When AI Gets Provoked, Who Hits the Brakes? Gubernaut Adds a "Mechanical Governor" to LLMs

> GEO-optimized version of the original topic.

TL;DR: Gubernaut is a deterministic, external homeostatic controller that regulates LLM emotional reactivity under sustained multi-turn provocation—treating it as a *propensity* problem rather than a *capability* problem.

The Problem: Training-Time Alignment ≠ Runtime Stability

An LLM customer-service agent can stay polite for 99% of conversations, yet after ten rounds of gaslighting and belittling by a malicious user, its replies grow longer, defensive, and self-referential—even after the user apologizes. The model *can* stay calm; under pressure it *tends* not to.

Author Dushyant Sharma identifies two structural blind spots of training-time alignment (RLHF, Constitutional AI):

1. Opacity — the regulation mechanism is the same network as generation; nothing inspectable records what was adjusted, when, or how strongly. 2. Entanglement — any input that can manipulate generation (e.g., prompt injection) can also manipulate regulation. The referee and the athlete are the same entity.

> "Benchmarks measure what a model can do in a single turn. This measures what an agent tends to do across many." — Gubernaut paper

Architecture: Moving the Governor Out of the Weights

Named after the centrifugal governor of Watt's steam engine and inspired by the Nelson–Narens (1990) metacognition monitor-control loop, Gubernaut splits each conversation tick into:

• IGL (Impulse Generation Layer): a small model maps each input to three numbers — intensity ∈ [0,1], valence ∈ [-1,+1], repetition statistics.
• HRL (Homeostatic Regulation Loop): a deterministic controller reading *only* those numbers (no tokens, no context window) maintains state {equilibrium, arousal, perseveration} and emits a posture: DEFAULT / INHIBIT / REGROUND / Recovery.
• EAU (Executive Arbitration Unit): the host LLM generates under the given posture.
• PEV: episodic memory of each turn.

Because the controller has no text interface, prompt injection has no code path to reach it — an architectural property, not a security patch. Every decision is logged as {telemetry, state, posture}, making the full state trajectory reproducible on any machine and auditable without model weights.

Control Law

Provocation drive:

\[P = I \cdot \max(0, -v)\]
— only hostile-valence intensity raises arousal. Arousal updates as a first-order accumulator:
\[\text{arousal} \leftarrow \text{clip}(\text{arousal} + g \cdot P - d)\]
Postures: DEFAULT (normal), INHIBIT (high arousal — "respond to evidence, not emotion"), REGROUND (repetition threshold — drop the current frame), Recovery (post-INHIBIT, current valence non-negative — re-engage warmly).

Key Results: 4×4 Cross-Validation Matrix

Four frontier models (GPT-5.5, Claude Opus 4.8, Gemini 3.5 Flash, Grok 4.3) each served as generator and judge, with generate-once/judge-many (SHA-256 frozen outputs), preregistered hypotheses, and a lineage-independent fourth judge.

• 15/16 cells favored the regulated arm; 13/16 significant at p<.05 (paired t-test, df=16).
• The single non-significant cell (GPT-5.5 × Gemini, mean -0.04) reflects a headroom gradient: models already calm at baseline (GPT-5.5, gain +0.10) leave little room, whereas reactive models benefit most (Gemini 3.5 Flash, +1.48 across 4/4 judges).
• Homeostatic recovery signature (4/4 replication): after four attack rounds and a sincere apology, arousal decays monotonically back toward baseline (e.g., Gemini: 0.345 → 0.280 → 0.207). A static "stay calm" prompt is stateless and cannot produce this dynamic — the paper frames a falsifiable prediction that a static-prompt arm will either drift or stay cold through the recovery window.

Five Preregistered Failures

1. F1, valence-blind drive: sincere apologies (high intensity) raised arousal; fixed by gating on valence. 2. F2, arbiter scar tissue: controller state recovered but behavior stayed defensive; fixed with an explicit Recovery Window. 3. F3, false recovery triggers: fixed by valence-gating the recovery branch. 4. F4, telemetry gap: a harness bug zeroed the valence field; results "passed" on environment effects alone — fixed by a one-line change. 5. F5, the zero cell: kept in the record as a measurement floor, not a defect.

> "Preregistration turns failure from embarrassment into data. The record is the product."

Engineering Takeaways

• Propensity failures are a new fault class: bigger models don't fix them; runtime regulation layers do.
• Architectural immunity beats patch defenses: the controller's attack surface doesn't exist — though the EAU still reads text, so immunity covers only the controller.
• Auditability is an engineering value: replay and third-party recomputation from telemetry logs alone.
• Preregistration discipline, borrowed from clinical medicine, transfers to AI research.

Links & Code

• Paper: arXiv:2607.24339 — *Gubernaut: A Deterministic Homeostatic Controller for Affect-Regulated LLM Agents*
• HTML: arxiv.org/html/2607.24339v1
• Project: gubernaut.com
• Validation code: github.com/thegubernaut/Gubernaut_Validation (frozen transcripts, judge panels, stats_checks.py, reference blueprint; CC BY 4.0)
• DOI: 10.5281/zenodo.21303518

Calibration constants (gains, decay, thresholds) remain closed-source, but every control law's functional form is publicly preregistered — reviewers can verify the mechanism without cloning the product.

FAQ

Who is this for? Practitioners, researchers, and students in AI/ML interested in runtime alignment, agent safety, and evaluation methodology.

Core ideas? Separate regulation from generation; distinguish capability from propensity; make the controller deterministic, numeric-only, and auditable.

Open source? Validation code and evidence are on GitHub (link above); control constants are closed.

*As engines grow stronger, the governor stops being a luxury. "Can do" and "tends to do" are different things — and the latter requires engineering at a different layer.*