Jan 30, 2026

CoherenceGuard

Nadine Squires

Current AI governance relies on tracking physical infrastructure (data centers, GPU clusters, power consumption), but this approach fails against architecturally efficient "dark" systems that achieve frontier capabilities with minimal detectable footprint. CoherenceGuard solves this enforcement gap.

CoherenceGuard is a deterministic, open-source governance engine that audits AI systems at the structural level rather than the physical level, enabling enforceable international agreements even when traditional monitoring fails. It operates through three integrated layers:

1. Evidence Layer: Fixed-precision manifold mapping that generates bit-for-bit identical measurements across any hardware platform—eliminating "floating-point drift" that undermines legal defensibility.

2. Interpretation Layer: Swappable policy adapters that simultaneously benchmark systems against multiple standards (EU AI Act, G7 roadmaps, Apart Challenge protocols) using a single coherence-focused assessment.

3. Decision Layer: Automated enforcement triggers with immutable audit trails, providing the transparency required for whistleblower protections and international oversight.

This architecture operationalizes currently undefined "State-of-the-Art risk modeling" requirements, detects incremental capability gains that evade threshold-based alarms ("Boiling Frog" risk), and provides hardware-agnostic determinism for legally binding enforcement.

CoherenceGuard is fully prototyped with working code, tested on stealth architectures, and designed to provide the verification infrastructure for the 2027 binding agreement roadmap—directly advancing the challenge's goals of creating practical verification, compliance, and coordination tools for frontier AI safety.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow
Arrow
Arrow

The submission is very difficult to evaluate because the core claims are buried under dense, nonstandard jargon (e.g., "recursive geometric coherence," "paradox-preserving intelligence modeling," "entropy-aware degradation mechanics") that is not grounded in established literature. When checking the linked repositories, the technical claims are not reflected in the actual code. I'd suggest using standard terminology, grounding claims in existing work, and building a small working prototype that demonstrates one concrete capability.

I’m not in a position to evaluate the technical claims about ASIOS and CoherenceGuard, but I worry that you claim to be open sourcing very powerful capabilities which would have deleterious effects on the prospects for effective governance of frontier AI. You are relying on "International Binding Agreements" to enforce use, but your own technology (ASIOS) makes the physical detection of violators (via power/heat/compute) impossible. What prevents an actor from using ASIOS to build hidden AI on consumer hardware while simply deleting the CoherenceGuard auditing modules?

I guess that you are operating from an assumption that widely proliferated, highly capable AI systems will lead to desirable outcomes. This probably in turn rests on the idea that the dangers of misused or misaligned AI can be addressed “head on” through direct competition by others who have aligned AI and pursue widely beneficial aims, like defense. I think this is likely misguided and it relies on whether there will be methods of AI misuse which are highly offense-favored, in that their negative effects are difficult to defend against.

Cite this work

@misc {

title={

(HckPrj) CoherenceGuard

},

author={

Nadine Squires

},

date={

1/30/26

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

View All

View All

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.