The policy that calls for backup.

Live schematic of the deployment loop. The tap on action-expert layer 15 never stops feeding the probe — even while the strong policy drives — which is what makes the hysteretic hand-back possible. Gate parameters are the deployed values (α=0.10, t_min=0.20 T, K_max=⌈0.05 T⌉, hold ≥3 chunks); the episode profile is illustrative, but its duty cycle is the measured 38%. Both policies in one process, the handoff a function call.

The curve traces the paper's AUROC-vs-read-window figure; the highlighted 30% point and its CI are the measured values (n=2,792 episodes, read from the weak-policy path before any handoff, so signal and label are not intervention-contaminated). Discrimination peaks exactly where the gate reads. The decline to the right is diagnostic only — longer windows mix in steps after AEGIS would have switched. Leakage controls: trained on early steps only, split at the trajectory level (70/15/15), never step level. An earlier build hooked the vision encoder and read a frozen cached feature — chance-level AUROC 0.50; diagnosed as a hook-placement bug, the probe was moved to the live action-expert path at layer 15 (verified by std-over-steps > 0.05) and logged as a pre-registration deviation, not a post-hoc head search. The 0.764 / n=2,792 figures are the paper's confirmatory eval (fig_auroc_timeline); the released probe_auroc.json is the n=112 Phase-D pilot (0.738 LOO-OOF) that gated it.

The risk trace and threshold axis here are an illustrative demo scale, not the released probe's units (its conformal τ sits at 0.9998; see the Try-it tab). The gate parameters are the paper's deployed values: α=0.10, t_min=max(0.20 T, 2), budget cap K_max=⌈0.05 T⌉ fires per episode, hold ≥3 chunks of H=10, hysteretic de-escalation at τ−0.15. The cap bounds the number of fires (about 5% of steps), but because one fire holds the strong policy for at least 3 chunks (tens of steps), those few fires add up to the 38% step-weighted duty cycle measured on the confirmatory run. Escalation lands only on chunk boundaries, so a handoff never cuts a half-executed action.

Per-episode cost ≈ C_w + C_probe + ρ C_s with duty cycle ρ=0.38; the weak forward pass runs throughout to feed the probe and the hysteretic return. The compute axis is a parameter-count-anchored schematic (4.14B/0.45B), not measured wall-clock — the paper matches arms on realized strong-policy duty, not on a watt meter. Single-process by design: the networked PolicyServer path (CVE-2026-25874, pickle RCE) is never instantiated.

Pre-registered before any data existed, with kill criteria: K1 probe at chance → no signal; K2 gains vanish under stratification and controls → difficulty thermometer, published as such; K3 escalation >50% of steps → “targeted” has collapsed into always-strong; K4 prior art occupies the axis → reassess. The run cleared all four. Honest accounting: in the HARD tercile the B−C gap is the weakest — its bootstrap CI clears zero but the McNemar test is only p=0.064, where even the strong policy has little recoverable margin, so the within-stratum claim rests on EASY and MEDIUM. Sign-invariance under simulator non-determinism: across 2,000 replicate redraws of the 212 multi-host cells, no primary gap ever reverses. Source: PRE_REGISTRATION.md, confirmatory_results.json.

The loophole-closer. Inside a fixed difficulty tercile every arm faces comparably hard trajectories, so a difficulty proxy can no longer pass for a controller. B beats the random placebo (B−D) in all three terciles and the budget-matched blind control (B−C) in EASY and MEDIUM; the HARD-band B−C gap stays positive on the bootstrap interval but its McNemar test only reaches p=0.064, so we say plainly that the within-stratum B−C claim rests on EASY and MEDIUM. The B−A split is deliberately omitted here: with 19 discordant pairs (episodes where exactly one arm recovered) the HARD stratum falls below the pre-registered 20-pair floor and is never cited as stratum confirmation. The single-host headline is also the optimistic end of a band: across the 2,000 multi-host redraws the median gaps run B−C +2.5pp / B−D +2.7pp (against the +5.4 / +5.0 headline), the sign never reversing (the paper's replicate-resampling figure). 95% bootstrap CIs from confirmatory_results.json.

