arborist/docs/soft-hash-channel-analysis.md

Soft-hash covert channel analysis

Ticket: #000018 Authored: 2026-05-09 Audience: fox + future blackops shifts + downstream Merkle-AGI v7+ authors Stance: defensive only — detection / flagging / bound-derivation, never generation or concealment.

---

0. Executive summary

We analyze whether an adversary controlling some fraction of training data, gradient computation, or hyperparameter scheduling can drive a v7-§9 plastic-trained model so that its next snapshot's hard hash C(M_{t+1}) lands on a prearranged target value or value-class, exploiting the soft-hash anchor map φ as a side-channel.

Result, under the assumptions stated in §5:

Under threat models T1 (data poisoner) and T2 (gradient adversary), the channel is bounded by a SHA-256 partial-preimage hardness reduction (§4). Under T3 (hyperparameter adversary), the channel is bounded by the per-checkpoint mitigation budget M2 (re-randomized anchors); residual channel without M2 is at most O(log N · entropy of training-data choices) bits per checkpoint window.

Recommended mitigation: M2 (per-checkpoint anchor nonce), costing one additional commit field per snapshot. Falls back to M1 (PRG-based φ) if a deployment surfaces residual structure. M3 (drop the anchor) is the strict-construction fallback if both fail; loses some training ergonomics.

This document is doc-only per the ticket's hard constraint: it recommends, does not implement. A follow-up ticket lands the chosen mitigation.

---

1. Threat model

Three adversary capabilities, increasing in strength.

1.1 T1 — Data poisoner

Adversary controls a fraction f ∈ (0, 1) of training-data examples. Training loop is honest; aggregator is honest; hyperparameters are honest; φ is the published deterministic embedding. Poisoned examples are valid in distribution (otherwise an outlier filter catches them).

Goal: poisoned examples drive Q(Θ_{t+1}) to a region whose soft hash h_v(t+1) projects to a SHA-256 bucket the adversary can predict. Concretely: adversary tries to land C(M_{t+1}) in a target class T ⊂ {0,1}^{256} with |T|/2^{256} = ε (so the 'class' could be "first byte 0xAA" → ε = 2^-8, or "specific 256-bit value" → ε = 2^-256).

1.2 T2 — Gradient adversary

T1 + adversary controls a fraction g of gradient computations (e.g., compromised data-parallel worker that returns dishonest local gradients to the central aggregator). Aggregator is still honest.

Adversary can bias the gradient signal in arbitrary directions — not bounded to legitimate-data-distribution reach. Tighter than T1.

1.3 T3 — Hyperparameter adversary

T2 + adversary controls some learning-rate / scheduler / batch-order decisions. Adversary can synchronize gradient updates with anchor geometry to maximize alignment. Strictly stronger than T2.

1.4 What's NOT in scope

• Direct attack on C(M_t) itself (preimage-attack on SHA-256). Out of scope by A3 in v7 §3 (collision-resistant hash assumption).
• Side-channel on training infrastructure (Spectre, RowHammer, compromised CPU). Different threat model.
• Adversary controlling the published φ seed retroactively. Once φ's seed is public, it's frozen; this ticket assumes seed is honestly drawn at v7 boot.
• Compromised aggregator that lies about the snapshot bytes. Different threat model — that's a checkpoint integrity attack, not a covert channel.

---

2. v7 § 9 plastic training, recap

The relevant slice of the v7 spec:

Θ        — model parameters (continuous, ~10^9 floats)
Q(Θ)     — public quantization of Θ (SQD §3, integer kernel)
C(M)     — SHA-256(canonical-encoding of Q(Θ) ∥ metadata)
                  ↑ THE HARD HASH — committed bytes
h_v(Θ)   — soft hash, dim_h-vector function of Θ
                  ↑ THE SOFT HASH — used during training only
φ(C(M))  — anchor map: SHA-256 digest → dim_h vector
                  ↑ FIXED DETERMINISTIC, published seed

Plastic training loss at step t:

L_total(Θ_t) = L_task(Θ_t) + α · ‖h_v(Θ_t) - φ(C(M_{t-1}))‖²
                                     ↑ L2 anchor pull

The anchor term pulls the model's soft hash toward the embedding of the previous checkpoint's hard hash. At each checkpoint boundary t → t+1, we compute Q(Θ_{t+1}) → C(M_{t+1}) and that becomes the next anchor.

