Regulatory and Acquisition Framework

Defense AI is governed by a stack of overlapping authorities that commercial development never confronts. DoDD 3000.09 (Autonomy in Weapon Systems) requires that autonomous and semi-autonomous systems be designed to allow commanders and operators to exercise appropriate levels of human judgment, and that systems undergo rigorous verification and validation establishing they will function as anticipated across the realistic operational envelope. DoDI 5000.97 (Digital Engineering) and the broader DoDI 5000-series acquisition framework push provenance and configuration traceability down to the artifact level, including the data artifacts that shape a model. Executive and DoD AI guidance layers on requirements for traceable, governable, and reliable AI. Above all of this sits the classification regime: content is partitioned across Unclassified, CUI, Secret, Top Secret, and compartmented SCI/SAP boundaries, and the rules that govern which information may combine with which are enforced by law, not by product policy.

A defense model trained on a heterogeneous corpus as if every example were equal training signal cannot satisfy any of these regimes. Classification spillage is a memorization problem: if Secret-derived content is encoded deeply and durably into a model that is later queried at a lower classification, the model becomes a covert exfiltration channel. Adversarial data poisoning is an admissibility problem: a corpus assembled from contested sources may carry deliberately crafted examples whose purpose is to install a behavior the autonomy review would never approve. Acquisition traceability is a provenance problem: a program office that cannot answer which content influenced which capability cannot certify the system it is buying. Depth-selective training governance addresses all three at the same architectural layer, because all three are consequences of an ungoverned gradient.

Why Output-Side and Procedural Controls Fail

The conventional defense posture treats the model as a fixed asset and wraps controls around it: classification guides applied at the prompt boundary, output filters that scan generated text for marked terms, access controls that restrict who may query the deployed model, and red-team exercises conducted after the model is built. Each of these operates after the knowledge is already in the weights. None of them can answer the question the autonomy review actually asks, which is whether the model behaves as designed because of how it was constructed.

Output filtering fails because a model that has deeply encoded restricted content can express that content through paraphrase, inference, and recombination that no marked-term filter catches. Deployment-time access control fails because it governs who may ask, not what the model knows; a model that memorized compartmented content remains a spillage hazard the moment its access boundary is misconfigured. After-the-fact red-teaming fails because it samples a behavior space it can never fully cover, and because it arrives after fielding under accelerated timelines. Post-hoc unlearning fails because removing a learned capability from a converged network without degrading adjacent capabilities is unreliable and unverifiable. The common defect is that every one of these controls is bolted onto an optimization process that was itself ungoverned: the training loop accepted every example, integrated every example to full depth, and recorded nothing about why.

The Inventive Step: Governing the Gradient

Depth-selective training governance, disclosed in Chapter 11 of United States Patent Application 19/647,395, reconceives the training loop as a governed execution environment. The same semantic execution substrate that evaluates agent mutation proposals at runtime is placed inside the training loop, where it evaluates each training example as a proposed semantic mutation to the model. Before any example contributes to a parameter update, the substrate renders an admissibility determination against the example's semantic metadata.

This has an immediate consequence that matters for defense: a training example consisting solely of raw content, without accompanying semantic metadata, cannot be evaluated and is inadmissible by default. Each admissible example must carry, at minimum, an entropy-band classification (the information-theoretic divergence of the example's semantic embedding from the model's current representational state, computed by a KL-divergence or Jensen-Shannon metric), a slope position within the platform's trust-slope hierarchy, a content provenance record identifying source, acquisition pathway, and chain of custody, and a policy scope identifying the governance constraints (classification, handling caveats, temporal validity, exclusion mandates) that apply. The corpus stops being an undifferentiated mass of data and becomes a governed collection of semantically annotated objects, each carrying its own governance profile. For a defense program that is precisely the artifact-level provenance the acquisition framework demands.

