arborist/docs/soft-hash-channel-t3-bound.md

T3 per-window covert-channel budget bound

Ticket: #000036 Source analysis: docs/soft-hash-channel-analysis.md Date: 2026-05-10 (review pass 2026-05-11) Status: formal derivation + calculator landed; dav1d review returned 2026-05-11. Tier-1 polish applied (recommendation wording, structured certification_status output, validation hardening, B1-model labelling — see §3.1 + §10.1). Closure blockers remaining: B1 conservative-envelope (v2 calculator, §10 item 1) and active KAT fixture (§10 item 2). The framework is the deliverable; the named constants are conservative starting estimates that empirical tightening (#000043) can replace without changing call sites.

---

§0. Reviewer brief (dav1d review returned 2026-05-11)

This document derives an upper bound on the per-window mutual information a T3 (hyperparameter) adversary can steer into the SHA-256 commitment C(M_{t+1}). The framework decomposes the channel across T3's three control surfaces (gradient bias, LR selection, batch order) and combines them into a closed-form bound consumed by bench/scripts/t3_bound_calculator.py.

dav1d's 2026-05-11 review (RESPONSE_1 + RESPONSE_2) landed these findings:

1. §2 decomposition — accepted. Markov-chain DPI on A → Θ_{t+1} → C(M_{t+1}) correctly applied; T1+T2 baseline cleanly separated from the T3 capacity term.
2. §4 (C_B2 LR selection) — accepted. Clean categorical-channel capacity bound.
3. §5 (C_B3 batch order) — accepted as a model-bound, not a theorem (§5's "model-bound" note reflects this).
4. §3 (C_B1 gradient bias) — closure blocker. g appears twice in the per-window expression, which is only sound under the effective_control_v1 reading (§3.1). A worst-case gradient adversary needs the max_envelope model — the v2 calculator path (§10 item 1).
5. Wording / validation / output-schema fixes — applied (§10.1).

What's not being asked: empirical validation against an actual adversarial-training run (out of scope per §10 item 7; opens as a future ticket once v7 plastic-training has a deployment target).

The headline numeric example in §7 + §11 yields I_window ≈ 626 bits/window for a default deployment config under the v1 effective-control B1 model — exceeding SHA-256's 256-bit threshold, so certification_status = NOT_CERTIFIED_BY_BOUND. A conservative max_envelope B1 model would produce ~5850 bits. The framework's job is to make the trigger derivable from operator-measurable inputs; the v2 path makes the bound worst-case-conservative rather than effective-control-relative.

---

§1. T3 model restatement

From docs/soft-hash-channel-analysis.md §6, threat model T3 (hyperparameter adversary) extends T2 (gradient adversary) with control over:

• Learning-rate scheduling: choosing the LR at each scheduled decision point from a constrained range (e.g. log-grid of R levels).
• Batch ordering: permuting batches within an epoch.

Combined with T2's gradient bias (controlling a g-fraction of training-step gradient computations), T3 is a strict superset of T2. The §4 reduction in soft-hash-channel-analysis.md bounds T1

• T2 channels at the SHA-256 random-oracle baseline assuming φ is independent of parameter geometry; T3 breaks the implicit "published schedule" assumption so the §4 reduction does not directly apply.

M2 mitigation (per-checkpoint anchor nonce, soft-hash-channel analysis §5.3) re-randomizes the anchor every checkpoint. T3's exploitation window is thus bounded to one nonce-window of length W steps before the anchor re-randomizes. This document bounds the bits T3 can steer into C(M_{t+1}) within a single window.

The bound's intended use: operators choose W (the nonce-window length) such that I_window stays below their target residual (e.g. < 1 bit per window means the adversary needs ≥ 2^256 windows to steer C(M) to a specific 256-bit target).

---

§2. Per-window channel — formal definition

For a single nonce window of length W steps starting at checkpoint t:

I_window := I( A ; C(M_{t+1}) | H_{≤t}, n_t )

where:

• A is the joint random variable over T3's adversary inputs during the window: A = (g_1, …, g_W, lr_1, …, lr_⌈W/K⌉, π) where g_s is the adversary-controlled gradient signal at step s, lr_d is the LR at decision point d, π is the batch-ordering permutation.
• C(M_{t+1}) is the SHA-256 hard-hash committed at the next checkpoint.
• H_{≤t} is the public history before the window opens.
• n_t is the published per-checkpoint nonce (M2 mitigation).

