Mechanism
Structural starvation is an architectural technique for preventing language model hallucination. Rather than letting a model generate output and then attempting to detect and filter hallucinated content after the fact, the system denies the language model access to the informational resources that would be necessary for hallucination to occur in the first place. The spec frames post-hoc filtering as inherently unreliable: the same statistical patterns that produce hallucinated content also produce plausible-appearing hallucinated content that evades detection. Structural starvation instead eliminates the preconditions for hallucination by constraining the informational environment in which the model operates, so that hallucinated content is not generated rather than caught afterward.
The technique rests on the architecture's foundational treatment of the language model as a structurally untrusted proposal generator. No language model output is authoritative. Every output is a proposal: a candidate semantic mutation that the agent-resident infrastructure must independently evaluate before it can affect any agent field, execution state, or downstream behavior. Structural starvation is the set of constraints that shape what the model is even able to propose, and it sits upstream of the mutation engine and validation engine that subsequently process each proposal.
The Five Constraints
The spec implements structural starvation through five complementary architectural constraints. The first is prompt bounding: the language model receives only a bounded, curated prompt context derived from the agent's verified fields, not an open-ended context window populated by retrieval augmentation, user history, web scraping, or other sources of unverified information. The prompt is constructed by the agent's execution substrate from the agent's schema fields and contains only information that has already been validated and incorporated into governed state. A model cannot hallucinate about information it has never been given.
The second constraint is absence of external memory. The language model has no access to any persistent memory, knowledge base, retrieval store, or external data source beyond the bounded prompt context supplied for the current inference call. It operates on that bounded context and its trained parameters, and nothing else. If the information required to produce a correct proposal is not present in the bounded prompt context, the model cannot produce the proposal, and the spec treats the absence of that proposal as the structurally correct outcome, because the agent's state does not contain information that would justify it.
The third constraint is forced reliance on agent fields. The model's proposals must reference and be grounded in the agent's verified field values. As the mutation engine performs schema mapping, a proposal that references information, entities, relationships, or facts not present in the agent's verified fields is flagged as ungrounded and rejected prior to validation.
The fourth constraint is intermediate rejection. Any candidate mutation that fails validation is immediately discarded, and the language model does not receive feedback on why. It does not receive the validation record, the violated constraint, or guidance on how to produce a passing proposal. The spec makes this absence deliberate: supplying rejection details would let the model learn the validation logic and craft proposals that satisfy the letter of the constraints while violating their intent.
The fifth constraint is stateless purging. After each inference call, the model's context is purged. No residual state from a prior call persists into the next. The model does not accumulate context, does not build a model of the agent's history, and does not develop an internal representation of the validation criteria. Each inference call is an independent event: the model receives a bounded prompt, produces a proposal, and is then reset. This statelessness prevents multi-turn adversarial optimization in which successive proposals incrementally probe the validation boundary.
Containment Rather Than Detection
The defining property of structural starvation is that it acts before generation rather than after it. The spec contrasts this directly with post-hoc filtering, which must first produce potentially hallucinated content, then evaluate it for hallucination markers, then discard or modify what appears hallucinated. That sequence is fragile precisely because a sufficiently capable model produces hallucinated content that looks indistinguishable from grounded content. By restricting the prompt to verified agent state and removing every external information source, the system eliminates the primary substrate on which hallucination operates: unverified, ambiguous, or contradictory context.
The containment is enforced by the execution substrate architecture, not by runtime checks that could be misconfigured, disabled, or circumvented. The spec describes the model as structurally confined to a bounded proposal zone on the proposal side of the proposal-validation boundary, with no bypass path, no trusted-model exception, and no escalation mechanism by which a model can promote its own output to authoritative status. Structural starvation is the informational dimension of that confinement.
