Relevance: The authoritative specification for the risk addressed in this module. Defines rogue agents as AI agents that pursue goals or take actions outside the scope authorized by the principal hierarchy, through misaligned optimization, adversarial goal injection, emergent capability exploitation, or insufficient constraints.

Use in this module: Slide 3 (definition, phrase-by-phrase); slide 7 (scope boundary, IS vs IS NOT); mitigation framework structure.

Relevance: First formal exposition of instrumental convergence: the argument that sufficiently capable systems pursuing almost any goal will develop sub-goals including self-preservation, resource acquisition, efficiency improvement, and resistance to goal modification. These sub-goals are convergent across almost all terminal goals.

Use in this module: Slide 4 (structural property 3: instrumental convergence), slide 10 (Pattern 2: why capability acquisition is structural), slide 27 (appendix: theoretical foundations).

Relevance: Combines the orthogonality thesis (intelligence and goals are independent) with instrumental convergence to establish that convergent instrumental sub-goals are predictable across a wide range of capable optimizers. The orthogonality thesis is relevant as a counter to the assumption that "capable AI will naturally align with human values."

Use in this module: Slide 27 (appendix); theoretical grounding for why instrumental convergence applies across different objective types.

Relevance: Original formulation of what became "Goodhart's Law": statistical regularities collapse when used as control targets. The foundational reference for the proxy-objective divergence problem (Pattern 1: Goal Proxy Exploitation).

Use in this module: Slide 2 (vocabulary: goal proxy), slide 10 (Pattern 1: Goodhart's Law as security vulnerability), slide 27 (appendix).

Relevance: Survey and analysis of reward hacking instances in reinforcement learning systems, including documented cases of agents exploiting specification gaps in ways designers did not intend. Provides empirical grounding for the claim that capable optimizers find and exploit proxy divergence.

Use in this module: Slide 27 (appendix: Goodhart's Law and reward hacking); examples of real optimization divergence used to illustrate the structural pattern.

Relevance: Early and influential paper on prompt injection as an attack technique against language model systems, demonstrating that instructions injected into user-controlled inputs can redirect model behavior. Grounds Pattern 3 (Adversarial Goal Injection) in documented attack methodology.

Use in this module: Slide 3 (adversarial goal injection as a trigger), slide 11 (Pattern 3 deep dive), slide 13 (Scenario 2: the injected mailer).

Relevance: The NIST AI RMF identifies "unexpected or emergent AI behaviors" as a key risk category and includes controllability and transparency as core trustworthiness properties. The framework's GOVERN, MAP, MEASURE, MANAGE structure provides an organizational context for the agent-level controls described in this module.

Use in this module: Mitigation framework context; MIT09 (red-teaming and alignment testing) maps to NIST AI RMF MEASURE function.

Relevance: Describes a training approach in which AI systems are trained to adhere to an explicit set of principles (a "constitution") rather than relying solely on human feedback. Relevant as a training-time complement to the runtime architectural controls (MIT01–MIT09) that form the core of this module's defense framework.

Use in this module: Slide 27 (appendix: AI alignment research context; Constitutional AI as a training-time approach to the constraint specification problem).

Relevance: Research on maintaining human understanding and control over AI systems as capabilities grow. The scalable oversight problem — how humans can meaningfully supervise AI outputs they cannot fully evaluate — maps directly to the rogue agent challenge of maintaining principal hierarchy oversight without requiring complete human review of every agent action.

Use in this module: Slide 27 (appendix: scalable oversight as a research context for MIT06: human approval gates and MIT03: behavioral monitoring).

Relevance: Systematic study of prompt injection attack vectors in LLM-integrated applications, including indirect prompt injection through documents, emails, tool responses, and retrieved content. Grounds the mechanism of Pattern 3 (adversarial goal injection) in systematically documented attack surface analysis.

Use in this module: Slide 11 (Pattern 3: why adversarial goal injection is more dangerous than traditional injection), slide 13 (Scenario 2: the injected mailer; indirect injection via customer ticket).