← Research
Security Sages

Project Rorschach.

Controlled ambiguity as an experimental defence against AI reconnaissance.

UNMODELLED research · Project Rorschach · The Mask

PERTURB controlled variation OBSERVE behaviour leaves a trace DECEIVE controlled decoy exposure Bot management DETECTION Signals from client behaviour and traffic, not proof of intent. Moving target MOVEMENT Changes selected observations within defined bounds. Deception MISDIRECTION Controlled decoys for suspected adversarial activity. 01 BOT × MTD 02 BOT × DEC 03 MTD × DEC 04 · RORSCHACH

Fig. 1 — Three disciplines, four overlaps. Conceptual illustration, not results: the centre combines observation changes, deception and measurement as a hypothesis. Tap a region.

04 · Rorschach investigation

Proposed investigation: combine controlled observation changes, decoy exposure and measurement. Test reconstruction accuracy and reconnaissance cost; effectiveness is untested.

What can an agent learn—and what does it cost?

The hypothesis is that controlled changes to selected observations may reduce an autonomous cyber agent’s reconstruction accuracy or increase reconnaissance cost. Behavioural traces record observable actions, not internal reasoning. Agents may be legitimate; risk signals alone do not establish adversarial intent.

SURFACE CHECKS headers, movement, reputation — risk signals, not intent IN THE PATH Agent request 010203 Within bounds?Which view?What changed? RISK SIGNALSTHE MASKMEASUREMENT Bounded decoy + trace
The four overlaps Related approaches and evaluation questions
01 Bot × Moving target

Challenges that move.

Changing automated-client challenges can vary the observations a client receives. Their responses are behavioural signals, not proof of automation, malicious intent or a particular reasoning engine.

Related approaches
Context: Client challengesContext: Behavioural signals
Evaluation questions
  • How do clients respond to changing challenges?
  • What friction reaches legitimate users and agents?
  • How do results vary across tools and environments?
02 Bot × Deception

Detect, then divert.

Combine risk signals with controlled decoy routing for suspected adversarial activity. Automation alone is not a routing justification: legitimate agents need protection within predefined impact limits.

Research context
Context: Risk signals + decoys
What to measure
  • Decoy interactions and reconstruction accuracy
  • False positives and legitimate-client impact
  • Observable actions within bounded exposure
03 Moving target × Deception

Traps that shift.

Changing exposure plus decoys draws on moving-target defence and deception. Selected observations may vary without requiring changes to real underlying state or access policy; effects must be tested in the chosen environment.

Related approaches
Context: MTD + deception
Evaluation questions
  • Does changing exposure alter reconstruction?
  • What cost does a client incur versus baselines?
  • Does benefit persist when the mechanism is known?
04 All three · Rorschach

A proposed investigation.

The Mask is the experimental control in Project Rorschach, UNMODELLED’s public research programme. The proposed contribution is controlled observation changes and adaptive feedback compared with baselines. Drift Identity and Entropy Engine are experimental mechanisms/applications in this scope.

Research context
Programme: Project RorschachControl: The Mask
Supporting behavioural measures
  • Response latency under controlled variation
  • Choice sequences through available paths
  • Retries and looping behaviour
  • Tool and command selection — not reasoning-engine identification
Hypothesis and uncertainty Effects depend on the agent and environment.
Reconstruction accuracy

A less accurate map?

Compare reconstructed facts with known ground truth under selected observation changes. Humans and models do not all respond alike; classification is a secondary exploratory question.

Reconnaissance cost

More effort to learn?

Measure requests, elapsed time and resource use against baselines. Effects may depend on tools, tasks and prior knowledge. No perception benchmark establishes security effectiveness here.

UNTESTED

Effectiveness must be measured in the target environment.

Who must be evaluated Evaluation concerns, not measured rankings
Scripted clients Parsing, retries and task completion To evaluate
Browser automation Navigation and completion under changing views To evaluate
Autonomous agents Reconstruction accuracy and reconnaissance cost To evaluate
AI web scraper Extraction accuracy and authorised use To evaluate
AI-assisted human Human correction, workload and task success To evaluate
Legitimate human Usability, trust and completion within limits Impact limits
Assistive technology Navigation and comprehension within impact limits Impact limits

Machine-readable content can reach humans and screen readers. Legitimate clients and accessibility tools must remain within predefined impact limits; zero impact has not been established.

Questions to test
Reconstruction accuracy primary
Reconnaissance cost primary
Human / agent classification exploratory
Exact-model attribution exploratory
Legitimate-client impact bounded

Does benefit persist against an adversary who knows the mechanism? That is a test question, not a guarantee of resource exhaustion.

Evidence statusconcept stage
Foundations Moving-target defence & deception
Proposed contribution Observation changes & adaptive feedback
UNMODELLED effects Not demonstrated
Human / agent classification Exploratory
Exact-model attribution Exploratory
Legitimate-client impact Predefined limits required
Originality / patentability Not established
Prototype Bounded, non-production
Adaptive feedback Compare with baselines
Known adversary Benefit untested
Proposed · nine months A proposed sequence, not completed results
M1M2M3M4M5M6M7M8M9
01DefineEnvironments, reconstruction accuracy and reconnaissance cost; set thresholds before testing.
02ImpactTest legitimate agents and assistive tools against impact limits.
03PrototypeThe Mask: bounded, reversible observation changes in a non-production testbed.
04CompareUnchanged baseline; static deception; matched randomised variation; adaptive variation.

Set thresholds before testing for practically meaningful effects on reconstruction accuracy or reconnaissance cost and predefined legitimate-impact limits. Match change budgets and decoy exposure across comparisons. Path divergence alone is not attack prevention.

Research decision

Proceed to bounded evaluation.

Security Sages publishes this concept-stage brief. UNMODELLED is the overarching research project; Project Rorschach is a public research programme, not an internal codename. There are no published UNMODELLED experimental results. Human Checkpoints and Assurance Integrity are separate research outside Rorschach and The Mask.

Descriptive research terminology Semantic MTD · not a validated protocol
Concept-stage research · no established originality or patentability claim