mirror of
https://github.com/hanzoai/papers.git
synced 2026-10-22 17:20:17 +00:00
zeekayandHanzo Dev
23fbeb46b6
An outside operator sells inference on hardware we do not own. Two properties have to hold before we pay for it automatically: the prompt stays confidential on a machine its owner controls, and the operator cannot bill for a model it did not run. Confidential computing answers the first directly and the second only by implication, and the paper keeps those apart. It specifies the flow (measured image, launch, attestation-gated key release from KMS, sealed session), the field checklist a verifier must actually run for SEV-SNP, TDX and a GPU in confidential mode, and the settlement receipt that binds the model commitment, the decoding regime and the input to the output -- adding the tokenizer digest, the sampling seed and the raw-input digest that HIP-0901's binding does not cover, so an auditor can replay a request exactly rather than testing it statistically. Then it says where this stops. A measurement is a hash of bytes, not a proof about what those bytes do; a model commitment is membership, not use. "The advertised model produced this output" is inherited from five named assumptions, and the receipt has no evidentiary value if any of them fails -- which is different from the one cryptographic statement available, the Freivalds check over an exact integer accumulator. Every guarantee is classified cryptographic, hardware-trust, economic or open, and execution integrity on the floating-point path is open. Grounded in the tree rather than in intent: the privacy-tier crates verify with mocks that return success; hanzo-attest declares snp/tdx and refuses them by name, which is where the real verifier belongs; the on-chain evidence backends are fail-closed with an empty voucher set; and the attestation verifier they depend on signs a 48-byte Lux header with no report-data field, so the binding those contracts document cannot yet be checked. One vendor root is embedded, Intel's. The reachable bench host exposes no CPU TEE, so nothing here is measured on confidential hardware and the paper says so. Co-authored-by: Hanzo Dev <[email protected]>
Hanzo AI Research Papers
Technical papers covering Hanzo AI compute infrastructure, agent frameworks, ML inference, platform services, and defense applications. Includes the Zen model family co-developed with Zoo Labs Foundation.
About
Hanzo AI is an American-owned, Techstars-backed ('17) applied AI lab, founded 2014, building the Zen frontier model family alongside a vertically integrated, post-quantum AI and cryptography stack. The work spans frontier models, an agentic runtime, edge inference, and production post-quantum cryptography — engineered to run sovereign and disconnected in defense, regulated, and air-gapped environments rather than on centralized cloud. The platform these papers document is generally available at hanzo.ai.
2026 Highlights
Each claim below is developed in the catalogued papers (INDEX.md):
- Defense & Reindustrialization suite (16 papers + one-pager). Positioned for the
American industrial base — sovereign AI, robotics, post-quantum, and low-latency
on-chain coordination for factories, vehicles, drones, ships, and contested-edge
systems. Strategy & case studies: sovereign-vs-closed AI (
hanzo-vs-claude), the ~90% cloud-cost migration on real numbers (hanzo-cloud-economics), agentic engineering at regulated scale (hanzo-agentic-prowess), FHE-native confidential computing (hanzo-fhe-native), automated security auditing (hanzo-security), and audit-ready compliance (hanzo-compliance). Capability depth: autonomous agentic AI (hanzo-agentic-ai), DDIL/tactical assured networking (hanzo-assured-networking), FHE-mediated cross-domain MLS (hanzo-cross-domain), edge AI/ML (hanzo-edge-ai-ml), counter-exploitation (hanzo-countermeasures), full-spectrum cyber (hanzo-full-spectrum-cyber), quantum sensing/QKD (hanzo-quantum-sensing-qkd), verification & validation (hanzo-test-evaluation), and the ZAP protocol (hanzo-zap-protocol). Start with the one-pager (defense/hanzo-overview.pdf); the full suite is published at papers.hanzo.ai. - Engine / AI infrastructure (6 papers, measured on-device). A native Rust
train-and-serve engine benchmarked on real silicon: ROCm decode parity with llama.cpp
at 97% of the memory-bandwidth wall (
hanzo-rocm-inference), measured AMD/NVIDIA/Apple edge inference (hanzo-cross-backend-inference), native training inside the inference stack (hanzo-native-training), continuously-learning private AI (hanzo-continuous-learning-privacy), serving economics (hanzo-platform-infra-desktop), and the unifying thesis (hanzo-native-stack-thesis). Unusually honest — they name their own stubs and reverted kernels and claim no win over NVIDIA. - Unified sovereign-tenant cloud (measured). The whole multi-tenant cloud as one Go
binary — 56 in-process subsystems over shared-nothing storage, each tenant its own
post-quantum-encrypted SQLite file. Measured on the production open path: ≈0.25 MB RAM
per actively-served tenant, near-zero idle — memory scales with concurrency, not
registrations, so one billion registered tenants at 1% peak concurrency fits ≈20
commodity 128 GB nodes (
hanzo-unified-tenant-cloud; architecture companioncloud-unified-binary). - Production post-quantum cryptography. All three NIST PQC standards — FIPS 203
(ML-KEM), 204 (ML-DSA), 205 (SLH-DSA) — integrated into a live consensus system with
hybrid classical/post-quantum security (
hanzo-full-spectrum-cyber). - Formal verification. 50 machine-checked Lean 4 proofs, 18 cryptographic security
reductions (incl. ML-DSA EU-CMA, ML-KEM IND-CCA2), and NIST Known-Answer-Test
validation across FIPS 203/204/205 (
hanzo-formal-verification). - ZAP (Zero-copy Application Protocol). 2.2 ns parse latency, 11.5M transactions/s,
91% memory and 96% energy reduction vs JSON-RPC; native post-quantum transport
(ML-KEM-768 + ML-DSA-65) and W3C DID identity (
hanzo-zap-protocol). - Agentic runtime. 83 specialized agents and 15 orchestrators executing 200–300
sequential tool calls, fully offline on embedded ARM with quantized Zen models
(
hanzo-agentic-ai,hanzo-edge-ai-ml). - Zen frontier models. An 18-model family (0.8B–1T+ parameters), co-developed with Zoo Labs Foundation, with owned weights and full provenance.
Structure
Each paper lives in its own subdirectory:
papers/
├── shared/ # cover styles, lstlang.tex, paperkit
│ ├── hanzocover.sty
│ └── lstlang.tex
├── <paper-slug>/
│ ├── <paper-slug>.tex # main file (\input's sections)
│ ├── <paper-slug>.pdf # compiled output
│ └── sections/ # modular sections
│ ├── 01-intro.tex
│ ├── 02-architecture.tex
│ ├── 03-protocol.tex
│ ├── ...
│ └── 99-bibliography.tex
└── INDEX.md # auto-generated catalogue
Building
cd <paper-slug>
TEXINPUTS=".:..:" latexmk -pdf <paper-slug>.tex
Or build all — every paper, and a nonzero status naming any that did not compile:
make -k all
Index
See INDEX.md for full catalogue of papers.
Conventions
- One paper, one directory. No top-level .tex files.
- Modular sections. Main .tex \input's
sections/NN-name.texfiles for easy editing. - Shared cover. All papers use
\usepackage{shared/hanzocover}and\hanzocoverpage. - Shared lstlang. All papers use
\input{shared/lstlang}after\usepackage{listings}. - No AI slop. Technical, dense, citation-supported.
- One paper per concept. Updates over time via versioning, not duplication.