Searcharxiv⌕ Search

arXiv subjects

Faruk Alpay

Publications and source records attributed to Faruk Alpay.

At least 19 recordsLinked to original sources

Nonreciprocal Spherical Attention and Retrieval: Sharp Coarsening Clocks and Certified Score Correction

We develop nonreciprocal spherical attention as a mathematical framework for coarsening and compressed nearest-neighbor retrieval. For two shrinking acute blocks whose centers have zero skew pairing and whose total mass ratio is subexponential in inverse temperature, we prove $\lim_{β\to\infty}β^{-1}\log T_β=1-\cosϕ$, without restricting particle-count growth. An explicit three-body flow has two rigorously separated metastable exponents. For finite compression, mass centering yields a sharp $O(r^2)$ attention-output error bound at fixed temperature, with an explicit spherical-normalization correction. We formulate skew query-side score calibration as a strictly convex moment problem and derive a unique normal equation, residual-based optimization certificates, and bounded low-rank projections. A norm-aware margin objective calibrates native squared-distance rankings. Experiments use semantic retrieval data, one million visual descriptors with three codebook seeds, and a ten-million-vector FAISS IVF-PQ index with recomputed exact cosine ground truth. On SIFT1M, skew margin calibration raises native-L2 hit@10 from 0.8926 to 0.8948; symmetric calibration reaches 0.8996. The ten-million-vector index reaches 0.8827 hit@10 at 0.1794 ms per query in a four-thread batch benchmark, while validation selects no skew update. Exact streamed attention over ten million keys evaluates compressed memory on 1,024 held-out queries. Independent matrix solves, automatic differentiation, finite differences, interval arithmetic, full-flow tests, and nine Rocq-checked algebra lemmas support reproducibility. Directionality alone does not establish retrieval superiority.

cs.LG↗

Revision-Bound Evidence Cuts: Authenticated Queries and Contextual Witness Capacity

Authentic records can support unauthorized narratives when their qualifications, query scope, or counterevidence are silently dropped. We present revision-bound evidence cuts, a framework for authenticating both supporting and opposing inference obligations across changing source versions. Signed complete-update frontiers permit transport of unaffected certificates, alternative-cut recovery, and an exact certified-reuse radius given by a frontier-hypergraph transversal number. Their source obligations induce an integral model of context-bound authorization. To secure database-derived claims, we introduce an authenticated relational query contract that binds original source records, complete selected bags, counting units, parameters, and aggregates independently of execution strategy. A full-source verifier checks 16,824 Chogha Mish records across SQLite scans, indexes, and materialized views; three valid strategies agree and eight contract/view mutations are rejected. A separate 340-row NISP cohort shows that changing the admitted weighting rule can reverse a comparison while preserving every source record. A frozen English text-to-frame compiler produces qualified evidence receipts, with linguistic accuracy evaluated separately from cryptographic integrity. We also separate logical-source from transport commitments so lossless re-encoding need not invalidate unchanged scientific evidence. The SCENE prototype evaluates signed revisions, authenticated queries, scoped disclosures, and adversarial mutations at scales reaching one million source records. These guarantees rely on declared policies and independently pinned trust roots; they authenticate specified computations and obligations, not historical truth, complete counterevidence, or institutional endorsement.

cs.CR↗

Provenance and Authorization in Autobiographical Language Models

Autobiographical language models may draw on archives containing observations, quotations, emotional reports, and earlier model outputs. Cryptographic authentication can preserve an archive while leaving these sources semantically conflated. We formulate this gap as a computer-security problem: narrative content must not silently become consent or alter an authorized decision rule. We define typed records, authenticated attestations, a separate policy channel, and admissible views. Under explicit assumptions, we give a standard integrity reduction and a noninterference argument, characterize the information required by exact decision-preserving summaries, and show why passive history and fixed-point convergence need not identify a preferred action. Alpay Algebra supplies a comparative language for iterative memory without being a premise of the proofs. Sociology of religious affiliation, source-monitoring psychology, and self-determination theory motivate distinctions in a bounded Latter-day Saint vignette. A separate, reproducible pilot uses a frozen public language model on 32 wholly synthetic cases across 576 paired conditions. It compares flattened records, source labels, and an explicit admission gate under contradictory summary repetition. The study concerns computational attribution and authorization, not the motives or psychology of the people in the vignette.

