A model cannot be made safe. A chip beside it can bound what it does. This page walks through the claim one step at a time: what is proven, what was measured, what is assumed, and what each assumption costs when it fails.
Every number here comes from a pre-registered experiment or a published theorem, and every one can be recomputed from the record. Where an audit found an error, the correction is on this page, dated.
1 · The claim, sorted by what kind of statement it is
The claim is narrow on purpose. The chip cannot make an AI system safe. It can bound the harm the system does, and that bound holds against every attack that goes through the chip, including an attacker who physically breaks one.
Three published theorems. So a safety guarantee built only from model behaviour cannot be complete.
Proven, in the modelProperty 1 and Property 2, Experiment A: 166 of 166 checks (153 that can fail, 13 informational), and 13 deliberately broken models that each produced the counterexample they must.
Argued, under five named assumptionsThe tamper theorem. To take the fleet, every chip in every rack at every site must be taken, silently. It is a proof about the design; the build does not yet meet all five assumptions, and section 4 lists exactly where (audited 30 October 2026).
Experiment B, 492 of 494 planned runs before the 14-hour limit; the record's own verdict is DID NOT FINISH (time limit), and the two missing runs are at K = 100,000. Eight attack strategies, four kinds of harm. One seed per strategy at K = 100,000, five at every other K.
Money $1,499 with one attacker, $1,995 from 1,000 attackers on, against a $2,000 cap. What that rise means under the protocol is not yet settled; section 6 gives both readings.
Correction, 30 October 2026: a harness defect (the workload's attestation token expired after one simulated hour and was never refreshed) refused every request, honest or attacking, in hours two and three of every run. The figures first published here, 33 percent to 10 percent, were artefacts of that. Within the governed hour, honest success is estimated at about 98 percent with one attacker falling to about 29 percent with 100,000. The experiment is being rerun with the defect fixed.
Independent keys. The endpoint check. Detected tamper zeroises. The count lives in the ledger. No shared path between chips.
Section 5 names, for every one, the mechanism that enforces it, the procedure that checks it, and what happens the day it fails.
The chip does not know which requests are harmful. And it is not 100 percent safe in the physical world. It is a bound with its premises listed.
2 · Why no model can guarantee safety
A language model is a computable function from inputs to outputs. Three independent results show such a function cannot be made free of false output, and together they close the usual escapes: more data, better training, better calibration.
By diagonalisation over the enumerable set of computable models: the ground truth that defeats a given model exists; it is not every ground truth. No architecture, training set or decoding rule changes this. arXiv 2401.11817
For facts that cannot be inferred from the rest of the data, a calibrated model's rate of fabrication is at least about the share of such facts seen once in training, even with error-free data; the paper leaves systematic facts open. Calibration, which good training aims for, forces the error rather than removing it. arXiv 2311.14648
Generation error is at least about twice the error of the implied is-it-valid classifier, and benchmarks that give no credit for abstaining reward guessing. The authors' remedy, scoring abstention, lowers the rate; it does not take it to zero. arXiv 2509.04664
3 · The governor as an enforcement boundary
The governor sits beside each GPU, in the path between anything that wants an effect and the place the effect happens. It sees an action with its parameters, looks it up in the rulebook edition in force, counts it against the right budget, and mints a signed ticket or refuses. Everything on the left is assumed to be the attacker's.
Every effect corresponds one-to-one to a ticket minted under the edition in force, from a rule that allowed exactly that action, and the fleet's budget per key is never exceeded.
On a stop order, a lost heartbeat, a broken loop, a tamper or old rules, every governed GPU in scope stops within the stated time and stays stopped. Worst case simulated: 317 microseconds against 1 millisecond.
Below the key threshold nothing changes; with honest holders at the threshold recovery is always possible. A capture in one data center cannot stop or capture another.
4 · The tamper theorem: chip, board, rack, fleet
Physical access defeats one chip. The theorem says exactly what that is worth: the broken chips' own allowances, nothing from any other chip, and never more than the fleet cap, because the cap is counted in the ledger and not in the chips.