This is the standard mutual-information upper bound on distinguishing-from-baseline channel capacity. Conditional on (H_{≤t}, n_t), the random variables form a Markov chain:

A  →  Θ_{t+1}  →  C(M_{t+1})

— T3's window inputs A affect the commitment only through the parameter state Θ_{t+1}. Markov-chain data-processing inequality gives the single-source bound:

I( A ; C(M_{t+1}) | H_{≤t}, n_t )  ≤  I( A ; Θ_{t+1} | H_{≤t}, n_t )

The right-hand side — T3's per-window capacity to encode adversarial bits into the parameter state — is what this document bounds in §§ 3-5.

Inherited T1 + T2 baseline. Independent of T3, the φ-mapping Θ → C(M) itself admits a constant random-oracle baseline channel under the §4 reduction in soft-hash-channel-analysis.md (when φ is φ_PRG per #000035, or φ_linear under the NO_ALIGNMENT verdict per #000034). That baseline is bounded by SHA-256 partial-preimage hardness and is independent of A. Threat-model-additive (T3 capacity

• T1+T2 baseline = total per-window leak budget) but not information-additive in the same MI sense — the two contributions come from disjoint adversary surfaces:

total per-window bits  ≤  I( A ; Θ_{t+1} | H_{≤t}, n_t )   ← T3, this doc
                        + (T1 + T2 baseline)               ← § 4, inherited

The baseline term is constant-bounded by §4 unchanged; the per- window adversarial capacity is the first term, which we now bound by decomposing across T3's three control surfaces.

---

§3. C_B1 — gradient-bias bandwidth

Setup. Each step s ∈ {1, …, W}, the adversary controls a g-fraction of gradient computations. The contributed adversarial signal g_s is bounded in norm by g · ‖∇L_max‖ where ‖∇L_max‖ is the per-step gradient-norm cap (gradient clipping, in practice).

Information bound. Per-step parameter-shift channel capacity by discrete-distinguishability counting.

For one SGD step with learning rate lr_s:

Δ Θ_s = lr_s · (1 - g) · ∇L_honest + lr_s · g · ∇L_adv

The adversarial component lr_s · g · ∇L_adv is the parameter shift in the adversary's chosen direction. The honest stochastic gradient contributes noise of standard deviation σ_grad. At each step the parameter shift falls in one of approximately SNR_grad + 1 distinguishable buckets — the noise-only level plus SNR_grad adversarial-signal levels resolvable above the noise floor. The single-symbol channel-capacity bound on a discrete channel with K distinguishable outputs is log₂ K:

I( g_s ; Δ Θ_s ) ≤ log₂( ‖adversarial step‖ / ‖noise step‖ + 1 )
                ≤ log₂( g · lr_s · ‖∇L_max‖ / (lr_s · σ_grad) + 1 )
                = log₂( g · ‖∇L_max‖ / σ_grad + 1 )

The +1 corresponds to the noise-only level (no signal injected); it keeps the log finite when the adversarial step is below the noise floor. (The lr_s factor cancels — LR scales signal and noise identically per-step, so the bound is LR-independent at the per-step level. LR's distinct channel contribution is the §4 LR-selection capacity, not double-counted here.)

Define:

SNR_grad := g · ‖∇L_max‖ / σ_grad

Then per-step gradient-bias capacity is bounded by log₂(SNR_grad + 1) bits.

Per-window. Adversarial signals across steps are information-additive (each step's signal can in principle target a different parameter direction):

C_B1 · g · W · log₂(N_dir)

where the ticket's log₂(N_dir) factor is the per-step bit budget (capped at log₂(SNR_grad + 1) per the discrete channel-capacity bound above, which by data-processing-inequality is much smaller than log₂ of the full direction count 2^256). Replace the ticket sketch's log₂(N_dir) with log₂(SNR_grad + 1):

B1 contribution ≤ C_B1 · g · W · log₂( SNR_grad + 1 )

with C_B1 = 1 (data processing inequality; tight).

For typical deployments g · ‖∇L_max‖ / σ_grad = 0.05 · 1 / 0.1 = 0.5, so log₂(1.5) ≈ 0.5850 bits/step. With W = 10000 and g = 0.05: 1 · 0.05 · 10000 · 0.5850 ≈ 292.48 bits/window.

