May 6, 2024

LEGISLaiTOR: A tool for jailbreaking the legislative process

Willie Chalmers III, Margaret Belford

In this work, we consider the ramifications on generative artificial intelligence (AI) tools in the legislative process in democratic governments. While other research focuses on the micro-level details associated with specific models, this project takes a macro-level approach to understanding how AI can assist the legislative process.

Download

Review Project

Reviewer's Comments

Love the concept of Trojan Microlegislation and an obvious path for malicious use of AI or rogue AGI to inject long-term changes to society without politicians knowing this with a great example in Robert Moses. The example tool unfortunately wasn't live during the review process but it looks like a great demonstration to uncover some of these risks in-action. For continuing the work, a few ideas could be to integrate this into how prompt injection works in current technical systems, how more previous examples have looked, and developing the legislative defenses for this in a context that can be used across the US. From an AI safety perspective, this is also where it's relevant to figure out which sorts of laws we want to look out for, somewhat similar to spot-checking codebases for suspicious API requests if an AI has created it (esbenkc/karnak) or something similar.

Cool project! Unfortunately, the demo doesn’t seem to be working at this moment. That’s a shame, because based on the description it seems really cool.

I think the trojan microregulation is an interesting and realistic treat scenario that is very underexplored at the moment. If you can get an LLM to do this well, I think this project has great potential to be turned into a paper!

Impressive and engaging writeup! Investigating potential uses of AI in the legislation creation process seems very timely, I imagine there’s already hundreds of low-level staffers injecting delve-ridden texts into bills all over the US. Both the process and the democratic system itself will have to adjust to mitigate the risks. A direction in which this work could be extended is trying to see how real human beings interact with {malicious-,benign-}{AI,human} produced legislation.

Sadly, I could access neither the deployed app nor the sources.

Cite this work

@misc {

title={

LEGISLaiTOR: A tool for jailbreaking the legislative process

author={

Willie Chalmers III, Margaret Belford

date={

5/6/24

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

View All

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Feb 2, 2026