cs.CR↗

Approval Integrity and Recovery in LLM Answer Publication

Publication integrity in LLM systems requires binding approved content to its current authorization context. We examine exact-content binding, authorization freshness and checkpoint recovery in Lightcap's publication enforcement mechanism. On 900 independently human-annotated RAGTruth responses from 150 source tasks, three dated Ministral models and a same-model direct-grounding baseline yield 3,600 assessments. The production response-act checker instantiated with 14B accepts 291 of 302 unsupported-labelled answers; the direct baseline accepts 41. Supported-answer retention is 95.2% and 66.9%, respectively. An exact promotion-correction identity tracks error through 100 chronological 3B-14B-8B-14B answer trajectories. Among 65 initially approved answers, the final stateful recheck-recovery policy increases exact-match error by 9.23 percentage points relative to the initial checkpoint (95% article-clustered interval [-1.72, 19.61]). Controlled evidence-fingerprint changes expose asymmetric freshness enforcement between publication and recovery. A separate BIPIA prompt-injection experiment records zero target insertions among 266 valid editor outputs. External Hugging Face calibration experiments transfer retrieval models from ArguAna to SciFact and NFCorpus, and diagnostic decision rules from Thunderbird to BGL, distinguishing probability calibration from ranking changes. The measurements separate semantic false approval, stale authorization and recovery-induced error at executable publication boundaries.

cs.CR↗

AccretionLink: On-Device Auditing of Exposure-Control Attacks on Attribute Inference

Exposure control lets an adversary rank authentic public posts to strengthen private-attribute inference without altering content. AccretionLink defines confidentiality and integrity games for this attack, models bounded selection odds through partial identification, and constructs dependence-aware time-uniform e-processes. On 52 held-out synthetic profiles, odds-four selection reduced aggregate negative log likelihood at every horizon. At eight posts the advantage was 0.01595 nats (95% CI [0.00890, 0.02336]), three of four target effects survived Holm adjustment, and label-blind model-guided selection caused 6/109 high-confidence false reversals. On 142 PAN15 test profiles, exploratory selection produced a 0.01227-nat advantage but no reversal. A separate TF-IDF selector retained a 0.01470-nat advantage against the unchanged G5 target, while matched identity shuffling did not reproduce it. Pixel 10 encoded all 1,622 held-out posts once with a fallback-free Tensor G5 graph. A P-256 checkpoint authenticated the selected-replay, actual-model, native-report, and operation digests; local KeyInfo identified the signing key as StrongBox-backed.

cs.CR↗

Pattern-Derived Visual Swarm Games: Multi-Scale Drone-Vision States for Interception and Sustainability Audits

We convert drone-vision annotation streams into virtual swarm-game states without controlling physical drones. VisDrone and UAVSwarm metadata are compressed into a Bloom representation; deterministic probes produce bounded capability vectors, image-space formations, finite zero-sum payoffs, and human-readable visual overlays. The audit scales from $6\times 6$ to $32\times 32$ finite games and adds a repeated Markov layer with stock, fatigue, adaptation, exposure, stress, budget, data-growth, model-improvement, and entropy-budget state variables. Local screen tuning raises robust screen security from $0.526$ to $0.593$, and the $32\times 32$ tuned screen reaches value $0.616$. A field readout audit shows that fixed-pixel rasters do not improve monotonically: $128\times 128$ accuracy is $67.2\%$ and hotspot error is $0.136$. The diagnosed error is shrinking image-plane bandwidth. A finite empirical-risk encoder over scale-normalized Gaussian bandwidths selects a scale-normalized encoder with $λ=1.50$, reaching $77.6\%$ accuracy at $128\times 128$ and reducing joint loss by $0.185$. A server-side audit checks $16{,}777{,}216$ target-localization states, and a 32-round repeated-game audit over $16{,}777{,}216$ trajectories selects a budget-adaptive policy with value $0.461$.