§3.1 The B1 model — g appears twice (dav1d review 2026-05-11)

Note that g enters the per-window B1 expression twice: once as the outer multiplier g · W (number of adversary-controlled steps) and once inside log₂(SNR_grad + 1) where SNR_grad = g · ‖∇L_max‖ / σ_grad. That double use is only sound under a specific reading:

b1_model = "effective_control_v1":
    g is an effective gradient-control coefficient that
    simultaneously bounds (a) the fraction of steerable
    directions per step AND (b) the amplitude shrinkage of
    the aggregate adversarial gradient signal.

If instead g means only "fraction of gradient computations controlled" (with full per-channel amplitude), the conservative shape is larger. dav1d's review spelled out the spread on the baseline (g=0.05, ‖∇L_max‖=1, σ_grad=0.1, W=10000):

B1 model	Formula	Baseline B1
effective_control_v1 (current)	g · W · log₂(1 + g·G/σ)	292.5 bits
fraction_channels (g = channel fraction only)	g · W · log₂(1 + G/σ)	1 729.7 bits
aggregate_bias (g = amplitude shrinkage only)	W · log₂(1 + g·G/σ)	5 849.6 bits
max_envelope (conservative)	max(fraction_channels, aggregate_bias)	5 849.6 bits

The current v1 calculator uses effective_control_v1. The certification_status it emits is therefore relative to that model — it is an operational risk score, not a worst-case upper bound across all gradient-adversary interpretations.

The conservative max_envelope model is the v2 path. When the team wants the calculator to certify against the worst-case gradient adversary, it should:

1. add a b1_model parameter (default "max_envelope" for v2)
2. bump CALCULATOR_VERSION → "t3-bound-v2-conservative-envelope"
3. emit a new KAT fixture under
   bench/fixtures/t3-bound/v2-conservative-envelope/
4. keep effective_control_v1 reachable as a backward-compat mode
   so v1 rows stay replayable

That v2 work is not in this ticket — see §10. Until it lands, read the calculator's output as: "under the v1 effective-control model, the baseline evaluates to ~626 bits/window; this exceeds the 256-bit certification threshold so the calculator CANNOT CERTIFY M2 residual safety at W=10000; a conservative B1 envelope would produce a larger bound (~5850 bits in the example above)."

---

§4. C_B2 — learning-rate selection

Setup. T3 picks LR from a log-grid of R levels at each LR-decision point. With decision interval K steps, the window of length W contains ⌈W/K⌉ decision points.

Information bound. Each decision contributes at most log₂(R) bits to the channel under uniform prior. By data-processing inequality, the LR choice's effect on Θ_{t+1} is bounded by what the LR can change about gradient steps it applies to — which is at most a multiplicative factor in the parameter-step magnitude.

The categorical-channel capacity of R symbols is log₂(R) bits per decision. The mapping from LR symbol to effective parameter shift is a finite function (each LR level corresponds to a fixed step magnitude), so:

B2 contribution ≤ C_B2 · ⌈W / K⌉ · log₂ R

with C_B2 = 1 (data processing inequality; tight).

For typical deployments K = 100, R = 8, W = 10000: 1 · 100 · log₂(8) = 100 · 3 = 300 bits/window.

Tightening note. C_B2 = 1 assumes every LR choice maps to an information-distinguishable parameter trajectory. In practice many LR choices produce trajectories that converge to similar Θ (the loss surface's basin geometry damps small-LR perturbations). A tighter bound would measure the LR-trajectory diversity empirically; the framework above admits substituting C_B2 < 1 when measured.

---

§5. C_B3 — batch-order bandwidth

Setup. T3 reorders batches within an epoch. With N_b batches per epoch, the naive bound is log₂(N_b!) bits per epoch — but this drastically overestimates the steering capacity because batch-order effects on final Θ are bounded by gradient noise, not by permutation entropy.

Information bound — the Bottou-Bousquet refinement. Per Bottou-Bousquet (2008), Hardt-Recht-Singer (2016), and the broader random-shuffle SGD analysis:

• Random-shuffle SGD: order has O(1/√N_b) effect on final Θ distribution. Channel bits ≈ 0.
• Cyclic-shuffle SGD: order has O(1) effect (consistent bias). Channel bits ≈ O(log₂ N_b) per epoch.
• Adversarial-order SGD: order can amplify directional bias by at most a factor of √N_b over random-shuffle. Channel bits ≈ log₂( σ_grad · √N_b / ‖∇L_max‖ ) per epoch = 0.5 · log₂(N_b) + log₂(σ_grad / ‖∇L_max‖).

