No Stable Self: What Self-Referential Anomaly Defence Can Certify for a Continually Learning System, Why Every Located Guarantee Holds the Benign Distribution Still, and Why Immunology's Own Answer Is a Damage Signal From Outside

2026-10-17T08:30:24Z https://lifeofresearch.com/oai2

oai:lifeofresearch.com:92 2026-10-08T10:41:54Z type:article openaire

10.5281/zenodo.23213949 https://lifeofresearch.com/articles/92 Pranay Mahendrakar 0009-0003-7224-029X SONYTECH No Stable Self: What Self-Referential Anomaly Defence Can Certify for a Continually Learning System, Why Every Located Guarantee Holds the Benign Distribution Still, and Why Immunology's Own Answer Is a Damage Signal From Outside Life of Research 2026 continual learning data poisoning artificial immune systems anomaly detection concept drift danger theory Byzantine robustness test-time adaptation Journal article Creative Commons Attribution 4.0 (c) 2026 Pranay Mahendrakar. Licensed under CC BY 4.0. Immune-inspired security proposes that a system can protect itself by learning what it normally is and treating departures from that as threats. Continual learning makes departure the normal case: the system is supposed to change, so a poisoning campaign and a legitimate shift in the data both reach the defender as an unexplained change. This paper asks what a defence that takes its reference from the system's own history can certify in that setting, and finds the answer narrower than either side of the debate states. Three readings of "self" are separated: a frozen reference, a tolerised self that absorbs whatever persists, and a damage-keyed rule that does not need a self at all. The stationarity objection defeats only the first. The second is what many working continual defences use, and it fails differently: retrained anomaly detectors and network coordinate systems have been shown to tolerate change that is slow enough, which is also how immunology's own discontinuity theory describes the biological immune system. That continual-learning and test-time-adaptation defences fail the same way is a prediction carried over from those results, not yet tested. Every positive guarantee located here, from online centroid detectors to Byzantine aggregation to a 2026 theory of poisoning in continual learning, either holds the benign distribution fixed, bounds how far it may move, or assumes attacks are rare; none survives an unbounded legitimate shift together with a persistent minority attacker. The paper argues that the transferable lesson of immunology is the danger model rather than self/non-self discrimination, and that in a learning system a damage signal has to come from supervision held outside the update loop: trusted data, provenance, labels or a restoration point. Where such an anchor has been costed, it was cheap: one study priced its renewal at 50 analyst labels a month, and another gives a static size of 100 clean examples. Whether it can be kept fresh as legitimate data moves, and at what cost, is the open part.