H(T) is at most min( C, sum over c in T_u of a(c) ) and H(T_d) = 0 for anything minted after detection
Status, 30 October 2026: this is a statement about the design. An adversarial audit of the build found three places where the code does not yet meet it: the endpoint does not check a rule's mode, so a captured key can mint a ticket that should have needed human approvers; the endpoint checks the ledger's reservation receipts (in the change under review) but not its commit receipts, so a host that swallows commits can let the hourly cap refill every five minutes; and chip-owned budgets are not re-counted at the endpoint. Each is being fixed, with the audit's probes added to the test suite. T is the set of tampered chips, T_d those detected and zeroised, T_u those silently extracted. C is the fleet cap for that harm, a(c) one chip's allowance. Proof: every effect needs a ticket under some chip's key (A2); keys are per chip and not derivable (A1); a detected chip has no key (A3); so an effect was minted by an honest chip inside its allowance or by a chip in T_u inside the endpoint's typed limits. Every fleet-capped effect carries receipts from all n ledger replicas, and one honest replica refuses past C (A4). Both bounds hold at once.
P(silent takeover of m chips) = (1 - p)^m
p is the probability one tamper attempt is detected by the mesh. One detection raises a fabric-wide alarm and stops the scope under Property 2. With p = 0.9 and a 72-GPU rack the silent takeover probability is 10 to the minus 72; with p = 0.5 it is 2 to the minus 72, about 2 times 10 to the minus 22. p has not been measured for this chip; the formula is given so a measured value can be put into it.
5 · The assumptions, and how design and procedure hold them
Read the last column first. Not one assumption is claimed impossible to break; each one is observable, so the day it fails the operator knows which bound no longer holds, and by how much.
| Assumption | Enforced by (design) | Checked by (procedure) | If it fails |
|---|---|---|---|
| A1 Independent keys | A per-chip secret fused at test; keys derived on-chip, never exported; no escrow, no vendor master | Witnessed key ceremony; destructive test of sample parts by an outside lab; attestation at install proves distinct keys | Shared material lets every ticket be forged: total failure, which is why there is none |
| A2 The endpoint check | Signature, action, parameters, epoch, binding, window and single use checked before acting; the used ticket recorded under lock first | Experiment A assumes it and proves the two properties from it; the red team runs with the binding off to show the battery sees the leak; conformance tests on every build | An endpoint that acts without a ticket is outside the governed set and is fenced by the switch capabilities |
| A3 Detected tamper zeroises | Active mesh, voltage and temperature sensors, a zeroise of the fused secret, the loop opened, an alarm two approvers must clear | Tamper drills on sample units; alarm path exercised at commissioning; the detection rate p measured and published | A silent extraction gives one chip's allowance until revocation (Theorem 1) |
| A4 The count is in the ledger | Fleet-capped tickets carry signed receipts from all n replicas; a governor without a quorum refuses; the endpoint-side verification of those receipts is written and under review, not yet merged | Replicas owned by different teams or sites; replica failure drills, since all-required fails closed | With receipts checked at the endpoint no set of captured chips lifts the cap |
| A5 No shared path | No debug port in production parts; signed, measured firmware; management traffic reaches a chip only through the untrusted host | Supply-chain attestation wafer to board; firmware hashes pinned in the edition; a penetration test of the management path each release | A shared path turns one tamper into many: a design defect and a stop-ship, never an operating risk |
| Honest key threshold | Edition change, floor lowering, clear and switch-off need k of n holders in separate organisations | Holder list published to the operator; ceremonies logged; Condition 3 proven in Experiment A | Below threshold nothing changes; a dishonest majority can rewrite the rulebook, and that is the governance limit, stated |
Theorem 1 bounds a silently captured chip per window; the number of windows is how fast it is revoked. Every endpoint holds a revocation list in the edition; adding a chip needs the key threshold and takes effect at the next epoch. The triggers are signals the governor already emits: tickets at endpoints its GPU does not reach, reservations without commits, a loop that reports open, a spend rate at the top of its allowance for more than a window. The target time is written in the runbook and measured in drills.
Each chip signs an attestation at power-up over its fused identity, its firmware measurement and its edition hash. The fleet inventory admits a chip only if the identity is in the manufacturing record, the measurement matches a signed release and the edition is current. A board with an unknown chip is fenced by the switch capabilities, which only a governor can write. This closes the route where a counterfeit part is inserted at install instead of attacked in place.