The window of length W contains ⌈W / E⌉ epochs where E = N_b (steps per epoch). Each epoch contributes at most:

log₂( N_b · σ_grad / ‖∇L_max‖ ) / 2  bits  (adversarial-order)

For N_b = 1024, σ_grad/‖∇L_max‖ ≈ 0.1: 0.5 · log₂(102.4) ≈ 3.34 bits/epoch.

B3 contribution ≤ C_B3 · ⌈W / E⌉ · log₂( N_b · σ_grad / ‖∇L_max‖ ) / 2

with C_B3 = 1 (data-processing inequality; tight under the
adversarial-order assumption made in this section).

Tightening to the random-shuffle baseline gives C_B3 → O(1/√N_b) — substantially below 1 for typical N_b. That tightening is deferred to §10 + #000043; the headline bound above stays at the adversarial-order ceiling so operators choosing W get the upper-bound conservative number unless they explicitly opt into the random-shuffle constant via --c-b3 on the calculator.

For W = 10000, E = 1024, the contribution is 1 · 9.77 · 3.34 ≈ 32.6 bits/window — substantially less than the naive log₂(N_b!) bound of ~8000+ bits/epoch.

B3 is a model-bound, not a directly-quoted theorem (dav1d review 2026-05-11). The expression above is a gradient-noise- scale conservative modelling term inspired by Bottou-Bousquet / Hardt-Recht-Singer shuffle-stability arguments. It is not a statement that "the Bottou-Bousquet theorem proves every batch-order adversary is bounded by this exact expression." The calculator's test_b3_exact_formula pins the implementation to the model; it does not prove the model. The floor at 0 (when N_b · σ_grad / ‖∇L_max‖ ≤ 1) does not mean batch order has literally zero effect — it means this upper-bound formula gives no positive distinguishable capacity above the noise floor in that regime. Empirical tightening (random-shuffle classification) remains Phase 2 / #000043.

---

§6. Combined per-window bound

Combining §3-§5:

I_window ≤ C_B1 · g · W · log₂( SNR_grad + 1 )
         + C_B2 · ⌈W / K⌉ · log₂( R )
         + C_B3 · ⌈W / E⌉ · log₂( N_b · σ_grad / ‖∇L_max‖ ) / 2

with conservative constants C_B1 = C_B2 = C_B3 = 1 (each by data-processing inequality; future work may tighten any of them based on empirical loss-surface measurement).

---

§7. Numeric examples

§7.1 Small deployment

g = 0.05, ‖∇L_max‖ = 1.0, σ_grad = 0.1
K = 100, R = 8, W = 10000, N_b = 1024, E = 1024
SNR_grad = 0.5

B1 = 1 · 0.05 · 10000 · log₂(1.5)         ≈ 292.48 bits
B2 = 1 · ⌈10000/100⌉ · log₂(8)             = 300.00 bits
B3 = 1 · ⌈10000/1024⌉ · log₂(102.4) / 2   ≈  33.39 bits
total                                       ≈ 625.87 bits/window

(Numbers are the calculator's closed-form output, not rounded estimates; see bench/scripts/t3_bound_calculator.py and the unit tests in tests/test_t3_bound_calculator.py.)

§7.2 Medium deployment (longer window)

g = 0.05, ‖∇L_max‖ = 1.0, σ_grad = 0.1
K = 1000, R = 16, W = 100000, N_b = 8192, E = 8192
SNR_grad = 0.5

B1 = 1 · 0.05 · 100000 · log₂(1.5)         ≈ 2924.81 bits
B2 = 1 · ⌈100000/1000⌉ · log₂(16)           = 400.00 bits
B3 = 1 · ⌈100000/8192⌉ · log₂(819.2) / 2   ≈  62.91 bits
total                                        ≈ 3387.72 bits/window

§7.3 Hardened deployment (lower g, smaller R)

g = 0.01, ‖∇L_max‖ = 1.0, σ_grad = 0.1
K = 100, R = 4, W = 10000, N_b = 1024, E = 1024
SNR_grad = 0.1

B1 = 1 · 0.01 · 10000 · log₂(1.1)          ≈  13.75 bits
B2 = 1 · ⌈10000/100⌉ · log₂(4)              = 200.00 bits
B3 = 1 · ⌈10000/1024⌉ · log₂(102.4) / 2   ≈  33.39 bits
total                                        ≈ 247.14 bits/window

---

§8. Operator guidance — choosing window length

The operator picks W such that I_window ≤ B_target where B_target is the desired residual.