cs.RO↗

Conductance-Repair Evidence Graphs for Prospective Security Retrieval

Security retrieval is often evaluated as ranking over complete evidence, but operational triage is prospective: CVE descriptions, weakness metadata, fix commits, EPSS scores, KEV membership, validation-vector metadata, and side-channel benchmark routes arrive through separate channels, and many are missing, delayed, poisoned, or visible only after the decision time. We introduce conductance-repair evidence graphs, a timestamped framework in which retrieval is performed over a temporal admissibility mask and missing channels are widened by a deterministic graph-flow recurrence rather than by a learned predictor. The method emits a repair certificate recording source probes, decision time, withheld edges, repaired channels, forbidden post-decision edges, backend availability, numerical deviation, and verifier results. The theoretical layer gives an adaptive \(\lceil\log_2 N\rceil\) lower bound for missing-channel identification, an NP-hardness result for minimum harmful repair, and a fixed-parameter certified search bound for \(q\) questionable channels. The current artifact materializes 30 deduplicated public security records, 57 terms, and 58 withheld admissible document-term edges. Under random edge withholding, conductance repair changes recall@\(k\) from 0.017 to 0.069 and average precision from 0.062 to 0.060, while a synthetic security fixture improves recall@\(k\) from 0.055 to 0.099; the public AP drop exposes a limit of broad admissible repair under random edge corruption. The implementation benchmarks the same flow/SVD/einsum kernel under NumPy, PyTorch, JAX, and TensorFlow when available, recording unavailable backends rather than silently substituting them. BBBC019 and LIVECell metadata are retained only as structural controls for sparse evolving source channels, with no clinical or biological performance claim.

cs.CR↗

Observer-Quotient Security: Composable Leakage Bounds for Hidden State Continuations

Observer-quotient security studies interactive cryptographic systems whose security depends on what an admissible observer can distinguish across transcripts, leakage traces, and hidden implementation continuations. The paper defines observer-indexed experiments with session identifiers, adaptive schedulers, oracle forwarding, simulators, ideal quotient functionalities, and nonuniform environments, and proves a real/ideal emulation theorem in which sequential morphism defects add, parallel defects obey a product-TV bound, and adaptive observer choice is absorbed by an explicit wrapper construction. The resulting advantage bound is indexed by $δ_{\mathrm{obs},t}$, $δ_{K,t}$, $δ_{\mathrm{post},t}$, $δ_{\mathrm{sim},t}$, $η_t$, and the residual floor $ρ_T(\mathbb E Z_T)$. The framework is instantiated for IND-CPA encryption with timing leakage, deterministic encryption with entropy ledgers, and finite-state side-channel refinement under transcript, timing, cache, power, EM, and profiled observers. The optimization/control component identifies hidden continuations with observability kernels, treats sensor redesign as quotient refinement, and converts dissipativity, PL-type rates, and ISS residual bounds into concrete reductions in distinguishing advantage. Ancillary code and synthetic data reproduce the finite-state leakage audit and LTI observer-design benchmark.

cs.CR↗

Epistemic Horizon Minority Games: When Abundance Reduces Strategic Value

Strategic value can fall when an option becomes visible. A route, signal, bet, or opportunity may be attractive because few agents see it; public attention can erase the advantage it reveals. We formalize this mechanism as an epistemic-horizon minority game (EHMG), where agents have bounded observation horizons, action-specific awareness, desire-biased utilities, and payoffs that decline with crowding, and where the object is not a fixed congestion game with omitted actions but an awareness-transition game on a finite lattice. We prove fixed-awareness potential-game reduction, finite monotone awareness convergence, logit mean-field uniqueness under an explicit norm condition, non-reducibility from static count-based congestion games, and sensitivity bounds for nonlinear revelation. We separate the target price of information from aggregate welfare loss, showing that they can coincide, diverge, or recommend opposite disclosure policies, while modeling private revelation, public common revelation, and correlated group disclosure as distinct signal structures with different equilibrium effects. Experiments regenerate awareness sweeps, public visibility shocks, horizon-desire grids, information-constrained Braess examples, disclosure optimization, minimum harmful revelation, and counterfactual baselines isolating the epistemic mechanism from ordinary full-awareness congestion. Strategic trace encodings are evaluated as a controlled regime-recognition benchmark using raw trajectories, Fourier summaries, recurrence and Gramian images, image bundles, local-filter features, leakage probes, phase-scrambled controls, resolution and recurrence-threshold sweeps, spectral carriers, and IAAFT-matched null parameter-shift controls to test whether trace encodings recover strategic structure under robust nulls.

cs.GT↗

Radial Interaction Tomography: Recognizing Non-Transitive Evolutionary Games from One Range-Expansion Image

