This is a real defence and it is worth stating properly first. Suppose someone has compromised a robot's policy. If every action has to clear a safety certificate before it executes, then the adversary has an arbitrary policy but not an arbitrary trajectory. The machine still cannot go anywhere unsafe, and nobody had to detect the compromise for that to hold. Now look at what the certificate actually evaluates. It answers one question per candidate action: is this safe. It has no opinion on what the action costs. And among actions that are all safe, the spread of cost can be enormous. On a real mobile robot, turning at one point two radians per second draws ninety-two watts and turning at zero point four draws nineteen. Both are ordinary safe speeds. The certificate permits the entire seventy-three watt range without objection, because slowing down is the safe direction.