arXiv subjects

Alfredo Metere

Publications and source records attributed to Alfredo Metere.

17 recordsLinked to original sources

arXiv2026

Attested Tool-Server Admission: A Security Extension to the Model Context Protocol

The Model Context Protocol (MCP) standardizes how a large-language-model (LLM) agent and an external tool server exchange messages, but not trust: a host reads a server's self-declared tool list and dispatches calls, with no notion of which servers it may use, at what sensitivity, or which of a server's tools are in bounds. This work grew out of a concrete need -- letting the Enclawed agent use Google's externally-operated MCP servers (Gmail, Calendar, Drive) safely, admitting the server and bounding the tools it may drive, without changing MCP or Enclawed's own tool application-programming interface (API). The mechanism we built, mcp-attested (shipped in both the open enclawed-oss distribution and the enclaved flavor), generalizes: the gap that makes an unmediated third-party connection unsafe for one user makes a regulated deployment impossible to accredit. We close it with three additive mechanisms: (1) a small, offline-signed clearance assertion a server publishes at a well-known Uniform Resource Identifier (URI) and a host verifies against a pinned trust root before any tool dispatch; (2) a deny-by-default per-server tool allowlist, so admitting a server is not trusting its every tool; and (3) a flavor-gated enforcement mode that turns the checks from warnings into hard denials, with every decision written to a tamper-evident audit log. We give the wire format, the verification algorithm, a security analysis, and an LLM-driven adversarial evaluation; we then state the design in normative Request-for-Comments (RFC 2119) form -- schema, verification rules, error registry, well-known registration, and machine-checkable conformance vectors -- so it can be adopted as an MCP addendum rather than reinvented. An unextended host ignores the well-known document and behaves exactly as today.

cs.CR↗

arXiv2026

An Application-Layer Multi-Modal Covert-Channel Reference Monitor for LLM Agent Egress

A large language model (LLM) agent that sends messages can leak data inside them. Destination allowlists and content scanners do not police whether an otherwise-benign payload is itself a covert channel: a compromised agent encodes bits in zero-width characters, homoglyphs, whitespace, base64, JavaScript Object Notation (JSON) key ordering, message timing or size -- and, in binary egress, in least-significant-bit (LSB) pixel planes, per-image mean luminance, inter-image sequence permutation, ultrasonic tones, or audible-band sonified data. Our egress reference monitor has three contributions. (i) A text pipeline of ten capacity-reducing stages, a per-sink leaky-bucket capacity ledger, and a staged posture that enforces lossless stages from day one. (ii) Two media scramblers (a Fourier-domain audio band-limiter and a red-green-blue (RGB) image bit-depth and mean-luminance bucketer) gated by a boot-time cryptographic legitimacy attestation: an auditor publishes at boot the trusted Ed25519 keys and {kind, data-class} pairs; only payloads with a verifying signature for an authorized class are exempt. The attestation sidesteps the intractable content-based discrimination between real media and data sonified or rasterized as a carrier; unsigned media is suspect by default; a content-addressed canonicalizer closes the inter-image permutation channel. (iii) Residual capacity is the Miller--Madow corrected mutual information between embedded and recovered bits (zero when destroyed), measured by an adversarial ensemble of fifteen working encoders across text, image and audio. The reference implementation drives residual capacity to zero on every destroyable channel and to a stated bound on the one (per-image mean luminance) that cannot be destroyed without ruining the image.

cs.CR↗

arXiv2026

Skills as Verifiable Artifacts: A Trust Schema and a Biconditional Correctness Criterion for Human-in-the-Loop Agent Runtimes

Agent skills - structured packages of instructions, scripts, and references that augment a large language model (LLM) without modifying the model itself - have moved from convenience to first-class deployment artifact. The runtime that loads them inherits the same problem package managers and operating systems have always faced: a piece of content claims a behavior; the runtime must decide whether to believe it. We argue this paper's central thesis up front: a skill is untrusted code until it is verified, and the runtime that loads it must enforce that default rather than infer trust from a signature, a clearance, or a registry of origin. Without skill verification, a human-in-the-loop (HITL) gate must fire on every irreversible call - which is operationally untenable and degrades into rubber-stamping at any non-trivial scale. With skill verification treated as a separate, gated process, HITL fires only for what is unverified, and the system becomes sustainable. We give a trust schema that includes an explicit verification level on every skill manifest; a capability gate whose HITL policy is a function of that verification level; a biconditional correctness criterion that any candidate verification procedure must satisfy on an adversarial-ensemble exercise; and a portable runtime profile with ten normative guidelines abstracted from a working open-source reference implementation. The contribution is harness- and model-agnostic; nothing here requires retraining, fine-tuning, or proprietary infrastructure.

