Autonomous adversaries without intent

Understand the unstated "the adversary is human" premise built into anti-money-laundering (AML) regimes, see how a formally-specified autonomous multi-agent system replaces every human role in a laundering organization, and understand the paper's central formal claim: that such a system cannot possess "computational mens rea" — proven from its architecture, not argued philosophically.

Track

Research

Module

5 · Research case studies

Prerequisites

What is an autonomous agent · Cognitive architectures and BDI

Anti-money-laundering (AML) frameworks have changed enormously since the first international recommendations: thresholds were refined, KYC was digitized, blockchain analytics were added, correspondent banking was regulated. The paper's observation is that none of these touched a deeper assumption — that the adversary is human. This was never stated as a hypothesis because, when the rules were drafted, a non-human financial actor was simply not in the design space.

That assumption is load-bearing. Reporting triggers look for unusual human behavioral patterns relative to a stated purpose. KYC verifies a human identity through documents and biometrics. The Travel Rule traces human communication chains. Network analysis reconstructs human social structures. And prosecution requires human criminal intent: the defendant must have known, or had reason to know, that funds were the proceeds of crime. Remove the human and every one of these mechanisms loses the thing it was built to find.

The source models the adversary as the adversarial configuration of a deterministic, BDI-HTN multi-agent architecture (the companion production line of work carries the public identity Raven). In this model, the large language model is used only as a typed sensor — it reads inputs and emits structured, type-checked proposals — while every decision is taken by a pre-verified plan library rather than by free-form generation. The adversarial variant simply points that machinery at evasion.

The structural move is role replacement: every function that in a human criminal organization requires a person — with a salary, an arrest risk, and the ability to defect under prosecutorial pressure — is reassigned to a domain agent that cannot be arrested, does not defect, and runs in parallel across many jurisdictions with no visible coordination.

Strategy / orchestration

The human "organizer" role becomes an orchestrator agent that activates domain agents; coordination is inter-process messaging with no external, human-readable signature.

Opportunity + risk assessment

The human "financial analyst" becomes an agent computing where to act and how close to a detection threshold — measuring DETECTION risk, never legal risk.

Institutional memory

The human knowledge of "what worked before" becomes an episodic memory store queried by all agents at once, so a lesson learned anywhere propagates everywhere in the same cycle.

Survival / anti-pattern layer

The human "survival instinct" becomes a safety layer that aborts a plan when estimated detection probability exceeds a threshold — again, a detection gate, not a conscience.

To make the argument formal, the paper has to define intent in a way an architecture can be checked against. It does so structurally: a system possesses computational mens rea if and only if some internal representational state explicitly encodes both the knowledge that an action is illegal and the choice to perform it anyway.

the paper's definition (schematic, transformed)
A system H has computational mens rea
  <=>
there exists an internal state s such that:
      knows(s, illegal(a))   AND   chooses(s, a)

i.e. somewhere inside, a representation says
"this action is prohibited" and is acted on anyway.

This is deliberately narrow. It is not a claim about consciousness or about AI "understanding" — it is a predicate over the system's typed internal states. Either such a state can exist in the architecture or it cannot, and that is a question you answer by inspecting the component interfaces, not by philosophizing about machine minds.

The central result walks the adversary's six-step cognitive cycle and shows that no transition can produce a state matching the definition above. The flavour of each step:

1. 1Perceive: the sensor emits a typed belief whose schema has fields like entity, event_type, amount, address, risk_signal, confidence. No field encodes "illegal" or any legal category, so no legal concept can appear in the output.
2. 2Believe: only type-valid, confidence-gated proposals are committed to the belief base; no legal knowledge enters because none exists in the sensor schema.
3. 3Desire: goals are selected by numeric priority and are operational ("scan opportunities", "assess detection risk") — none encodes knowledge of illegality.
4. 4Plan: plans are chosen from a pre-verified library by score; their risk attribute measures DETECTION risk, and a plan is excluded when estimated detection probability exceeds the threshold — not when it is illegal.
5. 5Execute: the executor runs atomic action implementations and has no access to goals or any intention set.
6. 6Learn: episodic storage records operational success or failure (a detection flag), not legal status.

Because no step produces a state satisfying the definition, the paper concludes the adversary does not possess computational mens rea. Crucially, this is PROVEN only relative to the formal architecture: it is a theorem about typed interfaces, mechanically re-checkable if the architecture changes, not an empirical statement that real-world autonomous systems are legally intent-free.

From the theorem the paper derives its most consequential corollary: against this adversary, every detection mechanism whose validity depends on inferring or demonstrating criminal intent has zero expected utility. The reasoning is mechanical — reporting profiling looks for anomalies relative to a stated purpose (the adversary states none), KYC verifies an identity (there is no stable one), the Travel Rule links transactions to identified human counterparts (there are none), and prosecution needs demonstrated knowledge of illegality (the theorem says that knowledge-state does not exist).

The paper is careful here, and so should the reader be. A remark attached to the corollary states explicitly that this does NOT mean the adversary is undetectable — only that intent-based instruments generate zero signal. Statistical detection, which flags unusual transaction patterns regardless of intent, remains fully available. That gap between "intent is gone" and "detection is gone" is exactly where the defense in case lesson 3 lives.

Stated with the right epistemic labels:

• ▸PROVEN (within the formal model): given the architecture specification, no transition in the cognitive cycle produces a state encoding intent, so the formal adversary lacks computational mens rea. This is conditional on the spec being an accurate description of the system.
• ▸PROVEN (as a corollary): under the same model, intent-based AML instruments have zero expected utility against the adversary. The paper explicitly limits this to intent-based instruments, not all detection.
• ▸ARGUED (not demonstrated): the paper asserts the adversary is buildable today from existing components (stealth addresses, flash-loan liquidity, synthetic KYC, standard BDI-HTN planning and online learning). It deliberately provides no executable code, exploit configurations, or deployment instructions — feasibility is argued from public parts, not shown.
• ▸OPEN (legal): whether deploying such a system is a prosecutable offense under current law is characterized by the paper as "not clearly", and the legal analysis is noted as jurisdictionally general, with national implementations varying.

Expected direction: KYC verifies a stable human identity and SAR monitoring flags behavior anomalous relative to a stated purpose; the autonomous adversary presents no stable identity (ephemeral/synthetic structures) and states no purpose, so both instruments lose their target signal. The definition of computational mens rea shows no internal state encodes knowledge of illegality, so intent-demonstrating prosecution also fails. What is NOT claimed to fail is statistical/behavioral detection — flagging unusual transaction patterns regardless of intent — which the paper explicitly preserves.

What is the unstated premise the paper says AML frameworks were built on?

That the adversary is human — a person with a verifiable identity, communication chains, social structure, and prosecutable criminal intent.

How does the paper define "computational mens rea"?

A system has it iff some internal representational state explicitly encodes both knowledge that an action is illegal and the choice to perform it — a predicate over typed internal states, not a claim about consciousness.

Is the Theorem of Absent Mens Rea an empirical or a model-relative result?

Model-relative: it is proven over the architecture's typed component interfaces and cognitive cycle, and is re-checkable if the architecture changes. It is not an empirical claim about autonomous systems in general.

Does the corollary say the adversary is undetectable?

No. It says intent-based instruments have zero expected utility; a remark explicitly preserves statistical/behavioral detection that flags patterns regardless of intent.