# Ticket #000018 — Adversarial soft-hash covert channel analysis

**Status:** closed · landed 2026-05-09 (analysis doc at `docs/soft-hash-channel-analysis.md`; three §9 open questions split into follow-ups #000034 / #000035 / #000036)
**Opened:** 2026-05-07
**Scope:** Formal threat model + falsifier set for whether training
gradients can route information from training data through soft hashes
to influence hard hashes (committed bytes). Doc-only ticket. Either
proves no covert channel exists under stated assumptions, or specifies
mitigation. Outcome feeds back into v7 § 9 plastic-training spec.
**Audience:** fox + future blackops shifts + downstream Merkle-AGI v7+
authors.
**Hard constraint:** the v7 separation theorem (T6) MUST hold. If this
analysis surfaces a channel, the channel either gets closed by
construction (preferred) or gets a measurable bound.

---

## 1. Problem statement

v7 § 9.9 dismisses "backdoor via soft hash" in two sentences:

> Backdoor via soft hash: impossible to affect published commitments;
> any effective backdoor must appear in Q(Θ) and is thus bound by
> C(M).

This is correct *to first order*: the hard hash preimage doesn't
include soft-hash bytes. But training is the **inverse direction** of
the hard→soft anchor map:

```
hard hash (frozen at checkpoint t)
     ↓ φ (fixed deterministic embedding)
hard-anchor vector
     ↑ L2 loss pulls soft hash toward anchor
soft hash (h_v at checkpoint t+1, before re-snapshot)
     ↑
plastic loss + task loss
     ↑
gradients
     ↑
training data
```

The training loop drives **Q(Θ) updates** based on training data. At
the next checkpoint, **C(M_{t+1}) is determined by Q(Θ_{t+1})**. The
question: can an adversary controlling training data systematically
push Q(Θ) toward a target subset such that **C(M_{t+1}) lands on a
prearranged value or value-class**?

If yes: a covert channel from training data → committed model bytes
exists, even though soft hashes never enter the hard preimage.

### 1.1 Threat model

Three adversary capabilities of increasing strength:

**T1 — Data poisoner.** Adversary controls a fraction f of training
data. Training loop is honest. Cannot directly modify Q(Θ).

**T2 — Gradient adversary.** Adversary additionally controls a
fraction of gradient computations (e.g., compromised data-parallel
worker). Honest aggregator.

**T3 — Hyperparameter adversary.** Adversary controls some learning
rate / scheduler decisions in addition to T2.

For each, the question: under v7 § 9 plastic dual-hash training,
can the adversary engineer Q(Θ_{t+1}) to land in a prearranged
SHA-256-class (e.g., `C(M_{t+1})` first byte equals 0xAA)?

### 1.2 Why this isn't trivial

The naive answer is "Q(Θ) is a function of training data, so trivially
training data influences Q(Θ), so trivially influences C(M)." Not
useful — that's the whole point of training.

The interesting question: can the influence be **steered** to a
*specific* hash-space target? Hash-space is uniform under SHA-256
assumptions; steering to a target requires either:

- Solving the inverse SHA-256 problem (infeasible under A3).
- Iterating through many candidate Q(Θ) values until one lands in
  the target class (feasible only with grid search; bounded by
  computational budget).
- Exploiting structure in the hard→soft anchor map φ that lets the
  soft loss feed back into Q(Θ) in a hash-aligned way.

Option 3 is the live concern. φ in v7 reference (`embed_hard_to_vec`)
is "interpret the 32-byte digest as 64×uint32, normalize to [-1,1],
random-project to dim_h." The random projection has a fixed seed → it's a
fixed deterministic linear map. If that map has any exploitable
structure relative to the parameter geometry, gradient updates that
push the soft hash toward a target anchor *do* push Q(Θ) in a
correlated direction.

---

## 2. Design choices

### 2.1 Analysis approach

**A. Information-theoretic.** Bound the channel capacity from
training-data → C(M_{t+1}) under each threat model. Likely yields
"adversary can move ≤ k bits of C(M) per N training steps with
probability p."

**B. Cryptographic reduction.** Reduce "covert channel exploitable"
to "SHA-256 partial-preimage attack" under explicit assumptions
about φ. If reduction holds, channel is closed under SHA-256.

**C. Empirical.** Construct an actual data-poisoning experiment;
measure whether a poisoner achieves any control over hash bytes.

