Repository navigation
P1: signed model manifest (M1+M2) + design: attested abliterated models on vast #58
Description
Tracking issue for the signed model manifest lane, mitigations M1 and M2 of the threat model (PR #54, research/security/threat-model/RANKED-MITIGATIONS.md). Part of #6, #36, #9.
Part A: signed manifest prototype (code, CPU only)
A detached manifest, signed with ed25519, that binds:
- FlashProve commitment ID
- upstream checkpoint: HF repo + revision + sha256 of every committed file
- conversion recipe (script, version, params) so a third party can rerun it and get the same ID
- digests of the three configuration files (
policy.txt,KL.bin,layout.txt) - tokenizer, chat template and system prompt digests (or explicit "none"), end tokens
- decode policy (exact vs clipped-gap and its limits)
- verifier build digest
Client-side verify refuses on any mismatch between manifest, signer key, proof files and the configuration it is given. Tamper tests for every field. Thin layer next to cp_verify; prover unchanged.
Part B: DESIGN-VAST-ABLITERATED.md
Design note on "attested abliterated models on vast nodes", compared with amiller/dsmack: which guarantees survive on an untrusted vast host with FlashProve alone, which need a TEE, reproducible abliteration derivation and what it does and does not prove, marketplace shape (registry, enrollment, per-request proof, off-chain verify, settle on Base), cost per request from measured receipts, which models are provable today. Honest verdict + smallest demo path.
No GPU spend. No claims in research/results.yaml.
Activity
wakesync commentedon Nov 4, 2026
Draft PR open: #59. PREREG committed first (experiments/20261104-58-signed-manifest/PREREG.md). Building tools/manifest next, CPU only.
tools/manifest: signed model manifest, client-side verify next to cp_…
experiments: signed manifest results (PASS 137/137), design note on p…
wakesync commentedon Nov 4, 2026
Final verdict (PR #59): Part A PASS vs prereg. 137/137 registered tampers refused, 10/10 untampered accepted with real cp_verify YES, RFC 8032 3/3, 64/64 vs cryptography. 10 of 37 fields are the signer's word only (pinned in tests). Part B design note: on vast, FlashProve gives integrity (which weights) but no prompt privacy and no hardware attestation, and vast has no CC offer (cited). Smallest demo path is in the doc. The next real step is a ~$1-2 H100 public-weights commit of an integer-abliterated synthetic model, which needs GPU approval.
tools/manifest: refuse small-order ed25519 keys and R, require --end-…
experiments: signed manifest re-measured after amendment 2 (PASS 137/…
experiments: fix amendment dates (2026-11-04 UTC, not 11-05) in signe…
research: results.yaml entry for the signed manifest (measured, unrep…
wakesync commentedon Nov 4, 2026
Review fixes for PR #59 pushed (draft, not merged). New head
949667653bddd8bd92283b41b2755d1db6452372.cryptography64/64.--end-tokensis required, and the caller must pass--recipeor an explicit--no-recipe. Leaving either out now refuses.commitment.kind(+ seed digest),upstream.*andconversion.committed_filesare accepted without--public-weights-seed/--upstream-dir/--committed-dir, and refused with them. That makes 14 of 37 fields the signer's word on this fixture.3bfec225.Re-run (measured, unreplicated, CPU): registered tampers refused 137/137, untampered accepted 10/10 (
cp_verifyYES), so the registered threshold is a PASS. Verify median 1.41 s (SD 0.03, min 1.38, max 1.45, n=10). pytest 52 passed.The ledger entry
signed-manifestis inresearch/results.yaml.update-results.py --checkandcheck-claims.pyexit 0.Needs an exact-head re-review.
tools/manifest: commitment.kind is the signer's word even with --publ…
experiments: signed manifest re-measured after amendment 3 (PASS 137/…
research: signed-manifest results.yaml after amendment 3 (11 always +…
wakesync commentedon Nov 5, 2026
Fix round 2 for PR #59 pushed (still DRAFT, not merged). Head
facd69cd0451583b323c4e88ea303e338a8fc9e1, normal commits on top of94966765.commitment.kindis now counted as the signer's word even with--public-weights-seed, because the flag checks a seed file against the digest, not the kind against the commitment. Split: 11 always + 3 unless a flag, total 14 of 37 unchanged. New coordinated row with a seed file the signer ships: ACCEPTED with the flag, pinned by tests. PREREG amendment 3 (dated 2026-11-05 00:23 UTC). RESULTS, docstring, README, design note, results.yaml (always 11/37, unless-flag 3/37) and claim updated. README block and CLAIMS.md regenerated.{"none": 1}/{"none": 1.0}refused; symlinks in rehashed dirs refused (the symlinked-subdir extra tokenizer file is refused now); deeply nested manifest refused cleanly, noRecursionError.c0d16125(measured, unreplicated, CPU, nice 19): pytest 61 passed. Registered tampers refused 137/137 and untampered accepted 10/10 (cp_verify YES), both PASS vs threshold. RFC 8032 3/3, cryptography 64/64, small-order 8/8 + 8/8. Hardening rows 6/6 refused. All 174 registered rows identical to the previous run. Verify n=10: median 1.407 s, SD 0.027, min 1.380, max 1.471.update-results --checkandcheck-claimsboth exit 0.check-no-host-paths: ok.This needs an exact-head re-review at
facd69cd.docs(manifest): review fixes: upstream repo/revision are the signer's…
Signed model manifest (M1+M2) + design: attested abliterated models o…