Add defensive half: Carbon-8B resists the composition-matched adversary (0.53 -> 1.00 at order 5+)

ADVERSARIAL.md

@@ -27,6 +27,26 @@ breaks at m=1, k=4 at m=3, and k=6 at m=5. The staircase is the sufficient-stati
 made visible. The hexamer detector this model uses is blind to an adversary who matches the
 order-5 composition of human DNA (AUROC 0.53 at m=5).
 
+## The neural model is not evaded
+
+Scoring the same order-m-matched synthetic human with Carbon-8B (zero-shot per-base likelihood)
+separates it from real human across every order, exactly where composition fails:
+
+| adversary order m | closed-form k=6 (AUROC) | Carbon-8B (AUROC) |
+|---|---|---|
+| 2 | 0.95 | 1.00 |
+| 3 | 0.77 | 1.00 |
+| 4 | 0.68 | 1.00 |
+| 5 | 0.53 | 1.00 |
+| 6 | 0.52 | 1.00 |
+| 7 | 0.52 | 1.00 |
+
+The order-5-matched construct is invisible to the hexamer detector (0.53) and obvious to the model
+(1.00). Even an order-7 match, reproducing every 8-mer frequency of human DNA, is caught at 0.997,
+because the model reads long-range structure, codon-pair grammar, gene organization, and motif
+context, that no fixed-order composition encodes. The model's value here is precisely adversarial
+robustness against the evasion composition cannot resist.
+
 ## Implication for biosecurity screening
 
 Homology-free, composition-based screening, the family that includes k-mer engineered-DNA