The prohibition on attacking a person recognised as hors de combat forms part of customary international humanitarian law (Rule 47 of the ICRC Customary IHL Study; Article 23(c) of the 1907 Hague Regulations) and binds all parties to an armed conflict irrespective of treaty ratification. For States party to Additional Protocol I, Article 41 provides the clearest treaty formulation of that protection, while Article 57 requires those planning or deciding upon an attack to take every feasible step to verify that the attack remains lawful. Those obligations are long established. Autonomous and semi-autonomous systems operating at machine speed nevertheless create a practical difficulty, because there is no commonly specified machine-readable form through which an intention to surrender can be communicated to, and recognised by, such systems.
This paper presents HF SIGNAL 01, a candidate protocol for surrender recognition intended to serve as a technical referent for machine-readable expressions of surrender. It offers two alternative modalities. One is a passive visual modality requiring no equipment. The other is an active electronic modality made up of two channels that must be confirmed together — a pulsating white optical signal and a radio-frequency signature. The paper makes no claim of operational effectiveness, adoption or legal status. The protocol is a supplementary means of expressing an intention to surrender, never a condition of protection, and its absence supports no adverse inference. The proposal is instead assessed against feasibility criteria previously defined for lawful operational safeguards, including technology readiness, latency, annotated datasets and independent validation.
The assessment is intentionally conservative. HF SIGNAL 01 currently exists as a publicly documented candidate whose active modality is specified closely enough to permit experimental characterisation, but without experimental validation, implementation or performance data. Its contribution at present is documentary rather than operational. The paper argues that the existence of a publicly available, integrity-protected candidate standard changes the factual setting in which surrender-recognition capability may be assessed. What was previously described solely as a technical impossibility becomes a documented question of design choice, review and validation. It concludes by inviting independent technical testing, dataset development and examination in the relevant fora of international humanitarian law and autonomous-weapons governance.
Version 8 corrects and tightens Version 7. A sentence stating that the paper took no position on whether such systems should exist has been removed, since it stood beside a stated view; the text now simply addresses the world in which such systems are deployed. Defensive and evasive formulations have been replaced by direct ones in Sections 1, 2.4 and 5.
References to the companion papers have been brought up to date: Lawful Operational Safeguards in AI Systems is cited as Version 9, Systemic Arrestability under its current title and as Version 8, and the Architecture Note as Version 4. The footnote typeface has been aligned with the body text.
Supersedes Version 7 (September 2026). Companion analyses: Lawful Operational Safeguards in AI Systems, Zenodo concept DOI 10.5281/zenodo.21932439; Systemic Arrestability, Zenodo concept DOI 10.5281/zenodo.20837150.
References to HF SIGNAL 01 as a dual-channel signal concern the active electronic modality; the protocol comprises two alternative modalities, and the requirement that both channels be confirmed applies only to the active one.
HF SIGNAL 01 is one protective function expressed through two alternative modalities. They are not cumulative requirements.
• Passive visual modality — a white disc on a red field, requiring no power, equipment, licence or emission. It is the modality available to a person who has nothing.
• Active electronic modality — a pulsating white optical signal combined with a continuous FM radio signal. Both channels must be confirmed together before the signal is treated as present.
The active modality specifies a white light at 7 Hz, with a recommended source brightness of at least 300 lux, a nominal visibility range of 100 m and infrared compatibility as an implementation objective. Its radio channel is a continuous FM tone at 144.0 MHz, with 25 kHz bandwidth, a 1,000 Hz tone and a stated detection threshold of −85 dBm. These are candidate reference values, not validated operational requirements.
The modalities carry the same protective meaning but require different levels of access: bare hands or instruments. The protocol therefore does not make equipment a condition of protection, and the absence of either modality supports no adverse inference.
The specification distinguishes manual activation from proximity-triggered and periodic activation. Only a deliberate human activation, assessed in context and accompanied by abstention from hostile acts, may evidence an expressed intention to surrender under Article 41(2)(b) of Additional Protocol I. Automatic, proximity-triggered or periodic activation is precautionary: it should trigger suspension, verification and assessment, but does not by itself confer hors de combat status. A confirmed signal is expected to inhibit aggressive action, preserve relevant signal and sensor data, and initiate non-hostile identification; it is not conclusive proof of status.
Abstract
This note states, in one place, the architecture of HF SIGNAL 01 as the Association has published it. It amends no deposited document, alters no identifier, and asserts no obligation. HF SIGNAL 01 does not replace the white flag; it translates it. The gesture has not changed; the recipient has: a machine does not see a surrender; it detects or fails to detect a signal, and it shares no code with the white flag.
HF SIGNAL 01 is a single protective function expressed through two modalities of differing accessibility: a passive visual modality — a white disc on a red field, requiring no power, equipment, licence or emission, and available to a person who has nothing — and an active electronic modality, whose optical and radio channels must be confirmed together. The modalities are alternative expressions of the same meaning, not a conjunction; requiring both modalities would exclude precisely those least equipped to signal. A confirmed signal calls for suspension of engagement and verification of status; it is never a necessary condition of protection, and its absence permits no adverse inference.
The note also records the questions that remain open, including carrier frequency, emission risk, photosensitivity, separability from the protective emblems of the Geneva Conventions, and the parameters of the passive symbol, whose geometry and chromaticity are a placeholder awaiting normative determination.
International Humanitarian Law · Autonomous Weapons Systems · Lethal Autonomous Weapons Systems · Article 41 · Article 57 · Surrender Recognition · Machine-Readable Signal
HF SIGNAL 01 applies the feasibility criteria developed in: Lawful Operational Safeguards in AI Systems (Paper I) and Systemic Arrestability (Paper II). The temporal precondition governing whether such a signal can be recognised at all is developed in HFA Technical Note HFA-TN-02. Experimental characterisation is specified in HFA-TN-03 (optical), HFA-TN-06 (RF) and HFA-TN-05 (joint confirmation); HFA-TAX-01 separates legal elements, detection states and design conduct.