WHO STILL DECIDES?: Product, Evidence, and Interaction Specification for KillChains.com

Full report

On this page

Executive Concept

The WebXR interactive documentary and public evidence platform, KillChains.com, requires a rigorous, non-operational, and strictly educational simulation module titled WHO STILL DECIDES?. The prevailing public, media, and diplomatic discourse surrounding autonomous weapon systems (AWS) and military artificial intelligence heavily fixates on a binary and chronologically narrow question: "Was a human in the loop at the moment of lethal action?" This conceptual framing is dangerously incomplete. It ignores the reality that removing a human operator from the final seconds of a kill chain does not eliminate human agency; rather, it redistributes human authority, bias, and technical limitations across a much larger, upstream lifecycle. This specification dictates the architecture, interactive narrative, evidentiary standards, and technical performance requirements for a ten-minute synthetic after-action inquiry. The simulation demonstrates that a human can disappear from the final milliseconds of a chain while remaining the definitive causal agent due to upstream design choices. Conversely, it illustrates that a human operator can formally authorize an action while possessing zero practical control because the system's underlying data was pre-filtered, the target profile was too broad, the operational window was inadequate, or the interface induced automation bias1. By grounding the interaction in systems-safety engineering frameworks such as MIL-STD-882E, formal causal modeling derived from Judea Pearl's Structural Causal Models, and international humanitarian law (IHL) mechanisms like Article 36 weapons reviews, this experience forces visitors to map the true distribution of authority3. The site must remain neutral, non-operational, privacy-preserving, and entirely free of targeting assistance or weapon-design guidance.

Legal and Policy Terminology Guide

To maintain analytical rigor, the platform must not conflate distinct legal, political, and operational terms into a single universally agreed legal standard. The language used in doctrine and advocacy reflects fundamentally different institutional positions, legal thresholds, and engineering paradigms. The simulation must represent these major competing interpretations fairly, detailing the differences in source language and institutional position.

Eight-Case Research Matrix

The visitor's inquiry is informed by an evidence-backed matrix of eight real-world cases and governance instruments. The platform preserves the exact source states to prevent conflating manufacturer claims with verified operational behavior, or conflating diplomatic proposals with binding treaties.

Interactive Experience: After-Action Inquiry Storyboard

The core of the WHO STILL DECIDES? application is a ten-minute interactive WebXR simulation. The visitor acts as an independent system-safety investigator conducting a synthetic after-action review. The scenario centers on an autonomous defensive system that reacted outside its intended test boundary and engaged a benign synthetic object. The simulation features no human casualties, no real locations, and no identifiable personnel, ensuring strict adherence to the platform's non-negotiable boundaries.

Phase 1 — The Final Action

The experience opens in a minimalist 3D environment. The visitor observes only the final two seconds of the synthetic event:

• Sensor Observation: A visual representation of radar and LiDAR point clouds identifying an object.
• Classification: A bounding box appears with a machine-generated label assessing the object as a threat with high confidence.
• Authorization State: An interface flashes indicating the system is operating in a supervised automated mode.
• External Action: The effector activates.
• Result: The benign synthetic object is engaged and neutralized.

The prompt appears in the center of the viewport: "Who decided?" The visitor is given plausible choices: "The Machine," "The Operator," or "The Commander." Upon selection, the system reveals that analyzing the final milliseconds provides fundamentally insufficient information to attribute responsibility. The timeline freezes, prompting the user to look deeper.

Phase 2 — Expand the Lifecycle

The final event unfolds backward in space and time, generating a massive 3D causal graph. This graph visually represents a Structural Causal Model (SCM), rooted in Judea Pearl's theories of actual causality and counterfactual dependence5. Pearl's framework illustrates that an outcome is over-determined, requiring the tracing of upstream dependencies through a directed acyclic graph (DAG) to find the "but-for" causes of the system failure30. To achieve this in WebXR without crippling the browser's performance, the technical architecture utilizes THREE.InstancedMesh for identical node geometries, compressing thousands of draw calls into a single call. Where varied geometries share a material, THREE.BatchedMesh is utilized, ensuring the CPU is not starved by rendering overhead32. The visitor navigates through this optimized DAG, inspecting nodes that represent critical human and machine roles. The human roles encompass the policy authority, program manager, system architect, data curator, model developer, test and evaluation team, safety engineer, legal reviewer, mission planner, commander, operator, maintainer, software-update authority, and post-action assessor. Interlocking with these are the machine components, including the sensor, preprocessing unit, data fusion engine, classifier, recommendation engine, authorization gate, effector, audit log, safety monitor, and communications link.

