Apr 26, 2026

Fragment Assembly Risk Scorer (FARS): Empirical Characterization of Split-Order Detection Boundaries for Benchtop DNA Synthesizers

Hritika Chaturvedi

Benchtop DNA synthesizers have no mandatory screening today — and existing tools have a structural blind spot: they evaluate DNA fragments individually, missing split-order attacks where multiple innocuous-looking fragments assemble into a sequence of concern. We present the Fragment Assembly Risk Scorer (FARS), a prototype on-device detector that scores orders by collective assembly potential rather than individual fragment identity. Tested against 960 simulated orders across three real 1918 H1N1 genomic segments from NCBI GenBank, FARS achieves 100% detection of high- and medium-coverage split orders with zero false positives. Most importantly, on partial split orders, FARS detects 80% compared to 40% for an individual-sequence baseline modeled on IBBIS commec's methodology, doubling detection while eliminating false positives entirely. The 20% that evade local detection define a precise empirical boundary motivating shared cross-device infrastructure. Our head-to-head comparison is the first

empirical quantification of what assembly-awareness buys in split-order detection on real genomic data — and directly characterizes the gap left by S.3741's mandated screening approach.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

I liked the well-defined scope and clear result of this submission. While a discussion of the limitations is present, I would have appreciated a more in-depth discussion on the implications of these. For example, the limitation of AI-enabled design is flagged but not really grappled with. For example, the results section could have discussed what the detection boundary would look like against codon-optimized or AI-designed sequences.

Additionally, while a great technical paper, the submission could have benefited from a summary in simple terms so that educated people in the field with no specific knowledge of synthesis screening could better grasp the problem and the corresponding solution.

Cite this work

@misc {

title={

(HckPrj) Fragment Assembly Risk Scorer (FARS): Empirical Characterization of Split-Order Detection Boundaries for Benchtop DNA Synthesizers

},

author={

Hritika Chaturvedi

},

date={

4/26/26

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.