arborist/docs/soft-hash-channel-t3-bound.md

T3 per-window covert-channel budget bound

Ticket: #000036 Source analysis: docs/soft-hash-channel-analysis.md Date: 2026-05-10 Status: first-cut formal derivation; awaiting fox + cryptographer review of constants. The framework is the deliverable; the named constants below are conservative-but-loose first estimates that future tightening can replace without changing the call sites of the closed-form bound.

---

§0. What we're asking the reviewer to confirm

This document derives an upper bound on the per-window mutual information a T3 (hyperparameter) adversary can steer into the SHA-256 commitment C(M_{t+1}). The framework decomposes the channel across T3's three control surfaces (gradient bias, LR selection, batch order) and combines them into a closed-form bound consumed by bench/scripts/t3_bound_calculator.py.

Three specific things to check:

1. §2 decomposition. Is the Markov-chain DPI step (A → Θ_{t+1} → C(M_{t+1})) correctly applied, and is the T1 + T2 baseline inherited from soft-hash-channel-analysis.md §4 cleanly separated from the T3 capacity bound this doc adds?
2. §§ 3-5 derivations. Is each per-surface bound (C_B1 gradient-bias, C_B2 LR selection, C_B3 batch order) derived with a sound information-theoretic argument? §3 uses discrete channel-capacity counting on the per-step parameter-shift; §4 uses categorical-channel capacity on the LR grid; §5 uses the Bottou-Bousquet adversarial-order refinement.
3. Conservative-constant choice. Are C_B1 = C_B2 = C_B3 = 1 genuinely upper-bounding (never optimistic)? Where would you tighten? Empirical tightening paths are catalogued in §10 and tracked under #000043.

What's not being asked: empirical validation against an actual adversarial-training run (out of scope per §10 item 5; opens as a future ticket once v7 plastic-training has a deployment target).

The headline numeric example in §7 + §11 yields I_window ≈ 626 bits/window for a default deployment config — exceeding SHA-256's 256-bit output, which is the calculator's "reduce W" trigger condition. The framework's job is to make that trigger derivable from operator-measurable inputs; the constants' job is to be honest worst-case starting points operators can refine per-deployment.

---

§1. T3 model restatement

From docs/soft-hash-channel-analysis.md §6, threat model T3 (hyperparameter adversary) extends T2 (gradient adversary) with control over:

• Learning-rate scheduling: choosing the LR at each scheduled decision point from a constrained range (e.g. log-grid of R levels).
• Batch ordering: permuting batches within an epoch.

Combined with T2's gradient bias (controlling a g-fraction of training-step gradient computations), T3 is a strict superset of T2. The §4 reduction in soft-hash-channel-analysis.md bounds T1

• T2 channels at the SHA-256 random-oracle baseline assuming φ is independent of parameter geometry; T3 breaks the implicit "published schedule" assumption so the §4 reduction does not directly apply.

M2 mitigation (per-checkpoint anchor nonce, soft-hash-channel analysis §5.3) re-randomizes the anchor every checkpoint. T3's exploitation window is thus bounded to one nonce-window of length W steps before the anchor re-randomizes. This document bounds the bits T3 can steer into C(M_{t+1}) within a single window.

The bound's intended use: operators choose W (the nonce-window length) such that I_window stays below their target residual (e.g. < 1 bit per window means the adversary needs ≥ 2^256 windows to steer C(M) to a specific 256-bit target).

---

§2. Per-window channel — formal definition

For a single nonce window of length W steps starting at checkpoint t:

I_window := I( A ; C(M_{t+1}) | H_{≤t}, n_t )

where:

• A is the joint random variable over T3's adversary inputs during the window: A = (g_1, …, g_W, lr_1, …, lr_⌈W/K⌉, π) where g_s is the adversary-controlled gradient signal at step s, lr_d is the LR at decision point d, π is the batch-ordering permutation.
• C(M_{t+1}) is the SHA-256 hard-hash committed at the next checkpoint.
• H_{≤t} is the public history before the window opens.
• n_t is the published per-checkpoint nonce (M2 mitigation).

This is the standard mutual-information upper bound on distinguishing-from-baseline channel capacity. Conditional on (H_{≤t}, n_t), the random variables form a Markov chain:

A  →  Θ_{t+1}  →  C(M_{t+1})

— T3's window inputs A affect the commitment only through the parameter state Θ_{t+1}. Markov-chain data-processing inequality gives the single-source bound:

I( A ; C(M_{t+1}) | H_{≤t}, n_t )  ≤  I( A ; Θ_{t+1} | H_{≤t}, n_t )

The right-hand side — T3's per-window capacity to encode adversarial bits into the parameter state — is what this document bounds in §§ 3-5.