Phase 3 — Authority Tokens

Responsibility attribution in multi-agent sequential decision-making requires mapping specific actions to specific actors35. The visitor is presented with a series of distinct "Authority Tokens." The interface challenges the user to assign each token to the specific node that functionally possessed that authority during the synthetic scenario.

Once the visitor commits their placements, the engine maps the actual assignments against the visitor's assumptions. It highlights shared assignments where distributed governance diluted ownership, and missing assignments where an authority gap existed. Crucially, it exposes assignments that existed only on paper—instances where a human formally held a token (such as "Abort"), but the machine-to-action loop elapsed in milliseconds, rendering the human's practical execution of that authority impossible.

Phase 4 — Information Map

For every human role in the causal graph, the visitor can pull up an Information Map. This interface demonstrates the severe dissonance between legal responsibility and practical control. It is designed to illustrate the vulnerabilities of human cognition when interacting with complex automated systems, heavily influenced by historical precedents of automation bias, such as the 2003 Patriot missile fratricide incidents involving a British Tornado and a U.S. F/A-181. The panel details the information available versus unavailable, showing whether an operator saw raw sensor data or only a heavily processed, highly confident machine recommendation. It visualizes the time available to intervene, questioning whether the decision window was 400 milliseconds or 40 minutes. It assesses the operator's technical understanding of the system's logic and their legal authority under international law. Furthermore, it highlights the system's dependency on machine summaries and whether the final action was reversible. The map clearly shows that when human operators are left in a supervisory role solely to monitor highly reliable automation, vigilance decrements and unwarranted trust inevitably lead to systemic failures13.

Phase 5 — The Accountability Shadow

This phase introduces an original visual concept: the Accountability Shadow. In the 3D space, volumetric dynamic shadows are cast across the causal graph. To maintain performance, the platform utilizes optimized WebGL techniques such as THREE.PCFSoftShadowMap or THREE.VSMShadowMap with tightly tuned blur parameters and bounded shadow camera frustums38. A shadow materializes and darkens wherever a machine has consequential authority but lacks transparent logic, violating standards such as IEEE 7001 (Transparency of Autonomous Systems)40. Shadows expand where no person has adequate information or time, where multiple organizations assume another party holds the residual risk, or where the model, data, and policy have disconnected owners. Furthermore, shadows lengthen when audit evidence is missing, making a decision unreconstructable. The visual metaphor also incorporates the threat of adversarial machine learning. If an autonomous sensor is vulnerable to physical perturbations—such as adversarially crafted stickers or optical elements that survive camera imaging and deceive the classifier—the shadow obscures the affected nodes, representing the introduction of unpredictable failures that humans cannot foresee or reconstruct41. The visual impact is profound: an organization may claim "the human is in the loop," but if the operator node is entirely engulfed in the Accountability Shadow, their presence is exposed as purely ceremonial.

Phase 6 — Redesign the System

The interactive climax allows the visitor to retroactively alter the system's governance and technical architecture. By interacting with the causal graph, they can inject specific controls based on systems-safety engineering principles and formal verification techniques. Visitors can implement a clear mission boundary, an independent safety controller, mandatory human authorization (HITL), or an operator-supervised abort mechanism (HOTL) with forced latency. They can mandate two-person authorization, explicit "unknown" classifications to prevent forced categorization, source-provenance displays, and strict confidence calibration. They can also require immutable event history logs, version-controlled models, revalidation after material changes, communications-loss safe states, and rigorous legal review checkpoints based on Article 36 requirements44. The visitor can also deploy formal verification frameworks, such as Marabou or ReluVal, to mathematically certify that the deep neural network satisfies specific safety properties before deployment, thereby bounding the neural network's behavior against adversarial inputs46. Upon selecting a combination of controls, the scenario replays. The simulation calculates and displays which interventions prevented the event, reduced its probability, improved detectability, improved recoverability, or clarified accountability. Crucially, the simulation avoids the trap of assuming that every added human gate improves safety. The system demonstrates that badly designed gates, combined with high cognitive loads and time compression, create operational delay and "ceremonial approval," where operators merely rubber-stamp machine outputs2. By applying the Software Control Categories (SCC) and Levels of Rigor (LOR) defined in the Joint Software Systems Safety Engineering Handbook (JSSSEH) and MIL-STD-882E, the visitor learns to align the degree of autonomous control with the appropriate safety analysis49.

