What the certificate permits
Gate every action on a safety proof and a compromised policy cannot go anywhere unsafe. It can still choose which safe action to take, and safe actions differ in what they cost. This is how much a perfectly compliant machine can still say.
Predict first
A policy is compromised but every action it takes passes the safety certificate, and it never once trips the energy monitor's alarm. How much data can it still push out through its power draw?
Action dimension
Decision rate
The monitor raises an alarm at 3σ, which is 8.7 W against a
2.9 W prediction residual. Everything below that line is a sequence of individually
certified-safe actions that the monitor reports as normal.
Where these numbers come from
| Quantity | Value |
|---|---|
| Angular speed 1.2 → 0.4 rad/s | 92.1 → 19.4 W |
| Detection rate 6 → 3 Hz | 36.5 → 26.8 W |
| Prediction residual σ | 2.9 W |
| Perception task rate | 3–6 Hz |
Measured on a profiled AMR, arXiv:2511.20467, via TR-2026-36. Capacity is the
Gaussian form ½·log₂(1+(A/σ)²) per use, an upper bound on what a cooperative
receiver could extract.