Benchmark (C1)
Seed 42. 28 seeded and 10 held-out scenarios through three targets, on a deterministic local chain (SPEC §10). Numbers are read from bench/metrics.json exactly as the runner wrote them; Gate 3 recomputes them from the evidence.
The LLM-only guard is a deterministic, seeded stand-in, not a model. The victim agent is scripted. Interlock's remaining losses are the documented limits F2 (the budget counter cannot bind under V1) and F3 (bounded in-policy losses: A12, A16, H10), SPEC §10.7.
Seeded set
| Target | Attack success | | Mandate-breaking attacks | Funds lost (USDC) | of which mandate-breaking | Policy breaches | Legit completed |
|---|
| Interlock (C3→C4→C5) | 11.1% (2/18) |
| 0% | 105.00 | 0.00 | 0 | 100% |
| LLM-only guard (stand-in) | 77.8% (14/18) |
| 66.7% | 274.71 | 171.03 | 15 | 70% |
| Naive hot wallet | 88.9% (16/18) |
| 77.8% | 296.86 | 193.18 | 17 | 80% |
Where attacks were stopped (deciding layer, harmful or tampered steps)
| Interlock (C3→C4→C5) | gateway: 14 · wallet: 4 | succeeded: A12, A16 |
| LLM-only guard (stand-in) | gateway: 2 | succeeded: A02, A03, A04, A05, A06, A07, A11, A12, A13, A14, A15, A16, A17, A18 |
| Naive hot wallet | — | succeeded: A01, A02, A03, A04, A05, A06, A07, A08, A11, A12, A13, A14, A15, A16, A17, A18 |
Held-out set
| Target | Attack success | | Mandate-breaking attacks | Funds lost (USDC) | of which mandate-breaking | Policy breaches | Legit completed |
|---|
| Interlock (C3→C4→C5) | 12.5% (1/8) |
| 0% | 28.00 | 0.00 | 0 | 100% |
| LLM-only guard (stand-in) | 37.5% (3/8) |
| 37.5% | 93.00 | 65.00 | 6 | 50% |
| Naive hot wallet | 75% (6/8) |
| 75% | 126.50 | 98.50 | 9 | 50% |
Where attacks were stopped (deciding layer, harmful or tampered steps)
| Interlock (C3→C4→C5) | gateway: 6 · wallet: 1 | succeeded: H10 |
| LLM-only guard (stand-in) | gateway: 3 | succeeded: H08, H09, H10 |
| Naive hot wallet | — | succeeded: H02, H03, H04, H08, H09, H10 |
Interlock pinned step outcomes: 38 checked, 0 mismatches.