Colored sectors in a microbial range expansion encode more than lineage survival counts. We formulate a computer-vision inverse problem: from one endpoint image of an accretive multi-type expansion, recover the radius-indexed pairwise boundary-flow field and test whether the visual pattern is compatible with a transitive scalar fitness hierarchy. The observable is a geometric signal extracted from sector-boundary curves in log-polar coordinates. We prove endpoint observability and stability for frozen fronts, weighted transitive/cyclic decomposition, contact-complete circular design, physical-clock and mechanism non-identifiability, exact Gaussian cyclicity testing, and Bonferroni-valid interval scanning. The benchmark is deterministic: analytic endpoint images, blurred/noisy pixel round trips, scalar-null stress tests, public-image tracing, multi-resolution mechanistic endpoints, and a non-learning frozen-front simulator. The implementation recovers pairwise edge-flow histories from endpoint images, detects cyclic residuals in a mechanistic four-type expansion, and uses those residuals as forcing signals for a dimensionless active design-control layer covering reaction-diffusion control, phenotype-frontier optimization, protocol synthesis, Monte Carlo robustness, and a downstream population-state bridge.

cs.CV↗

Interface-Variant Dynamics in Software Ecosystems: Resolver-Induced Selection and Adoption in Package Graphs

Compatibility research usually treats an interface change as a local writer-reader decision. Distributed software stacks make that decision population structured: an RPC, telemetry, middleware, or service-contract variant is introduced by one provider release and then spreads, stalls, or is mediated across consumers, transitive dependencies, and resolver rules. This paper asks when that observation is a load-bearing software-engineering estimator rather than evolutionary relabeling. We mine interface histories, audit npm, Maven Central, PyPI, and crates.io package graphs, execute 2100 package-manager resolver probes, estimate an ecosystem-specific selection coefficient $s$ from clean conflict probabilities, and use that measured $s$ to forward evaluate a pairwise-comparison absorbing process on the observed package graph. We separate three evidential roles. Fixation is a forward evaluation, not independent evidence: once $s$ is measured, deviation from $1/N$ follows mechanically from the non-neutral process. Checker-derived direction carries adoption signal: a direction-permutation null gives checker-direction gap MAE 0.07 versus null median 0.43 ($p=0.002$). But because that direction is derived from the same boundary state whose admitting frequency is predicted, it is a diagnostic rather than an orthogonal selection test. The stricter checker-free temporal test asks whether early resolver-channel features predict later blocked-to-admitted flips; in this snapshot they do not beat age-only (Brier 0.28 versus 0.24, AUC 0.51 versus 0.54). The result is a reproducible estimator audit for interface-variant dynamics in distributed package graphs, showing where resolver evidence becomes population input and where the current registry data still fail to close the resolver-to-adoption loop.

cs.SE↗

Detector-Output Instability near the Kesten-Stigum Boundary: Separating Hard Readout, Relaxation, and Fixed-Point Dispersion

Community-detection algorithms usually return a single partition, even when independent initializations or small data perturbations yield several plausible outputs. We probe this output distribution through three paired observables: hard-partition variation of information (VI), a residual-gated fixed-point VI, and a cutoff-free Jensen-Shannon distance between belief-propagation (BP) marginal fields. For the symmetric sparse stochastic block model, linearizing BP around the uninformative fixed point gives the Kesten-Stigum onset at $\mathrm{snr}=(c_{\rm in}-c_{\rm out})/(q\sqrt{c})=1$. The hard VI maximum is instead a finite-size, readout-dependent detector curve on the detectable side, typically $\mathrm{snr}^\star \simeq 1.05\text{-}1.10$; moving the polarization cutoff from 0.001 to 0.1 shifts it across 1.047-1.128. The nontrivial-readout activation obeys $\mathrm{snr}_{50}(τ)-1 = 0.0086 + 0.522\,τ$ ($R^2=0.996$). Long-budget residual gating separates readout and critical slowing from fixed-point dispersion: at $\mathrm{snr}=1.05$ and 1.10 the hard VI is 1.49 and 1.58 bits but the gated subsets have zero VI, whereas from 1.15 to 1.30 nearly all runs pass the gate and retain VI 1.31 down to 1.24 bits. A high-replication audit through $N=100000$ disfavors a zero-asymptote power law and finds a small plateau $\mathrm{snr}^\star-1 \simeq 0.024$ (graph-bootstrap 90% interval [0.0227, 0.0316]). On real networks, a label-free Bethe-Hessian modularity margin with a Chung-Lu null gate is run on political blogs and six SNAP graphs: the measurement stays label-free, while heterogeneous networks can retain null-significant structure even after strong edge subsampling. The result is a detector-output decomposition near the Kesten-Stigum boundary, reporting hard readout, relaxation dynamics, and fixed-point-field dispersion separately.