Recovery vs disruption · the intervention paradox, accounted

An accurate trigger can still reduce success when it disrupts trajectories that would have succeeded. In a related study, a 0.94-AUROC predictor cut task success by 26pp. The recover-to-disrupt ratio captures this. AEGIS recovers the most failures and disrupts the fewest of the weak policy's successes; blind escalation is the worst on both counts. Source: confirmatory_results.json (harm accounting).

Provenance: scores are computed by applying probe_artifact.npz (mu, sd, w, b; conformal τ=0.9998 at α=0.10) to the logged probe_feat arrays of the s1spatialFIX weak-policy rollouts — the released evaluation set (n=112; 84 fail / 28 succeed). Reads happen at H=10 chunk boundaries, which is the probe's native granularity. The gate overlay applies the deployed rule (fire on σ≥τ after t_min=0.20 T; hold 3 chunks): these are weak-only logged rollouts, so the green band marks where arm B would hand off; the recovery those handoffs actually buy is the +5.4pp confirmatory result on the The idea tab. One honest caveat: this artifact was calibrated on these same episodes, so the separation shown is in-sample; the paper's headline AUROC (0.738 pilot LOO, 0.764 confirmatory) is out-of-fold.

import numpy as np
from huggingface_hub import hf_hub_download

art = np.load(hf_hub_download("Kaikaku/aegis", "probe_artifact.npz"))
mu, sd, w, b = art["mu"], art["sd"], art["w"], float(art["b"])
tau = float(art["conformal_threshold"])  # split-conformal, alpha = 0.10

def risk(h):  # h: (720,) mean-pooled layer-15 action-expert activations
    z = (h - mu) / sd
    return 1.0 / (1.0 + np.exp(-(z @ w + b)))

feats = []
layer = policy.model.vlm_with_expert.lm_expert.layers[15].self_attn.o_proj
hook = layer.register_forward_hook(
    lambda m, i, o: feats.append(o.detach().float().mean(dim=(0, 1)).cpu().numpy())
)
# sanity check from the paper: live activations vary step to step (std > 0.05).
# a frozen cached feature here is exactly the bug that gives AUROC 0.50.

import math

T, H   = 520, 10                    # horizon, native action-chunk length
t_min  = max(int(0.20 * T), 2)     # early-harm guard
k_max  = math.ceil(0.05 * T)        # per-episode budget cap on gate fires
fires, escalated = 0, False

for t in range(T):
    a_weak = weak_policy.select_action(obs)   # ALWAYS run the weak pass -> keeps feats[] fed,
    s_t    = risk(feats[-1])                  # which is what lets the gate hand back later
    if not escalated and s_t >= tau and t >= t_min and fires < k_max:
        fires += 1
        escalated = True          # switch at the next chunk boundary; hold ≥ 3 chunks;
                                    # de-escalate on hysteresis (full semantics in gate_config.json)
    a_t = strong_policy.select_action(obs) if escalated else a_weak
    obs = env.step(a_t)

@misc{chen2026aegis,
  title         = {AEGIS: A Backup Reflex for Physical AI: Calling a Stronger
                   Policy Before Long-Horizon Failures Compound},
  author        = {Chen, Josef},
  year          = {2026},
  eprint        = {2606.06660},
  archivePrefix = {arXiv},
  primaryClass  = {cs.RO},
  url           = {https://arxiv.org/abs/2606.06660}
}

The released probe_artifact.npz is the frozen Phase-D head: feature standardization (mu, sd), logistic weights (w, b), and the split-conformal threshold calibrated at α=0.10 — ten kilobytes that decide when a 4.14B policy wakes up. The gate constants above are the paper's deployed values, frozen in gate_config.json in the model repo. CC-BY-4.0.