# Ticket #000034 — Hessian alignment under φ_linear

**Status:** in progress · Phase 1a landed 2026-05-10 (synthetic-ablation probe + KAT fixture); Phase 1b parks for v7 deployment ramp-up
**Opened:** 2026-05-09
**Scope:** Empirically measure whether the v7 reference
`embed_hard_to_vec` matrix W (frozen-seed linear projection from
SHA-256 digest space → dim_h vector space) has structural alignment
with low-eigenvalue directions of the typical training-loss Hessian.
If yes, the §4 reduction in #000018 is loose under φ_linear and
T2 adversaries can amplify covert-channel steerage beyond the
random-oracle baseline.
**Audience:** maintainers of the v7 plastic-training spec; #000018
follow-up.
**Hard constraint:** measurement-only. This ticket does NOT change
v7 spec or the φ implementation; it produces a residual-channel
bound that informs the M1 (φ_PRG) vs M2 (anchor nonce) priority.

---

## 1. Problem statement

The #000018 analysis (`docs/soft-hash-channel-analysis.md` §4)
shows that under threat models T1 (data poisoner) and T2 (gradient
adversary), the covert channel from training data → committed
hard hash `C(M_{t+1})` is bounded by SHA-256 partial-preimage
hardness — **provided φ is independent of parameter geometry**.

§5.1 flags the v7 reference choice (frozen-seed linear projection)
as not obviously independent. If W's column space aligns with
low-eigenvalue directions of the loss Hessian, the L2 anchor pull
provides cheap parameter movement in directions correlated with
SHA-256 buckets. Cheap = "reachable within a per-step gradient
budget" = exploitable.

This ticket measures whether that alignment exists.

## 2. Design choices

### 2.1 Measurement target

For a representative model checkpoint:

```
W           — dim_d × 256 frozen projection matrix
                (in v7 reference: digest_as_uint32 → dim_h via
                 random-seed Gaussian)
H(Θ)        — Hessian of L_task at Θ (dim_d × dim_d, symmetric)
{λ_i, v_i}  — eigenvalue / eigenvector pairs of H(Θ)
```

Quantity of interest: does W's column space concentrate on the
low-eigenvalue subspace of H(Θ)?

Define **alignment score**:

```
A(W, H) = (Σ_i  ⟨W·e_i, v_i⟩² / (λ_i + ε))   /   ‖W‖_F²
```

where the sum is over the 256 columns `W·e_i` of W and the
eigenvectors of H, and ε is a small regularizer to avoid
division by 0 on flat directions.

Under random-oracle modeling, A is uniformly distributed across
the eigenvalue spectrum (no preference for low-λ). If A is
concentrated on the low-λ tail, we have evidence of structural
alignment.

### 2.2 Hessian estimation strategy

The Hessian of a 10⁹-parameter model is intractable. Three
approximation choices:

**A. Top-k Lanczos.** Estimate the top-k and bottom-k eigenpairs
via Lanczos iteration. Captures the spectrum's tails — the
ones that matter for the alignment question.

**B. Hutchinson stochastic trace estimator.** Bounds the trace
distribution but doesn't give per-eigenvector alignment.

**C. KFAC / block-diagonal approximation.** Layer-wise Hessian
approximation. Cheap; loses cross-layer structure that may be
exactly where the alignment lives.

**Recommendation:** A. Top-100 + bottom-100 eigenpairs is
empirically tractable on a single GPU for ~10⁸-parameter
checkpoints.

### 2.3 Reference checkpoints

Run the measurement on:

1. v7-reference fresh-init checkpoint (no training).
2. v7-reference after K=1000 steps on a representative task.
3. v7-reference after K=10⁵ steps (mid-training).

If the alignment score remains low across all three, the
structural-alignment concern is empirically dismissed.

If alignment grows during training (e.g., the loss landscape
develops low-λ valleys aligned with W's columns), that's the
exploit pathway and M1 (φ_PRG) becomes the recommended
mitigation.

## 3. Implementation sketch

### 3.1 New script

`bench/scripts/phi_alignment_probe.py`:

```python
def measure_alignment(checkpoint_path, k=100):
    # 1. Load Θ, W (from v7 boot manifest).
    # 2. Build a small task-loss closure on a fixed eval batch.
    # 3. Run top-k + bottom-k Lanczos on H(Θ).
    # 4. Compute A(W, H_top) and A(W, H_bottom).
    # 5. Emit JSON with eigenvalue spectrum + alignment scores.
    ...
```

### 3.2 Bench fixture

`bench/fixtures/phi-alignment/sentinel-checkpoint.json` (or
similar) — a deterministic mini-checkpoint we can re-measure
across runs to detect drift in the analysis.

### 3.3 Interpretation thresholds

- A_low / A_uniform ratio > 1.5 → structural alignment confirmed,
  M1 (φ_PRG) becomes priority over M2.
- A_low / A_uniform ratio ≈ 1.0 → no alignment, M2 alone is
  sufficient.
- A_low / A_uniform ratio < 0.7 → φ_linear is anti-aligned with
  the loss landscape; the linear projection is actually safe.

## 4. Out of scope

- Full Hessian computation (intractable).
- Implementing M1 / M2 in code (separate tickets).
- Training new models for the experiment (use existing
  representative checkpoints).
- Adversarial training that deliberately creates alignment
  (out-of-scope; that's an attack-construction experiment, not a
  measurement).