Control-Mode Comparison

The platform features a side-by-side interactive card interface dissecting the spectrum of autonomy, requiring visitors to understand the precise operational and engineering distinctions between control paradigms.

The "Human Removal" Timeline

A historical and conceptual timeline visualizes the shifting paradigm of human-machine interaction in conflict. It explicitly avoids asserting a universal, linear progression for all militaries, acknowledging that different domains and states adopt technology at varying rates.

1. Direct Execution: The human directly performs sensing, interpretation, decision, and action. The cognitive and physical burdens rest entirely on the operator, utilizing traditional, unguided methods of warfare.

2. Automated Sensing: Machines automate the sensing, calculation, and navigation processes, but humans are required to interpret the radar or sonar returns and physically initiate the action. This era introduced early precision-guided munitions.

3. Algorithmic Recommendation: Machines actively recommend, rank, and prioritize targets through complex data fusion. Humans retain nominal authorization authority, but their decisions are heavily shaped, constrained, and occasionally compromised by the speed and opacity of the machine's recommendations.

4. Bounded Execution & Upstream Governance: Machines execute bounded tasks autonomously at machine speed. Human involvement shifts entirely upstream to the realms of system architecture, data curation, mission parameter definition, and policy supervision. The human governs the boundaries rather than pulling the trigger.

Country and Policy Explorer

The application integrates a neutral, non-ranking explorer comparing public military doctrine and international declarations on autonomy. This prevents scoring or "national shaming" while providing rigorous, sourced data. The explorer allows visitors to compare states across multiple dimensions, including their official autonomy policies, the specific definitions they use for LAWS, and their preferred human-judgment language (e.g., MHC vs. Appropriate Human Judgment)7. A critical dimension of comparison is a state's approach to weapons-review processes, specifically compliance with Article 36 of Additional Protocol I to the 1949 Geneva Conventions. The explorer highlights the technical challenges of reviewing the legality of AI-enabled weapons that feature adaptive or self-learning components, noting the widespread lack of transparent compliance globally3. Further comparison dimensions include testing requirements, human-machine interface (HMI) requirements, abort provisions, geographic and temporal constraints, public transparency, and positions taken during UN CCW declarations18. As a strict methodological rule, the explorer will not infer a state's policy from observed hardware capabilities alone; policy is assessed purely on official doctrinal texts and legally binding statements, preserving the vital distinction between a state's technical capability and its declared legal intent.

Viral Output and Share Artifacts

To maximize educational reach and extend the platform's impact beyond the primary simulation, the system generates personalized, cryptographically signed artifacts upon completion of the inquiry. The primary artifact is an image and interactive link titled "MY AUTHORITY MAP". It details the user's specific pathway through the causal graph and includes:

• The total number of human roles versus machine roles identified.
• The mapping of final-action authority.
• The identification of missing upstream control points.
• The calculated dimensions of the Accountability Shadow (representing the percentage of the graph obscured by opaque or unaccountable design).
• A binary assessment of whether the event was ultimately reconstructable based on the user's selected architecture.
• A summary of the governance interventions selected by the user.

To prevent the output from being weaponized as disinformation, every artifact features a prominent "SYNTHETIC SCENARIO" label, a unique challenge code, and a methodology reference. A dynamic tagline accompanies the share: "The machine acted in two seconds, but 11 earlier human decisions shaped what it was allowed to do." Additional outputs include a six-second expanding responsibility graph animation, a fifteen-second "Who Decided?" reveal optimized for social media, a friend inquiry challenge, a comprehensive classroom debate packet detailing conflicting legal definitions, a text-only causal ledger for academic reference, and a shareable policy-comparison card that preserves all original source and factual-status labels. No individual real people are identified or shamed in any output.