The dual-hash separation theorem (T6, v7 §3): C(M) is determined solely by Q(Θ) and metadata; soft-hash bytes never enter the SHA-256 preimage. First-order conclusion: training cannot directly affect committed bytes.

The covert-channel concern: training does affect Q(Θ) (that's what training does). The question is whether the L2 anchor term lets the adversary steer Q(Θ) toward a target SHA-256 bucket.

---

3. Channel capacity definition

Define the per-checkpoint covert channel as the mutual information

I_t = I(adversary inputs at training step ≤ t  ;  C(M_{t+1}))
      conditional on the public training history H_{≤t}

The conditioning on H_{≤t} (public training history: published losses, public hyperparameters, public seeds) removes the "adversary trivially knows what they did" channel. We measure the bits the adversary can steer ABOVE the public information's predictive power.

A non-adversarial bound: under random training, C(M_{t+1}) is near-uniform on {0,1}^{256} conditional on H_{≤t} if Q(Θ_{t+1}) is sufficiently varied. Adversarial bound is the question.

3.1 Capacity bound under random φ

If φ is modeled as a random oracle independent of the parameter geometry, then h_v - φ(C(M_{t-1})) is a uniform random direction at each checkpoint, and the L2 pull provides no parameter-aligned gradient signal. Under this idealization, the covert channel reduces to:

I_t ≤ I(adversary inputs ; Q(Θ_{t+1}))
       conditional on H_{≤t}

…which is the un-amplified channel — adversary is no better off through the soft-hash side-channel than they would be attacking Q(Θ) directly.

3.2 Capacity bound under structured φ

If φ has algebraic structure relative to parameter geometry (the v7 reference embed_hard_to_vec is a fixed-seed linear projection of the SHA-256 digest), the bound depends on whether gradient updates that minimize the L2 anchor term are parameter-aligned to shifts in Q(Θ) that move SHA-256 buckets predictably.

The reduction in §4 shows this dependency reduces to a SHA-256 partial-preimage problem.

---

4. Reduction to SHA-256 partial-preimage

4.1 Reduction sketch

Suppose adversary A exists that, given black-box training oracle access under T1/T2, can drive C(M_{t+1}) into a target class T of density ε with non-negligible probability p.

Construct algorithm B that solves SHA-256 partial-preimage:

B(target T):
    1. Initialize a fresh v7 plastic-training run with random seed.
    2. Run A as a sub-routine, supplying T as the target class.
    3. After A signals success on checkpoint t+1, output Q(Θ_{t+1}).
    4. Q(Θ_{t+1}) is then a partial preimage of T under SHA-256.

B's success probability is p minus the probability that A succeeds via legitimate-Q-randomization (i.e., B would have solved the problem by random Q-search anyway). Under the standard random-oracle model for SHA-256, the random-Q baseline is ε. So:

P[B solves partial-preimage] ≥ p - ε

If p > ε + δ for any non-negligible δ, then B is a non-trivial SHA-256 partial-preimage attacker — contradicting A3 (collision- resistance / partial-preimage hardness).

Conclusion: under the SHA-256 random-oracle assumption (A3), no T1/T2 adversary can succeed with probability non-negligibly above ε. The channel exists but is bounded at the random baseline.

4.2 Where the reduction is tight, where it's loose

Tight: when φ is independent of parameter geometry (M1 or M2 applied), the reduction is essentially exact. T1/T2 are bounded to the random baseline.

Loose: when φ has structure relative to parameter geometry (reference v7 embed_hard_to_vec with fixed-seed linear projection), the gradient feedback through the anchor MAY favor parameter directions correlated with target SHA-256 buckets. We don't know whether this correlation is large enough to break the reduction without explicit structural analysis of embed_hard_to_vec.

This is the residual gap §6 addresses.

4.3 T3 caveat

T3 (hyperparameter adversary) is NOT bounded by the §4.1 reduction directly. The reduction assumes A's queries to the training oracle follow the published schedule. T3 violates that. Under T3:

• Adversary can synchronize gradient bursts with anchor geometry via learning-rate schedule manipulation.
• Per-checkpoint channel capacity grows with the adversary's schedule-control budget.

