papers/morpheus/onepagers/lp-319-confidential-routing.tex

\documentclass[10pt,a4paper]{article}
\usepackage{../shared/proposal}
\usepackage[utf8]{inputenc}\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb}\usepackage{listings}\usepackage{xcolor}
\input{../shared/lstlang}

\newcommand{\code}[1]{\texttt{\small #1}}

\begin{document}

\proposalhead{Learning From Traffic You Cannot Read}%
{A router improves by observing outcomes; a confidential market forbids observing content. They
reconcile if the extractor runs where the prompt already is, and if you say plainly what its
output still reveals.}%
{LP-319}

Enso picks a model per request in microseconds on CPU and improves because it observes what
happened after the pick. LP-312 closes the prompt inside a post-quantum session and LP-313
closes the inference inside an enclave, so the learner and the confidentiality argument want
opposite things from the same bytes.

\section*{Mechanism}

A ledger row is $(\phi, m, r, c, \ell)$: a bucketed feature vector $\phi \in \mathbb{R}^{d}$,
model id, scalar quality score, cost, latency, driving a policy matrix $W$ toward
$r - \lambda c - \mu \ell$. No prompt text, no completion text, no embedding, in any field. The
score comes from a judge model inside the same enclave that terminated the session: it reads
plaintext and emits one number. Consumer feedback, accept or retry or discard, is content-free
by construction and is the stronger signal. Updates ship $\Delta W$ aggregated over a minimum
batch, a statement about traffic rather than about one request.

Extraction has to happen inside that boundary or the property never existed: compute $\phi$
outside and the prompt has already left. The extractor is therefore part of the attested
workload and the ledger's only writer, pinned in the golden set the verifier fetches today.
Morpheus has the machinery: 5{,}439 lines under
\code{proxy-router/internal/attestation}, \code{report\_data} checked against SHA-256 of the
peer's SubjectPublicKeyInfo DER (\code{verifier.go:292}), golden values from a cosign
attestation pinned to an OIDC identity (\code{golden.go:25}).

\vspace{0.4ex}
\noindent\textbf{What a feature vector still says.} Content-free is not leak-free, and features
derived from a prompt are not nothing.

\begin{itemize}
\item $\phi$ carries task class, language, length bucket, difficulty estimate, tool markers.
Someone holding the ledger recovers a profile: three short legal questions and a long code
generation at 04:00, and that is the price.
\item Membership inference is the sharp risk and it scales with $d$. A 1024-dimensional
embedding row fingerprints its prompt; 32 coarse buckets do not. Fix $d$ small, quantise every
field, bar embeddings at the schema level, and publish how many prompts collide on one row.
\item Inversion against $W$ recovers the feature regions where reward ran high, summed over
traffic. It stops being aggregate the moment a row of $W$ is fit to one account, so per-tenant
policies stay in the enclave, gradients are clipped, and no $\Delta W$ ships below the batch
floor.
\item We do not claim differential privacy. An honest claim names a mechanism, a noise scale
and an accountant, and a ledger living for years exhausts any fixed $\varepsilon$. DP on the
update is a separate docket with a budget, not a word borrowed here.
\end{itemize}

Under LP-312's threat model the ledger is the long-lived half, so harvest-now applies to
storage as much as to the wire: rows sealed under ML-KEM, signed under ML-DSA, keyed by a rotating session pseudonym
and never by a consumer address. A vector written today is an artifact an adversary keeps.

\begin{stake}{What Morpheus gets}
\item Routing that improves on live traffic without reopening what LP-312 and LP-313 close, and
provider selection on measured quality rather than price ordering alone.
\item Content-freeness as an auditable property: a published field list and an attested writer,
checkable by anyone who can already verify a quote.
\end{stake}

\begin{stake}{What Hanzo and Lux get}
\item Traffic diversity a single endpoint does not produce, on a market pricing
\code{Bid.pricePerSecond} rather than tokens.
\item Adversarial review from engineers who run a bounty with a mandatory proof of concept.
\end{stake}

\vspace{0.4ex}
\noindent\textbf{First step.} Hanzo publishes the schema with $d$ fixed and the extractor as a
reproducible build, then submits its measurement for pinning in the golden set the verifier
already trusts. One Morpheus core contributor reviews the field list and points a single
registered \code{modelId} at it. A schema review and one bid.

\vspace{0.35ex}
\noindent\textbf{What this does not solve.} Nothing here proves the advertised model served the
request, and a content-free ledger written by an unattested extractor is worth nothing at all.
That gap has been open since HideNSeek's last commit on 2024-07-29, and it is LP-313's problem.

\vspace{0.4ex}
\noindent{\color{muted}\footnotesize\sffamily LP-319, full paper available. Citations checked
against the tree. \quad\textbullet\quad \texttt{[email protected]}}

\end{document}