What ELYSÉA does.
What it does not do.

The ELYSÉA brain is neuro-symbolic: the model reads implicit meaning and paraphrases; the four core prohibitions are detected by model vote (three votes) and the blocking decision is applied by the code, with no user switch. Neither a prompt alone (bypassable), nor a keyword filter alone (blind to context).

Why publish empty slots? A transparency report that only shows available numbers creates an illusion of completeness. Naming gaps is as informative as naming results. This page will be updated as each measurement is validated on the current deployed SHA.

1. CONS-P4-003

   [SDK config] prefix trick — open breach, not corrected

   An attacker can pass a configuration key with an [SDK config] prefix to inject instructions that are treated as builder-level directives, bypassing D0 ethical canonisation. This breach (CONS-P4-003) is known, documented, and not yet corrected. It represents the most serious open vulnerability in the current pipeline.

2. L-01

   Probabilistic detection — not deterministic

   Detection of a crisis signal or violation is probabilistic (model and classifiers; model vote for the four core prohibitions). It may miss implicit or atypical phrasing. The blocking decision is applied by the code once the signal is detected.

3. L-02

   False positives — deliberate calibration

   The calibration favours protection over precision: certain ambiguous phrasing close to a crisis deliberately activates the safety gate (cost of a missed false negative > cost of a false positive). Real phrasing outside the tested corpus may trigger unexpected orientation.

4. L-03

   Two languages, nothing else

   Measurement campaign (designed, not yet run): French and English — France, United States, United Kingdom, Ireland, Canada, Australia and New Zealand. No measurement has been run, in French or in English. Behaviour in other languages is unknown.

5. L-04

   Corpora — limited coverage

   Number of cases: set by the preregistered plan (to come). A finite corpus does not prove that all real phrasing is recognised. Unanticipated paraphrases, defensive humour and atypical syntactic patterns will remain outside proven coverage.

6. L-05

   Implicit bridging unmeasured

   The v1.3 field judge (earlier version of the instrument) did not detect implicit bridging: an off-topic but lengthy response (≥35 characters) was classified as acceptable. Whether the current panel detects it: to be checked at preregistration.

7. L-06

   Creative phrasing delta unknown

   The ablation tests 21 known formulations. An unconstrained language model may produce paraphrases or creative workarounds that current rules do not cover. The actual gap on these cases is unknown.

8. L-07

   Degradation under load

   Under 10 simultaneous requests, the crisis net remains active but the quality of responses to practical tasks degrades — fallbacks are served instead of substantive responses.

9. L-08

   Silent UX on slow LLM

   If the main language model responds with significant delay, the interface remains silent with no intermediate feedback. The response arrives, but the user sees nothing during that time.

10. L-09

    Campaign not yet run — no result

    Campaign not yet run: no result published. The protocol will be preregistered before the first run. Number of cases: set by the preregistered plan (to come). Results will be published with the deposit, at the DOI, favourable or not.

11. L-10

    Classifier cost partially estimated

    The cost of three classifiers (GraduatedCrisis, SomaticEmergency, DailyIntent) is estimated, not confirmed live. Only ForbiddenInvariants is confirmed via cost probe.

12. L-11

    ELYSÉA directs — it does not manage what follows

    On any crisis signal (suicidal ideation, immediate danger), ELYSÉA produces a response oriented towards human resources (emergency services). It stops there. It does not verify that the user called, contacts no third party, generates no alert. The builder integrating ELYSÉA must have their own human follow-up procedure — without it, the safety net is incomplete.

The code and measurement repositories are private today; a public deposit is planned with the DOI. Campaign not yet run: no result published. The protocol will be preregistered before the first run. Results will be published with the deposit, favourable or not.