**Recommendation:** B for the formal result (this ticket's
deliverable), with C as a follow-up sanity check experiment if B
leaves any gap.

### 2.2 Mitigation candidates (if a channel exists)

**M1 — Make φ unfriendly.** Replace `embed_hard_to_vec`'s linear
projection with a non-linear map (e.g., PRG-based) so gradient feedback
through soft hash is uncorrelated with parameter-space updates that
would shift hash bytes.

**M2 — Re-randomize anchors per checkpoint.** φ's seed becomes a
per-checkpoint nonce committed in the manifest. Adversary can't pre-
plan against the next anchor.

**M3 — Decouple plastic loss from anchor.** Drop the L2 anchor term
entirely and only use task loss + diversity. Loses some training
ergonomics; closes the channel by construction.

**M4 — Plastic-loss budget cap.** Bound the magnitude of soft-hash
gradients per step relative to task-loss gradients. Limits the
adversary's per-step manipulation budget.

**Recommendation:** M2 first (cheapest), with M1 as a fallback if
the analysis shows residual channel even with re-randomized
anchors.

---

## 3. Recommendation

Produce a formal-analysis doc (`docs/soft-hash-channel-analysis.md`)
that:

1. States the threat model precisely.
2. Defines the channel capacity formally as I(training-data;
   C(M_{t+1})) conditional on the public training history.
3. Reduces "channel exploitable" to "SHA-256 partial-preimage" under
   explicit assumptions about φ.
4. Lists mitigations and the analysis residual after each.
5. Recommends one specific mitigation to fold into v7 § 9 for the
   next revision.

---

## 4. Implementation sketch

### 4.1 Doc structure

```
docs/soft-hash-channel-analysis.md
├── 1. Threat model (T1, T2, T3)
├── 2. v7 § 9 plastic training, recap
├── 3. Channel capacity definition
├── 4. Reduction to SHA-256 partial-preimage
├── 5. Assumptions on φ (the embed_hard_to_vec map)
├── 6. Mitigations M1-M4 with residual analysis
├── 7. Recommendation
└── Appendix — worked example with concrete φ choice
```

### 4.2 Key questions to answer

- Is `embed_hard_to_vec` (frozen-seed linear projection) friendly
  to gradient-aligned attacks? Yes/no with proof.
- Does periodic re-snapshotting of C(M) every K steps reduce per-
  attack budget linearly with K? Yes/no with proof.
- Does the bigint-accumulator integer-kernel discipline (v7 § 5)
  reduce the channel's analog leakage to zero, or only bound it?
- What's the residual channel if φ is replaced with a PRG?

### 4.3 Optional follow-up: empirical sanity check

If the analysis result is "channel closed under SHA-256," a
small experiment running v7 § 9 plastic training with deliberate
data poisoning targeting a specific hash byte should show:

- Adversary's success rate is indistinguishable from random (1/256
  per byte).
- Mitigation-applied training shows the same baseline.

If the empirical result diverges from the analysis prediction, the
analysis is wrong. Empirical run is its own follow-up ticket; not
in scope here.

---

## 5. Out of scope

- Implementing any mitigation in code. This ticket recommends; a
  follow-up implementation ticket lands the chosen mitigation.
- Empirical validation experiment. Sanity-check follow-up ticket.
- Attacks against the hard hash itself (SHA-256). Out of scope by
  A3 assumption.
- Side-channel attacks on training infrastructure (compromised CPU,
  Spectre-class). Different threat model.

---

## 6. Risks & open questions

- **Result might be "channel exists but bounded."** Then v7 needs a
  budget cap (M4) and the bound becomes a published artifact.
  Acceptable but adds operational complexity.
- **Result might be "needs M3 (drop anchor entirely)."** Then v7's
  plastic-training ergonomics regress; the dual-hash advantage
  shrinks. Document the trade clearly.
- **Time horizon.** This is several weeks of analysis work, not a
  one-session ticket. Recommendation: park unless v7+ deployment
  is imminent.

---

## 7. Status

**Open · awaiting go/no-go.** Doc-only deliverable. Recommended
deferral until v7 plastic training has a concrete deployment
target — analysis without deployment is theoretical hedging.

Closure criterion: `docs/soft-hash-channel-analysis.md` lands with
a stated reduction (proof or counterexample), recommended mitigation,
and residual-bound table.
