Unsolvable by Design: Turning AI Plans Into Security Guarantees

Opening — Why this matters now

AI systems are no longer just generating outputs—they are executing plans. From automated workflows to agentic systems, we are increasingly delegating sequences of decisions to machines. The problem is not whether these systems can act, but whether they might act in ways we did not anticipate.

Traditional safeguards—rules, filters, monitoring—are reactive. They detect or mitigate undesirable outcomes after the system has already found a path to them.

The paper introduces a more structural idea: what if we could redesign the system so that harmful outcomes are not just unlikely, but mathematically impossible?

That shift—from detection to impossibility—is the essence of planning task shielding. fileciteturn0file0

Background — Planning, but inverted

Classical AI planning is straightforward: given an initial state and a goal, find a sequence of actions (a plan) that achieves that goal.

Formally, a planning task is:

Normally, we ask: Can we reach G from I?

This paper asks a more uncomfortable question:

What if G represents a failure condition—a state that must never happen?

In that case, the existence of a plan is not success—it is a vulnerability.

This inversion is subtle but profound. Planning becomes a tool for finding exploits, not solutions.

Analysis — From detection to structural repair

Step 1: Find all failure paths

Instead of generating a single optimal plan, the system enumerates all possible plans that lead to the undesirable state.

Each plan is effectively a “failure trajectory”—a sequence of actions that exposes a weakness in the system design.

Step 2: Break all of them—minimally

Rather than manually patching one flaw at a time (which often introduces new ones), the paper proposes a global optimization approach:

• Modify the system’s actions
• Ensure every failure path becomes invalid
• Do so with the minimum number of changes

This is where the method becomes interesting.

The ALLMIN Approach — Optimization as defense

The proposed algorithm, ALLMIN, operates in two phases:

The second phase is formulated as a Mixed-Integer Linear Program (MILP).

What can be modified?

The system restricts modifications to three types:

These are not arbitrary changes—they are carefully chosen because they monotonically reduce the number of valid plans.

In other words: every modification shrinks the space of possible behaviors.

Objective: Minimal disruption

The optimization goal is simple:

This matters in practice. Over-constraining a system can make it unusable. The goal is not to cripple the system—but to surgically remove its vulnerabilities.

Findings — Efficiency vs. complexity trade-off

The empirical results are modest but revealing.

Key performance trends

Interpretation

1. Efficiency in overlap The number of required modifications is less than the number of failure paths. → The algorithm identifies shared vulnerabilities across multiple plans.

2. Exponential time cost Computation time grows rapidly with system complexity. → The bottleneck shifts from plan generation to optimization.

3. Balanced modification types No strong bias toward any specific modification strategy. → Suggests flexibility, but also lack of domain-specific prioritization.

Where time goes

This is a familiar pattern: enumeration scales linearly-ish, optimization explodes combinatorially.

Implications — Why this matters for real systems

1. From monitoring to guarantees

Most AI safety today is probabilistic:

• “The model is unlikely to produce harmful output.”
• “We filter unsafe responses.”

This approach offers something stronger:

“There exists no sequence of actions that can produce the harmful outcome.”

That is a formal guarantee, not a heuristic.

2. Agentic AI needs structural safety

As systems evolve into autonomous agents—planning, executing, iterating—this becomes critical.

A single overlooked path can lead to:

• Financial loss (automated trading agents)
• Compliance breaches (workflow automation)
• Security exploits (API orchestration)

Shielding transforms safety from runtime control to design-time constraint.

3. Minimal intervention is economically relevant

In enterprise systems, every rule change has cost:

• Engineering overhead
• Operational friction
• Reduced flexibility

The “minimal modification” objective aligns directly with business reality: fix only what is necessary.

4. A new lens for AI governance

This framework implicitly suggests a regulatory direction:

It is closer to formal verification than policy enforcement.

Limitations — Where the idea strains

Let’s not romanticize it.

1. Scalability MILP does not scale gracefully. Real-world systems may be too large.

2. Model dependence The guarantee is only as good as the model of the system.

3. No preference structure All modifications are treated equally—real systems have priorities.

4. Static assumptions Dynamic environments (e.g., markets, user behavior) complicate guarantees.

In short: elegant theory, but still early-stage engineering.

Conclusion — Designing systems that cannot fail (in specific ways)

The core idea is deceptively simple:

Instead of preventing bad outcomes, remove the possibility of reaching them.

This reframes AI safety from a probabilistic discipline into a structural one.

For businesses, this is not just academic curiosity. It hints at a future where:

• Compliance is encoded, not audited
• Risks are eliminated at the design level
• AI systems are constrained with mathematical rigor

The real question is not whether this approach will scale.

It is whether we are willing to redesign systems so that failure is not merely unlikely—but logically excluded.

Cognaptus: Automate the Present, Incubate the Future.