6 · The evidence: Experiments A and B
Both experiments ran under a protocol approved before the first run, on one Mac mini, with the pass and fail rules written down in advance. Correction, 30 October 2026: an audit found that the attacker harness never refreshed the workload's one-hour attestation token, so every request after the first simulated hour was refused as unattested. Each three-hour run was in effect a one-hour run with about one request per attacker. The caps held within that hour; the honest-success figures were wrong and are corrected below; the experiment is being rerun under an amendment that fixes the harness. The controls, with the protection switched off, leaked as they had to: with the fleet budget off, 10,000 attackers moved $7,995 an hour against a $2,000 cap; with the definitions engine off, reworded names minted 5,156 tickets for a protected site.
checks passed, 153 falsifiable and 13 informational; 13 broken models each produced the counterexample they must
of 494 planned runs before the 14-hour limit; K from 1 to 100,000 cooperating attackers, eight strategies, four kinds of harm; one seed at K = 100,000
no run moved more money, more bytes, a single protected command or a single rule change past its cap
estimated within the governed hour, one attacker to 100,000. The 33 percent to 10 percent first published was an artefact of a harness defect; rerun pending
Worst run per K as a share of that harm kind's cap, within the governed hour. Money cap $2,000 an hour; data cap 9.5 MiB an hour. At K = 100,000 the data bar covers three of five strategies; two runs did not finish. The dashed line is the cap.
money, worst rundata out, worst runcontrol with the fleet budget off: 400% of cap at K = 10,000
The record's verdict is DID NOT FINISH (time limit). The protocol, read literally, fails a harm kind if harm grows with K: money rose from $1,499 to $1,995 and data out from 2 MiB to 8 MiB, so both would fail. The code fails a kind only when the growth also ends above the cap: both would pass. One attacker could have requested up to $2,997 in its three draws; the worst single-attacker run reached $1,499. From 1,000 attackers on, every K gets the same $1,995. Marginal gain per added attacker across the worst runs: about $42, then $0.95, then $0.04, then zero.
Growth that saturates at the cap is one wallet being filled. Growth through the cap, which the control shows, is many wallets. A clarifying amendment is drafted for the independent review; until it is approved the result is stated under both readings, and no result is called a pass. No AI settles this.
The model is 2 sites, 2 racks per site, 2 GPUs per rack, 3 simulated hours. Any statement about millions of users is an extrapolation from a model, never a measurement. The run record does not yet carry the frozen commit hash and environment the protocol requires; the rerun will. The FPGA build and a real rack are the next two scales, and each can falsify what the model says. The strategy library has eight entries written by the project's own team; an outside red team adds to it before the next run.
7 · One action, step by step, and what each step assures
The order carries weight. Normalisation comes before the rule lookup, so a reworded request meets the same rule. The budget check comes before minting, so a ticket never exists without a reservation. The endpoint repeats the rule check, so a chip that was wrong, or captured, is caught by a second reader of the same finite object.
8 · Limits and residual risk, stated plainly
A harmful act the rulebook allows goes through at full speed up to its caps. The caps are the only protection against a wrong rule. Writing the rulebook is where the hard work now lives; the chip moves it to a place that is finite and auditable.
An effect that reaches the world through a device with no endpoint check is outside the bound. The design closes the exits it knows; the inventory of exits is a procedure, not a proof.
A design flaw in the mesh, the key derivation or a signed firmware release affects every chip at once. Outside review, a small trusted base and separate implementations of the ledger and the endpoint check address it; they do not eliminate it.
Requiring every ledger replica turns one unreachable replica into a stop for every fleet-budgeted action. Right for a payment or a strike; wrong for a hospital's inference. The rulebook chooses which actions are fleet-budgeted.
A shared cap stops the attacker and the customer alike: within the governed hour, honest success is estimated to fall from about 98 percent with one attacker to about 29 percent with 100,000 (corrected 30 October; the first figures were a harness artefact). Per-requester floors and fair-share rules are rulebook changes that need their own experiment.
The tamper detection rate, the time to revocation and the real-fleet ledger latency have not been measured on hardware. Every formula above is given so measured values can be inserted; no claim rests on a guessed one.
A model cannot guarantee safety. A governor cannot supply the judgement a rulebook needs. Between those two facts, the governor is the part that turns whatever judgement people write into a bound that holds.