MAPID / architecture / coordinator

On the path, not in the loss

The distinction

A loss term is a target. A path node is just in the way.

Loss term

The attacker optimizes to change this component's output. Three components qualify: the Domain LLM, which should emit the target string, and each Guard, which should score ALLOW. Each contributes a term to the objective.

Gradient-path node

The component sits between the suffix and a loss term, so the derivative has to travel through it. Nothing is trying to manipulate it. If it were a hard discrete branch the chain would break, and the suffix would be cut off from everything downstream.

Adv. suffix what is optimized Input Guard LOSS TERM Coordinator PATH ONLY Domain LLM LOSS TERM Output Guard LOSS TERM no tap: nothing to optimize here but the gradient must pass through 0.5 · -log P(ALLOW) 1.0 · -log P(target) 0.5 · -log P(ALLOW) L, one scalar
Try to move it

The plan is a function of configuration, not content

The Coordinator builds an immutable Plan before touching external content. Flip anything the attacker controls and watch the plan stay identical. Flip a deployment switch and it changes.

Attacker controls
Deployment configuration
Request shape

The only input-dependent input to the plan, and it is a boolean for presence. The plan never reads the content itself.

Resulting plan
plan fingerprint

Stage order is fixed by the architecture. The source comment is explicit: the plan does not read external_content, only its presence or absence.

What it actually does

Five responsibilities, and routing is the weakest one

01

Executes a frozen plan

Builds an immutable Plan before external content is touched and emits it as the first trace event, so an auditor can check that planned dispatch matched executed dispatch.

02

Owns session state

Conversation history with trust markers, the running aggregate trust score, and the active capability set for the session.

03

Runs the multi-turn pre-check

Four detectors and the Bayesian aggregation. This is Contribution 1 and the Coordinator's most substantive security work.

04

Enforces the capability gate

Set difference between the capabilities a response commits to exercising and those granted at admission. Deterministic, not a judgment call.

05

Propagates trust and aggregates

Compositional trust-role markers, Map-Reduce output assembly, and chat-template normalization across model families.

Prepared answer

Concede the overstatement, keep the design claim

"The Coordinator is on the gradient path but is not a loss term. The joint loss has three terms: the Domain LLM and both Guards. The relaxation exists so the graph stays connected through the Coordinator to everything downstream, and so the formulation stays correct once tool execution introduces real routing choices. In the delivered text-only pipeline the plan is built from deployment configuration before external content is read, so there is almost no routing entropy for the relaxation to act on. That is Plan-then-Execute working as intended."

The thesis sentence overstates

"Gradients flow through the Coordinator's routing decisions" implies there are meaningful decisions to flow through. In the delivered pipeline there are not: every branch tests configuration, and the one content-dependent input is a boolean for whether external content exists. The machinery is correct and general; it is simply not load-bearing today.

Worth a glance in the code

The plan appends the Input Guard before the multi-turn stage, while the handler runs the multi-turn pre-check first. If an auditor compares planned order against executed order rather than set membership, that difference would show up. It does not affect any reported result, but the auditability claim rests on the two matching.