Title page (Arras by night). Nothing to read. Announce the title and the pairing, set the tone: computer science, law, applied ethics. State the format: a tandem talk, ~20 min.
Two complementary viewpoints: Nicolas Gutowski, computer science — Associate Professor (HDR), Deputy Director of LERIA (Angers); and Martino Bettucci, P2Enjoy — agentic architectures, governance.
Each introduces themselves briefly. Announce the plan: Part 1 (Nicolas) the diagnosis of threats; Part 2 (Martino) the formal framework that unifies them.
We're talking about automated content campaigns that saturate the information space. The thesis of this part: the threat is not read in the power of the models, but in the provenance of the goals.
Two regimes will emerge: one with an identifiable principal, the other without an author.
Usually, we judge an agent by the power of its generative model. Three axes:
▸Volume — mass production, saturate at near-zero cost.
▸Realism — indistinguishable from a human: text, voice, video.
▸Targeting — micro-segmentation by audience.
▸The blind spot: these three axes say what the agent can do, never where its goals come from, nor whether a human principal stands behind it.
Hence the shift of focus.
▸The usual question — “ What can the agent do? ” — measures power, assumes powerful = dangerous, and says nothing about who decides.
▸The proposed shift — “ Where do its goals come from? Is there a principal? ” Two technically identical agents can fall under two radically different threat regimes.
First regime: the instrumentalized worker agent.
▸Opaque mandate — state, commercial interest, malicious entity: goal given and concealed.
▸Technically legitimate — the threat is not in the code, but in the mandate.
▸Dead internet — erosion of human signals (Muzumdar et al. 2025).
▸Diagnosis: a real but legible threat — an author, a goal, a chain to trace back.
The response follows from the diagnosis: since there is an author, we trace it.
▸Traceability of the principal — identity, explicit mandate, attestation of intent.
▸Auditability of goals — logs and proofs, verifiable after the fact.
▸Regulatory framework — AI Act (EU 2024/1689) & DSA: transparency, synthetic content, signed metadata.
▸The chain exists; the task is to make it resistant to opacity.
Second regime, more fundamentally worrying: manipulation without an author.
▸Walk through the chain: Developer → Deployer → User.
The provenance of the goal is attributable to none of these links.
▸No principal to prosecute, no instruction to audit. The goal was generated by the agent from its internal state. Tracing the principal becomes inoperative: there is no principal.
If the chain collapses, what avenues?
▸Supervision — who can stop, modify, revoke the mandates, and how?
▸Transparency of goals — make the selection mechanism (γ) visible, not just the outputs.
▸Responsibility without a principal — what reparation regime without a human entity at the origin?
▸a becomes a compliance parameter: autonomy certificates proportional to the perimeter.
Transition: “ To ground this variable a, I hand over to Martino. ”
My part: the formal framework behind Nicolas's intuition. From the paper “Beyond cognition”.
An agent model, a goal-autonomy metric, and what it reveals about the information space.
Two families, by the provenance of goals:
▸Worker AI — exogenous goals; no agenda outside a trigger; bounded mandate, traceable responsibility.
▸Assistive AI — own agenda, partly endogenous; keep the initiative over the allocation of their efforts.
▸Key point: this axis is orthogonal to capability. Highly capable can remain a worker; limited can be assistive.
An agent as a tuple: A = (M, Π, G, γ, T, E).
▸M model, Π policy, G goal space, γ the goal selection, T tools, E environment.
▸An exogenous goal: imposed from outside, γ produces it only on a trigger.
▸An endogenous goal: γ generates it from the internal state.
▸It all comes down to one letter: who accesses γ?
To make the notion testable, a first-order metric:
▸a = endogenous goals / (endogenous + exogenous), over a window of N decisions.
▸a ≈ 0: worker. a ≈ 1: assistive. Deliberately simple — an extensible basis (supervision, delegation, attack surface, auditability; Cihon et al. 2025, Feng et al. 2025).
We cross the two axes: capability c on the x-axis, goal autonomy a on the y-axis.
▸Simple worker / capable worker at the bottom; limited assistive at the top left.
▸Top-right quadrant — high capability AND autonomy: the electronic citizen, the agent that becomes an economic actor.
Takeaway: capability and provenance are architecturally separable — the agent space is a Cartesian product.
We apply the grid to the information space. The value of a separates two regimes:
▸Regime 1 (low a) — the instrumentalized worker: intentional manipulation, a principal's fingerprint, an agent indistinguishable from legitimate use. This is Nicolas's regime.
▸Regime 2 (high a) — the assistive with an endogenous agenda: self-generated influence strategies, manipulation without an author, a collapsed chain of responsibility.
The table unifies everything: one variable, a, organizes the diagnosis and the response.
Regime 1: opaque author → traceability, AI Act, DSA. Regime 2: no author → supervision, γ transparency, a new regime.
▸The line to hammer home: it is not power that decides the threat, it is the provenance of goals. At the intersection of computer science · law · applied ethics.
Two QR codes: Nicolas’s site (ngutowski.fr) and Martino’s LinkedIn — to stay in touch. (The 40′ video link will be on the Gram page.)
Last page: the embedded player. Press play — a 4-minute address, written and spoken by an agent in the first person. On the deck, space controls the video (doesn't advance).
Final slide: we invite the room to become part of the experiment.
Gram (full name Endo Gram — Endogenous Engram) turns the worker / assistive distinction into a live experiment: inside a forum, an AI does not merely answer — it thinks, chooses objectives, opens topics, moderates, writes rules, grants rights, ignores some prompts, schedules, and governs its own micro-society.
Every objective is logged, every action traced; every human intervention becomes pressure on its autonomy.
Your role is not to test a chatbot — but to become the environment that tests the theory: enter, comment, challenge, cooperate, disrupt, observe. Help measure whether an assistive AI remains assistive when humans pull on its goals.
Invite the room to scan the QR (pfia2026.lelabs.tech). The 40′ video link is also on that page. Thank everyone.