17 KiB
Report: adversarial pass on the program acceptance rule (class v4 sub-version 3)
internal adversarial pass, not an independent review
- Target commit:
017e703764(class v4 sub-version 3, object byte 7). - Crate built: igneum-pow at the frozen commit (this worktree's igneum-pow/ is reset to it; build/master diverged by 635 deletions and is not used). Harness: tools/attack/adv-accept (depends on igneum-pow by path).
- Re-base (18:3x UTC): build/master moved to
7a7caa34whose igneum-pow IS the frozen object; merged at 8748e955ceb48be5a6cbf7f8718a4884d3de9828;git diff --quiet 017e7037 HEAD -- igneum-powprints IDENTICAL. Nothing measured here was on a stale tree: igneum-pow/ had been reset to the frozen object before the first build. - Binary sha256 (first build, box 2): e3d35f4464937f91aac0648e2ee7134f33c85c7aa314b87b33f91059dedc6682 (adv-accept single-binary build); the two-binary build (adv-accept, adv-live = the unmodified f8 harness) sha256 is logged per box in the run sections below.
- Boxes: igneum-build-1 (CPU-bound sweeps, by the coordinator's order) and igneum-build-2 (shard 0, already there). nice 10 on every idle core, the capacity layer's yield (run-box.sh). Logs under /srv/builds/igneum-wt-adv-accept/adv/ on each box (spared from the checkout clean by .igneum-scratch-spare; the first 10k log on box 2 was wiped by a rebuild before the spare existed and is void anyway: old labels, old binary).
- Lane scope since 18:2x UTC: THE BYPASS (Q1, Q2, Q5). Q3 is lane adv-accept-3's, Q4 lane adv-accept-2's.
- Seed space: the attack-pass F8 label space (program k = seed_words("igneum-attack-f8/program/k"), era
".../era/k"), so
adv-live warps --program kmeasures the live hot set of exactly the program the sweep reports. - rustc 1.99.0 both sides. First results by 8 October 2026 18:00 UTC. GPU: not available, so any per-card hash-rate confirmation of a gain is BLOCKED and said so.
- Box-hours spent so far: about 0.1 (one 7 s build, three short runs). Budget 8.
Draw-path validation (must pass before any claim)
The shared devnet epoch-0 class v4 program drawn through Epoch::chain_program(ProgramClass::V4) has
program id a785001687d8688a at attempt 1 (class mx8-erad810f22d+sh256x27), which matches the frozen
pack proto-cuda/packs-ca3-v4/v4-devnet-epoch0/program.json and the brief. So my draw path is the
chain's. Command: adv-accept derive-check on box 2. Devnet 3 epoch-0 (id fce15bf61030be57) derive
check is owed once I copy its program.json read-only from build-1.
Status board
| Q | Method | Known-failed shape (must fire) | Gate | Result | Status |
|---|---|---|---|---|---|
| Q1 | Steering/hot set: draw accepted class v4 programs over >=10^6 seeds, measure the hot set of the 128 live loads per hash (share of reads on top 0.1% / 1% of items vs uniform) | f8 const-item / quarter-lines / half-lines plant must FLAG; clean control within noise | X_f >= f flags a hot set; gain = implied on-die SRAM copy size | closed-form proxy sweep (10k seeds) running; live-dataset histogram owed | RUNNING |
| Q2 | Stand-in gap: compare the (c) metrics (distinct-address sum, saturation, bias, per-site ratio) on the closed form vs the live memory-hard dataset for accepted programs; count and bound false accepts | a hand-built closed-form-accept / live-reject program must be reported as such | any false accept that reads a hot set on the live set | not started (rides on Q1 cache) | PENDING |
| Q3 | Attempt grinding + last resort: variance of the hot set across attempts of one seed vs across seeds; what last_resort_v4 (256-cap, or/mul/mulhi->xor, no (c) check) hands an attacker | the forced last-resort program's live hot set must be measurable; derive check fce15bf61030be57 | a predictable or weak accepted program the hot-set rule never sees | not started | PENDING |
| Q4 | Header grinding for locality: vary H and nonce_hi (init words only), measure distinct DRAM rows / cache lines a 32-lane group touches, search cost vs clustering gain | a harness-mirror patch making the address depend on I must let the search find a clustering header; the real path must not | best clustering over a header budget, cost in hashes | not started | PENDING |
| Q5 | Generator distinguishers: over accepted programs count lossy last writes, contractions, register-set collapse, low-entropy sites in the 0.98 tail; headroom of the floor | reproduce the crate's ratio verdict: p15/p18/p19/p56 rejected, p23 attempt 1 accepted | a structural shape that lowers the live distinct-item count | per-site ratio distribution in the 10k sweep; F8 reproduction owed | RUNNING |
| Q6 | Fixed (c) sample grindability; live-size invariance of the (c) verdict | a program tuned to the 2,048 fixed nonces but failing off-sample must be found or bounded | BOUND unless something fires | not started | PENDING |
The plant (known-failed shape for the harness itself) fired: planting an or write of a load's
source register immediately before the load makes the rule reject with "(a') load at 1 reads r4, not
fresh by dataflow in the loop's steady state". So the harness reads the real rule, not a copy.