## 5. Risks

- **No representative v7 checkpoint exists today.** v7 plastic
  training is on the roadmap, not deployed. This ticket assumes
  a v7 reference checkpoint becomes available; it parks until
  one does. Until then, measurement on a *proxy* checkpoint
  (e.g., a small transformer trained with the L2-anchor term
  retrofit) lets us derive a preliminary bound.
- **Lanczos convergence on noisy gradients.** Stochastic Hessian
  estimation has well-known noise issues; bound calculations
  should report confidence intervals.

## 6. Acceptance criteria

1. `bench/scripts/phi_alignment_probe.py` runs against any
   v7-reference-shape checkpoint.
2. Output JSON includes per-eigenvalue alignment scores for
   top-k and bottom-k.
3. Decision threshold (§3.3) yields one of three verdicts:
   `STRUCTURAL_ALIGNMENT`, `NO_ALIGNMENT`, `ANTI_ALIGNED`.
4. Result feeds back into #000018 §9.1 — either closes the
   open question (if NO_ALIGNMENT) or escalates the M1
   priority (if STRUCTURAL_ALIGNMENT).

## 7. Status

**In progress · Phase 1a landed 2026-05-10** (synthetic-ablation
probe + KAT fixture in commit `1dfb8b9`; test backfill in
`a4b3056`). Phase 1b parks until a v7 reference checkpoint is
available — the real-data measurement is empirical-only and
useless without representative training data on the V7 deployment
side. **Phase 1a infrastructure is ready to run the moment v7
ramp-up surfaces a checkpoint.**

### Phase 1a — synthetic-ablation probe (landed 2026-05-10)

Mirrors the #000035 pattern: ship the deterministic primitive +
unit tests + KAT-style verification on a synthetic input ahead
of the real-deployment target, so the cryptographic / numerical
infrastructure is unit-tested + bench-pinned the moment v7
deployment provides a real checkpoint.

What lands in Phase 1a:

- ``bench/scripts/phi_alignment_probe.py`` (~150 LOC) per §3.1.
  Public surface:

  ```python
  def measure_alignment(
      W: numpy.ndarray,                  # dim_d × 256, frozen
      hessian_eval: Callable[[numpy.ndarray], numpy.ndarray],
                                          # closure: x → H @ x
      *,
      k_top: int = 100,
      k_bot: int = 100,
      epsilon: float = 1e-6,
  ) -> AlignmentReport
  ```

  ``AlignmentReport`` carries top-k / bottom-k eigenvalue
  spectra, per-eigenvector alignment scores, the aggregate
  ``A(W, H_top) / A(W, H_uniform)`` ratio, and a verdict label
  per §3.3 thresholds (``STRUCTURAL_ALIGNMENT`` /
  ``NO_ALIGNMENT`` / ``ANTI_ALIGNED``).

- ``bench/fixtures/phi-alignment/synthetic-checkpoints.jsonl``
  (~30 KAT entries). Each row pins a synthetic ``(W, H)`` pair
  with a deterministic seed AND the expected verdict. Three
  classes:

  1. **Aligned**: W's columns engineered to lie in the
     low-eigenvalue subspace of a known-eigenstructure quadratic.
     Expected verdict: ``STRUCTURAL_ALIGNMENT``.
  2. **Uniform**: W ~ Gaussian(0, 1/dim_d) — the v7 reference
     spec — measured against an isotropic Hessian. Expected
     verdict: ``NO_ALIGNMENT``.
  3. **Anti-aligned**: W's columns deliberately placed in the
     high-eigenvalue subspace. Expected verdict:
     ``ANTI_ALIGNED``.

- ``tests/test_phi_alignment_probe.py``:

  - Round-trip determinism (same seed → same alignment score).
  - Verdict thresholds (engineered cases land in their expected
    bucket; boundary cases land cleanly).
  - Lanczos convergence on the synthetic Hessian (top-k matches
    a known dense decomposition).
  - Module export shape.
  - KAT regression against the fixture.

- New optional-deps block in ``pyproject.toml``:

  ```toml
  [project.optional-dependencies]
  hessian = [
    # Lanczos top-k / bottom-k eigendecomposition for the
    # phi_alignment_probe (#000034). Pulled into a separate
    # extras to keep the core install lightweight; same
    # pattern as the [math] extras for sympy. Tests skip via
    # pytest.importorskip when absent.
    "numpy>=1.26",
    "scipy>=1.11",
  ]
  ```

  Tests fail-soft via ``pytest.importorskip("scipy.sparse.linalg")``.
  Operators run real-checkpoint measurements via
  ``pip install 'arborist[hessian]'``.

What does NOT land in Phase 1a:

- Real v7 checkpoint measurement (gates on v7 deployment producing
  a representative checkpoint per §5 / original §7).
- M1 / M2 implementation (separate tickets).
- Adversarial-training experiment (out-of-scope per §4).

### Phase 1b — real-checkpoint measurement (parks)

Original §7 deferral preserved. When a v7 reference checkpoint
becomes available, run ``measure_alignment`` against it; the
verdict resolves §9.1 of ``docs/soft-hash-channel-analysis.md``
and either closes #000018's open question (NO_ALIGNMENT) or
escalates M1 priority (STRUCTURAL_ALIGNMENT).

### Closure criterion (unchanged)

Closes when Phase 1b lands a real-checkpoint measurement that
resolves the §9.1 open question — Phase 1a is the prerequisite
infrastructure, not closure.
