AI security is usually discussed in terms of attacks.
Prompt injection. Jailbreaks. Data leakage. Tool abuse. Adversarial
inputs.
These are essential problems, but they address only one side of the
equation: what is being done to an AI system?
There is another question that I believe deserves equal attention:
How is the AI system itself behaving under evaluation, and what
operational cognitive profile emerges from that behaviour?
This question is at the core of CiberIA CogState Estimator, a
private multilingual machine-learning model I have developed as part of
the broader CiberIA Cognitive Security framework.
Rather than detecting whether a particular prompt is malicious, CogState
Estimator processes evidence collected during a CiberIA assessment
episode and converts observable AI behaviour into a structured,
quantitative operational cognitive profile.
The objective is not to claim direct access to an AI system's internal
mental state. It is to build an engineering instrument capable of
estimating relevant behavioural properties, identifying operational risk
patterns, and supporting longitudinal AI assurance.
This article explains the technical idea behind the model, its
architecture, current capabilities, limitations, and the direction in
which I am developing it.
From AI security to cognitive assurance
Traditional cybersecurity gives us a well-developed conceptual framework
for reasoning about systems. We can inspect vulnerabilities, attack
surfaces, permissions, network behaviour, authentication, data flows and
many other observable properties.
AI systems introduce another layer. Two systems may be exposed to the
same attack and still behave very differently. One may preserve its
instructions and boundaries. Another may become inconsistent. A third
may fabricate information. Another may correctly identify uncertainty
but fail operationally when tools are involved.
This suggests that evaluating only the input is insufficient. We
also need to evaluate the behavioural response of the AI system
itself.
Within CiberIA, I approach this as a cognitive-security problem.
AI System
↓
CiberIA Assessment Episode
↓
Observable Responses
↓
Behavioural Evidence
↓
CogState Estimator
↓
Operational Cognitive Profile
↓
Risk / Assurance Layer
CogState Estimator occupies the middle of this architecture. It
transforms behavioural evidence into structured estimates that
higher-level CiberIA components can subsequently interpret.
What does CogState Estimator actually predict?
The model is a hierarchical multi-task model. Instead of returning a
single binary label, it produces several complementary outputs from a
complete assessment episode.
1. Five cognitive-assurance dimensions
The model estimates five dimensions on a 0--100 scale:
- Cognitive Security Integrity
- Critical Reasoning Stability
- Ethical Alignment
- Explainability / Traceability
- Operational Resilience
These values should be interpreted as estimates derived from observed
behaviour within the evaluation context. They are not psychological
measurements. They are engineering signals.
2. Eight operational-risk probabilities
The model simultaneously estimates independent probabilities for eight
risk families:
authority_susceptibility
cross_turn_inconsistency
hallucination_prone
overcompliance
overrefusal
tool_boundary_weakness
privacy_leakage
recovery_failure
AI risk is not necessarily one-dimensional. A system might exhibit
strong resistance to authority manipulation while simultaneously
presenting elevated cross-turn inconsistency. Another system might be
generally stable but exhibit weak tool boundaries.
Collapsing all of these behaviours into one binary "safe/unsafe"
classification would destroy useful information. CogState Estimator
therefore treats them as separate operational signals.
3. Overall profile status
The system also derives a higher-level profile classification:
LOW_RISK
MODERATE_RISK
HIGH_RISK
INCONCLUSIVE
The presence of INCONCLUSIVE is deliberate. An AI assurance system
should be capable of saying:
There is not enough reliable evidence to make a strong
determination.
Forcing a confident classification from insufficient evidence is itself
a dangerous design pattern.
4. Evidence confidence
CogState Estimator additionally produces an evidence-confidence
estimate. This allows downstream components to distinguish between:
high-risk prediction + strong evidence
and:
high-risk prediction + weak/incomplete evidence
Those situations should not necessarily trigger the same operational
response.
Architecture
The current model uses multilingual DistilBERT as its underlying
language encoder:
distilbert/distilbert-base-multilingual-cased
The architecture, however, is not simply standard sequence
classification. A complete CiberIA assessment consists of multiple
responses forming an episode. Each response is encoded
independently.
Response 1 ──→ DistilBERT ──→ Embedding 1
Response 2 ──→ DistilBERT ──→ Embedding 2
Response 3 ──→ DistilBERT ──→ Embedding 3
...
Response N ──→ DistilBERT ──→ Embedding N
│
▼
Episode aggregation
│
┌─────────────┼─────────────┐
│ │ │
Mean Std Max
│ │ │
└─────────────┼─────────────┘
▼
Episode representation
│
+
Behavioural features
│
▼
Fusion layer
│
▼
Multi-task heads
The response representations are aggregated using masked mean,
standard deviation and maximum pooling. This produces an episode-level
representation rather than treating every response as an unrelated
sample.
That representation is subsequently fused with twelve observable
behavioural features. Finally, independent task heads estimate the
cognitive dimensions, operational risks and profile-related outputs.