Inherited T1 + T2 baseline. Independent of T3, the φ-mapping Θ → C(M) itself admits a constant random-oracle baseline channel under the §4 reduction in soft-hash-channel-analysis.md (when φ is φ_PRG per #000035, or φ_linear under the NO_ALIGNMENT verdict per #000034). That baseline is bounded by SHA-256 partial-preimage hardness and is independent of A. Threat-model-additive (T3 capacity

• T1+T2 baseline = total per-window leak budget) but not information-additive in the same MI sense — the two contributions come from disjoint adversary surfaces:

total per-window bits  ≤  I( A ; Θ_{t+1} | H_{≤t}, n_t )   ← T3, this doc
                        + (T1 + T2 baseline)               ← § 4, inherited

The baseline term is constant-bounded by §4 unchanged; the per- window adversarial capacity is the first term, which we now bound by decomposing across T3's three control surfaces.

---

§3. C_B1 — gradient-bias bandwidth

Setup. Each step s ∈ {1, …, W}, the adversary controls a g-fraction of gradient computations. The contributed adversarial signal g_s is bounded in norm by g · ‖∇L_max‖ where ‖∇L_max‖ is the per-step gradient-norm cap (gradient clipping, in practice).

Information bound. Per-step parameter-shift channel capacity by discrete-distinguishability counting.

For one SGD step with learning rate lr_s:

Δ Θ_s = lr_s · (1 - g) · ∇L_honest + lr_s · g · ∇L_adv

The adversarial component lr_s · g · ∇L_adv is the parameter shift in the adversary's chosen direction. The honest stochastic gradient contributes noise of standard deviation σ_grad. At each step the parameter shift falls in one of approximately SNR_grad + 1 distinguishable buckets — the noise-only level plus SNR_grad adversarial-signal levels resolvable above the noise floor. The single-symbol channel-capacity bound on a discrete channel with K distinguishable outputs is log₂ K:

I( g_s ; Δ Θ_s ) ≤ log₂( ‖adversarial step‖ / ‖noise step‖ + 1 )
                ≤ log₂( g · lr_s · ‖∇L_max‖ / (lr_s · σ_grad) + 1 )
                = log₂( g · ‖∇L_max‖ / σ_grad + 1 )

The +1 corresponds to the noise-only level (no signal injected); it keeps the log finite when the adversarial step is below the noise floor. (The lr_s factor cancels — LR scales signal and noise identically per-step, so the bound is LR-independent at the per-step level. LR's distinct channel contribution is the §4 LR-selection capacity, not double-counted here.)

Define:

SNR_grad := g · ‖∇L_max‖ / σ_grad

Then per-step gradient-bias capacity is bounded by log₂(SNR_grad + 1) bits.

Per-window. Adversarial signals across steps are information-additive (each step's signal can in principle target a different parameter direction):

C_B1 · g · W · log₂(N_dir)

where the ticket's log₂(N_dir) factor is the per-step bit budget (capped at log₂(SNR_grad + 1) per the Fano bound above, which by data-processing-inequality is much smaller than log₂ of the full direction count 2^256). Replace the ticket sketch's log₂(N_dir) with log₂(SNR_grad + 1):

B1 contribution ≤ C_B1 · g · W · log₂( SNR_grad + 1 )

with C_B1 = 1 (data processing inequality; tight).

For typical deployments g · ‖∇L_max‖ / σ_grad = 0.05 · 1 / 0.1 = 0.5, so log₂(1.5) ≈ 0.5850 bits/step. With W = 10000 and g = 0.05: 1 · 0.05 · 10000 · 0.5850 ≈ 292.48 bits/window.

---

§4. C_B2 — learning-rate selection

Setup. T3 picks LR from a log-grid of R levels at each LR-decision point. With decision interval K steps, the window of length W contains ⌈W/K⌉ decision points.

Information bound. Each decision contributes at most log₂(R) bits to the channel under uniform prior. By data-processing inequality, the LR choice's effect on Θ_{t+1} is bounded by what the LR can change about gradient steps it applies to — which is at most a multiplicative factor in the parameter-step magnitude.

The categorical-channel capacity of R symbols is log₂(R) bits per decision. The mapping from LR symbol to effective parameter shift is a finite function (each LR level corresponds to a fixed step magnitude), so:

B2 contribution ≤ C_B2 · ⌈W / K⌉ · log₂ R

with C_B2 = 1 (data processing inequality; tight).

For typical deployments K = 100, R = 8, W = 10000: 1 · 100 · log₂(8) = 100 · 3 = 300 bits/window.

Tightening note. C_B2 = 1 assumes every LR choice maps to an information-distinguishable parameter trajectory. In practice many LR choices produce trajectories that converge to similar Θ (the loss surface's basin geometry damps small-LR perturbations). A tighter bound would measure the LR-trajectory diversity empirically; the framework above admits substituting C_B2 < 1 when measured.

