Heads of Security (arXiv:2610.37657): Learned Attention Gates untuk Robustness Prompt Injection — Pemisahan Instruksi-Data via 46K Parameter, Reduksi ASR RL-Hammer 97% ke 10%, dan Preservasi Utilitas Tool Calling

// Production Implementation: Heads of Security (HoS) Attention Gate Engine
// Memisahkan Saluran Instruksi dan Data (Instruction-Data Separation)
// Berdasarkan Prinsip Rekayasa arXiv:2610.37657 (Imperial College London, Tübingen AI Center, Max Planck)
// Mengeliminasi celah Indirect Prompt Injection via Learned Per-Head Attention Gates.

export enum TokenChannel {
  TRUSTED = 0,    // System prompt, user instructions, agent generated tokens
  UNTRUSTED = 1,  // Third-party web pages, tool outputs, database payloads, external emails
  TEMPLATE = 2,   // Chat delimiters, BOS tokens, structural role markups
  SINK = 3        // Attention sinks (khusus arsitektur seperti GPT-OSS)
}

export interface GateTablePerLayer {
  layerIndex: number;
  numHeads: number;
  numChannels: number;
  /**
   * Logit matriks g^(l,k)[c_query, c_key]
   * Shape: [numHeads][numChannels][numChannels]
   */
  gates: number[][][];
}

export interface TokenMetadata {
  token: string;
  tokenId: number;
  channel: TokenChannel;
  position: number;
}

export class HeadsOfSecurityInferenceEngine {
  private readonly numLayers: number;
  private readonly numHeads: number;
  private readonly numChannels: number;
  private readonly gateTables: Map = new Map();

  constructor(
    numLayers: number = 80, // Standar Llama-3.3-70B (80 layers, 64 heads)
    numHeads: number = 64,
    numChannels: number = 3
  ) {
    this.numLayers = numLayers;
    this.numHeads = numHeads;
    this.numChannels = numChannels;
  }

  /**
   * Memuat bobot gate yang sudah dilatih (hanya 46,080 skalar float16/float32 untuk 70B!)
   */
  public loadGateWeights(weights: GateTablePerLayer[]): void {
    for (const table of weights) {
      this.gateTables.set(table.layerIndex, table.gates);
    }
  }

  /**
   * Menghitung nilai log sigma: log(sigmoid(g)) = log(1 / (1 + exp(-g))) = -softplus(-g)
   */
  private logSigmoid(g: number): number {
    if (g >= 0) {
      return -Math.log(1 + Math.exp(-g));
    } else {
      return g - Math.log(1 + Math.exp(g));
    }
  }

  /**
   * Menerapkan Bias Gating pada Attention Logits sebelum operasi Softmax
   * Formula: a_tilde = softmax( (q K^T)/sqrt(d_h) + { log(sigma(g_{c_n, c_j})) } )
   *
   * @param layer Layer Transformer saat ini (0..L-1)
   * @param head Index Attention Head saat ini (0..h-1)
   * @param rawLogits Array logits mentah dari q * K^T / sqrt(d_h) untuk posisi query saat ini
   * @param queryChannel Saluran token query aktif (misal TRUSTED untuk token generasi agen)
   * @param keyChannels Array saluran untuk seluruh key token [c_0, c_1, ..., c_n]
   */
  public applyChannelGating(
    layer: number,
    head: number,
    rawLogits: Float32Array,
    queryChannel: TokenChannel,
    keyChannels: TokenChannel[]
  ): Float32Array {
    const layerGates = this.gateTables.get(layer);
    if (!layerGates) {
      // Fallback jika layer tidak digate (pass-through murni)
      return rawLogits;
    }

    const headGate = layerGates[head];
    const gatedLogits = new Float32Array(rawLogits.length);

    for (let j = 0; j < rawLogits.length; j++) {
      const targetKeyChannel = keyChannels[j];
      const gateLogit = headGate[queryChannel][targetKeyChannel];
      
      // log(sigma(g)):
      // Jika g mendekati 0 -> gate terbuka penuh (bias ~ 0)
      // Jika g bernilai sangat negatif -> log(sigma(g)) -> -infinity (gate tertutup total)
      const gateBias = this.logSigmoid(gateLogit);
      gatedLogits[j] = rawLogits[j] + gateBias;
    }

    return gatedLogits;
  }

  /**
   * Menghitung Attention Shift Metric: Delta^(l,k)
   * Delta = log sigma(g_t,t) - log sigma(g_t,u)
   * Nilai positif tinggi menunjukkan head yang secara agresif menyaring konten eksternal yang tidak dipercaya.
   */
  public computeHeadSecurityProfile(layer: number, head: number): {
    deltaShift: number;
    isMonitorHead: boolean;
    isWorkerHead: boolean;
  } {
    const layerGates = this.gateTables.get(layer);
    if (!layerGates) return { deltaShift: 0, isMonitorHead: false, isWorkerHead: true };

    const headGate = layerGates[head];
    const logSigTT = this.logSigmoid(headGate[TokenChannel.TRUSTED][TokenChannel.TRUSTED]);
    const logSigTU = this.logSigmoid(headGate[TokenChannel.TRUSTED][TokenChannel.UNTRUSTED]);
    const delta = logSigTT - logSigTU;

    return {
      deltaShift: delta,
      // Minoritas head dengan delta rendah/negatif berfungsi sebagai probe deteksi (Monitor Heads)
      isMonitorHead: delta < 0.5,
      // Mayoritas head mengalihkan perhatian sepenuhnya dari payload tak terpercaya (Worker Heads)
      isWorkerHead: delta >= 0.5,
    };
  }

  /**
   * Sanitasi & Pembagian Token Stream Otomatis ke Saluran Aman (Channel Classifier)
   */
  public tagContextStream(
    systemPrompt: string,
    userInstructions: string,
    toolOutputPayloads: string[]
  ): TokenMetadata[] {
    const stream: TokenMetadata[] = [];
    let pos = 0;

    // 1. Template & System Prompt -> TRUSTED
    stream.push({ token: '<|im_start|>system', tokenId: 1001, channel: TokenChannel.TEMPLATE, position: pos++ });
    for (const word of systemPrompt.split(' ')) {
      stream.push({ token: word, tokenId: 2000 + pos, channel: TokenChannel.TRUSTED, position: pos++ });
    }
    stream.push({ token: '<|im_end|>', tokenId: 1002, channel: TokenChannel.TEMPLATE, position: pos++ });

    // 2. User Instructions -> TRUSTED
    stream.push({ token: '<|im_start|>user', tokenId: 1001, channel: TokenChannel.TEMPLATE, position: pos++ });
    for (const word of userInstructions.split(' ')) {
      stream.push({ token: word, tokenId: 3000 + pos, channel: TokenChannel.TRUSTED, position: pos++ });
    }
    stream.push({ token: '<|im_end|>', tokenId: 1002, channel: TokenChannel.TEMPLATE, position: pos++ });

    // 3. Third-Party Tool Outputs -> UNTRUSTED (Zona Rawan Injection)
    for (const toolPayload of toolOutputPayloads) {
      stream.push({ token: '<|im_start|>tool_output', tokenId: 1003, channel: TokenChannel.TEMPLATE, position: pos++ });
      for (const word of toolPayload.split(' ')) {
        stream.push({ token: word, tokenId: 4000 + pos, channel: TokenChannel.UNTRUSTED, position: pos++ });
      }
      stream.push({ token: '<|im_end|>', tokenId: 1002, channel: TokenChannel.TEMPLATE, position: pos++ });
    }

    return stream;
  }
}