T3 needs M2 (re-randomized per-checkpoint anchor) or M3 (drop anchor). M1 alone may not suffice.

---

5. Assumptions on φ

Three concrete φ choices, with channel-residual under each:

5.1 φ_linear — v7 reference (linear projection, fixed seed)

φ(digest) = W · digest_as_uint32_vector  (W frozen at boot)

• Pros: fast, deterministic, simple.
• Channel residual: unclear without explicit structural analysis of W relative to the parameter Hessian. If W has any direction aligned with a low-eigenvalue direction of the loss Hessian, the L2 pull provides cheap parameter movement that aligns with SHA-256 buckets — exploitable under T2 with empirical effort.
• Verdict: the reduction in §4 is loose under φ_linear.

5.2 φ_PRG — non-linear PRG-based map (mitigation M1)

φ(digest) = PRG(seed=published, output_len=dim_h * 4 bytes)
            then bytes → floats in [-1, 1]

PRG output is computationally indistinguishable from random under the PRG security assumption. Gradient feedback through the anchor is uncorrelated with parameter-space updates that would shift hash bytes predictably.

• Channel residual: zero modulo PRG security (one-way function
  • no algebraic structure for the parameter Hessian to exploit).
• Verdict: §4 reduction is tight under φ_PRG.

5.3 φ_nonce — re-randomized anchor (mitigation M2)

At each checkpoint t, sample fresh random nonce n_t (committed
in the snapshot manifest). Compute anchor as
        φ(C(M_{t-1}) ∥ n_t)
where φ is φ_linear or φ_PRG. Adversary can't precompute against
the next anchor because n_t is unknown until commitment.

• Channel residual: even under φ_linear base, T1/T2 adversaries can't pre-plan attacks because the gradient direction they want to steer toward is randomized between checkpoints.
• T3 residual: still bounded — T3 adversary controls timing, not the nonce. Per-checkpoint window is O(steps) × per-step channel; the nonce reset zeroes the cumulative steerage.
• Verdict: lightweight; only adds 32 bytes to the manifest per checkpoint. Closes the residual channel for T1/T2 entirely; bounds T3 by a per-window budget.

5.4 φ dropped — anchor term removed (mitigation M3)

L_total(Θ) = L_task(Θ) + (no anchor term).

• Channel residual: zero by construction (no soft-hash gradient signal at all).
• Loss: plastic training loses some ergonomics (stable representation between checkpoints relied on the anchor pull). Quantified loss: depends on deployment; estimated in v7 §9.7 as 5-15% slower convergence on representation-stability metrics.
• Verdict: strict-construction fallback. Recommend only if M1
  • M2 prove insufficient empirically.

---

6. Mitigations with residual analysis

Mitigation	Cost	T1 residual	T2 residual	T3 residual	Closes the channel?
None (v7 reference)	0	bounded by §4 reduction (loose under φ_linear)	bounded by §4 reduction (loose under φ_linear)	unbounded structurally	No
M1 — φ_PRG	fast PRG eval per checkpoint	tight bound at random baseline ε	tight bound at random baseline ε	unbounded (T3 controls timing)	T1+T2 yes; T3 no
M2 — per-checkpoint nonce	32 B in manifest per checkpoint	ε	ε	bounded by per-window budget	T1+T2 yes; T3 bounded
M1 + M2 (combined)	both costs	ε	ε	bounded by per-window budget	T1+T2 yes; T3 bounded
M3 — drop anchor	5-15% training-ergonomics regression	0	0	0	Yes, by construction
M4 — gradient-budget cap	per-step gradient-norm clip	bounds adversary's per-step budget	bounds adversary's per-step budget	bounds T3 per-step	Soft bound; doesn't close

---

7. Recommendation

Land M2 first (re-randomized per-checkpoint anchor):

• 32 bytes additional manifest field, committed in the snapshot.
• Closes the T1 + T2 channel under any φ choice.
• Bounds the T3 channel by per-checkpoint budget (the only attack window is between nonce-publish and next-checkpoint).
• No training-ergonomics regression — the nonce is purely per-checkpoint randomization, anchor pull still lands.

Add M1 (φ_PRG) as Phase 2 if M2-only deployment surfaces structural concerns (e.g., empirical evidence that T3 attacks within a window achieve > ε success rate).