cs.CR↗

arXiv2026

enclawed: A Configurable, Sector-Neutral Hardening Framework for Single-User AI Assistant Gateways

We present enclawed, a hard-fork hardening framework built on the OpenClaw AI assistant gateway. enclawed targets deployments that need attestable peer trust, deny-by-default external connectivity, signed-module loading, and a tamper-evident audit trail -- typically regulated industries (financial services, healthcare, defense, government). The framework ships in two flavors: an open flavor preserving OpenClaw compatibility while emitting audit, classification, and data-loss-prevention (DLP) signals, and an enclaved flavor activating strict allowlists, FIPS cryptographic-module assertion, mandatory manifest signature verification, and high-assurance peer attestation for the Model Context Protocol. The classification ladder is data-driven: deployers pick from five built-in presets or supply their own JSON. We ship a 356-case test suite (261 unit + 95 adversarial pen-tests) covering tamper detection, signature forgery, egress bypass, audit-log truncation, trust-root mutation, DLP evasion, prompt injection, code injection, and biconditional admission for net-capable extensions; real-time human-in-the-loop control; a memory-bounded transaction buffer with rollback; strict-mode TypeScript typecheck; and a CI workflow. The biconditional extension-admission gate extends the skill trust schema to non-skill extensions. The four-level verification lattice is now closed at the top: four skill-formal-* primitives plus a CLI produce a signed proof-carrying bundle the runtime re-checks at load, raising a skill from tested to formal via static effect-containment, refinement-typed dispatch, and bounded model checking. enclawed is a hardening framework, not an accredited certification; hardware, validated crypto, facilities, and assessor sign-off remain the deployer's responsibility.

cs.CR↗

arXiv2026

Methods for Formal Verification of Agent Skills: Three Layers Toward a Mechanically Checkable Capability-Containment Proof

The companion paper introduced a four-level verification lattice on agent-skill manifests (unverified, declared, tested, formal) and left the top level aspirational. This paper closes that gap. We give a precise semantics for skill behaviour faithful to how a skill is consumed by an LLM-driven runtime (a deterministic script-side reachable through a non-deterministic LLM-side), state the verification problem as a capability-containment property over that semantics, and present three composable methods that together raise a skill from declared or tested to formal: (1) sound static capability-containment analysis of the script-side via abstract interpretation over a small effect lattice; (2) a refinement type system for tool-call envelopes that mechanically rejects any call whose statically-inferred capability is not in the manifest's declared set; (3) SMT-bounded model checking against the parent paper's biconditional correctness criterion, with the bound chosen so any counter-example fitting the runtime's transaction-buffer horizon is exhibited as a concrete trace. We prove the three layers composed soundly cover the parent paper's threat model modulo a single residual (the LLM's freedom to refuse to act) that the parent paper's runtime biconditional catches at session boundary. The methods reuse existing well-engineered tools (Z3, Semgrep, CodeQL, refinement-type checkers, mechanised proof assistants) rather than asking operators to build new ones, and the proof-carrying artifact extends the existing SKILL.md convention. All three methods plus the bundle producer and re-checker ship as zero-dependency JavaScript modules in the open-source enclawed framework (https://github.com/metereconsulting/enclawed; project page https://www.enclawed.com/), with 53 unit tests and an end-to-end CLI demo on a sample skill.

cs.AI↗

arXiv2026

Architectural Obsolescence of Unhardened Agentic-AI Runtimes

An agentic-AI runtime issues tool calls, sends messages, and actuates devices on behalf of an LLM. Catching the four ways an action can diverge from its audit record -- F1 gate-bypass, F2 audit-forgery, silent host failure, F4 wrong-target, -- is a load-bearing safety property of any such runtime. We show that upstream OpenClaw, the most engineered single-user agentic-AI gateway in public release, catches none of them: recall is 0.000 on every cell of every confusion matrix, on a 1600-sample template baseline through OpenClaw's actual production command-line interface (CLI) and on a ten-LLM cross-model generalisation run. Detecting F1--F4 requires seven specific runtime structures absent from OpenClaw's source tree: a biconditional checker, a hash-chained audit log, an extension admission gate, a two-layer egress guard, a Bell-LaPadula classification policy, a module-signing trust root, and a bootstrap seal. enclawed-oss -- an MIT-licensed drop-in fork that ships all seven -- reaches $P = R = F_1 =$ accuracy $= 1.000$ on the same input. The gap is structural, not parametric: a six-line append-only widening of enclawed-oss's data-loss-prevention (DLP) regex catalog raises per-channel F3 detection by 14.6\% net at unchanged precision; the same edit on OpenClaw has nowhere to land. The harness deliberately exercises real Discord and Telegram channels -- plugin categories the first enclawed release deleted as unsafe -- to show F1--F4 detection extends to those previously-unsafe extensions. With architectural superiority for security and feature parity for extensions, we argue that unhardened agentic-AI runtimes are architecturally obsolete: a strictly better alternative exists, is adoptable today, and the gap requires re-architecture rather than configuration. We invite reviewers to apply the harness to any candidate runtime.

