papers/hanzo-ai-chain/sections/09-security.tex

\section{Security}
\label{sec:security}

\subsection{Three complementary protocol layers}

A-Chain PoAI consensus decides whether an admitted useful-work claim is valid,
final, unique, and reward-bearing. Z-Chain P3Q compresses and settles finalized
A-Chain receipt transitions without becoming a mining authority. Lux Quasar
supplies validator ordering, fork choice, and finality for both states. The
activated post-quantum validator authentication policy secures exported A/Z
settlement roots. These are complementary layers: PoAI is not an alternate
block-leader race, P3Q is not raw-work admission, and Quasar finality alone does
not prove that an AI workload ran.

Security claims must be made against the protocol actually activated. ML-DSA is
a standardized signature, not evidence of computation and not a threshold
protocol by itself. P3Q is the intended Plonky3-derived, pairing-free Z-Chain
settlement substrate, but a PoAI AIR, recursive policy, A-to-Z state binding,
and verifier are not authoritative until implementation, audit, parameter
review, node wiring, and activation are complete. Pulsar and
Corona likewise require their selected threshold protocol and networking, not
only compatible signature bytes.

\subsection{Execution soundness}

For a committed integer matrix product $C=AB$ over
$\mathbb{F}_{p}$, $p=2^{61}-1$, a post-commitment Freivalds challenge accepts an
invalid product with probability at most $1/p$ per independent vector. Honest
integer work has zero false rejection when serialization, overflow, reduction,
and challenge derivation are identical.

This local bound does not automatically cover a full graph. If $s$ operations
are sampled uniformly from a graph of $L$ operations with $b$ invalid nodes, a
simple upper bound on acceptance is

\begin{equation}
  \Pr[\mathrm{accept\ invalid\ trace}] \leq (1-b/L)^s+s/p^k,
\end{equation}

where $k$ is the number of independent challenge vectors per opening. Sparse
fraud is dominated by the coverage term. A production optimistic policy
therefore needs complete transcript availability and independent watchers that
may challenge any invalid operation, or a coverage parameter justified against
the reward at risk.

\subsection{CPU validation claim}

For supported operations, CPU validation is practical because an opened matrix
product is checked in quadratic work instead of rerunning the provider's cubic
product. Merkle inclusion and graph binding ensure the opened matrices are part
of the committed job. Small jobs may be replayed exactly. This does not imply
that every arbitrary floating-point training system is CPU-verifiable; only
activated deterministic operations with bounded payloads fall under the claim.

\subsection{Availability and metering}

An optimistic proof is ineffective when the provider withholds the transcript.
The complete transcript, or erasure-coded data sufficient for every challenge,
must remain available through the finality window. Issuance remains reversible
or disabled until that window closes.

Correct output does not prove the claimed work quantity. Reward calculation must
bind a metering commitment that is derived from the admitted graph and execution
policy. Wall-clock time, GPU SKU, token count, and FLOP claims cannot be accepted
solely from the provider.

\subsection{Usefulness and anti-self-dealing}

Cryptography proves execution of the specified job; protocol admission proves
that the work had an identified consumer or governed network purpose before the
result existed. Neither proves universal truth or social value. A miner-created
circular job, recycled demand fee, copied output, or colluding requester must not
turn the mining pool into an unbounded faucet. Admission caps, declared related
parties, non-recyclable budgets, work-class normalization, and per-era reward
limits are consensus-critical economics.

\subsection{TEE scope}

TEE evidence is optional and explicitly vendor-dependent. A confidential profile
must validate the complete certificate chain, TCB collateral, measurement,
freshness, revocation, model, input, output, runtime, job, and provider binding.
A quote proves provenance under that vendor trust model; it does not prove
semantic correctness and does not replace proof-policy finality.

\subsection{Replay and omnichain safety}

The global work nullifier includes the A-Chain network, policy epoch, job, and
execution commitment. A-Chain consumes it atomically with receipt finalization.
The receipt binds one destination chain and recipient. Each destination records
consumption of that exact receipt, but its local consumed set does not decide
whether work was valid.

An accepted destination payout must require a monotonically advancing,
PQ-authenticated, Quasar-finalized Z-Chain settlement commitment to the A-Chain
receipt root (or an explicitly activated native A/Z direct-finality proof) and
Merkle inclusion of the full receipt. Accepting a raw proof, TEE quote, miner
signature, or local subsidy calculation would create a second mining authority
and violate the supply cap.

\subsection{Launch security gates}

Mining remains disabled until the production system demonstrates:

\begin{itemize}[leftmargin=1.2em]
  \item byte-identical CPU/GPU commitments for a real model path;
  \item objective detection of a fabricated intermediate operation;
  \item transcript recovery and challenges under node loss;
  \item no irreversible issuance while proof status is pending;
  \item verifiable metering and anti-self-dealing admission;
  \item atomic global-nullifier consumption and reward finalization;
  \item Z-settled, PQ-authenticated receipt export and exactly-once consumption in at
        least two destination environments;
  \item enforcement of the two-trillion total cap and one-trillion mining pool
        under replay, reorganization, and bridge failure.
\end{itemize}