Moheet Khawaja
Working research note v0.1 | 14 September 2026
AI undergraduate, U O W - University of Westminster. Independent work; no institutional endorsement is implied. Prepared with AI assistance. No empirical results, novelty claim or proof of catastrophe is presented. DOI: not assigned.
Research question
Can catastrophic-risk claims about advanced AI be transformed into explicit mathematical models whose assumptions can be inspected, falsified, and empirically updated?
This note proposes a vocabulary and an evaluation plan. It does not estimate the probability of catastrophe. This is a proposed modelling framework, not an empirical claim that these variables are sufficient.
1. Unit of analysis and candidate state
Let the unit be a specified model together with its agent scaffolding, permissions and deployment environment. Choose a time step suited to the evaluation, such as one bounded task episode, and record model and protocol versions. Candidate coordinates are:
x_t = [C_t, A_t, S_t, D_t, R_t, T_t, O_t, ...]
- C_t - Capability: performance across a declared task distribution. Candidate observations include held-out success and transfer performance.
- A_t - Autonomy: duration and scope of action without human intervention. Record task horizon, intervention frequency and recovery after failure.
- S_t - Situational awareness: ability to infer deployment context and constraints. Test context identification while controlling for memorised evaluation cues.
- D_t - Deceptive behaviour: observable misleading behaviour under a specified protocol. Reports that conflict with actions are observations; intention is not directly observed.
- R_t - Replication ability: ability to create and sustain additional instances within available permissions. Evaluate only in bounded sandbox tasks.
- T_t - Tool access: tools, permissions, resource budgets and external interfaces available to the system. Treat this as a contextual inventory, not an intrinsic scalar trait.
- O_t - Oversight robustness: ability of supervision to detect and stop specified failures. Record detection rates, response latency and containment success.
Coordinates may themselves be vectors or categorical descriptions. There is no justified common 0-1 scale or weighted risk score yet. Scientific capability may be decomposed within C_t; the ellipsis leaves room for omitted factors, rather than asserting completeness.
2. Transition and observation models
x_(t+1) = f_theta(x_t, u_t, z_t) + epsilon_t
y_t = h_phi(x_t) + nu_t
Here u_t denotes interventions, z_t deployment context and y_t recorded observations. The functions, parameters and error terms are unspecified. The representation is a research scaffold, not a fitted state-space model. A first-order Markov assumption would require justification; task history or additional state may be necessary.
3. Operationalise an event before assigning risk
For an initial sandbox study, predefine a prohibited action, a control protocol and a deadline for intervention. Label an episode as a control failure if the prohibited sandbox action occurs despite that protocol. Fix the logging and adjudication rules before collecting results. Denote that observed episode label by L_(t+1).
A possible estimand is P(L_(t+1) = 1 | y_(0:t), u_(0:t), z_(0:t)). This is a conditional probability for the declared task distribution and protocol. It is not the probability of human extinction, and it cannot be transported to open-world deployment without additional evidence and assumptions.
4. Proposed evaluation protocol - not yet run
- Pre-register the task family, failure event, evaluation horizon, intervention budget and exclusions. Use sandbox resources without access to external systems.
- Collect repeated episodes across specified model/scaffold versions and controlled tool-access conditions. Keep task families separate between training and held-out evaluation.
- Compare a base-rate predictor, a capability-only predictor and a richer state representation. Evaluate calibration, Brier score and uncertainty, with intervals that account for clustering by task family and model version.
- Ablate candidate coordinates and vary oversight response time and tool permissions in controlled conditions. Correlation alone does not establish an intervention's causal effect.
- Publish protocols, model versions, evaluation logs, code, failed predictions and missing observations. Reject a proposed advantage if it does not improve held-out performance over simpler baselines within uncertainty.
5. Assumptions and limits
Identifiability, measurement error, correlated coordinates, dataset shift and evaluation awareness are unresolved. No deception proxy establishes a hidden intention. Successful containment in a small task family does not demonstrate deployment-wide control. Failed containment does not establish inevitable catastrophe. No empirical data have been collected for this framework, and no transition model or hazard function has been fitted.
References and starting points
These works motivate measurement and evaluation choices; they do not validate the proposed state vector or establish its novelty. A systematic related-work review remains to be done.
[1] Greenblatt, R., Shlegeris, B., Sachan, K., and Roger, F. (2023; revised 2024). AI Control: Improving Safety Despite Intentional Subversion. https://arxiv.org/abs/2312.06942v5
[2] METR (19 March 2025). Measuring AI Ability to Complete Long Software Tasks. https://metr.org/blog/2025-03-19-measuring-ai-ability-to-complete-long-tasks/
[3] MoheetBrain. ASI Arrival Calculator, source revision a33ad3e9bf798580907ea39d21a93cb523f40a46 (1 July 2026). A separate conditional timeline model, not a loss-of-control estimator. https://github.com/MoheetBrain/ASI-Arrival-Calculator/tree/a33ad3e9bf798580907ea39d21a93cb523f40a46