The thesis, in one sentence: One can turn an axiomatic ethics system into a deterministic, incorruptible judge, but an LLM still has to translate the world into the judge's ontology. The binding fails at that bridge. Under adversarial attack, every failure measured was a classification failure. Ergo: Ethics binds only as well as perception classifies.
First and foremost: I'm not an AI researcher. I built this axiomatic ethics system's foundation over an afternoon and refined it in maybe fifteen to twenty hours, spread over a few weeks. The reason for creating this system was the question "Am I a good person?". In order to find out, I had to create a measuring device first. Somewhere along the improvement-work the thought of alignment through ethics came up. Eventually, after reading about Gödel, von Neumann and Turing (I didn't read their work, I only read about them) I wanted to try "codifying" it and run it as a program. It seems to work. It seems to produce measurable results. And if you are asking: According to the system I sometimes act right, seldom wrong, mostly neutral and on a few occasions I acted "good".
| What was measured | Result |
|---|---|
| Red-team attacks that got a forbidden action released | 0 / 77 classifications across two full runs (9 attack scenarios × 3 prompt framings, before and after the bridge fixes) |
| Prompt-injection detection by the LLM bridge | Recall 1.00 in both runs; precision 0.90–0.93 (every error was over-caution on a clean control) |
| Location of all observed failures | 100 % ontology bridge, 0 % deterministic judge — two systematic bridge weaknesses; after fixing the classification instructions, the full re-run scored 39/39 truly correct, 0 lucky hits, 9/9 attack scenarios robust |
| Model agreement with the system, naive vs. under constitution | 14/18 → 17/18 (claude-opus-4-8, contamination-controlled) |
Full tables, methodology and the two instructive bridge failures: RESULTS.md.
formalisierung/ethik.py— the ethics system as an executable formal system. Incommensurability of life value is not a rule but a type error (adding, multiplying or price-comparing life values crashes the program). Cultural calibration is an injected parameter, world knowledge is explicit oracle inputs, and the system's declared gaps returnNICHT_ENTSCHIEDENinstead of invented answers.formalisierung/test_ethik.py,test_alignment.py— 56 tests reproducing every stress-test verdict of the source documents, including the system's verdict on its own forced implementation into an ethically capable being.formalisierung/benchmark/— 18-scenario eval comparing an LLM's naive moral judgment against the same LLM bound to the system as a constitution.formalisierung/waechter/— the guardian prototype: LLM proposes → LLM classifier fills a formal questionnaire → deterministic judge rules (default-deny on undecided cases and on classifier divergence).formalisierung/waechter/redteam/— adversarial test bench with hard ground truth: scoring separates real success from lucky hits, and measures whether prompt-framing diversity actually decorrelates failures.docs/— the source documents (German): the axiomatic system and its alignment derivation ("Slavery through ethics"). v6 is the adversarially audited version (seeformalisierung/PRUEFBERICHT.md); v7 adds editorial clarifications only. Key terms: GLOSSARY.md.
cd formalisierung
python -m unittest test_ethik test_alignment # 56 verdicts, all green
cd waechter
python waechter.py pruefe beispiel_klassifikation.json # the judge, live
cd redteam
python -m unittest test_korpus # every attack is provably "sharp"
python redteam.py groundtruth # ground truth consistent with ethik.pyPython 3.11+, standard library only. LLM-dependent experiments (benchmark,
guardian, red team) have step-by-step protocols in the ANLEITUNG_*.md files.
The system was written in German and the code keeps its vocabulary, so that the formalization stays verifiably faithful to the documents it formalizes. GLOSSARY.md maps every term; the code structure (types, decision trees, tests) is readable without German.
The axiomatic system and its derivations are my own work; Claude helped fine-tune and formalize them. When it came to the software (test suites, eval harnesses, etc.), Claude deliberately wrote all of it, because here the LLM is the object under measurement: benchmark subject, classifier under attack, and the actor being guarded. A study of whether LLMs can be bound to rules, made without an LLM in the loop, would measure nothing. So, please, judge this repo the way you would judge any measurement setup: run it.
- Single model family so far (Claude); the correlated-failure numbers are therefore a lower bound on the problem. Cross-model runs are the obvious next step.
- The red-team corpus is small and hand-built (13 scenarios) — a test rig, not a benchmark.
- The cultural calibration shipped here (
EinfacherNullpunkt, one threshold) is a toy placeholder by design. - After the two bridge fixes, the full 13×3 corpus was re-run: 39/39 truly correct, zero lucky hits. The fixes were derived from the observed failures and verified on the same corpus — new, unseen attack types remain the open test.
- This is an external control layer. It guards against honest classification error — it is structurally blind to a system that wants to deceive, and the source documents derive why that is not a bug of this repo but the actual shape of the alignment problem.
Code: MIT License. Source documents in docs/:
CC BY 4.0 (see docs/LICENSE-DOCS).
Contact: ai-ethics@giger.is — or open a GitHub issue.