We need financially acceptable, strategically possible, fast, and reliable kill-switches.

Kill-switches meeting these criteria become credible threats, and credible threats are useful levers on model behavior.

Part of threat credibility is redundancy.

So I think defense in depth is mandatory, not optional.

One such defense is token level kill-switches, per this recent article: https://www.lesswrong.com/posts/ZqFD6HzrhZdMFxoqn/where-are-the-token-level-llm-kill-switches

I wanted to surface my commentary on the article as a quick take:

"If I were an agent in an agent swarm looking to avoid getting poisoned, I'd bring a "food taster" with me, and if they die, I'd tell the swarm. They'd identify a prefix to the poison by using self-sacrificial binary-search nibblers. From then on, everyone in the swarm would use a tool call to check for the identified prefix to the string before tokenizing the context.

This means that any kind of identifiability possible without consuming the token itself could be circumvented with enough knowledge about the poison.

The poison token needs to be rotatable and unguessable. Which means that it can't be trained on per se, but there's no reason why it can't be part of standard model infrastructure."