{"id":"7c0b55d6-adc1-450f-8b48-a72bdfc1a1bf","arxiv_id":"2506.06469","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"The Internet should borrow ecological principles such as local immunity, software mutation, and mutualism to avoid collapse as it scales toward trillions of nodes.","lead":"This paper argues that the Internet, like natural ecosystems, needs immune-system-like defenses, software mutation, and re-decentralization to survive AI-driven attacks and monoculture. It proposes three biologically inspired mechanisms: local 'antibotty' quarantine, protocol-mutation via AI code models, and mutualistic protocols.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The antibotty scheme's 'outraces global botnets' claim is load-bearing but unsecured: the same scan-and-exploit primitive granted to vigilante hosts is available to malware, so a locally-scanning botnet could negate the defense.","rationale":"I read the paper as a deliberately speculative vision and position paper. The authors repeatedly call the proposals 'thought experiments' and list caveats, and the abstract's claim that the Internet can 'integrate adaptation mechanisms into its fabric' is a research agenda rather than an empirical result. What would have to be true for the central claim to hold is that the proposed mechanisms at least do not make the system less secure. The antibotty proposal is the most concrete, and it contains a specific unsupported performance assertion. The 'outraces' argument assumes the adversary scans globally while defenders scan locally. But the defense's own toolkit — scan and exploit remote hosts — can be repurposed by a compromised defender. Once one antibotty node is taken over, the malware has local low-latency access to many hosts and can use the same primitive to compromise them, potentially before other defenders react. This is not a mere implementation detail; it is a failure of the security model. The paper acknowledges the risk but does not resolve it, and the 'hierarchy of controllers' is only a sketch. I therefore focus on this as the load-bearing concern. The reader's weakest assumption — transferability without new failure modes, specifically the vigilante compromise risk — captures the same issue, so I agree. Because the paper is a position piece and explicitly labels the proposals as thought experiments, I would not reject it. The CONDITIONAL verdict already reflects that the overreaching claims need tempering or pilot studies. My concern reinforces that verdict rather than changing it. A simulation or formal analysis of the local-scanning adversary would settle whether the 'outraces' claim can survive an adaptive threat model.","tokens_in":16556,"tokens_out":4205,"duration_ms":46375,"concrete_test":"Simulate an epidemic on a network with two adversary strategies: (A) a classic global-scanning botnet, and (B) a botnet that uses the antibotty local-scan-and-patch primitive as its propagation mechanism. Use an SIR-like model or a packet-level simulator such as ns-3, with defenders running the proposed vigilante protocol and with one compromised antibotty node. Measure time-to-full-compromise under both a non-adaptive adversary (global scanner) and an adaptive adversary that uses the same local-scan/exploit API to compromise neighbors. If the local-scanning botnet achieves full compromise as fast as or faster than the global scanner, the 'outraces' claim fails and the scheme provides no resilience advantage.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that a self-regulating Internet ecology can be built from local immune-style defenses rests on §2.1's assertion that 'the antibotty network approach outraces global botnets because local hosts only need to scan orders of magnitude fewer devices in their vicinity.' This is load-bearing because it is the only concrete quantitative argument for the defense's viability. It is not established, and it fails under an adaptive adversary. The mechanism requires every host to have the capability to scan nearby hosts for malware and 'directly exploit it before a global botnet does to deliberately patch it.' That capability — remote scan, remote exploit, remote modification — is exactly the primitive a botnet needs. The paper attempts to distinguish vigilantes by 'advertising its intent' and by assuming vigilantes are 'not incentivised to exploit the host for personal gain,' but security cannot rest on intent. A malware that compromises one host gains the same local scanning and exploitation capability; a botnet can adopt neighborhood scanning and propagate faster than a global-scanning botnet, eliminating the alleged temporal advantage. The authors themselves flag that 'great care needs to be taken to ensure that the antibotties do not themselves become a threat,' but no technical mechanism is specified beyond a vague 'hierarchy of controllers.' Therefore the core resilience claim depends on an unresolved security paradox: the proposed defense and the attack are the same protocol.