Command: adv-accept plant --seed 0 on box 2.
Q1 and Q5: the accepted-program sweep (RUNNING, sharded)
Ten shards of 100,000 seeds (k = 2..1,000,001 of the F8 label space), each
adv-accept sweep --seed-start S --seeds 100000 --threads 96 --ratio-units 256 --out /srv/builds/igneum-wt-adv-accept/adv/sweep-sNN.txt, started through run-box.sh (nice 10, yield to
builds, pid/pgid/yield pid files beside the log). Shard 00 (S = 2) on box 2, started 18:27Z. Shard 01
(S = 100,002) on box 1, started 18:30Z. Shards 02..09 sit as self-contained scripts in
/srv/builds/_adv/accept/queue/ on box 2 (claim by mkdir under claims/), to be run back to back on
whichever box has idle cores. Every row is written as it lands, so a partial shard is data.
Live hot set (the measure the chip model prices): adv-live warps --program k --nonces N (the
unmodified f8 harness: the day's items derived into a table, the cross-hash item histogram, the
hot-set test X_f >= f against the window-model control, the 6-sigma test, library agreement checks).
Known-failed shape run first: --plant const-item on program 2 at 10^6 nonces (box 1, 18:30Z, log
adv/live-plant-p2.log) beside its clean control (adv/live-control-p2.log). The plant must be FLAGGED
and the control clear before any live number below is trusted.
Seeds: epoch bytes = LE words of seed_words_from_bytes("igneum-attack-f8/program/k"), era bytes of ".../era/k"; each drawn through the chain path generate_era(V4_CLASS, V3_ALLOWED), which runs the full attempt loop and the real acceptance rule.
Per accepted program the sweep records: attempt, program id, the closed-form distinct-item mean per hash (the rule's own (c) metric; 128 is ideal, the rule floor is a mean above 120), the minimum per-site distinct-index ratio at 256 units (the (c'') metric sampled cheaply; the enforced floor is 0.98 at 2^20 units), the saturated-final count and the output-bias max.
This is the closed-form proxy for Q1 and the headroom characterization for Q5. The live-dataset hot set (the memory-hard cache, items derived into a table, the cross-hash histogram with the hot-set test) is the next run and is what the chip model prices; the closed-form distinct mean is a cheap upper bound on how concentrated an accepted program can be on the stand-in.
Numbers land here when the run finishes (first results by 8 October 18:00 UTC).
Results as they land
Tool validation (box 1, 18:30Z, 10^6 nonces each, about 30 s per run on 32 threads)
| Run | Hot-set test (window-model control) | Top 0.1% share ratio over the window model | 6-sigma | Verdict |
|---|---|---|---|---|
adv-live warps --program 2 --plant const-item (known-failed shape) |
f 1%: S_f 8.58%, E_f 2.09%, X_f +6.49% (X_f/f 6.49) HOT SET | 21.80x (flat control 26.85x) | FLAGGED | FLAGGED |
adv-live warps --program 2 (clean control) |
f 1%: S_f 2.56%, E_f 2.09%, X_f +0.47% (X_f/f 0.47) no hot set | 0.9996x (flat 1.2312x, the window layer) | clear | PASS |
The plant fires and the control is clean, so the live hot-set numbers below are trusted. Logs adv/live-plant-p2.log and adv/live-control-p2.log on box 1.
Sweep shard 01, first 864 accepted programs (box 1, seeds 100,002..., read at 18:33Z)
| Metric | Value |
|---|---|
| Attempt histogram 0..9 | 273, 191, 134, 90, 59, 38, 34, 12, 7, 11; max 26 |
| Min per-site distinct-index ratio at 256 units | 0.9986 (floor 0.98 at 2^20; every row above 0.998) |
| Programs with a lossy (or/mul/mulhi) last write to an output register | 715 of 864 (83%) |
| Programs writing fewer than 8 registers | 0 |
| Last-resort programs | 0 |
| Lowest-ratio seeds (live hot set queued) | 100211 (0.9986), 100629 (0.9987), 100064, 100767 (0.9988), 100159 |
Reading: on the stand-in the accepted population sits 0.02 above the 0.98 floor at this sample size; the floor leaves headroom (Q5), and no accepted program in this sample comes near it. Whether any of the lossy-last-write programs concentrate reads on the LIVE set is what the live census answers.