The admissibility determination is not a binary admit/reject gate. It is graded. The substrate may admit an example for shallow integration but exclude it from deep integration; admit it with full depth access for one set of layer blocks and suppressed access for another; or admit it with an attenuated contribution magnitude. The mechanism that carries this decision is the entropy-band-indexed training depth profile: a per-layer or per-block contribution-weight vector in which a weight of one permits the full gradient signal to reach a block, a weight of zero prevents any gradient from reaching it, an intermediate weight attenuates by that factor, and a weight greater than one amplifies. The depth profile is the shape of an example's influence across the model's depth dimension, and it is computed from the example's governance metadata rather than from its textual frequency in the corpus.

Embodiments and Deployment Options

The depth-selective aggregation that enforces a depth profile can be realized through several disclosed techniques, and a defense integrator may choose among them based on the model architecture in the program of record.

A gated residual connection embodiment augments each residual shortcut with a gating coefficient derived from the example's depth profile; the coefficient multiplies the gradient flowing through the residual pathway during the backward pass only, so the forward pass and therefore inference behavior is unchanged. An attention-based depth selection embodiment, for transformer architectures, feeds the per-layer depth-profile weight into each layer's attention computation, scaling the gradient that reaches the attention weights and value projections during backpropagation. A layer-specific scaling factor embodiment is architecture-agnostic: it multiplies the backward-pass gradient signal by the depth-profile weight at each layer boundary before accumulation, requiring only the ability to intercept and scale gradients, and therefore applies to convolutional, recurrent, mixture-of-experts, and hybrid networks alike. Because per-layer profiles are impractical for networks of hundreds of layers, the mechanism may operate at block-level granularity, grouping contiguous layers into architecturally meaningful blocks and specifying a per-block weight. In every case the modulation occurs only on the backward pass, the per-example gradient is scaled before accumulation into the block's gradient buffer, and the optimizer downstream operates on the modulated gradient buffer as though it were standard, so the technique drops into an existing pipeline with minimal change.

These embodiments compose with several defense-relevant capabilities also disclosed in Chapter 11:

  • Classification confinement via differential privacy by depth-selective routing. Rather than adding uniform noise to all gradients (the global differential-privacy approach, which calibrates noise to the worst-case sensitivity across the whole corpus and degrades accuracy for content that needs no protection), the depth profile for restricted content specifies high gating coefficients at shallow blocks, where representations are generic and distributed, and low or zero coefficients at deep blocks, where representations are specific, localized, and memorizable. The guarantee is structural rather than statistical: the model cannot memorize what it was not permitted to encode in memorizable layers. For a classification boundary, this converts a policy promise into an architectural property, and non-sensitive content can still train at full depth without paying the accuracy cost.
  • Policy-governed retention and suppression with hierarchical resolution. When a content owner's policy and a governing authority's policy disagree, the deterministic hierarchical resolution logic applies the more restrictive depth restriction and records which policy prevailed. Content that is freely usable is encoded deeply and durably; content admitted under restriction is encoded shallowly and separably; excluded content is not encoded at all. The resulting model's knowledge structure is a governed structure whose depth and durability reflect the governance profile of its sources, which is a far stronger property than removing content after the fact.
  • Content-anchored provenance for poisoning resistance. Provenance records are enriched with an anchored identity derived from the content's own structural-entropy signature rather than from externally attached metadata or watermarks, an identity that persists across format conversion and platform boundaries. Content without a verified anchored identity is flagged provenance-incomplete, and governance policy may restrict it to shallow layers, preventing deep integration of content whose origin and chain of custody cannot be structurally verified. In an adversarial corpus, this caps the depth at which an unverifiable, potentially poisoned example can install a behavior.

