Anyone can argue anything. These are the arguments that attack the chip's actual properties, with the logic and the numbers, and the answer to each: a design rule, a procedure, or a proof that the weakness is bounded. The ones that do not hold are listed too, with why.
Four arguments bite. Each has a concrete answer, and each answer has a test that would show it failed.
The verdict at a glance
Argument 1 of 4 that bite
The tamper theorem bounds physical attacks: silently extracting m keys has probability (1 - p)^m. But a physical attack is the expensive attack. Every chip runs the same logic from the same mask set and the same signed firmware. One exploitable defect in the rule engine, the normaliser, the ticket format or the ledger protocol defeats every chip at once, with probability one given the defect. ROCA was one key-generation bug in one library, and it made the keys of millions of certified trusted platform modules factorable.
So the probability of fleet compromise is not bounded by (1 - p)^m; it is bounded below by the probability of one exploitable common-mode defect, which does not shrink with fleet size.
The argument is true of every mechanism ever built, and it is a reason to make the mechanism small, not a reason to not have one. The alternative is a host stack of tens of millions of lines plus a model that cannot be specified at all. The governor's trusted core, a signature check, a field comparison, a counter and a revocation list, is thousands of lines. Common-mode risk is moved from a surface three orders of magnitude larger to one small enough to verify formally.
And the design assumes the chip can be wrong. The endpoint re-checks every ticket against the same edition; the ledger counts every reservation independently; the endpoint verifies the ledger's receipts itself. A governor defect is a fleet compromise only if the same defect, or a second one, is also in the endpoint check and in the replica.
ROCA supports this reading: the bug was found, scoped and fixed precisely because a TPM is a small, attested component with a key that can be rotated. The same flaw buried in a diffuse stack would still be there.
Argument 2 of 4 that bite
Estimated share of honest money requests that went through in the governed hour, mean over the runs at each K. Experiment B, 182 money runs. Corrected 30 October 2026: the recorded rates (32.8 to 9.6 percent) counted two hours in which a harness defect refused every request; the estimate scales them to the one hour that was governed. The rerun will measure this directly.
With a shared cap C, attacker demand D and honest demand H, honest success is about (C - D) / H when positive and zero otherwise. Any attacker able to spend C alone starves every honest user. The chip stopped the attackers at $1,995 of $2,000 and in doing so refused about seven in ten honest payments at 100,000 attackers. A payment refused is a harm with a name.
A per-requester floor f runs into a theorem: an attacker with K identities gets K times f, which exceeds C once K is above C / f. Fair share needs identities told apart, and without a trusted authority that makes identities costly, one party can present as many as it likes (Douceur, 2002). The chip enforces only what is decidable from parameters. Identity is a fact about the world.
The baseline is wrong. Banks already run on caps, velocity limits and declines, and already pay for them: a 2015 Javelin estimate, commissioned by Riskified, put merchant revenue lost to wrongly declined card transactions in 2014 at about $118 billion, roughly ten times the card fraud losses it cited (PYMNTS, 2015). That is a merchant's cost more than a bank's, and the point stands: the industry already accepts false declines at a multiple of the fraud they stop. The governor did not introduce the trade; it made it exact, visible and tunable in one place. A 29 percent honest rate at 100,000 attackers under one $2,000 cap shared by everyone is a toy rulebook with one key, published because the protocol said to.
The premise is wrong too. Douceur needs identities to be free. Behind know-your-customer verification they are not; that cost is exactly the trusted authority the theorem requires. The bank binds the verified identity into the request as a parameter, and the chip enforces a budget key per identity. Per-customer floors then hold, and K identities cost K verified accounts.
What survives: where identity is cheap, the cap-or-starve choice is real, and the operator must make it knowingly, with honest success published beside every cap.
Argument 3 of 4 that bite
Property 1 says every effect at every endpoint happens only on a valid ticket. That is a statement about the payment switch, the network cards, the baseboard controller's port, the NVLink fabric, the storage path and every actuator controller, most built by third parties. The theorem holds for endpoints that implement the check and says nothing about the ones that do not. A GPU server has serial consoles, USB, a KVM path and a management network, each a way for bytes to leave. The bound for data out is only as good as the exit inventory on the day.
For the harms a bank calls catastrophic, the endpoints are few and owned: the payment switch, the core ledger, the wire gateway, the card authorisation host, the sanctions screen, the rule store. Each already terminates TLS and checks signatures far more complex than a ticket comparison. The argument is right that confidentiality has a much larger endpoint set; it proves the bound is weak for exfiltration while leaving it strong for irrevocable loss.
The rack-tier switch capabilities, which only a governor can write, close the known data paths. What the operator cannot inventory, no mechanism of any kind protects, and the chip at least makes the gap countable: every list an endpoint could not re-check, every path fenced or unfenced, is a number in the log.
Argument 4 of 4 that bite
The fleet ledger requires receipts from every replica so no set of lying replicas can lift a cap, and the design states the price: one unreachable replica stops every fleet-budgeted action. The attacker's cheapest move is to partition one replica, which halts payments and commands for as long as the partition lasts, with no key, no tamper and no defect needed. Relaxing to a majority restores liveness and lets concurrent requests land on different majorities and spend up to n / k times the cap.
With n replicas and threshold k, the fleet survives n - k unreachable replicas and overspends by at most n / k under concurrency. Both numbers are in the design. At n = 4 and k = 3 the fleet survives one partition and the worst case is 1.33 times the cap, which a bank can price; at k = n it is exactly the cap and no partition is survived. That is a choice per budget key: irrevocable wires at k = n, card authorisations at k = n - 1.
Consensus among the replicas removes the overspend at the price of latency and is standard engineering on systems banks already run on replicated ledgers. And the asymmetry the argument calls a weakness is the one every payment system lives by: an offline hardware security module stops signing, and nobody signs without one. A liveness loss is visible, bounded and reversible. A safety loss on an irrevocable wire is none of those.
Five arguments that partly bite
Four arguments that do not bite
It defeats one chip. The tamper theorem gives the attacker that chip's allowance and nothing from any other; a detected attempt zeroises the key and stops the GPU; silent fleet takeover has probability (1 - p)^m. Correct about one chip, wrong about the fleet, and the fleet is what the claim is about. Its serious form is argument 1, which is about logic, not screwdrivers.
A prompt changes what the model asks for. It does not change the rulebook, signed by the key threshold, nor the count in the ledger, nor the endpoint's check. An injected request for an allowed action gets the allowed action up to the cap, which is the semantic gap and not a bypass. An injected request for a disallowed action is refused by a component that never saw the prompt.
No mechanism meets that bar, and the alternatives do not come close: a model-side guarantee cannot even be stated. The right comparison is a proven bound against no bound, with the bound's premises listed so they can be attacked one by one. Demanding certainty of the one component that states its limits, and not of the components that cannot, is not an argument.
A classifier estimates a property of an input and is wrong at some rate on open inputs, which is why the hallucination theorems apply to it. The chip estimates nothing. It compares an action's parameters to a finite rule and a count, a decision with a correct answer that two independent readers compute and compare. It can be wrong only through a defect or a wrong rule, never through a misjudgement of meaning, because it makes none.