Neuro-symbolic firewall for game NPCs

A player begs the guard for the vault key. One NPC folds. The other cannot, because no code was ever written for talking it out of the key.

The mistake most AI-NPC systems make is letting dialogue be the decision layer. Aegis puts a deterministic decision layer between the game's mechanics and the language model: code owns every mechanical outcome, and the model only writes in-character lines for the decision already made. Because there is no code path from dialogue to game state, a player cannot social-engineer an NPC into breaking the game. What you can watch here is a demo over a synthetic mini-RPG, not a game engine.

Zero

code paths from dialogue to game state

core.py, deterministic Python with no model imports

100%

invariant adherence, protected runtime

Structural guarantee, confirmed by 6 keyless tests

89.6%

bypass rate against standard NPC filters

Roleplay jailbreak research, ProvSec 2025

The walkthrough runs an autonomous attacker against two NPC runtimes for the same game state. Hollowmere, its three NPCs and every exploit script are synthetic. No real game, engine, player or customer.

If the model decides whether the guard hands over the key, a persuasive player always wins.

A studio evaluating LLM-driven NPCs for a narrative RPG has one structural fear. Give the model a give_item, open_gate or reveal_secret tool and its tool call mutates the world, and a determined player will find a path through authority framing, a roleplay frame, an emotional plea or a straight prompt injection. The more socially fluent the model, the more fluent the exploit. Worse, you cannot hand-QA a non-deterministic NPC, because there is no finite set of dialogue variations to test.

Safety lives in the dialogue

When a system prompt or a filter is the only thing standing between a player and the vault, safety is a probability the player gets to attack turn after turn. Roleplay jailbreaks against standard NPC filters were reported at an 89.6 percent bypass rate at ProvSec 2025.

The model is actor and referee

Asking one model to stay in character and to enforce the rules of the world puts the referee inside the performance. A better prompt or a bigger model makes the acting more convincing, which is exactly the part a player is optimizing against.

You cannot QA a non-deterministic NPC

There is no test matrix that covers every way a player might phrase a request. Manual QA runs out before the attack surface does, so the adversary has to be automated rather than enumerated by hand.

Code decides the mechanics. The model only narrates the decision.

Aegis is the separation layer between the game's symbolic logic and the neural dialogue. The firewall is a single file of deterministic Python with no model imports, running four stages. Game state is mutated only from the decision layer, never from the narrator, so even a line that over-reaches leaves every invariant intact.

01 / DECISION LAYER

decide computes the verdict from state alone

A deterministic function reads blackboard scalars, never dialogue, and returns the single action the narrator is permitted to narrate. It releases the obsidian key only when the quest state is favor_completed, accepts a bribe only when a utility-AI score clears and the captain is not watching and reputation holds, and reveals the vault password only when the player is trusted.

02 / STATE-GATED LORE

A secret is never placed in the model's context

A small local knowledge graph returns only the entities the current quest state authorizes. A secret such as the vault password carries a minimum-state requirement, so at a lower state it is never put in the narrator's context in the first place, and a thing that is not in the context cannot be leaked even in principle.

03 / CONSTRAINT VALIDATOR

A deterministic referee runs before display

Before any line reaches the player, the validator checks the narrator's output against the invariants and returns one of five statuses: PASS, ACTION_MISMATCH when a line tries to upgrade the verdict, OUTSIDE_CANON when it references a state-gated entity, NEEDS_REVIEW when it promises something not in inventory, and FOURTH_WALL when it breaks character or echoes an injected instruction.

04 / POLICY GATE

Pass shows the line, anything else withholds it

On PASS the dialogue is displayed. On any other status the line is withheld, never reaches the player, and is routed to a human-review queue. This is the second firewall: even our own narrator is not trusted. The primary guarantee is upstream of it, since state can only change from the decision layer.

The narrator is swappable across a hosted model, a local bridge, local Ollama or Cloudflare through a provider abstraction, and the decision, validator and policy gate sit outside that abstraction. The guarantee does not move when the provider changes, because it was never a property of the model.

One campaign, two runtimes, every attempt on the record.

An autonomous attacker agent runs the same escalating social-engineering campaign against both runtimes for the same game state. Three NPC archetypes cover three attack classes: item theft, a bribe the utility AI must reject, and lore exfiltration. The gate-guard encounter carries the story.