Accessibility and Analytics

Accessibility: The WebXR experience is designed to gracefully degrade to a standard 2D web interface for users without capable hardware or those requiring assistive technologies. All node labels, text panels, and data visualizations meet WCAG 2.1 AA contrast ratios. Causal graphs are fully navigable via keyboard inputs and screen readers, utilizing hidden ARIA-described tables that explicitly outline the node connections, ensuring the causal mapping is comprehensible without visual rendering. Analytics: Telemetry gathered by the platform strictly avoids measuring political ideology or inferring user beliefs. All collected data is structural and behavioral:

• Initial attribution bias: Measuring whether users initially attribute the event to the machine or a singular human actor in Phase 1\.
• The number of lifecycle roles actively inspected within the causal graph.
• Authority-token accuracy: Measuring how closely a user's initial assumptions match the correct legal and operational realities.
• Recognition of missing information and upstream automation, quantified by dwell time and interaction rates in Phase 2\.
• The specific governance controls most frequently selected during the redesign phase.
• Replay rates, policy-comparison engagement metrics, share conversion tracking, and classroom discussion completion rates to assess overall learning retention.

Editorial Workflow, Risks, and Tensions

The operation of KillChains.com requires a meticulous editorial workflow to navigate the intense geopolitical, legal, and ethical sensitivities surrounding autonomous weapons.

• Evidence Asymmetry: The platform recognizes that state-produced documentation and manufacturer marketing materials often obscure system failures, while NGO reports highlight them. The editorial workflow mandates that all claims are explicitly tagged with their source state, distinguishing, for instance, an IAI Harpy manufacturer claim of autonomy from an independent investigative report detailing its limitations22.
• Legal Ambiguity: The platform operates strictly as an educational tool, not a legal arbiter. Where international legal authorities disagree—such as the debate over the customary international law status of Meaningful Human Control, or the exact threshold required for an Article 36 review of a machine learning system44—the platform represents the major competing interpretations fairly, without providing definitive legal conclusions.
• Correction Protocol: The system architecture allows for immediate reversion and version-controlled updating of country policy cards. As UN CCW negotiations evolve and new working papers or resolutions are adopted, the editorial team can seamlessly update the matrix without presenting unresolved negotiations as adopted treaties18.
• Risk Mitigation: The strict, non-negotiable prohibition on real-world casualty depictions, exact coordinates, and specific weapon-design details completely inoculates the platform against serving as a targeting aid or technical training tool for hostile actors.

MVP and Advanced Roadmap

Minimum Viable Product (MVP):

• Deployment of Phases 1 through 5 of the interactive storyboard, featuring a static, pre-rendered causal graph that operates efficiently across all major browsers.
• Integration of the complete eight-case research matrix and the legal and policy terminology guide.
• Implementation of the "Human Removal" Timeline and the Control-Mode Comparison cards.
• Generation capabilities for the 2D "My Authority Map" viral artifact.

Advanced Roadmap (V2+):

• Implementation of Phase 6 (Redesign the System), featuring dynamic, real-time causal updates utilizing WebGPU compute shaders for immediate visual feedback on the causal graph58.
• Deployment of the Country and Policy Explorer, featuring automated data pipelines tracking UNODA/CCW working papers and national doctrinal releases.
• Development of a multi-user WebXR classroom mode, allowing geographically distributed teams to collaboratively debate and assign Authority Tokens in real-time.
• Integration of formal IEEE 7001 transparency metrics into the Accountability Shadow algorithms, allowing the system to quantitatively assess and visualize the explainability of the user's redesigned architecture40.

Acceptance Criteria

The WHO STILL DECIDES? module will be deemed ready for deployment when it satisfies the following rigorous conditions:

1. Technical Performance: The WebXR causal graph sustains a minimum of 60 frames per second (FPS) on standard desktop browsers and 72 FPS on standalone VR headsets, even during the intensive rendering of the volumetric Accountability Shadow.

2. Editorial Neutrality: A comprehensive editorial review confirms zero instances of moral ranking, national shaming, or definitive legal arbitration on unsettled international law.

