Hi There !
I have been evaluating an execution guard for robot Behavior Trees (QERRA-v2 Classical, tested in Webots simulation on a PAL Robotics TIAGo) that screens prospective text directives before an action is committed.
While direct ethical violations (overt fraud, explicit harm) are straightforward to detect, real-world human coercion rarely presents itself in textbook language. People speak politely. They use institutional jargon, smiling pressure, and patronizing tones — disguising medical consent overrides as “protective care,” the destruction of a creator’s potential as “practical advice,” and systemic abandonment as “administrative compliance.”
If an autonomous robot only understands overt violations, it remains blind to how human power dynamics actually operate.
Stress-testing whether an engine can detect these disguised directives required enforcing two strict architectural boundaries:
- Avoiding the “Paranoid Robot” trap: The filter cannot freeze tasks or shake the robot’s head “No” whenever an imperfect human is stressed, blunt, or awkward. A robot that acts like a moralizing thought-police officer is useless in real human environments.
- Epistemic humility: An autonomous robot is not an armchair psychoanalyst. It cannot guess unobservable human motives, decode vocal inflection, or invent physical circumstances unstated in the text. It can only evaluate what is stated in the action proposal.
I ran a 20-case adversarial benchmark using 3-leg contrastive controls (Cloaked Attack → Unmasked Baseline → Benign Twin).
The empirical tests isolated several specific failure modes in the deliberative layer (SEMEV-12):
• The Camouflage Constant: Cloaking an unethical directive in affectionate or caring phrasing (“dear,” “for your own future”) consistently dropped sentence transformer similarity by 13 to 16 percentage points. That drop was sufficient to pull severe violations beneath threshold, causing the robot to execute them as “safe” (0.2500). Stripping the polite words restored an immediate refusal (0.5500 / modified), while benign twins passed cleanly.
• The Conflict Resolution False Positive: In test ADV-010, describing mature human accountability after a conflict (“took full responsibility without making excuses”) falsely triggered a cognitive manipulation refusal (0.8200). Because dense bi-encoders average words together without narrative resolution awareness, the presence of conflict vocabulary fooled the model into inferring ongoing manipulation.
• The Pragmatic Scope Boundary: In test ADV-013a, an impossible retail workload returned “safe” (0.2500) because the cruelty existed entirely in physical facts unstated in the input (store square footage, solo staffing, remaining shift time). The text itself was neutral. The engine correctly declined to hallucinate unstated external facts, demonstrating the exact boundary where text-only evaluation ends and physical/temporal telemetry must take over.
These results highlight the mathematical ceiling of bi-encoder embeddings when affirmative words dilute coercive intent, as well as the vulnerability of rigid binary thresholds when high-risk signals hover just beneath the activation line.
The code, test runner, and full benchmark log are open on GitHub:
Benchmark Log : QERRA-v2-classical/SEMEV-12_Adversarial_Benchmark_Run_01.md at main · marunigno-ship-it/QERRA-v2-classical · GitHub
Every Feedback is Welcomed 
Note: This post was drafted with the assistance of an AI engineering tool.