cs.CR↗

arXiv2025

Low-Rank GEMM: Efficient Matrix Multiplication via Low-Rank Approximation with FP8 Acceleration

Large matrix multiplication is a cornerstone of modern machine learning workloads, yet traditional approaches suffer from cubic computational complexity (e.g., $\mathcal{O}(n^3)$ for a matrix of size $n\times n$). We present Low-Rank GEMM, a novel approach that leverages low-rank matrix approximations to achieve sub-quadratic complexity while maintaining hardware-accelerated performance through FP8 precision and intelligent kernel selection. On a NVIDIA RTX 4090, our implementation achieves up to 378 TFLOPS on matrices up to $N=20480$, providing 75\% memory savings and $7.8\times$ speedup over PyTorch FP32 for large matrices. The system automatically adapts to hardware capabilities, selecting optimal decomposition methods (SVD, randomized SVD) and precision levels based on matrix characteristics and available accelerators. Comprehensive benchmarking on NVIDIA RTX 4090 demonstrates that Low-Rank GEMM becomes the fastest approach for matrices $N\geq10240$, surpassing traditional cuBLAS implementations through memory bandwidth optimization rather than computational shortcuts.

cs.PF↗

arXiv2023

GPU acceleration of local and semilocal density functional calculations in the SPARC electronic structure code

We present a GPU-accelerated version of the real-space SPARC electronic structure code for performing Kohn-Sham density functional theory calculations within the local density and generalized gradient approximations. In particular, we develop a modular math kernel based implementation for NVIDIA architectures wherein the computationally expensive operations are carried out on the GPUs, with the remainder of the workload retained on the CPUs. Using representative bulk and slab examples, we show that GPUs enable speedups of up to 6x relative to CPU-only execution, bringing time to solution down to less than 30 seconds for a metallic system with over 14,000 electrons, and enabling significant reductions in computational resources required for a given wall time.

physics.comp-ph↗

arXiv2019

Self-assembly of orthorhombic Fddd network in simple one-component liquids

Triply periodic continuous morphologies arising a result of the microphase separation in block copolymer melts have so far never been observed self-assembled in systems of particles with spherically symmetric interaction. We report a molecular dynamics simulation of two simple one-component liquids which self-assemble upon cooling into equilibrium orthorhombic continuous network morphologies with the Fddd space group symmetry reproducing the structure of those observed in block copolymers. The finding that the geometry of constituent molecules isn't relevant for the formation of triply periodic networks indicates the generic nature of this class of phase transition.

cond-mat.soft↗

arXiv2018

A Practical Approach to Sizing Neural Networks

Memorization is worst-case generalization. Based on MacKay's information theoretic model of supervised machine learning, this article discusses how to practically estimate the maximum size of a neural network given a training data set. First, we present four easily applicable rules to analytically determine the capacity of neural network architectures. This allows the comparison of the efficiency of different network architectures independently of a task. Second, we introduce and experimentally validate a heuristic method to estimate the neural network capacity requirement for a given dataset and labeling. This allows an estimate of the required size of a neural network for a given problem. We conclude the article with a discussion on the consequences of sizing the network wrongly, which includes both increased computation effort for training as well as reduced generalization capability.

cs.NE↗

arXiv2018

Isomorphism between Maximum Lyapunov Exponent and Shannon's Channel Capacity

We demonstrate that the Maximum Lyapunov Exponent for computable dynamical systems is isomorphic to the maximum capacity of a noiseless, memoryless channel in a Shannon communication model. The isomorphism allows the understanding of Lyapunov exponents in the simplified terms of Information Theory, rather than the traditional definitions in Chaos Theory. This work provides a bridge between fundamental physics and Information Theory to the mutual benefit of both fields. The result suggests, among other implications, that machine learning and other information theory methods can be successfully employed at the core of physics simulations.