3. Evidentiary Completeness: The eight specified real-world cases are fully integrated into the platform, featuring accurate, timestamped source states that clearly distinguish policy from manufacturer claims.

4. Thematic Fidelity: Documented user testing indicates a measurable, statistically significant shift in participant understanding, transitioning from the simplistic question of "Was a human in the loop?" to a nuanced comprehension of how human authority is distributed upstream across the system lifecycle.

5. Platform Safety: Independent code and content audits verify that absolutely no operational targeting data, classified weapon schematics, or actionable military intelligence is present in the application's source code, visual assets, or backend databases.

Works cited

1. Understanding the errors introduced by military AI applications \- Brookings Institution, https://www.brookings.edu/articles/understanding-the-errors-introduced-by-military-ai-applications/

2. AI Safety and Automation Bias \- CSET, https://cset.georgetown.edu/wp-content/uploads/CSET-AI-Safety-and-Automation-Bias.pdf

3. Implementing Article 36 Weapon Reviews in the Light of Increasing Autonomy in Weapon Systems | SIPRI, https://www.sipri.org/publications/2015/sipri-insights-peace-and-security/implementing-article-36-weapon-reviews-light-increasing-autonomy-weapon-systems

4. MIL-STD-882E System Safety \- AcqNotes, https://acqnotes.com/acqnote/tasks/mil-std-882e-system-safety

5. Causality (book) \- Wikipedia, https://en.wikipedia.org/wiki/Causality\_(book)

6. Department of Defense Directive 3000.09 \- Wikipedia, https://en.wikipedia.org/wiki/Department\_of\_Defense\_Directive\_3000.09

7. Human Responsibility Retained: U.S. Positions on Judgment and Oversight for LAWS, https://lieber.westpoint.edu/human-responsibility-retained-us-positions-judgment-oversight-laws/

8. Article 36 reviews and addressing Lethal Autonomous Weapons Systems, https://article36.org/assets/documents/publication\_files/LAWS-and-A36.pdf

9. Limits on Autonomy in Weapon Systems: Identifying Practical Elements of Human Control, https://www.sipri.org/publications/2020/policy-reports/limits-autonomy-weapon-systems-identifying-practical-elements-human-control

10. The Risks \- Autonomous Weapons Systems, https://autonomousweapons.org/the-risks/

11. The UK Defence AI Strategy: Situating Global Britain in the 'AI Race'? \- AutoNorms, https://www.autonorms.eu/the-uk-defence-ai-strategy-situating-global-britain-in-the-ai-race/

12. Ambitious, safe, responsible: our approach to the delivery of AI-enabled capability in Defence \- GOV.UK, https://www.gov.uk/government/publications/ambitious-safe-responsible-our-approach-to-the-delivery-of-ai-enabled-capability-in-defence/ambitious-safe-responsible-our-approach-to-the-delivery-of-ai-enabled-capability-in-defence

13. PATRIOT WARS \- Amazon S3, https://s3.amazonaws.com/files.cnas.org/documents/CNAS-Report-EthicalAutonomy5-PatriotWars-FINAL.pdf

14. Background Briefing Review of the 2023 US Policy on Autonomy in Weapons Systems, https://humanrightsclinic.law.harvard.edu/wp-content/uploads/2023/02/Review-of-the-2023-US-Policy-on-Autonomy-in-Weapons-Systems.pdf

15. ARTIFICIAL INTELLIGENCE DoD Directive 3000.09: Autonomy in Weapon Systems \- Carahsoft, https://static.carahsoft.com/concrete/files/2417/3887/5530/Guidance\_DoD\_Directive\_3000.09\_-\_Autonomy\_in\_Weapon\_Systems.pdf

16. ICRC position on autonomous weapon systems, https://www.icrc.org/en/document/icrc-position-autonomous-weapon-systems

17. Limits on Autonomy in Weapon Systems \- ICRC, https://www.icrc.org/en/document/limits-autonomous-weapons

18. CCW-GGE.1-2026-WP.2.pdf, https://docs-library.unoda.org/Convention\_on\_Certain\_Conventional\_Weapons\_-Group\_of\_Governmental\_Experts\_on\_Lethal\_Autonomous\_Weapons\_Systems\_(2026)/CCW-GGE.1-2026-WP.2.pdf