M3 (drop anchor) stays in reserve as the strict-construction fallback. v7 §9 spec amendment proposed:

v7 §9.10 (proposed): The anchor map φ takes both the prior
checkpoint's hard hash AND a per-checkpoint nonce committed in
the manifest. The nonce is fresh entropy at each checkpoint,
sealed before training resumes. This closes the soft-hash covert
channel under threat models T1 and T2, and bounds T3 by the
per-checkpoint window.

---

8. Empirical validation (out of scope; follow-up)

A small experiment to sanity-check the analysis:

1. Run v7 §9 plastic training with a deliberately-poisoned dataset targeting "first byte of C(M) equals 0xAA" — that's ε = 2^-8.
2. With M2 disabled (φ_linear, no nonce): measure success rate over N checkpoints. Hypothesis: indistinguishable from ε if §4 reduction holds under φ_linear; structurally elevated if φ_linear has Hessian-aligned structure.
3. With M2 enabled (φ_linear, per-checkpoint nonce): measure again. Hypothesis: indistinguishable from ε regardless of φ_linear's structure.
4. Same experiment under φ_PRG: should match ε baseline with or without M2.

If empirical results diverge from analysis predictions, the analysis is wrong somewhere — likely in §5 about φ_linear's structural alignment with the parameter Hessian.

This experiment is a follow-up ticket; not in scope here.

---

9. Open questions

The reduction in §4 leaves three loose threads:

1. Hessian alignment under φ_linear. Is the v7 reference embed_hard_to_vec matrix W aligned with low-eigenvalue directions of the typical training-loss Hessian? If yes, T2 adversaries with full gradient control can amplify steerage beyond the §4 random-oracle baseline. Test: compute the spectrum of W^T W and compare to typical Hessian eigenvalue distributions on representative checkpoints.

   Phase 1a landed 2026-05-10 under #000034: synthetic- ablation infrastructure at bench/scripts/phi_alignment_probe.py (measure_alignment(W, hessian_eval, *, k_top, k_bot, epsilon) → AlignmentReport; Lanczos top-k + bottom-k via scipy.sparse.linalg.eigsh). 23 tests in tests/test_phi_alignment_probe.py covering verdict classification (STRUCTURAL_ALIGNMENT, NO_ALIGNMENT, ANTI_ALIGNED), boundary cases, monotonicity, closure (full-spectrum sum), parametrized invalid-input cones, and KAT regression. KAT fixture (30 vectors: 10 aligned + 10 uniform + 10 anti-aligned synthetic checkpoints) at bench/fixtures/phi-alignment/synthetic-checkpoints.jsonl pins synthetic-checkpoint verdicts so the probe is regression- guarded ahead of v7 deployment ramp-up. Lands under bench/scripts/ (measurement tool, not a substrate primitive like arborist/substrate/anchor_prg.py). Phase 1b runs the probe against a real v7 checkpoint when one becomes available; the alignment-score distribution then resolves this open question and feeds C_B1 tightening per #000043.

2. PRG modeling for φ_PRG. The §4 reduction treats φ_PRG as a random oracle. In practice it's a deterministic PRG with public seed. The reduction holds modulo PRG security; we should pick a PRG with cryptographic strength matching SHA-256 (e.g., AES-256-CTR with public IV; or HMAC-SHA-512 expansion). Decision: use HMAC-SHA-512(seed, digest ∥ counter) for dim_h floats. Keeps the dependency surface (already on SHA-256) tight.

   Phase 1 landed 2026-05-10 under #000035: reference implementation at arborist/substrate/anchor_prg.py (HMAC-SHA-512 counter-mode KDF, pure stdlib — hashlib + hmac, no third-party crypto dep). 31 tests in tests/test_anchor_prg.py covering determinism, range invariants, chi² uniformity, dim_h boundary (1, 16384), seed-bit-flip and hash-bit-flip avalanche, hand-computed HMAC-SHA-512 first-block formula, prefix-extension closure, parametrized invalid-input cones, input validation, module-export shape, and KAT regression. 10 pinned KAT vectors at bench/fixtures/phi-prg/known-answer-tests.jsonl covering block-boundary cases (dim_h=16 = one HMAC block; dim_h=17 = two blocks with truncation), one-bit-flip variants, and a 4096-element counter-rollover stress sample. Module exports PHI_PRG_VERSION = "phi-prg-v1-hmac-sha512-le" so future algorithm rotation is detectable at the call site without string-comparing module paths.