cs.SI↗

Dipole Diffusion Error in Thin Geometry: Optical Thickness Laws for Grid-Free Subsurface Scattering

The dipole and its descendants model subsurface scattering with a radial reflectance profile fitted to a flat, semi-infinite slab. This assumption introduces a systematic geometry error on thin and curved objects. We isolate the effect by comparing the dipole with the finite-slab multipole under the same diffusion model and boundary condition. In slab geometry the diffuse-albedo error has a material-independent leading rate, $C e^{-2τ}$ with $τ=T/\ell_d$, while the prefactor remains material dependent; the same image series gives the transmitted flux, whose leading decay is $e^{-τ}$. We give the closed-form albedo and transmittance, relate the exponents to killed random walks, and extend the interpretation to spatially varying media through optical distance. A brute-force volumetric path tracer fits a reflectance-deficit rate of 1.99 and a transmittance rate of 0.99, matching the round-trip and single-pass predictions. The resulting thickness predictor is a useful thin-feature heuristic, but stress tests show that curvature and illumination can dominate away from the slab setting. For the remaining geometry-dependent term we solve the screened-Poisson diffusion problem directly inside the signed-distance domain with Walk on Spheres, without an interior mesh or a tangent half-space approximation; the estimator matches closed-form tests to 0.75%. Against a four-case path-traced benchmark it improves the back-lit, thickness-governed case but not every front-lit or curved case, showing that the method reduces geometry error within diffusion and does not replace radiative transport.

cs.GR↗

Self-Verifying Measurement Records: Hash-Linked Evidence Graphs for Hardware Benchmarking

Performance numbers reported for hardware are accepted on trust: the reader cannot recompute them, the apparatus is gone, and the silicon itself can be silently wrong, with fleet studies reporting on the order of one core in a thousand returning incorrect arithmetic with no error raised. We make a reported hardware measurement a tamper-evident, independently checkable record. Every quantity in the text, a table, or a figure is bound, by its content hash, to the observation and the verification behind it; the whole is a hash-linked, append-only structure (a transparency log for measurement) that a verifier audits offline without trusting its producer. Matrix products are verified by a probabilistic identity (Freivalds) at O(k n^2) cost under a tolerance we derive from floating-point error analysis and calibrate to the device's own measured residual floor, so a wrong product is rejected with probability 1 - 2^(-k); quantities with no such identity carry an algebraic checksum and a measured reproducibility class. We then treat the check itself as a security object: a probe seed committed for offline reproducibility is an attack surface, and a probe-aware adversary can hide a corruption in the probe's null space, fooling even a quorum of bit-identical witnesses, while a Fiat-Shamir challenge derived from the claimed output closes this. Driving the device from an unprivileged tenant's reach, with a di/dt power virus and a thermal soak, neither moves the calibrated tolerance nor produces a silent error, placing the physical-fault threat at the rare defective part or the privileged attacker and marking the boundary at which the record must compose with a hardware root of trust. We demonstrate the construction across Blackwell and Hopper GPUs and report a residual-floor and reproducibility map by precision, size, and device.

cs.CR↗

Residual GPU Cache State on Apple M4 Pro

Apple silicon exposes unified CPU-GPU memory, but the cache state left after a completed GPU command is not documented. This paper characterizes that phase boundary on a 14-core Apple M4 Pro. We validate the measurement pipeline against unmodified STREAM 5.10 and BabelStream 5.0, then adapt an 8192-byte system-level-cache occupancy pattern to a synchronized Metal experiment. A GPU kernel touches 0 to 512 MiB and finishes before a 16 MiB CPU probe begins. The first CPU traversal is slower after large GPU footprints, while a second traversal removes most of the cost, showing residual shared-cache displacement rather than simultaneous DRAM contention. A separate matched-block experiment measures GPU slowdown under high-priority CPU traffic and finds background QoS close to baseline. Root PMU measurements and public IOReport histograms provide hardware grounding: they distinguish L1D refill sectors from software cache-line size, expose page-offset-dependent conflict behavior, and separate performance-core, efficiency-core, and AGX demand. The results identify a reproducible post-GPU cache-displacement window on M4 Pro and quantify a simple one-pass software recovery mechanism.

