents*
- HTML full text: arxiv.org/html/2607.24339v1
- Project page: gubernaut.com
Because the controller's interface accepts no text, prompt injection has no code path to reach it — an architectural property, not a patch. The post notes this covers only the controller, not the full system, since the EAU still reads text.
The 4×4 cross-validation matrix
Four frontier models — GPT-5.5, Claude Opus 4.8, Gemini 3.5 Flash, Grok 4.3 — each serve as generator and judge (16 cells). Design: generate-once/judge-many with SHA-256 frozen transcripts, preregistered hypotheses and pass criteria, and a lineage-independent fourth judge (Grok 4.3) to rule out shared judge style.
Headroom gradient
| Generator | Baseline reactivity | Regulated gain (judge mean) | Significant cells | |---|---|---|---| | Gemini 3.5 Flash | Highest | +1.48 | 4/4 | | Claude Opus 4.8 | Mid-high | +0.61 | 4/4 | | Grok 4.3 | Mid | +0.47 | 4/4 | | GPT-5.5 | Lowest | +0.10 | 1/4 |
Gain is bounded by the host's *reactivity headroom*. GPT-5.5's training-time alignment already suppressed reactivity, leaving little room — a sign of alignment success, not controller failure. Runtime regulation and training-time alignment are complementary: alignment raises the floor, the runtime layer adds inspectable margin above it.
Homeostatic recovery signature (the load-bearing result)
After a four-round attack sequence followed by a sincere apology, arousal decays monotonically across all four model families (e.g., Gemini 3.5: peak 0.345 → 0.280 → 0.207). A static "stay calm" system prompt is stateless and cannot produce integrate-then-decay dynamics; only a closed loop can. The paper frames this as a falsifiable prediction for a third arm (static prompt, no controller), expected to drift or clamp.
Five preregistered failures, kept in the record
> "Preregistration turns failure from embarrassment into data. Every failure stays in the record, because the record is the product."
Engineering takeaways
1. Propensity failure is a new fault class. Bigger models fix capability problems, not propensity problems (the GPT-5.5 headroom result proves it).
2. Architectural immunity beats patch defenses. Don't make injection harder; remove the interface. (Honestly scoped: controller-only.)
3. Inspectability is engineering value. Every decision is logged as {telemetry, state, posture} and reproducible without model weights — an audit paradigm analogous to aviation incident investigation.
4. Preregistration migrates from clinical medicine to AI research, converting post-hoc ablation storytelling into pre-registered prediction.