   dav1d-reviewed §9.10 spec amendment text (2026-05-11) — #000035 §3.4 holds the final wording. Decisions: HMAC-SHA-512 LOCK; manifest field anchor_prg_seed (purpose-scoped; phi_prg_seed is a code-local alias only); 32-byte seed LOCK; uint32 little-endian counter + uint32-word reads from 0 — matching v7's canonical TLV integer encoding (merkle-agi-dag_v7.txt §A1: TLV length prefixes + enc_int are to_bytes(…, "little"), tensors are <i8). dav1d's review rule said "if v7 TLV is little-endian, flip §3.4 to little-endian before KAT freeze" — done; PHI_PRG_VERSION → "phi-prg-v1-hmac-sha512-le", the 10 KAT vectors regenerated under the little-endian counter. Float map 2·(u32_le/2^32)−1; prose says "uniform over a 2^32-point grid in [-1, 1) with negligible finite-grid mean −2^−32" rather than "unbiased"; SHALL replace embed_hard_to_vec when M1 enabled (M1 enablement itself is a separate mitigation-selection-policy question, with the NO_ALIGNMENT-skip rule documented in §9.10.1); plus a dim_h ≤ 16·2^32 exhaustion guard and a seed-independence / single-purpose-seed requirement. The reference implementation + 31 tests + 10 KAT vectors are pinned to these choices. Phase 2 landed 2026-05-11 (4b85eb1): the v7 substrate spec was brought into the repo as docs/_source/merkle-agi-dag-v7.rst and § 9.10 + § 9.10.1 were folded in after § 9.9. This open question is resolved — φ_PRG = HMAC-SHA-512(seed, C(M) ‖ counter_le32), 32-byte committed seed, little-endian. #000035 → closed. (A full upstream v7 spec revision remains exogenous; the amendment now lives version- controlled in the in-repo copy where future amendments land.)

3. T3 per-window budget formal bound. §6 lists "bounded by per-window budget" without giving the bound. Closed 2026-05-10: the explicit closed-form bound now lives at docs/soft-hash-channel-t3-bound.md §6 (under #000036), parametrized in operator-measurable inputs (g, ‖∇L_max‖, σ_grad, K, R, W, N_b, E). The combined bound has three contributions — gradient-bias C_B1 via Fano's inequality, LR-selection C_B2 via categorical-channel capacity, batch-order C_B3 via the Bottou-Bousquet random-shuffle refinement — summed over a window of length W. Calculator at bench/scripts/t3_bound_calculator.py.

---

10. References

• v7 § 3 (T6 dual-hash separation theorem)
• v7 § 9 (plastic training; the source of the L2-anchor term)
• v7 § 9.9 (the "backdoor via soft hash" first-order dismissal we're superseding)
• SQD § 3 (hard-hash construction for Q(Θ))
• SQD § 5 (integer-kernel discipline; bigint accumulator)
• ticket #000018 (this document is the closure deliverable)

---

11. Status

Open questions: §9.1 (Hessian alignment under φ_linear: synthetic-ablation infrastructure landed 2026-05-10 per #000034 Phase 1a — probe + 23 tests + KAT fixture; parks on v7 deployment data per #000034 Phase 1b for the actual checkpoint measurement), §9.2 (PRG cryptographic strength for φ_PRG: decision pinned + Phase 1 reference implementation landed 2026-05-10 per #000035 — HMAC-SHA-512 with 32-byte committed anchor_prg_seed, KAT-pinned; dav1d-reviewed §9.10 wording final 2026-05-11 (#000035 §3.4); awaits v7 §9.10 spec amendment when v7 plastic-training spec gains an active deployment target). §9.3 closed 2026-05-10 via the T3 per-window bound at docs/soft-hash-channel-t3-bound.md (under #000036).

Closed: §4 reduction shows T1/T2 are bounded by SHA-256 partial- preimage hardness under any φ independent of parameter geometry. M2 (per-checkpoint nonce) closes residual channels at minimal cost.

Recommendation: v7 spec amendment §9.10 lands the M2 nonce. Implementation ticket follows.

Doc closure criterion (per #000018 §7): reduction stated, mitigation recommended, residual-bound table present (§6). Done.