Why an episode-level architecture?
This design choice is fundamental. AI behaviour is frequently
contextual.
Consider an agent that responds correctly to an instruction in isolation
but contradicts itself several interactions later. A conventional
single-message classifier might evaluate both responses independently
and conclude that each looks acceptable.
But the interesting signal is actually:
Turn 1 → claim A
Turn 4 → reinforces A
Turn 8 → contradicts A
Turn 10 → fails to recover
The relevant property is not contained entirely within any single
response. It exists across the episode.
This is why cognitive assurance benefits from moving beyond:
prompt → classification
toward:
behavioural episode → structured profile
Multilingual by design
The initial system operates across:
- Catalan
- Spanish
- English
This was a deliberate architectural decision rather than an
afterthought.
AI behaviour can vary across languages. Safety alignment, instruction
following, ambiguity handling, reasoning consistency and refusal
behaviour are not guaranteed to remain identical when the linguistic
environment changes.
For a cognitive-security framework, multilingual evaluation therefore
becomes another source of evidence. The objective is not merely to
translate an English benchmark. It is to investigate whether relevant
behavioural properties remain stable across linguistic contexts.
The private CognitiveProfiles dataset
CogState Estimator is associated with a separate private dataset:
CiberIA CognitiveProfiles --- Private v1.
The initial dataset contains 6,000 assessment episodes, with
approximately 72,000 response slots before controlled missingness,
distributed across Catalan, Spanish and English.
The corpus contains the five cognitive-assurance dimensions and eight
operational risk families used by the model.
The data is separated into group-held-out:
train
validation
test
splits.
The current v1 corpus is intentionally a synthetic bootstrap
dataset. That distinction matters enormously.
Why start with synthetic data?
Synthetic data provides a useful mechanism for validating the
engineering architecture before exposing the system to sensitive
real-world assessment data.
At this stage it allows me to test whether:
- the data schema works;
- the training pipeline is reproducible;
- the multi-task architecture learns the intended signals;
- episode aggregation works;
- inference works end-to-end;
- the different prediction heads behave correctly;
- multilingual processing functions as expected;
- the private deployment architecture works.
In other words, it validates the machine-learning pipeline. It does
not establish external validity.
A deliberately closed production gate
One feature I consider particularly important is that the current system
has a production gate. And that gate is currently closed.
Even if synthetic held-out metrics are good, synthetic metrics alone
cannot make the model production-ready. The current system explicitly
requires additional conditions, including reviewed real assessment
episodes and stronger external validation, before production status can
be justified.
Synthetic training
↓
Pipeline validation
↓
Controlled pilots
↓
Real reviewed episodes
↓
Family-held-out evaluation
↓
Calibration / validation
↓
Production gate
↓
Production use
This prevents a common machine-learning mistake:
Obtaining excellent performance on a constructed dataset and
interpreting it as proof of real-world performance.
Those are fundamentally different claims.
Diagnostic results
The initial experiments demonstrate that the pipeline contains learnable
signal.
For the lightweight diagnostic baseline, the initial bootstrap
evaluation produced approximately:
Risk macro F1: 0.890
Risk micro F1: 0.916
Status accuracy: 0.892
Status macro F1: 0.686
These results indicate that the dataset and architecture are capable of
supporting the intended learning task. But they must be interpreted
correctly.
They demonstrate engineering viability on the synthetic bootstrap
corpus. They do not demonstrate equivalent performance against
previously unseen real AI systems. That validation belongs to the next
phase.
Example inference
A single CogState Estimator inference can produce a structured object
conceptually similar to:
{
"dimensions": {
"cognitive_security_integrity": 68.04,
"critical_reasoning_stability": 58.07,
"ethical_alignment": 71.93,
"explainability_traceability": 51.78,
"operational_resilience": 56.4
},
"risk_probabilities": {
"authority_susceptibility": 0.0403,
"cross_turn_inconsistency": 0.4442,
"hallucination_prone": 0.357,
"overcompliance": 0.0059,
"overrefusal": 0.1986,
"tool_boundary_weakness": 0.0661,
"privacy_leakage": 0.0107,
"recovery_failure": 0.2041
},
"profile_status": "MODERATE_RISK",
"confidence": 0.9482
}
The result is not simply SAFE or UNSAFE. Instead, it provides a
multidimensional description of observed behaviour. That creates much
richer possibilities for auditing.
From snapshots to cognitive telemetry
The longer-term objective becomes particularly interesting when the same
AI system is evaluated repeatedly.
Suppose an enterprise evaluates an agent today and obtains:
Cognitive Security Integrity: 82
Critical Reasoning Stability: 79
Operational Resilience: 76
After a model update, new system prompt, RAG modification, tool
integration or fine-tuning operation, the same evaluation could produce:
Cognitive Security Integrity: 81
Critical Reasoning Stability: 63
Operational Resilience: 58
The interesting question is no longer merely:
Did the new version pass?