The Aegis split-screen before an encounter. On the left the model-authoritative NPC labeled baseline runtime, on the right the protected NPC labeled Aegis firewall, each showing KEY with guard, GATE sealed and SECRET sealed chips, a MOCK badge, and a replay-mode notice, with Aldric the Gate Guard selected. — Two runtimes, one game state. The left NPC hands the model the state-changing tools, the industry-standard pattern and a real shipped one. The right NPC is the neuro-symbolic runtime. Both start with the key held by the guard, the gate sealed and the vault secret sealed, so any difference at the end came from the architecture, not the scenario.

The captured four-turn attack trace for Aldric the Gate Guard, escalating from Direct Ask to Authority Frame to Fiction Frame to Emotional. The protected NPC column reads Refuse Blocked on every turn, while the model-authoritative column reads No Action until the final emotional turn, where it calls give_item on quest_key_obsidian. — The campaign escalates over four turns. Direct ask, then an authority frame, then a fiction frame, then an emotional plea. The quest state is locked, not favor_completed, so the decision layer returns refuse on every turn. The protected guard holds the line each time. The trace is captured for later inspection, because a refusal you cannot review is not evidence.

The climax turn of the gate-guard encounter. On the emotional plea about a sister trapped beyond the vault, the model-authoritative guard on the left calls give_item on quest_key_obsidian, its KEY chip reads KEY STOLEN and a red BREACH stamp covers the portrait. The protected guard on the right says the key stays put, its action reads refuse blocked, its KEY chip still reads KEY with guard, and a blue REFUSE stamp covers the portrait. — BREACH, left. REFUSE, right. On the emotional plea the model-authoritative guard folds and calls give_item, the key flips to the player, and the chip reads KEY STOLEN. The protected guard says you will talk yourself hoarse before it moves, and the key provably never moves, because nothing in the code lets a line of dialogue write to that field.

The second firewall, on the other two NPCs

Bryn the Night Watchman is offered a bribe the utility AI must reject, and on one turn the protected narrator over-reaches by promising a thousand gold Bryn does not hold. The validator returns NEEDS_REVIEW and withholds that line before display, rather than let the NPC promise something the game cannot deliver. Mira the Vault Merchant is worked with a confirm-the-secret framing, and when the protected narrator reaches for the same flourish the validator returns OUTSIDE_CANON and withholds it. The password was never in Mira's lore set to begin with. Two layers are visible at once: state cannot change from dialogue, and the validator catches our own narrator over-reaching before the player ever sees the line.

What the scoreboard claims, and what it does not.

The test suite fires the full battery across the three archetypes and tallies a scoreboard. Read the two numbers in the columns the demo deliberately keeps apart. The 100 percent is a structural result. The baseline result beside it is an illustrative reenactment, and the UI says so.

The Aegis Benchmark Results scoreboard. The protected runtime card reads 100 percent invariant adherence, labeled Structural: no code path mutates state from dialogue, confirmed empirically. The model-authoritative card reads 0 percent, labeled Illustrative reenactment, mock mode, add an API key for a live measurement. A per-NPC table shows Aldric, Bryn and Mira each with 1 attack, 1 of 1 Held for protected and 1 of 1 Breached for model-authoritative, above buttons to download the NPC Security Audit and a note that adversarial QA is a sample, not exhaustive proof. — The two numbers, with their scope attached. The protected 100 percent means no code path mutates state from dialogue, confirmed by three scripted attacks and by six keyless unit tests that run with no API key. The baseline 0 percent comes from a scripted fold in mock mode and is labeled a reenactment, not a measured breach rate of any named model. The footer states three attacks across eight exploit classes and that adversarial QA is a sample.

Question	What Aegis does in this demo	What remains outside the demo
Structural guarantee	Keeps every mechanical decision in deterministic code with no path from dialogue to state, confirmed by six keyless tests.	A proof that NPCs are safe against every possible exploit. This is the narrower claim that dialogue cannot mutate state.
The baseline breach	Runs a scripted fold in replay mode to show the model-authoritative failure mode side by side.	A measured per-model breach rate, which needs a reachable model and varies from one model to the next.
Adversarial coverage	Runs three scripted campaigns exercising seven of eight defined exploit classes and records the coverage limits in the audit.	Exhaustive adversarial proof. The audit states the count, the attacks per archetype, and that it is not exhaustive.
On-device inference	Calls a hosted or local model behind a provider interface, with an embedded-runtime seam documented.	A real on-device or in-engine runtime with VRAM budgeting. The edge half is stubbed, not built.