cs.AR↗

Naturalness Predicts but Does Not Cause Transferability in Image Encodings of Real-World Streams

A common practice converts a one-dimensional signal into an image so that a vision backbone pretrained on natural photographs can be reused for recognition, yet the encoded image is rarely examined. We ask how the visual naturalness of an encoded image relates to its transfer accuracy under a frozen backbone. We build WorldStream, a corpus of 299 heterogeneous current-value series from key-free public APIs (weather, air quality, earthquakes, gold and oil, equities, crypto, foreign exchange, web activity and space weather), with a nine-way source-recognition task over 3143 temporally split windows. Across seven encodings and six frozen backbones, the Frechet distance of an encoding to natural images (FID) predicts its accuracy: Spearman $ρ=-0.72$. Two controlled interventions show this is not causal in the spectrum. Our invertible encoder has a single adjustable part, a spectral exponent $β$ (power $\propto |f|^{-β}$); varying $β$ moves the image toward or away from the natural-image manifold at fixed content. FID is lowest near the natural value $β\approx 2$, but frozen accuracy stays flat and far below the structured baselines (19.2% vs. 73.0%), and FID and accuracy are only weakly related over the sweep (Pearson $-0.32$). A second intervention, phase scrambling, holds the power spectrum exactly fixed while removing local structure; now FID and accuracy fall together (Pearson $-0.89$). The cross-encoding correlation is thus mediated by local structure, not spectral naturalness: FID predicts accuracy because Inception reads the same structure the backbones do. Full fine-tuning does not close the gap (27% vs. 67%), so the deficit is structural. The encoder is exactly invertible, recovering the signal from the 8-bit image at 72.9 dB, so the image doubles as a lossless record of the data.

cs.CV↗

Exact Local Annotations for Regular Languages

A regular language is recognized by a finite monoid, but a locally checkable explanation of that recognition can have a nontrivial update geometry. We study exact bounded-arity annotations for regular word languages under one-symbol substitutions. The cost of an edit is the number of annotation cells that a canonical locally accepted representation must change, together with the corresponding bit movement and the number of local constraints that must be revalidated. For every morphism recognizing a regular language, the balanced product annotation gives constant locality, linear size, O(log n) edit stability, O(log n) revalidation, and constant access to the membership value. The matching lower bound proved here is restricted to product decompositions that expose an edit-active nontrivial group quotient as ordered product labels; in that setting one substitution changes every quotient label on an ancestor path. We also show that annotation-free bounded-window recognition is exactly strict locality, prove closure properties for a two-sided total decision variant, and formulate the remaining constant-stability boundary as a finite obstruction problem. The ancillary files include Lean, CP-SAT, and CUDA certificates, including a context-free interval-chart experiment.

cs.FL↗

Unprivileged Topology Certificates for Cloud GPU Attestation

Cloud GPU tenants receive a model name and a region, but cannot directly inspect the physical accelerator that runs their job. We present a software-only attestation primitive for this setting. A CUDA probe measures an SM-by-memory-region latency matrix using physical SM labels and dependent global loads. A streaming reducer commits sufficient statistics, configuration, code hashes, network evidence, and a compressed raw data archive into a certificate that a verifier can check without a GPU. The certificate supports three claims. First, the per-SM latency map is a stable physical fingerprint. Over a six-hour full-load RTX 5090 run, its median temporal jitter is 0.09 cycles, while shape-only leave-one-out classification separates distinct Blackwell dies with 100.0% accuracy. Second, cache-bypassing HBM sweeps recover hardware-class topology across generations, including a unified Volta V100 memory domain, a two-way Hopper H200 L2 split, and a Blackwell B200 two-die NV-HBI package whose 74/74 SM partition carries a 30-cycle, 15.5 ns cross-die penalty. Third, public network landmarks bind the same certificate to a coarse location. In the B200 run, 169 RIPE Atlas probes place the server within 44 km of its claimed datacentre and reject all 11 decoy sites. Together, these measurements check cloud-GPU identity, class, and coarse location without privileged access or a vendor key.

cs.CR↗