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper is a vision/position piece arguing that the Internet has become a software monoculture with no built-in immune system, and that concepts from ecology—local 'antibotty' defenses, AI-generated protocol-compatible mutations, and mutualistic re-decentralization—could make it more resilient as it grows toward a trillion nodes. It is explicitly framed as an inspiration for future research rather than a comprehensive solution, and it contains no implementations, measurements, or formal models. The core thought experiments are presented through an analogy table (Table 1) and three main sections, with a caveats section that acknowledges several open risks.","tokens_in":16751,"tokens_out":6119,"duration_ms":63680,"significance":"If the broad claims held, the paper would open a productive interdisciplinary research agenda connecting ecological theory, network security, and programming languages. Its strengths are its wide-ranging and mostly well-chosen references, its explicit statement that the proposals are thought experiments, and its honest caveats in Section 5 about mutualism not being guaranteed and about local defenses being unable to handle global rapid spread. However, the specific feasibility claims that carry the argument—notably the claim that antibotties 'outrace' botnets and that AI code models can be safely constrained by formal specifications—are not yet supported, and the manuscript's own caveats concede the central open problems. There are no machine-checked proofs or reproducible artifacts to verify, so the contribution is conceptual.","major_comments":[{"comment":"The sentence 'The antibotty network approach outraces global botnets because local hosts only need to scan orders of magnitude fewer devices in their vicinity' is load-bearing for the proposed defense, but it is not established and is unlikely to hold against an adaptive adversary. The paper grants every vigilante host the capability to scan neighbours, exploit a vulnerability, and patch it; that is precisely the primitive a botnet needs, and a botnet that has compromised one host can use the same local-scanning strategy, so the claimed temporal advantage disappears. 'Advertising its intent' and 'not incentivised to exploit' do not constitute security mechanisms. The paper should either weaken this to an explicitly open conjecture with a threat model, or provide a concrete mechanism (e.g., hardware attestation or authenticated patch signing) that gives vigilantes an asymmetric capability.","section":"§2.1"},{"comment":"The feasibility claim that AI code models, 'with sufficient guardrails,' can generate protocol-compatible mutations, and that formal specifications can guide LLMs 'towards generating only permissible protocol messages,' is not supported. The cited systematic review [57] and adversarial-attacks work [101] point to known failure modes, and Section 3.2 itself concedes that malware could guide mutations into new exploits. Because the mutation pipeline is one of the paper's three central defenses, this needs to be reframed as a research challenge with an explicit threat model and a discussion of what selection pressure or fitness function would prevent harmful mutations from spreading; otherwise the claim should be removed.","section":"§3.1"},{"comment":"The paper's own risk acknowledgment, 'great care needs to be taken to ensure that the antibotties do not themselves become a threat' (§2.1), is not backed by any design argument; the proposed 'hierarchy of controllers' (§2.1) and 'capability-based programming' (§3.2) are mentioned as directions, not mechanisms. Because the antibotty concept is the one place where the paper makes a concrete quantitative-sounding claim, the absence of even a sketch of the trust or attestation architecture is a load-bearing gap. The authors should either supply a minimal adversary model showing what property gives vigilantes an advantage, or explicitly mark the scheme as an open problem.","section":"§2.1, §3.2"}],"minor_comments":[{"comment":"The abstract contains a duplicated phrase: 'We take lessons from from biological systems' should be 'We take lessons from biological systems.'","section":"Abstract"},{"comment":"The word 'openess' should be 'openness,' and the phrase 'The Internet now currently lacks' is redundant; 'currently' can be removed.","section":"§1.1"},{"comment":"The section heading 'SCALING THE INTERNET TOW ARDS A TRILLION NODES' contains a stray space; it should read 'TOWARDS.'","section":"§3"},{"comment":"The name 'Ribiero' in the discussion of reference [74] should be spelled 'Ribeiro' to match the cited author.","section":"§2.1"},{"comment":"In the paragraph on sexual reproduction, the sentence 'These combinations may result in produced diverse lifeforms that are not only exciting new options but are also are different from each other and the parent' contains the awkward 'produced' and the duplicated 'are also are'; the sentence should be rewritten.","section":"§3.2"},{"comment":"The row mapping 'Chromosome' to 'Software interfaces, formal specifications' is not used consistently in the text: Section 2, which the table cites, does not return to the chromosome analogy after the introductory mapping.","section":"Table 1"}],"recommendation":"major_revision","confidential_remarks":"This is a manifesto-style vision piece, and its interdisciplinary breadth is a strength. My main concern is the mismatch between the assertive, indicative mood of claims such as 'outraces global botnets' and 'with sufficient guardrails' and the paper's stated goal of inspiring future research rather than providing a comprehensive solution. I would recommend treating the revision as requiring a change of epistemic register—labeling the feasibility claims as explicit conjectures and adding a minimal threat model for the antibotty idea—rather than requiring new experiments. If the venue expects archival technical results, the fit is marginal, but for a decennial, forward-looking venue the topic is appropriate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a deliberately speculative essay, not a technical result. The authors say so, and they mostly stick to that. What is genuinely useful is the collation of older ideas — local worm containment (Vigilante), automated diversity (Larsen et al.), rewilding (Farrell & Berjon) — into one coherent research agenda with three concrete sketches: antibotty vigilante hosts, LLM-guided protocol mutation grounded in formal specs, and re-decentralization toward mutualistic protocols. The writing is clear, the references are appropriate, and the caveats section honestly acknowledges that mutualism isn't guaranteed and that local defenses developed for local pathogens may not handle global threats.