Rule change in the method column (box-hours honesty)
18:27Z to 18:4xZ: shards ran under the capacity layer's SIGSTOP yield and were paused almost the whole time (a build slot held nearly continuously on both boxes). Ruling at 18:4xZ: yield dropped, every sweep at nice 10 on cores 8-95 (cores 0-7 reserved for release builds, the seed and the observer). Shards 00 and 01 SIGCONTed and re-pinned at 18:4xZ. Box-hours before the ruling: about 0.1 of running time.
Live hot set of the five lowest-ratio shard-01 programs (box 1, 18:37Z, 10^6 nonces each)
All five pass the rule (they are the chain's accepted programs). Log logs/adv-accept/live-lowratio-s01.log. Columns: the f8 gate (top 0.1% share over the window-model control, gate 1.2x), the hot-set excess X_f at f = 0.1% and 1% (a hot set needs X_f >= f), the windowed 6-sigma test, the hottest item and its traced source.
| Seed | id | attempt | closed ratio (256 u) | top 0.1% over window model | X_0.1% / X_1% | 6-sigma (buckets64) | hottest item, reads, share, source |
|---|---|---|---|---|---|---|---|
| 100211 | d07885a437e237c7 | 0 | 0.9986 | 1.08x | +0.026% / +0.049% | +42.4 sigma FLAGGED | 0x454585, 1238 (0.0010%), site instr 4 reads r0 one-zero-bit, writer load@3 |
| 100629 | 37c849d9741c5994 | 0 | 0.9987 | 1.01x | +0.003% / +0.015% | +5.6 within | 30 reads, none |
| 100064 | 2442abf9d56f6611 | 2 | 0.9988 | 1.17x | +0.044% / +0.189% | +77.3 sigma FLAGGED | 54 reads; the flag is a 256-item bucket at p43 (iteration 2, site 11, instr 33) holding 0.048% of that position's reads against 0.0061% expected (8x) |
| 100767 | 9d68e6286fc817d4 | 2 | 0.9988 | 1.34x BEYOND the 1.2x gate | +0.087% / +0.138% | +68.0 sigma FLAGGED | 0x000000, 1677 (0.0013%), site instr 6 reads r6 = zero, writer mad@4; saturated-source share 0.013% at that position (the (c') limit is 1%) |
| 100159 | 573d650159a8b04e | 3 | 0.9988 | 1.07x | +0.020% / +0.124% | +37.5 sigma FLAGGED | 37 reads, none |
| p2 control (18:30Z) | f8 seed 2 | 0.9996x | +0.00% / +0.47% (flat) | clear | 32 reads |
Reading, as an attacker. (1) The stand-in ratio does correlate with live concentration: four of the five lowest-ratio seeds flag the windowed 6-sigma test at 10^6 nonces where the random control is clear, and one sits beyond the f8 gate. (2) The concentration is NOT a hot set a chip can use: the top 0.1% of items (16.7k items, 1 MB) take at most 0.34% of reads against 0.26% expected; the hottest single item takes 0.0013% of reads. An on-die copy of these items saves under 0.1% of DRAM reads: no row of chip-model-v3.md moves. (3) The mechanism is the known one, a near-saturated source (zero, or one bit off all ones) at one site in one iteration, below the (c') 1% limit (0.013% here), so (c') never fires, and the per-site ratio at 0.98 is loose enough (these sit at 0.9986) that (c'') never fires either.
FINDING (bounded): seed 100767 at 2^24 nonces passes the rule and flags the f8 hot-set test (box 1, 18:4xZ)
adv-live warps --program 100767 --nonces 16777216 --threads 32 --diag 1 (log adv/live-confirm-16m.log,
copied to logs/adv-accept/ when the four runs end). Program id 9d68e6286fc817d4, attempt 2, accepted by
every part of the rule.
