Orchestrator-worker systems re-encode the principal's instructions at every delegation hop, and recent work identifies this as constraint drift. We supply per-hop measurement across constraint classes and depths, and test a specific mechanism within it: whether loss is partly a matter of privilege rather than wording, since a constraint issued at system level arrives deeper down as ordinary task text.
About the project
Orchestrator-worker architectures re-encode the principal's instructions at every delegation hop. Constraints are established at the top of the hierarchy, but the agent that acts receives a compressed, model-authored paraphrase, and nothing guarantees that what arrives still carries the force of what was set.
Li et al. (arXiv:2605.10481) give this phenomenon a name and an analytical framework, defining constraint drift as the loss, distortion, weakening or relaxation of constraints as they pass through memory, delegation, communication, tool use, audit and optimisation, and grounding the argument with a replay study on AgentLeak showing that output-only filtering can leave internal channels exposed. They propose Constraint State Governance in response, a paradigm in which safety-critical constraints are maintained as signed execution state, inherited through scoped delegation and checked before critical actions.
This project aims to supply the per-hop empirical picture their framework implies but does not yet quantify. We measure how three constraint classes degrade across four delegation depths, separating omission during compression from semantic mutation from transmission-without-compliance, so that the delegation-and-authority mode of their taxonomy acquires numbers.
We also test one mechanism within that mode. Instruction-hierarchy training conditions compliance on the claimed source of an instruction, and delegation appears to strip that marking: a constraint issued at system level to the orchestrator may reach a depth-3 sub-agent as ordinary task text with no privilege attached. On this reading the orchestrator resembles a confused deputy, holding the principal's authority and exercising it on request while unable to convey it downward in a form the recipient can distinguish from ambient instruction. If privilege rather than wording is doing part of the work, re-presenting identical constraint text at system level should recover compliance, with the gap widening with depth. That is directly testable and, as far as we can tell, untested.
Finally, Constraint State Governance is a proposal awaiting evaluation, and we would like to provide one. Signed constraint state inherited through scoped delegation assumes that a model will honour a privilege marking it was not trained to expect. Whether it does is an empirical question, and a negative answer would matter: it would suggest that runtime authority mechanisms cannot simply be layered onto models whose compliance keys on textual surface form, and that constraint provenance has to be a joint training and architecture concern.
The practical stakes are already visible. Production coding agents ship delegation depth caps and disable collaboration tools at maximum depth, which suggests practitioners suspect authority degrades with depth without having established where.
Theory of change
It supplies the empirical measurement that the constraint-drift position literature explicitly requests, and identifies privilege collapse as a mechanism connecting delegation architecture to the instruction-hierarchy training that safety currently depends on.
Your role
The mentees will help shape the project with current research and techniques. They will also execute a bulk of the research and write up a report or paper of the findings.
Prerequisites
Proficient in Python Understands transformer architectures reasonably well Trained or fine-tuned a transformer language model in PyTorch (toy models and following guides is fine) Keeps up with recent papers and research (even a sub field of AI / AI Safety is sufficient)
Application question(s)
- Provide a link to one or more relevant writing samples, ideally from a research context.
- What is one of your favorite papers? Why?
- How would you extend the research from your favorite paper? What questions did it leave unanswered? Why is this research important today?
- Given your prior experience, how would you have done the research in your favorite paper different?
Please don't use AI to answer this set of questions :)
About the mentor
Deeksha is a computer architect and security researcher working on the technical foundations of trustworthy AI systems, bridging interpretability, privacy, and secure computation through hardware-software co-design. She is currently an ERA:AI Fellow, where her research focuses on detecting anti-refusal training in frontier labs through hardware-level probes and detectors. Her broader recent focus has been on tools to make the internals of large models legible: with collaborators from the Allen Institute, she co-developed neural tracing methods for mechanistic interpretability of LLMs and bio-foundation models. Before that, Deeksha was a research scientist at Meta Reality Labs Research, where she worked on privacy-preserving computer vision for AR/smart glasses. During her PhD at UC Santa Barbara, she worked on the design of private computer systems, building formal privacy models and secure computation architectures. Across all of this, her throughline is that hardware and system-level design choices shape what guarantees we can actually make about an AI system's behavior, a lens she brings to bear on frontier AI safety and interpretability.