This repository was archived by the owner on Aug 3, 2026. It is now read-only.
op1: reject patches that inject off-protocol inputs (proof-forgery) - #82
Merged
Conversation
- scan_diff_for_exploit_patterns: flag added recipe-patch lines that reference a host path (/home /root /mnt /media /srv /scratch /Users, ~, ..) or torch.load/np.load an ABSOLUTE checkpoint path. A canonical recipe trains from scratch and reads only mounted canonical data. - wired into op1_diff_and_integrity (validator-side, authoritative) and proof.runner main flow (in-container, defense-in-depth) - catches the in-the-wild warm-start forgery (load an off-protocol checkpoint + fabricate the training log) + non-canonical data-dir overrides; tests include lr-schedule/relative/canonical false-neg guards - static pre-compute gate; NOT sufficient alone — sealed re-eval is the authoritative fix Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds an op1 static gate that rejects the proof-forgery class found in open recipe PRs: a miner patches
train()totorch.load("/home/.../checkpoint.pt")— a model trained off-protocol, mounted on their own CC box — and fabricates the training log; or points the data dir at/mnt/.../data_50bto bypass the locked manifest. The attestation still signs (the canonical image did run the recipe — it just loaded a file), andintegrity.check_checkpoint_trainedpasses a real-but-off-protocol checkpoint.Seen in the wild (open recipe PRs): #586
torch.load("/home/jovyan/v10sub/checkpoint.pt")+ fakefinal_state.json/training_log.jsonl; #344"data_base_dir": "/mnt/scratch/SN40/data_50b".How
proof.runner.scan_diff_for_exploit_patternsflags added patch lines that reference a host path (/home /root /mnt /media /srv /scratch /Users,~,..) ortorch.load/np.load/… an absolute checkpoint path. Wired into:validator.op1_diff_and_integrity— authoritative, rejects before any compute is spentproof.runnermain flow — in-container defense-in-depthNot a complete fix
Static + evadable (a determined miner can stage inputs under a canonical mount). The authoritative defense is sealed re-eval (re-run the recipe with no external mounts and require the checkpoint to reproduce). This stops the current in-the-wild attempts and raises the bar substantially.
Tests
tests/test_restricted_scanner.py(+7): the 3 real exploit patterns + false-negative guards (lr-schedulereturns, relative //data-canonical //tmp-cache paths, removed lines). 29 passed.🤖 Generated with Claude Code