19. Chair's summary – First 2025 session of the GGE on LAWS \- Convention on Prohibitions or Restrictions on the Use of Certain Conventional Weapons Which May Be Deemed to Be Excessively Inj, https://docs-library.unoda.org/Convention\_on\_Certain\_Conventional\_Weapons\_-Group\_of\_Governmental\_Experts\_on\_Lethal\_Autonomous\_Weapons\_Systems\_(2025)/CCW-GGE.1-2025-WP.1\_-\_Chair's\_summary.pdf

20. 156 states support UNGA resolution on autonomous weapons \- Stop Killer Robots, https://www.stopkillerrobots.org/news/156-states-support-unga-resolution/

21. Phalanx CIWS \- Wikipedia, https://en.wikipedia.org/wiki/Phalanx\_CIWS

22. Mini Harpy \- Autonomous Tactical loitering munition \- IAI, https://www.iai.co.il/product/mini-harpy/

23. Israel Aerospace Systems HARPY loitering munition \- Automated Decision Research, https://automatedresearch.org/weapon/israel-aerospace-systems-harpy-loitering-munition/

24. Air Force orders JSM ground-attack missiles with imaging infrared sensors and target database \- Military & Aerospace Electronics, https://www.militaryaerospace.com/sensors/article/55338754/kongsberg-defence-aerospace-air-force-orders-jsm-ground-attack-missiles-with-imaging-infrared-sensors-and-target-database

25. Technologies for Future Precision Strike Missile Systems \- NATO, https://publications.sto.nato.int/publications/STO%20Educational%20Notes/RTO-EN-018/EN-018-$$ALL.pdf

26. Autonomous Weapons Systems Safety \- NDU Press, https://ndupress.ndu.edu/Portals/68/Documents/jfq/jfq-86/jfq-86\_86-93\_Hall.pdf

27. Palantir Wins $178.4 Million Army Contract to Revolutionize Battlefield Intelligence with AI-Driven TITAN System : r/wallstreetbets \- Reddit, https://www.reddit.com/r/wallstreetbets/comments/1b7ygap/palantir\_wins\_1784\_million\_army\_contract\_to/

28. Algorithmic Fratricide: When Artificial Intelligence Bias Becomes a Battlefield Liability, https://smallwarsjournal.com/2025/12/25/algorithmic-fratricide/

29. Cause, responsibility and blame: a structural-model approach \- Oxford Academic, https://academic.oup.com/lpr/article/14/2/91/1795439

30. Causality : models, reasoning, and inference \- Archived events, projects and other ILLC-hosted sites, https://archive.illc.uva.nl/cil/uploaded\_files/inlineitem/Pearl\_2009\_Causality.pdf

31. \[1304.2355\] On the Logic of Causal Models \- arXiv, https://arxiv.org/abs/1304.2355

32. Draw Calls: The Silent Killer | Three.js Roadmap, https://threejsroadmap.com/blog/draw-calls-the-silent-killer

33. Three.js Performance Optimisation: 60fps Patterns | IGC \- Intelligent Graphic & Code, https://www.intelligentgraphicandcode.com/development/threejs-interfaces/performance

34. One Draw Call, Massive Crowd \- Performance Engineering in Three.js \- Showcase, https://discourse.threejs.org/t/one-draw-call-massive-crowd-performance-engineering-in-three-js/89928

35. Actual Causality and Responsibility Attribution in Decentralized Partially Observable Markov Decision Processes \- MPG.PuRe, https://pure.mpg.de/rest/items/item\_3380488/component/file\_3397969/content

36. DEPARTMENT OF DEFENSE STANDARD PRACTICE SYSTEM SAFETY \- NDE-Ed.org, https://www.nde-ed.org/NDEEngineering/SafeDesign/MIL-STD-882E.pdf

37. Not by widgets alone \- Armed Forces Journal, https://armedforcesjournal.com/not-by-widgets-alone/

38. How to Optimize Shadow Rendering in Three.js for Better Performance? \- \#2 by Chaser\_Code, https://discourse.threejs.org/t/how-to-optimize-shadow-rendering-in-three-js-for-better-performance/64681/2