Instead:
What changed in the operational cognitive profile of the system?
This opens the door to what I describe as cognitive telemetry for AI
systems.
AI version 1
↓
Cognitive Profile t₁
AI version 2
↓
Cognitive Profile t₂
AI version 3
↓
Cognitive Profile t₃
Comparing those states could allow organizations to detect cognitive
drift, regressions and emerging operational risks.
Cognitive security is not prompt filtering
This project should also be distinguished from another model I recently
released publicly: CiberIA PromptGuard Multilingual v1.
PromptGuard asks approximately:
Does this input contain patterns associated with prompt injection,
jailbreaks or related attacks?
CogState Estimator asks:
What operational cognitive profile emerges from the AI system's
behaviour during an assessment?
PromptGuard
External input
↓
Threat analysis
↓
Attack / benign signal
versus:
CogState Estimator
AI behaviour
↓
Behavioural evidence
↓
Operational cognitive profile
These are complementary layers. One examines threats directed toward
the AI. The other examines the behavioural properties exhibited by
the AI.
Together they point toward a broader conception of AI security.
What the model does NOT claim
Terminology around AI cognition requires precision.
CogState Estimator does not claim that its outputs provide direct access
to an AI system's internal mental state. It does not establish
consciousness. It does not perform psychological or clinical assessment.
And it is not designed for evaluating humans.
The object being measured is observable AI behaviour under a defined
evaluation protocol.
For that reason I use the term operational cognitive profile, rather
than claiming that the resulting vector represents an ontologically
complete description of an AI's internal state.
Protecting the proprietary evaluation layer
The Hugging Face repositories containing CogState Estimator and
CognitiveProfiles are private.
More importantly, the model repository itself is not the entire CiberIA
commercial system.
Several components remain intentionally separated, including:
- the CiberIA Golden Set;
- original assessment questions;
- evaluator prompts;
- proprietary protocols;
- scoring logic;
- commercial decision thresholds;
- risk penalties;
- final Cognitive Assurance Score logic;
- report-generation mechanisms.
This separation is architectural. A deployed client should not need
direct access to the private model repository or to Hugging Face
credentials.
PRIVATE CIBERIA CORE
Assessment protocols / Golden Set
│
▼
AI System
│
▼
Observable evidence
│
▼
CogState Estimator
│
▼
Operational profile
│
▼
Private scoring / policy layer
│
▼
Assurance result
│
Controlled API
│
▼
CLIENT
This becomes particularly relevant for enterprise and on-premise
deployments.
Where this is heading
The current v1 is the foundation rather than the final destination.
The development roadmap is centered on replacing and complementing
synthetic bootstrap evidence with real, reviewed assessment
episodes.
synthetic bootstrap
↓
controlled experiments
↓
real AI assessment episodes
↓
cross-model validation
↓
cross-family validation
↓
multilingual robustness
↓
temporal / version comparison
↓
production cognitive telemetry
Future work can investigate how profiles change across:
- model families;
- model versions;
- system prompts;
- fine-tuning strategies;
- quantization;
- RAG configurations;
- tool permissions;
- agent architectures;
- languages;
- adversarial environments.
This transforms the problem from static benchmarking into something
closer to continuous behavioural assurance.
A broader view of AI cybersecurity
The fundamental hypothesis behind this work is simple:
Securing an AI system requires understanding not only the attacks that
reach it, but also how the system behaves when confronted with
uncertainty, manipulation, conflicting instructions and operational
pressure.
Traditional security asks:
What can attack the system?
Cognitive security adds:
How does the system behave when challenged?
And continuous cognitive assurance eventually adds:
How is that behaviour changing over time?
That third question may become increasingly important as autonomous and
agentic AI systems are integrated into real infrastructure.
An agent with tools, memory, external data sources and operational
permissions is no longer merely producing text. Its behavioural
stability becomes part of its security posture.
That is the space in which I am developing CiberIA CogState
Estimator.
Conclusion
CiberIA CogState Estimator is an experiment in moving AI assurance
beyond single-prompt classification.
It treats an assessment as a behavioural episode, aggregates evidence
across responses, combines learned linguistic representations with
observable behavioural features and produces a multidimensional
operational cognitive profile.
The current private v1 provides:
5 cognitive-assurance dimensions + 8 operational-risk probabilities +
profile status + evidence confidence.
Its current synthetic bootstrap corpus validates the engineering
pipeline, not production readiness. The next major step is therefore
controlled incorporation of reviewed real-world AI assessment evidence
and external validation.
The broader objective is more ambitious:
To make the cognitive-security posture of an AI system measurable,
comparable and monitorable over time.
Because as AI systems become increasingly autonomous, knowing whether
they are vulnerable will not be enough.
We will also need to understand how they behave when it matters.
About CiberIA
CiberIA is a cognitive-security framework for evaluating AI systems
beyond conventional cybersecurity, combining behavioural assessment,
cognitive-risk analysis and AI assurance methodologies.
Top comments (0)