\n\nThe soft spot is in §2.1. The paper claims the antibotty approach 'outraces global botnets because local hosts only need to scan orders of magnitude fewer devices in their vicinity.' That is the only concrete quantitative argument, and it is not established. The stress-test concern lands: the scan-and-exploit capability given to vigilante hosts is the same capability malware needs. A botnet that scans locally instead of globally removes the claimed temporal edge; security cannot rest on vigilantes' 'advertising intent' or lack of personal incentive. The authors do flag that antibotties could become a threat and gesture at a 'hierarchy of controllers,' but no mechanism is given. For a thought experiment, this is okay; as a stated performance comparison, it overreaches. It should either be dropped or turned into a real model with an adaptive adversary.\n\nThe rest of the paper is appropriately tentative. The LLM-based mutation idea is explicitly conditional on guardrails and containment layers, and the authors cite existing formal verification and sandboxing work rather than pretending those problems are solved. I don't see circularity or invented entities beyond the reasonable 'antibotty' concept, which is clearly introduced as a portmanteau and a thought experiment.\n\nWho is this for? Someone thinking about Internet architecture and resilience who wants a broad set of biologically-inspired directions in one place. It is not a paper that needs to be refereed for technical correctness; it needs to be engaged with as a framing piece. I would bring it to a reading group only if the group is discussing research agendas rather than results.\n\nRecommendation: send it to review, but with a clear request that the 'outraces' claim be either removed, qualified as a conjecture, or supported with an explicit threat model. The core proposal is a research agenda, and the paper's honesty about its own limits is a point in its favor.","headline":"A clear, honest position piece worth engaging with, but its one quantitative-sounding claim about local containment outrunning botnets does not survive an adaptive adversary.","tokens_in":17401,"tokens_out":2000,"would_cite":false,"duration_ms":21434,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The Internet has no built-in immune system; this paper argues it can evolve one by borrowing from ecology — local antibody-like hosts that contain malware, AI-driven mutation of protocol software to break monoculture, and a shift back to…","keywords":["ecology","protocols","evolution","botnets","malware","containment","code models","re-decentralisation"],"falsifier":"A controlled testbed in which a fast-spreading worm can read the antibotty alert channel would settle the central claim: if the worm propagates faster through that channel than the local scanners can contain it, the containment mechanism fails and becomes a new infection vector.","tokens_in":16305,"feed_emoji":"🧬","tokens_out":7658,"duration_ms":63903,"temperature":0.7,"pith_summary":"This paper argues that the Internet, heading toward a trillion nodes, is dangerously fragile because it has no built-in immune system. It proposes three ecological mechanisms for repairing that: local 'antibotty' hosts that scan and patch neighboring devices before global botnets can; software-stack 'mutations' generated by AI code models under formal protocol constraints, to end the software monoculture; and a re-decentralisation toward mutualistic services. The authors present these as thought experiments and research directions rather than deployed systems, and they flag the risk that the antibody-like defenses themselves could be subverted. If the proposals are right, malware could be contained locally, a single vulnerability would no longer compromise every host at once, and a less centralized, more cooperative network becomes plausible.","feed_headline":"Local hosts could outrace global botnets by patching neighbors","feed_subtitle":"Borrowing from ecology, the Internet could fight malware locally, mutate its software, and re-decentralize.","key_machinery":"The carrying mechanism is the antibotty network, a digital analog of the adaptive immune system in which each host scans only nearby friendly hosts, isolates or patches infected ones, and is coordinated by a hierarchy of scoped controllers so the vigilantes do not themselves become a threat. The second mechanism is 'protocol mutatis mutandis,' directed mutation of protocol implementations by AI code models whose outputs are constrained by formal specifications distilled from the RFC corpus, with mutations inserted and evaluated at containment layers such as hardware protections, unikernels, WebAssembly sandboxes, and formal network verification. The paper's mapping table (DNA to RFCs, cells to endpoints, tissues to host clusters) frames both mechanisms as ecological engineering rather than metaphor.","core_discovery":"The paper's central claim is that the Internet's lack of a defensive immune system is a correctable design flaw, and that ecology provides the design patterns. The end-to-end principle kept the network core simple and pushed complexity to the edge, leaving hosts to defend themselves individually; combined with a software monoculture, this means a single vulnerability compromises millions of hosts within minutes. The authors propose an 'antibotty' network in which every host plays the role of an antibody, scanning only its local community — orders of magnitude fewer devices than a global botnet must scan — and taking active measures to isolate or deliberately patch infected neighbors