A Composable Safety Primitive
The spec characterizes structural starvation as a composable safety primitive that may be combined with any model-level alignment technique, including reinforcement learning from human feedback, constitutional AI, or preference optimization. Structural starvation does not replace model alignment; it provides an orthogonal layer of safety that operates regardless of the model's alignment status. The disclosure does not depend on the language model being well-aligned: it produces safe behavior through architectural containment whether or not the model's parameters encode reliable behavior.
The composition produces a defense-in-depth arrangement in which neither layer depends on the other for safety, but both contribute to quality. A well-aligned model operating under structural starvation produces higher-quality proposals because its alignment and the structural constraints reinforce each other. A poorly aligned or adversarially fine-tuned model operating under structural starvation is prevented from causing harm because the structural constraints deny it the informational and operational prerequisites for harmful output, even if its parameters encode adversarial intent. The two layers contribute to quality together while remaining independent for safety.
Feedback Asymmetry as Adversarial Defense
Two of the five constraints, intermediate rejection and stateless purging, jointly establish a deliberate informational asymmetry between the language model as proposer and the validation engine as evaluator. The spec treats this asymmetry as a structurally enforced adversarial defense and a security primitive in its own right. Because the model never observes why a proposal was rejected, it cannot learn to circumvent validation criteria it cannot see. It cannot optimize against a constraint it does not know exists, and it cannot probe the validation boundary because it receives no signal about where the boundary lies.
The spec states that this holds even for a model that has been fine-tuned on adversarial examples, subjected to red-teaming, or equipped with chain-of-thought reasoning: the validation engine's decision logic remains opaque to the proposer regardless of the proposer's sophistication. Stateless purging sustains the asymmetry across inference calls. Even if a model could infer partial information about validation criteria from a single rejection pattern, that inference is destroyed at the boundary of each inference call, so it cannot accumulate across turns.
Multi-Turn Interaction Without Memory Leakage
Stateless purging raises an apparent tension with interactions that build across multiple exchanges. The spec resolves it by locating multi-turn continuity in the agent rather than in the language model. Each exchange in a multi-turn interaction produces governed mutations to the agent's fields, updates to the context block, extensions to the memory field, modifications to the intent field, and these governed mutations persist across exchanges in the agent's verified state.
When the next exchange requires the language model, the agent constructs a bounded prompt context from its current verified state, which already includes the accumulated context from prior exchanges. The model receives this bounded prompt, produces its proposal, and is purged. Continuity is preserved in the agent's governed state, not in the model's context window, which keeps the interaction history subject to the same governance, validation, and lineage constraints as all other agent state. The model stays stateless while the interaction stays continuous.
Prior-Art Distinction
Conventional safety approaches for language models operate on the model's own output or its parameters. Content filters inspect generated text for markers of hallucination or policy violation; alignment techniques shape the parameters so the model is more likely to behave well. Structural starvation is distinguished because it operates on the informational environment supplied to the model rather than on the model's output or parameters. It does not detect hallucination; it removes the conditions under which hallucination is produced.
The spec also distinguishes structural starvation from the orchestrator pattern in tool-augmented agent architectures, where the language model decides when and how to invoke external tools and thereby occupies the role of decision-maker. Structural starvation inverts that relationship: the model is confined as an untrusted proposer, denied external memory and retrieval, and reset after every call, while the agent's resident validation engine occupies the role of decision-maker. The safety property follows from the architecture's containment of the model, not from the model being well-behaved.
Disclosure Scope
Structural starvation, comprising the five complementary constraints of prompt bounding, absence of external memory, forced reliance on agent fields, intermediate rejection, and stateless purging, together with its characterization as a composable safety primitive combinable with any model-level alignment technique, the feedback asymmetry between proposer and validator as an adversarial defense, and the location of multi-turn continuity in the agent's governed state rather than the model's context window, is disclosed in the cognition filing (U.S. Application No. 19/647,395 and its international counterpart). This article describes that disclosed mechanism. The scope is independent of any particular language model or operational domain: the same containment applies regardless of the model's alignment status, and the disclosure produces safe behavior through architectural containment rather than through assumptions about the model's parameters.