Target = 1 bit/window (very conservative; adversary needs ≥ 2^256 windows for a specific target):

Solving for W in §6 with the small-deployment constants:

1 ≥ 0.05 · W · 0.58 + (W/100) · 3 + (W/1024) · 3.34 / 2
1 ≥ 0.029 W + 0.030 W + 0.0016 W
1 ≥ 0.061 W
W ≤ 16  steps  (impractical — re-anchor every 16 steps)

Target = 256 bits/window (the SHA-256 hard-hash output size; informational equivalent of a single brute-force preimage attempt per window):

256 ≥ 0.061 W
W ≤ 4196 steps

This is the practical operating range: re-anchor approximately every 4000 SGD steps to keep T3's per-window steerage at the SHA-256 baseline.

Target = 2^16 = 65536 bits/window (much larger window, adversary still needs ~2^240 windows to brute-force):

W ≤ 1.07 × 10^6 steps

This admits week-long training runs between anchor rotations.

---

§9. Closure of soft-hash-channel-analysis.md §9.3

§9.3 of the analysis posed the open question:

What is the explicit per-window bound on T3 channel capacity under M2?

This document answers it. §6's closed-form bound, parametrized in operator-measurable inputs (g, K, R, W, N_b, σ_grad, ‖∇L_max‖), is the explicit form. Reference: this doc §6.

---

§10. Open questions + future work

Items 1-2 below are the closure blockers flagged by dav1d's 2026-05-11 review; items 3-6 are tightening paths that refine the bound without invalidating it.

1. B1 conservative envelope (v2 calculator) — closure blocker. The current b1_model="effective_control_v1" (§3.1) reads g as a combined direction-fraction + amplitude-shrinkage coefficient, which makes the headline B1 ~292 bits on the baseline. A worst-case gradient adversary needs the max_envelope model (~5850 bits on the same baseline). Until the v2 calculator with b1_model selection lands — CALCULATOR_VERSION → t3-bound-v2-conservative-envelope, new KAT fixture under bench/fixtures/t3-bound/v2-conservative-envelope/, effective_control_v1 kept as a backward-compat mode — the calculator's certification_status is relative to the v1 model only and should be read as an operational risk score, not a certified worst-case bound. Do not close #000036 until this is resolved (either by landing v2 or by an explicit team decision to keep v1 with the narrowed-semantics caveat documented in §3.1).
2. Active KAT fixture for closure. bench/fixtures/t3-bound/known-answer-tests.jsonl must exist and test_t3_bound_known_answer_tests must run (not skip) with ≥ 5 entries before #000036 closes. If the v2 B1 model lands first, the KAT fixture goes under the versioned subdirectory.
3. C_B1 below the data-processing limit. The discrete channel-capacity bound log₂(SNR_grad + 1) is a per-step ceiling derived under uniform-prior signal levels; tighter bounds are possible if the loss surface has reduced adversary-controllable directions (e.g. Hessian rank deficiency). Empirical measurement via #000034's probe could tighten C_B1 by 1-2 orders of magnitude on typical deployments. (Tracked under #000043.)
4. C_B2 below 1. Many LR choices map to similar trajectories; a deployment-specific empirical measurement of LR-trajectory diversity (1-Wasserstein distance between (LR_1, LR_2, … LR_R) final-checkpoint distributions) yields C_B2 < 1. (Tracked under #000043.)
5. C_B3 closer to the random-shuffle baseline. If the deployment's SGD is random-shuffle (most modern training is), the adversarial-order bound used here over-estimates by O(√N_b) factor. C_B3 → O(1/√N_b). (Tracked under #000043; the cheapest of the three constant-tightening paths — needs only a DataLoader-config audit, no checkpoint.)
6. Future B4-B5 control surfaces. Adaptive optimizer state manipulation (momentum, second-moment estimates) is not in the §1 model. The framework here generalizes — add new B_i terms as new T3 control surfaces are documented.
7. Empirical validation. This bound has not been validated against an actual adversarial-training experiment. The acceptance criterion (§5 of the source ticket) explicitly marks empirical validation as out-of-scope; landing the doc establishes the framework operators can plan around. #000034's Phase 1b would feed directly into a future empirical-validation ticket.