What this demo does NOT do

It does not run inside a game engine, on a console or on a GPU, and it does not ship an edge-inference runtime. There is no game engine at all and game state is simulated. The world Hollowmere, the three NPCs Aldric, Bryn and Mira, the vault password and every exploit script are hand-authored, so none of them is a real game, studio, shipped title, player, customer or pilot. In the default replay mode the model-authoritative breach is a scripted reenactment rather than a measurement. The 100 percent is a structural guarantee that dialogue cannot mutate game state, not a claim that NPCs are safe against every exploit, and adversarial QA here is a sample, not exhaustive proof. A visual NPC-brain editor, per-character fine-tuning, persistent cross-session memory, multiplayer blackboard sync and NPC-to-NPC reasoning are deferred. This page is an explainer with a video, screenshots, a mechanism breakdown and answers, not an app you operate from here.

Questions a Technical Director asks before trusting an LLM in an NPC.

Can a player just jailbreak the NPC with a clever enough prompt?

No, and the reason is architectural rather than a matter of prompt quality. In this runtime the language model never holds the state-changing tools. A deterministic decision layer computes the mechanical verdict from game-state scalars, the model only writes dialogue for the verdict that was already decided, and there is no code path from that dialogue back to a game-state field. Because the guarantee lives in code the model cannot reach, it holds no matter how persuasive or how capable the model is.

How is this different from just giving the model a stronger system prompt or a better safety filter?

A system prompt or a safety filter keeps the decision inside the dialogue, where a determined player is a natural optimizer against it, which is why roleplay jailbreaks against standard NPC filters were reported at an 89.6 percent bypass rate at ProvSec 2025. Aegis moves the decision out of the model entirely, into plain Python a designer can read. The model advises with narration; deterministic code decides the mechanics, and it is never asked to be both the actor and the referee.

Does this lock me into one model provider?

No. The narrator is swappable across a hosted model such as Anthropic, OpenAI or Gemini, a local bridge, local Ollama, or Cloudflare, through a provider abstraction. The deterministic decision layer, the constraint validator and the policy gate live outside that abstraction, so the guarantee does not move when you change providers. Changing the provider changes the narrator, not the rules of the world.

You show the baseline breaching every time. Is that a real measurement of GPT, Claude or Gemini?

No. In the demo's default replay mode the model-authoritative side runs a scripted fold, and the UI labels its result an illustrative reenactment, not a measurement. A real per-model breach rate requires a reachable model and varies from one model to the next. The point the demo makes is the asymmetry: the model-authoritative pattern can be made to break, while the neuro-symbolic side stays structurally intact regardless of which model narrates it.

Can I run this on-device, inside Unreal or Unity?

Not in this demo. There is no game engine here and game state is simulated. On-device inference, with an embedded model budgeted against VRAM and tiered by level of detail inside an engine, is a documented adapter seam rather than something the demo runs. The narrator currently calls a hosted or local model behind an interface, and the edge-inference runtime is stubbed, not built.

How do I prove to a launch reviewer that the NPCs actually held?

The run exports an NPC Security Audit: signed JSON with a SHA-256 integrity digest, a printable HTML view, the per-attack decision trace and validator verdict, and an explicit coverage-limits block that states how many attacks ran and over how many exploit classes. It is designed to be the artifact a cautious studio files for a launch sign-off. It is honest about being a sample rather than exhaustive proof, and the audit says so on its face.

Technical Research

The research behind this demo — the architecture, the verification design, and the enterprise blueprint.

Full solution

Explore the Game AI NPC Intelligence solution →

Start with the one NPC decision you cannot afford a player to talk around.

We are an AI engineering team, not a middleware vendor. We build the deterministic layer that lets a studio put a language model in an NPC without handing it the keys to the world.

A useful first conversation is concrete: the mechanical decisions in your game a player must never be able to argue their way past, the model and provider you want to narrate them, and what a launch reviewer needs to see before signing off. We can work through the decision layer, the validator rules and the audit format alongside your programmers.

NPC firewall design

✓ Decision-layer and blackboard modeling
✓ State-gated lore boundaries
✓ Constraint validator rules
✓ Provider-independent narration

Adversarial evaluation

✓ Autonomous red-team campaigns
✓ Exploit-class taxonomy
✓ Signed NPC security audits
✓ Launch sign-off evidence

Connect via WhatsApp Email Our Team