Auditable Provenance for Acquisition and Autonomy Review

The semantic substrate operating in the training loop records a comprehensive provenance trail for every iteration, producing a training provenance log that is the training-time analog of the lineage field the platform maintains for agents and inference processes. For each training batch or example the log records the entropy-band classification, the slope position, the depth-aggregation profile (the per-block contribution-weight vector that was applied), the per-layer contribution weight that actually reached each block, the policy objects consulted, and the hierarchical resolution applied. The log is chronologically ordered and append-only: each entry is timestamped, sequentially numbered, and annotated with the training epoch, iteration, and batch index, so entries cannot be retroactively modified, deleted, or reordered without producing detectable inconsistencies in the numbering and timestamp sequence. The log may be periodically sealed using the cryptographic sealing infrastructure disclosed in the cross-referenced governance application, producing tamper-evident checkpoints for third-party verification.

This log answers the questions defense oversight actually poses. A forward query begins with an example or class of content and traces the depth profile, contribution weights, and governance decisions that governed its integration, producing a record of which blocks it influenced and at what magnitude. A reverse query begins with a behavior or capability observed at inference time and traces backward to the training content whose depth profiles encompassed the active layer blocks. The reverse query does not claim exact attribution, because the non-linear dynamics of gradient optimization preclude it, but it returns a bounded attribution set substantially narrower than the full corpus. When a program office must demonstrate that restricted content was not deeply integrated, the log provides the depth-profile records showing the gradient signal was confined to the specified layers and magnitudes. When the question is whether particular content was used at all, the log answers definitively: either the content is present with its full governance record, or its absence is confirmed.

Building on the same records, training-level memorization detection classifies an observed similarity between model output and a known training artifact as shallow (the content was trained under a suppressed depth profile confined to shallow layers, indicating pattern-level rather than conceptual encoding, the expected outcome when restricted content was properly governed), deep (full-depth or deep-weighted integration, which is either policy-compliant or a governance failure the log will identify), or absent (no record of the artifact, so the similarity arises from structurally related content rather than direct training). For classification review, shallow-versus-deep is the decisive distinction between a model that pattern-matched and a model that learned and can therefore leak.

Adoption Pathway

Adoption begins where the compliance pressure is most acute: programs subject to DoDD 3000.09 autonomy review, programs handling CUI or classified training corpora, and programs fielding under accelerated mass-production timelines where after-the-fact red-teaming cannot keep pace. The architecture-agnostic layer-specific scaling embodiment is the lowest-friction entry point, because it intercepts and scales gradients without modifying the model architecture in the program of record, and the append-only provenance log can be stood up alongside an existing pipeline before any depth-selective routing is enabled, giving an immediate acquisition-traceability win.

From there, integrators enable classification confinement for compartmented corpora, content-anchored provenance for corpora assembled from contested or open sources, and memorization detection as a standing control feeding the autonomy review. The same primitive extends to allied and coalition training arrangements, where the hierarchical policy-resolution logic governs which partner's content may train which layers under which caveat, and to fine-tuning provenance, where a deployed model adapted on theater-specific data carries the governance record of that adaptation forward. The depth-selective training governance disclosed in United States Patent Application 19/647,395 positions the control at the layer where high-consequence defense AI and high-stakes oversight currently meet only through procedure, and replaces that procedure with an architectural property of the model itself.

Disclosure Scope

This disclosure covers the application of depth-selective training governance to defense AI systems, including enforcement of classification boundaries through depth-selective gradient confinement, resistance to adversarial corpus poisoning through content-anchored provenance and depth-restricted integration of unverifiable content, and acquisition- and autonomy-review traceability through an append-only, cryptographically sealable training provenance log supporting forward and reverse provenance queries and training-level memorization detection. It covers embodiments realizing depth-selective aggregation through gated residual connections, attention-based depth selection, or architecture-agnostic layer-specific scaling factors, at per-layer or block-level granularity, and deployment options spanning standalone program corpora, coalition and allied training arrangements under hierarchical policy resolution, and governed fine-tuning of fielded models. These mechanisms are disclosed in United States Patent Application 19/647,395. The scope extends to any admissibility predicate, any depth-profile representation, and any provenance serialization, provided the substrate governs the depth of gradient integration and produces a traceable training provenance record.