“Sovereign AI without Sovereign Defense is just Sovereign Risk.”
Every country is building Sovereign AI.
None are building Sovereign AI Defense.
Until now.
Over the last 18 months, democracies have committed over USD 10Bto build Sovereign AI. None have prepared a defense layer for the autonomous agents they’re building.
This is not an oversight. It is a structural vulnerability. Today, that gap has its first open, operational, community-governed answer — MIT-licensed, 314 behavioral rules, already shipping in Cisco, Microsoft, NVIDIA, Meta, and IBM security stacks.
Why Sovereign AI became a national imperative
AI is no longer a tool. It is the core of next-era national competitiveness — whoever controls AI controls the future of economic, military, diplomatic, and cultural voice. Over the last 18 months, democratic allies have signed over USD 10B in Sovereign AI commitments:
The driver is sovereignty anxiety — no country wants its critical data and intelligence running in US clouds, nor wants to be shut off or censored by foreign platforms at critical moments.
Every country now owns its AI. None owns its AI Defense.
These countries have their own models and their own compute. But when those AI systems become agents — autonomous actors, tool users, MCP clients, transaction executors — no widely accepted agent security detection standard exists.
The current reality: sovereign AI customers source their security layer from US-private vendors running proprietary rule sets and black-box models. This reproduces exactly the dependency that Sovereign AI was created to escape. You can own your AI, but still have to rent the knowledge that defends it — that is incomplete sovereignty.
ATR — the open standard that fills the missing layer
MIT License · 314 behavioral rules · protocol-agnostic · behavior-based. Derived from real attack corpora, classified to NVIDIA garak / OWASP Agentic / MITRE ATLAS taxonomies. Adoptable by any country, contributable by any organization. No geopolitical risk. No vendor lock-in.
ATR detects behavioral intent, not string signatures. Attackers who rephrase prompts, repackage payloads, or restructure attack chains cannot evade it, because the detection target is the causal structure of the attack. Each attack has to be redesigned — cost rises exponentially.
Already shipping across the major democratic security stacks
43 days solo · 0 → 314 rules · 6 ecosystem integrations · 30+ PRs in flight · Apache 2.0 academic edition · DOI 10.5281/zenodo.19178002
An open standard, governed by its contributors
ATR is not a single lab’s or vendor’s deliverable. Every rule passes through a public, auditable pipeline: pull request → automated safety gate → community review → merge → npm publish. Governance rules are codified in GOVERNANCE.md; every rule carries provenance metadata; any contributor can challenge, correct, or extend the taxonomy.
If this proposal resonates with your organization, there are three levels of participation:
- →Contribute rules: translate AI agent attack samples you've observed into ATR YAML rule PRs
- →Contribute probes: define new attack classes so rule generation can be systematically mapped
- →Contribute validation: test FP/Recall against real attack corpora, surface detection gaps
Open governance is itself a structural requirement for Sovereign AI Defense — attacks are not defined by a single lab, and defense should not be defined by a single vendor.
Why Taiwan is positioned to be the first reference deployment
Taiwan will not own this standard. Taiwan will be the first to adopt it — like the first bank to deploy Linux, or the first government to adopt OpenSSL.
Who we're looking for
ATR is MIT-licensed. This proposal has no exclusivity. If you believe the Sovereign AI era needs a corresponding open Defense standard, we invite the following groups to make contact:
- Governments · public sector · national cybersecurity agenciesAny jurisdiction willing to adopt ATR as an AI agent security reference framework, or to provide anonymized attack samples for rule development.
- Enterprise security teams · CISOsFinance, telecom, healthcare, critical infrastructure — teams that want to deploy ATR into their agent runtime before Mythos-class threats arrive.
- Research institutions · academic labsGroups working on AI agent attacks, red-teaming, or threat intelligence who want to use ATR as a benchmark or contribute rules.
- Open-source communities · standards bodiesOpenSSF, OWASP, MITRE, CSA, Linux Foundation, ROOST — any partner willing to help integrate ATR into the existing security standards ecosystem.
- Security vendors · tool buildersTeams willing to integrate ATR rules into existing products (SIEM, SOC, agent runtime, MCP gateways).
- Journalists · analysts · policy researchersIf you're reporting on or researching Sovereign AI, agent security, or global AI governance, this proposal is open to citation, scrutiny, and challenge.
Help this gap become visible
The distribution of this manifesto directly shortens the timeline to adoption. A share is a vote that this layer should exist.