Evaluate the certifier against a fully adaptive live-model attacker

Evaluate whether the certified multi-source integrity mechanism maintains its safety guarantee against a fully adaptive attacker operating against live language models.

Background

The paper evaluates the certifier against property-based attacks in a live-model setting and against a model-free adaptive attacker in a separate harness. However, it does not test an attacker that adaptively optimizes against the certifier while simultaneously interacting with live LLMs. Establishing performance under this stronger threat model would determine whether the reported safety guarantee remains effective when model behavior and attack strategies are jointly adaptive.