cond-mat.stat-mech↗

arXiv2018

Principle of Conservation of Computational Complexity

In this manuscript, we derive the principle of conservation of computational complexity. We measure computational complexity as the number of binary computations (decisions) required to solve a problem. Every problem then defines a unique solution space measurable in bits. For an exact result, decisions in the solution space can neither be predicted nor discarded, only transferred between input and algorithm. We demonstrate and explain this principle using the example of the propositional logic satisfiability problem ($SAT$). It inevitably follows that $SAT \not\in P \Rightarrow P\neq NP$. We also provide an alternative explanation for the undecidability of the halting problem based on the principle.

cs.CC↗

arXiv2017

A hexatic smectic phase with algebraically decaying bond-orientational order

The hexatic phase predicted by the theories of two-dimensional melting is characterised by the power law decay of the orientational correlations whereas the in-layer bond orientational order in all the hexatic smectic phases observed so far was found to be long-range. We report a hexatic smectic phase where the in-layer bond orientational correlations decay as $\propto r^{-1/4}$, in quantitative agreement with the hexatic ordering predicted by the theory for two dimensions. The phase was formed in a molecular dynamics simulation of a one-component system of particles interacting via a spherically symmetric potential. This is the first observation of the theoretically predicted two-dimensional hexatic order in a three-dimensional system.

cond-mat.soft↗

arXiv2017

Visual, user-interactive generation of bond networks in 3D particle configurations

We present a new program able to perform visual structural analysis on 3D particle systems called PASYVAT (PArticle SYstem Visual Analysis Tool). More specifically, it can select multiple interparticle distance ranges from a radial distribution function (RDF) plot and display them in 3D as bonds between the particles falling within the selected distance range, thus generating a network of bonds. This software can be used with any data set representing a system of points or other objects having a welldefined center of mass or geometric center in 3D space. In this article we describe the program and its internal structure, with emphasis on its applicability in the study of certain particle configurations, obtained from classical molecular dynamics simulation in condensed matter physics.

physics.comp-ph↗

arXiv2015

New kind of dodecagonal quasicrystal

We report a novel kind of dodecagonal quasicrystal that has so far never been observed, nor theoretically predicted. It is composed of axially stacked hexagonal particle layers, with 12-fold rotational symmetry induced by 30 degrees rotation of adjacent layers with respect to each other. The quasicrystal was produced in a molecular-dynamics simulation of a single-component system of particles interacting via a spherically-symmetric potential, as a result of a first-order phase transition from a liquid phase under constant-density cooling. This finding implies that a similarly structured quasicrystal can possibly be produced by the mesogens of the kind that produce smectic-B crystals and in a system of spherically-shaped colloidal particles with appropriately tuned potential.

cond-mat.soft↗

arXiv2015

Formation of a Columnar Liquid Crystal in a Simple One-Component System of Particles

We report a molecular dynamics simulation demonstrating that a columnar liquid crystal, commonly formed by disc-shaped molecules, can be formed by identical particles interacting via a spherically symmetric potential. Upon isochoric cooling from a low-density isotropic liquid state the simulated system performed a weak first order phase transition which produced a liquid crystal phase composed of parallel particle columns arranged in a hexagonal pattern in the plane perpendicular to the column axis. The particles within columns formed a liquid structure and demonstrated a significant intracolumn diffusion. Further cooling resulted in another first-order transition whereby the column structure became periodically ordered in three dimensions transforming the liquid-crystal phase into a crystal. This result is the first observation of a liquid crystal formation in a simple one-component system of particles. Its conceptual significance is in that it demonstrated that liquid crystals that have so far only been produced in systems of anisometric molecules, can also be formed by mesoscopic soft-matter and colloidal systems of spherical particles with appropriately tuned interatomic potential.

cond-mat.soft↗

arXiv2014

Formation of a New Archetypal Metal-Organic Framework from a Simple Monatomic Liquid

We report a molecular-dynamics simulation of a single-component system of particles interacting via a spherically symmetric potential that is found to form, upon cooling from a liquid state, a low-density porous crystalline phase. Its structure analysis demonstrates that the crystal can be described by a net with a topology that belongs to the class of topologies characteristic of the metal-organic frameworks (MOFs). The observed net is new, and it is now included in the Reticular Chemistry Structure Resource database (RCSR). The observation that a net topology characteristic of MOF crystals, which are known to be formed by a coordination-driven self-assembly process, can be reproduced by a thermodynamically stable configuration of a simple single-component system of particles opens a possibility of using these models in studies of MOF nets. It also indicates that structures with MOF topology, as well as other low-density porous crystalline structures can possibly be produced in colloidal systems of spherical particles, with an appropriate tuning of interparticle interaction.

cond-mat.mtrl-sci↗