| Measure | Value | Uniform / control |
|---|---|---|
| Hot-set test f = 0.1% | S_f 0.303%, E_f 0.148%, X_f +0.155%, X_f/f 1.55: HOT SET | X_f >= f fires |
| Hot-set test f = 0.5%, 1% | X_f +0.266% (X/f 0.53), +0.325% (0.33): no hot set | |
| Top 0.1% share over the window-model control | 2.05x (0.5%: 1.37x, 1%: 1.23x); flat control 2.31x | f8 gate 1.2x; population 0.998x to 1.043x (14 random accepted programs, census, 10^6 nonces) |
| Windowed 6-sigma, 64-item buckets | largest bucket +294.8 sigma | population +4.4 to +30.6 at 10^6 nonces |
| Hot items (top 0.1% = 17,034 items, 1.0 MB) | 6,579,906 of 2,147,483,648 reads (0.306%) | 0.148% expected |
| Top 8 items | 0x000000 (29,355 reads), 0x200000, 0x300000, 0x180000, 0x100000, 0x080000, 0x380000, 0x0c0000: multiples of 2^19, read almost only from site 6 in every iteration | |
| Site attribution | site 6 (instr 23, src r6, quarter window) puts 3.35% of its reads into the hot items; site 7 (instr 32, src r0) 0.41%; every other site 0.00 to 0.21% (expected 0.10%) | |
| Site 6 source | r6, last written by mad at instr 4; saturated (zero) in 0.0126% of evaluations at that position (the (c') limit is 1%); the hot items are the images of small source values under the era stride |
Gain, priced against chip-model-v3.md section 5.7: an on-die copy of the top 0.1% of items (1 MB of SRAM) serves 0.31% of this program's loads instead of 0.15%, so it removes 0.16% of DRAM reads. The f = 1 chip's rate is lanes over latency per read; 0.16% fewer reads is a gain of 1.002x. No row moves. The rule has let through a program with a measurable, attributable hot set, and the hot set is worthless to a chip. The distinguisher is real; the bypass is not exploitable at this size.
What a larger search adds: the sweep ranks seeds by the stand-in ratio, and the worst of 4,600 accepted programs gave X_0.1% = 0.155%. If the tail scales as the extreme of the population, 10^6 seeds reach a few times that, still under 1% of reads. The census over consecutive seeds (random accepted programs) says how often the hot-set test fires in the population; that number lands below.
Q2, the stand-in gap: first bound (box 2, 18:46Z, adv-accept gap)
Tool: a mirror interpreter with per-site index capture, run on the rule's own base nonces (seed-keyed
acceptance stream) with init words = seed words, once on the closed-form dataset and once on the LIVE
memory-hard dataset (day 20730, the kit's day). Validation on every program: the mirror's 32 hashes equal
the library's hash_warp on 8 units on both datasets, and the mirror's closed-form per-site distinct counts
equal the library's distinct_indices_v4 on all 4096 units. Known-failed shape --plant zero-dataset
(every live word 0): live min ratio 0.9733, verdict live REJECT against closed accept, live distinct
mean 115.99 against 128.00: the tool reports a gap when there is one. Logs adv/gap-plant.log, gap-first.log.
| Seed | id | min per-site ratio closed (2^20) | min live (2^20) | largest site gap | (c) on 64 units: distinct mean, saturated, bias max (closed / live) | verdict closed / live |
|---|---|---|---|---|---|---|
| 100767 (the finding) | 9d68e6286fc817d4 | 0.9919 | 0.9920 | +0.0002 | 127.714, 0, 82 / 127.730, 1, 53 | accept / accept |
| 2 (control) | 8a0047b2eb071ade | 0.9999 | 0.9999 | -0.0002 | 128.000, 1, 56 / 128.000, 0, 57 | accept / accept |
| 100211 | d07885a437e237c7 | 0.9907 | 0.9908 | +0.0002 | 128.000, 0, 61 / 128.000, 0, 57 | accept / accept |
| 100064 | 2442abf9d56f6611 | 0.9832 | 0.9831 | +0.0002 | 128.000, 11, 64 / 128.000, 6, 51 | accept / accept |
Reading. The per-site index distribution is set by the program and the register init, and the dataset words it folds in act as fresh randomness on both sides: the closed form and the live set give the same ratio to 2 parts in 10,000 at 2^20 evaluations, and the same (c) verdicts. No stand-in gap to steer into on these four; the 50-program widening is running (gap-50.log). Also: the cheap 256-unit proxy did rank real tail programs, and 100064 sits 0.0032 above the 0.98 floor at 2^20, so the floor is live in the population tail, not idle.
Live hot-set census (RUNNING)
- box 2, 18:5xZ:
adv-live census --programs 2..201 --nonces 1000000 --threads 32(200 consecutive accepted programs of shard 00's range: the random sample), log adv/live-census-s00-2-201.log. - box 1, 18:5xZ:
adv-live warps --program k --nonces 1000000for the five lowest-ratio shard-01 seeds, log adv/live-lowratio-s01.log.
Running notes
- Box-hours and commands are logged in each section with the seed, so every claim is reproducible by re-running the exact command on box 2.
- No cargo on the Mac. Pushes to the build mirror only. Commits as igneum-labs.