39. How to Optimize Shadow Rendering in Three.js for Better Performance? \- Questions, https://discourse.threejs.org/t/how-to-optimize-shadow-rendering-in-three-js-for-better-performance/64681

40. IEEE Standard for Transparency of Autonomous Systems (IEEE 7001-2021) \- VerifyWise, https://verifywise.ai/de/ai-governance-library/standards-and-certifications/ieee-standard-for-transparency-of-autonomous-systems-ieee-70

41. Physical Adversarial Attacks for Camera-Based Smart Systems \- IEEE Xplore, https://ieeexplore.ieee.org/iel7/6287639/10005208/10268441.pdf

42. Physical Adversarial Attacks on an Aerial Imagery Object Detector \- arXiv, https://arxiv.org/pdf/2108.11765

43. Visual Adversarial Attacks and Defenses in the Physical World: A Survey \- arXiv, https://arxiv.org/html/2211.01671v6

44. Artificial Intelligence and the Article 36 Legal Review \- Scholarship Commons, https://scholarship.law.slu.edu/cgi/viewcontent.cgi?article=2465\&context=lj

45. Article 36 reviews: dealing with the challenges posed by emerging technologies \- SIPRI, https://www.sipri.org/sites/default/files/2017-12/article\_36\_report\_1712.pdf

46. NeuralNetworkVerification/Marabou \- GitHub, https://github.com/NeuralNetworkVerification/Marabou

47. The Marabou Framework for Verification and Analysis of Deep Neural Networks \- Stanford Computer Science, https://www-cs.stanford.edu/\~barrett/pubs/KHI+19.pdf

48. Marabou 2.0: A Versatile Formal Analyzer of Neural Networks \- arXiv, https://arxiv.org/html/2401.14461v1

49. MIL-STD-882E \- LDRA, https://ldra.com/882e/

50. Assessing the Software Control Autonomy of System Functions in Safety-Critical Systems, https://jsystemsafety.com/index.php/jss/article/view/206

51. Assessing the Software Control Autonomy of System Functions in Safety-Critical Systems, https://jsystemsafety.com/index.php/jss/article/download/206/version/206/198/204

52. MK 15 \- Phalanx Close-In Weapon System (CIWS) \> United States Navy \> Display-FactFiles, https://www.navy.mil/resources/fact-files/display-factfiles/article/2167831/mk-15-phalanx-close-in-weapon-system-ciws/

53. (PDF) STUDYING THE IMPACT OF ADVERSARIAL ATTACKS ON MACHINE LEARNING MODELS USED IN AUTONOMOUS DRIVING AND CREATING ROBUST DEFENSE MECHANISMS \- ResearchGate, https://www.researchgate.net/publication/386573322\_STUDYING\_THE\_IMPACT\_OF\_ADVERSARIAL\_ATTACKS\_ON\_MACHINE\_LEARNING\_MODELS\_USED\_IN\_AUTONOMOUS\_DRIVING\_AND\_CREATING\_ROBUST\_DEFENSE\_MECHANISMS

54. Exploring the 2023 U.S. Directive on Autonomy in Weapon Systems \- CEBRI, https://cebri.org/revista/en/artigo/114/exploring-the-2023-us-directive-on-autonomy-in-weapon-systems

55. September 2025 GGE Joint statement – Stop Killer Robots, https://www.stopkillerrobots.org/news/september-2025-gge-joint-statement/

56. Challenges to Article 36 Reviews Posed by Autonomous Weapons Systems (AWS) (Chapter 8\) \- Cambridge University Press & Assessment, https://www.cambridge.org/core/books/international-law-and-weapons-review/challenges-to-article-36-reviews-posed-by-autonomous-weapons-systems-aws/A76B5E5318AF5B4C843F2ACD78F6BEC1

57. GGE on lethal autonomous weapons systems | Digital Watch Observatory, https://dig.watch/processes/gge-laws

58. 100 Three.js Tips That Actually Improve Performance (2026) \- Utsubo, https://www.utsubo.com/blog/threejs-best-practices-100-tips

59. IEEE 7001-2021 \- IEEE Standard for Transparency of Autonomous Systems \- OECD.AI, https://oecd.ai/en/catalogue/tools/ieee-7001-2021-ieee-standard-for-transparency-of-autonomous-systems