---

§5. C_B3 — batch-order bandwidth

Setup. T3 reorders batches within an epoch. With N_b batches per epoch, the naive bound is log₂(N_b!) bits per epoch — but this drastically overestimates the steering capacity because batch-order effects on final Θ are bounded by gradient noise, not by permutation entropy.

Information bound — the Bottou-Bousquet refinement. Per Bottou-Bousquet (2008), Hardt-Recht-Singer (2016), and the broader random-shuffle SGD analysis:

• Random-shuffle SGD: order has O(1/√N_b) effect on final Θ distribution. Channel bits ≈ 0.
• Cyclic-shuffle SGD: order has O(1) effect (consistent bias). Channel bits ≈ O(log₂ N_b) per epoch.
• Adversarial-order SGD: order can amplify directional bias by at most a factor of √N_b over random-shuffle. Channel bits ≈ log₂( σ_grad · √N_b / ‖∇L_max‖ ) per epoch = 0.5 · log₂(N_b) + log₂(σ_grad / ‖∇L_max‖).

The window of length W contains ⌈W / E⌉ epochs where E = N_b (steps per epoch). Each epoch contributes at most:

log₂( N_b · σ_grad / ‖∇L_max‖ ) / 2  bits  (adversarial-order)

For N_b = 1024, σ_grad/‖∇L_max‖ ≈ 0.1: 0.5 · log₂(102.4) ≈ 3.34 bits/epoch.

B3 contribution ≤ C_B3 · ⌈W / E⌉ · log₂( N_b · σ_grad / ‖∇L_max‖ ) / 2

with C_B3 = 1 (data-processing inequality; tight under the
adversarial-order assumption made in this section).

Tightening to the random-shuffle baseline gives C_B3 → O(1/√N_b) — substantially below 1 for typical N_b. That tightening is deferred to §10 + #000043; the headline bound above stays at the adversarial-order ceiling so operators choosing W get the upper-bound conservative number unless they explicitly opt into the random-shuffle constant via --c-b3 on the calculator.

For W = 10000, E = 1024, the contribution is 1 · 9.77 · 3.34 ≈ 32.6 bits/window — substantially less than the naive log₂(N_b!) bound of ~8000+ bits/epoch.

---

§6. Combined per-window bound

Combining §3-§5:

I_window ≤ C_B1 · g · W · log₂( SNR_grad + 1 )
         + C_B2 · ⌈W / K⌉ · log₂( R )
         + C_B3 · ⌈W / E⌉ · log₂( N_b · σ_grad / ‖∇L_max‖ ) / 2

with conservative constants C_B1 = C_B2 = C_B3 = 1 (each by data-processing inequality; future work may tighten any of them based on empirical loss-surface measurement).

---

§7. Numeric examples

§7.1 Small deployment

g = 0.05, ‖∇L_max‖ = 1.0, σ_grad = 0.1
K = 100, R = 8, W = 10000, N_b = 1024, E = 1024
SNR_grad = 0.5

B1 = 1 · 0.05 · 10000 · log₂(1.5)         ≈ 292.48 bits
B2 = 1 · ⌈10000/100⌉ · log₂(8)             = 300.00 bits
B3 = 1 · ⌈10000/1024⌉ · log₂(102.4) / 2   ≈  33.39 bits
total                                       ≈ 625.87 bits/window

(Numbers are the calculator's closed-form output, not rounded estimates; see bench/scripts/t3_bound_calculator.py and the unit tests in tests/test_t3_bound_calculator.py.)

§7.2 Medium deployment (longer window)

g = 0.05, ‖∇L_max‖ = 1.0, σ_grad = 0.1
K = 1000, R = 16, W = 100000, N_b = 8192, E = 8192
SNR_grad = 0.5

B1 = 1 · 0.05 · 100000 · log₂(1.5)         ≈ 2924.81 bits
B2 = 1 · ⌈100000/1000⌉ · log₂(16)           = 400.00 bits
B3 = 1 · ⌈100000/8192⌉ · log₂(819.2) / 2   ≈  62.91 bits
total                                        ≈ 3387.72 bits/window

§7.3 Hardened deployment (lower g, smaller R)

g = 0.01, ‖∇L_max‖ = 1.0, σ_grad = 0.1
K = 100, R = 4, W = 10000, N_b = 1024, E = 1024
SNR_grad = 0.1

B1 = 1 · 0.01 · 10000 · log₂(1.1)          ≈  13.75 bits
B2 = 1 · ⌈10000/100⌉ · log₂(4)              = 200.00 bits
B3 = 1 · ⌈10000/1024⌉ · log₂(102.4) / 2   ≈  33.39 bits
total                                        ≈ 247.14 bits/window

---

§8. Operator guidance — choosing window length

The operator picks W such that I_window ≤ B_target where B_target is the desired residual.