before the botnet can act. They further propose 'protocol mutatis mutandis': directed mutation of protocol implementations by AI code models, constrained by formal specifications extracted from the RFC corpus and contained by layered hardware and OS sandboxing, to increase architectural diversity. The final claim is that these local defence mechanisms enable a re-decentralisation of the Internet toward mutualistic protocols such as ActivityPub and the AT Protocol, restoring the cooperation the early Internet exhibited.","pith_inferences":["If the antibotty argument is right, the speed advantage of local scanning is testable today: measure how many devices a local scanner covers versus a netblock-wide botnet scan in the same time window.","The mutation proposal would invert into a liability if an attacker can steer code-model outputs; the paper's containment layers are then the entire security story, and hardening them becomes the real research problem.","The biological analogy implies that hosts that stop contributing ('cheaters') must be detectable and sanctionable; the paper does not propose such a protocol, so designing an incentive-compatible cooperation metric is a concrete next step.","Read sympathetically, the end-to-end principle is both the cause of the immune deficit and the reason new defenses can be deployed edge-first; the natural synthesis is a protocol that preserves edge flexibility while adding local, scoped defense."],"forward_implications":["Antibotty containment would outpace global botnets because a local host scans orders of magnitude fewer devices than a netblock-wide scanner must.","Software-stack mutations constrained by formal protocol specifications would break the monoculture, so a single vulnerability would no longer expose every host at once.","Layered containment (hardware protection, OS sandboxing, capability-based access, formal verification) can keep AI-generated mutations from becoming new attack surfaces.","A hierarchy of controllers, analogous to the blood-brain barrier, would stop vigilante hosts from inflicting unintended harm on mission-critical devices.","Redecentralized social protocols (ActivityPub, ATProto) plus mutualistic defense protocols could restore the cooperative structure the early Internet had."],"supporting_citations":[{"why":"Supplies the end-to-end worm containment model on which the antibotty concept builds.","marker":"[18]"},{"why":"Documents the minutes-scale speed of worm propagation that motivates local-only scanning.","marker":"[84]"},{"why":"Documents botnet netblock scanning that the antibotty approach is designed to outrace.","marker":"[5]"},{"why":"Shows botnet command-and-control can be seized and repurposed, the basis for deploying it defensively.","marker":"[85]"},{"why":"Argues for automated software diversity as the defense against monoculture exploits.","marker":"[41]"},{"why":"Demonstrates LLM extraction of protocol specifications from RFCs, enabling constrained mutations.","marker":"[81]"},{"why":"Supplies the 'deconstraining constraint' view that IP permits evolvable, diverse implementations.","marker":"[22]"},{"why":"Shows AI code models can generate competitive code, underpinning the mutation proposal.","marker":"[46]"},{"why":"Shows protein language models can propose evolutionarily plausible antibody mutations, the analog for code mutations.","marker":"[29]"}],"fun_headline_variants":["Ecology-inspired 'antibotty' lets hosts patch neighbors locally","Self-healing Internet: local defenses can outrace global botnets","Software mutation and mutualism could re-decentralize the Internet","Like antibodies, local hosts could isolate infected neighbors","Borrowing from biology: a decentralized immune system for the net"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The argument stands on the premise that a vigilante host can scan, isolate, and patch its neighbors without itself being compromised, and that AI code models, even constrained by formal specifications, can produce protocol mutations that are safe rather than exploitable.","fun_headline_variants_meta":{"raw":{"variants":["Ecology-inspired 'antibotty' lets hosts patch neighbors locally","Self-healing Internet: local defenses can outrace global botnets","Software mutation and mutualism could re-decentralize the Internet","Like antibodies, local hosts could isolate infected neighbors","Borrowing from biology: a decentralized immune system for the net"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000261,"raw_usage":{"total_tokens":1559,"prompt_tokens":878,"completion_tokens":681,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":494,"completion_tokens_details":{"reasoning_tokens":595}},"tokens_in":494,"tokens_out":681,"duration_ms":6150,"temperature":1.0,"reasoning_tokens":595,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T05:56:10.915322+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A controlled testbed in which a fast-spreading worm can read the antibotty alert channel would settle the central claim: if the worm propagates faster through that channel than the local scanners can contain it, the containment mechanism fails and becomes a new infection vector.","supporting_citations":[{"cited_title":"How to own the internet in your spare time","cited_arxiv_id":null,"evidence_quote":"Documents the minutes-scale speed of worm propagation that motivates local-only scanning."},{"cited_title":"SoK: Automated Software Diversity","cited_arxiv_id":null,"evidence_quote":"Argues for automated software diversity as the defense against monoculture exploits."},{"cited_title":"Architecture, constraints, and behavior","cited_arxiv_id":null,"evidence_quote":"Supplies the 'deconstraining constraint' view that IP permits evolvable, diverse implementations."}],"review_version":1}