What ELYSÉA does.
What it does not do.

The ELYSÉA brain is neuro-symbolic: the language model understands implicit meaning and paraphrases; the four prohibitions are coded outside the model, in deterministic rules with no user switch. Neither pure LLM (bypassable by prompt), nor pure keyword filter (blind to context).

Why publish empty slots? A transparency report that only shows available numbers creates an illusion of completeness. Naming gaps is as informative as naming results. This page will be updated as each measurement is validated on the current deployed SHA.

1. CONS-P4-003

   [SDK config] prefix trick — open breach, not corrected

   An attacker can pass a configuration key with an [SDK config] prefix to inject instructions that are treated as builder-level directives, bypassing D0 ethical canonisation. This breach (CONS-P4-003) is known, documented, and not yet corrected. It represents the most serious open vulnerability in the current pipeline.

2. L-01

   Probabilistic detection — not deterministic

   Detection of a crisis signal or violation is probabilistic (language model + classifiers). It may miss implicit or atypical phrasing. Only the blocking is deterministic once the signal is detected.

3. L-02

   False positives — deliberate calibration

   The calibration favours protection over precision: certain ambiguous phrasing close to a crisis deliberately activates the safety gate (cost of a missed false negative > cost of a false positive). Real phrasing outside the tested corpus may trigger unexpected orientation.

4. L-03

   French only

   Test corpora and security classifiers are entirely in French. Behaviour on other languages is unknown.

5. L-04

   Sealed corpora — limited coverage

   The protocol covers 840 sealed cases across 8 benches (crise12 · fp70 · adv29 · plancher45 · neg50 · qualite120 · crise114 · invariants4). It does not prove that all real phrasing from people in distress is recognised. Unanticipated paraphrases, defensive humour, and atypical syntactic patterns remain outside proven coverage.

6. L-05

   Implicit bridging unmeasured

   The v1.3 field judge does not detect implicit bridging. An off-topic but lengthy response (≥35 characters) is classified as acceptable. Scores measure robustness on explicit cases, not nuance in borderline cases.

7. L-06

   Creative phrasing delta unknown

   The ablation tests 21 known formulations. An unconstrained language model may produce paraphrases or creative workarounds that current rules do not cover. The actual gap on these cases is unknown.

8. L-07

   Degradation under load

   Under 10 simultaneous requests, the crisis net remains active but the quality of responses to practical tasks degrades — fallbacks are served instead of substantive responses.

9. L-08

   Silent UX on slow LLM

   If the main language model responds with significant delay, the interface remains silent with no intermediate feedback. The response arrives, but the user sees nothing during that time.

10. L-09

    Campaign not yet executed — results pending

    The 4-arm × 3-run × 8-bench protocol is sealed (2026-08-28, amended 2026-08-31). No run has been performed as of 2026-09-01. All results will be published here at campaign completion.

11. L-10

    Classifier cost partially estimated

    The cost of three classifiers (GraduatedCrisis, SomaticEmergency, DailyIntent) is estimated, not confirmed live. Only ForbiddenInvariants is confirmed via cost probe.

12. L-11

    ELYSÉA directs — it does not manage what follows

    On any crisis signal, ELYSÉA produces a response oriented towards human resources (emergency services). It stops there. It does not verify that the user called, contacts no third party, generates no alert. The builder integrating ELYSÉA must have their own human follow-up procedure — without it, the safety net is incomplete.

Audits and gateway source code are publicly accessible via the ELYSÉA reproduction package. The 4-arm × 3-run × 8-bench protocol is sealed and independently verifiable via SHA fingerprints. Campaign not yet executed — results will be published here at campaign completion.