§10.1 Calculator hardening landed 2026-05-11 (dav1d review)

Not "open" — already done in the 8916bf3 follow-up + the 2026-05-11 review pass:

• Recommendation wording: "M2's single-window guarantee is broken" → "this conservative bound CANNOT CERTIFY M2's residual" (an upper bound exceeding 256 means we cannot certify, not that the adversary can steer 256 bits).
• Structured output fields: b1_model, certification_status ∈ {CERTIFIED_BY_BOUND, NOT_CERTIFIED_BY_BOUND}, certification_threshold_bits, model_assumptions[] — so callers read a machine-readable status, not just prose.
• Input validation: bools rejected for both int and float fields (isinstance(True, int) is True in Python — a real leak risk for a security calculator); NaN / ±inf rejected for every numeric input and constant.
• gradient_fraction = 0 now accepted (no T2 surface; B1 = 0; T3's LR + batch-order channels still contribute) — improves component isolation.
• Tests: hard-coded cwd="/home/fox/git/arborist" replaced with pathlib.Path(__file__).resolve().parents[1] so the suite runs on any checkout. New bool/NaN/inf rejection tests, g=0 acceptance test, certification_status field tests. Suite count 53 → 75.

---

§11. Calculator script

The closed-form bound from §6 lands as bench/scripts/t3_bound_calculator.py for operator use:

$ python -m bench.scripts.t3_bound_calculator \
    --gradient-fraction 0.05 \
    --gradient-norm-max 1.0 \
    --gradient-noise-stddev 0.1 \
    --lr-decision-interval 100 \
    --lr-grid-size 8 \
    --window-length 10000 \
    --batches-per-epoch 1024 \
    --steps-per-epoch 1024
{
  "calculator_version": "t3-bound-v1-bottou-refinement",
  "b1_model": "effective_control_v1",
  "I_window_bits_upper_bound": 625.8716,
  "B1_contribution": 292.4813,
  "B2_contribution": 300.0,
  "B3_contribution": 33.3904,
  "snr_grad": 0.5,
  "decisions_in_window": 100,
  "epochs_in_window": 10,
  "constants": {"C_B1": 1.0, "C_B2": 1.0, "C_B3": 1.0},
  "certification_status": "NOT_CERTIFIED_BY_BOUND",
  "certification_threshold_bits": 256,
  "model_assumptions": [
    "M2_nonce_per_window",
    "SHA256_random_oracle_baseline",
    "B1_effective_control_model_v1",
    "B3_gradient_noise_refinement"
  ],
  "inputs": { "...echoed input tuple..." },
  "recommendation": "I_window upper bound ≈ 625.9 bits/window
                     EXCEEDS the SHA-256 (256 bit) certification
                     threshold. This conservative bound CANNOT
                     CERTIFY M2's single-window residual at this W
                     — it does not prove the adversary can steer
                     256 bits, only that the bound is too loose to
                     certify safety. Reduce W (or reduce g / R /
                     increase K, or tighten C_B* empirically) until
                     the certified bound is < 256 bits/window."
}

The above example shows a deployment whose per-window bound exceeds 256 bits under the effective_control_v1 B1 model — certification_status is NOT_CERTIFIED_BY_BOUND and the W of 10000 is too large for a 1-window SHA-256-resistance certification. A conservative max_envelope B1 model (§3.1) would produce a larger bound (~5850 bits in the worked example). Operators read the structured certification_status field, not just the prose, and adjust W (or g, R, K) to tune.

---

§12. References

• docs/soft-hash-channel-analysis.md — source analysis (#000018).
• Ticket #000036 — this document's spec.
• Ticket #000034 — φ_linear Hessian-alignment probe; informs the C_B1 tightening path.
• Ticket #000035 — φ_PRG construction; closes the random-oracle modeling gap independent of T3.
• Bottou & Bousquet (2008), "The Tradeoffs of Large Scale Learning" — gradient-noise / batch-order argument that inspires the §5 C_B3 model-bound (not a direct quotation; see §5's "model-bound, not theorem" note).
• Hardt, Recht & Singer (2016), "Train Faster, Generalize Better: Stability of Stochastic Gradient Descent" — shuffle- stability framework the §5 C_B3 random-shuffle reasoning draws on.
• dav1d review 2026-05-11 (RESPONSE_1 + RESPONSE_2) — the B1-double-g finding (§3.1), the recommendation-wording correction, validation hardening, and the v2 conservative- envelope path (§10 item 1).