Target = 1 bit/window (very conservative; adversary needs ≥ 2^256 windows for a specific target):

Solving for W in §6 with the small-deployment constants:

1 ≥ 0.05 · W · 0.58 + (W/100) · 3 + (W/1024) · 3.34 / 2
1 ≥ 0.029 W + 0.030 W + 0.0016 W
1 ≥ 0.061 W
W ≤ 16  steps  (impractical — re-anchor every 16 steps)

Target = 256 bits/window (the SHA-256 hard-hash output size; informational equivalent of a single brute-force preimage attempt per window):

256 ≥ 0.061 W
W ≤ 4196 steps

This is the practical operating range: re-anchor approximately every 4000 SGD steps to keep T3's per-window steerage at the SHA-256 baseline.

Target = 2^16 = 65536 bits/window (much larger window, adversary still needs ~2^240 windows to brute-force):

W ≤ 1.07 × 10^6 steps

This admits week-long training runs between anchor rotations.

---

§9. Closure of soft-hash-channel-analysis.md §9.3

§9.3 of the analysis posed the open question:

What is the explicit per-window bound on T3 channel capacity under M2?

This document answers it. §6's closed-form bound, parametrized in operator-measurable inputs (g, K, R, W, N_b, σ_grad, ‖∇L_max‖), is the explicit form. Reference: this doc §6.

---

§10. Open questions + future work

The framework is conservative; tightening any of these refines the bound without invalidating it:

1. C_B1 below the data-processing limit. The discrete channel-capacity bound log₂(SNR_grad + 1) is a per-step ceiling derived under uniform-prior signal levels; tighter bounds are possible if the loss surface has reduced adversary-controllable directions (e.g. Hessian rank deficiency). Empirical measurement via #000034's probe could tighten C_B1 by 1-2 orders of magnitude on typical deployments.
2. C_B2 below 1. Many LR choices map to similar trajectories; a deployment-specific empirical measurement of LR-trajectory diversity (1-Wasserstein distance between (LR_1, LR_2, … LR_R) final-checkpoint distributions) yields C_B2 < 1.
3. C_B3 closer to the random-shuffle baseline. If the deployment's SGD is random-shuffle (most modern training is), the adversarial-order bound used here over-estimates by O(√N_b) factor. C_B3 → O(1/√N_b).
4. Future B4-B5 control surfaces. Adaptive optimizer state manipulation (momentum, second-moment estimates) is not in the §1 model. The framework here generalizes — add new B_i terms as new T3 control surfaces are documented.
5. Empirical validation. This bound has not been validated against an actual adversarial-training experiment. The acceptance criterion (§5 of the source ticket) explicitly marks empirical validation as out-of-scope; landing the doc establishes the framework operators can plan around. #000034's Phase 1b would feed directly into a future empirical-validation ticket.

---

§11. Calculator script

The closed-form bound from §6 lands as bench/scripts/t3_bound_calculator.py for operator use:

$ python -m bench.scripts.t3_bound_calculator \
    --gradient-fraction 0.05 \
    --gradient-norm-max 1.0 \
    --gradient-noise-stddev 0.1 \
    --lr-decision-interval 100 \
    --lr-grid-size 8 \
    --window-length 10000 \
    --batches-per-epoch 1024 \
    --steps-per-epoch 1024
{
  "I_window_bits_upper_bound": 625.8716,
  "B1_contribution": 292.4813,
  "B2_contribution": 300.0,
  "B3_contribution": 33.3904,
  "snr_grad": 0.5,
  "decisions_in_window": 100,
  "epochs_in_window": 10,
  "constants": {"C_B1": 1.0, "C_B2": 1.0, "C_B3": 1.0},
  "recommendation": "I_window ≈ 625.9 bits/window EXCEEDS the
                     SHA-256 (256 bit) output size. M2's
                     single-window guarantee is broken at this W.
                     Reduce W (or reduce g / R / increase K) until
                     I_window < 256 bits/window."
}

The above example shows a deployment whose per-window budget exceeds 256 bits — the W of 10000 is too large for a 1-window SHA-256-resistance guarantee. Operators read the calculator output and adjust W (or g, R, K) to tune.

---

§12. References

• docs/soft-hash-channel-analysis.md — source analysis (#000018).
• Ticket #000036 — this document's spec.
• Ticket #000034 — φ_linear Hessian-alignment probe; informs the C_B1 tightening path.
• Ticket #000035 — φ_PRG construction; closes the random-oracle modeling gap independent of T3.
• Bottou & Bousquet (2008), "The Tradeoffs of Large Scale Learning" — gradient-noise / batch-order bound argument.
• Hardt, Recht & Singer (2016), "Train Faster, Generalize Better: Stability of Stochastic Gradient Descent" — formal stability framework underlying the C_B3 random-shuffle bound.