Security¶

Safety and trust infrastructure: ethical constraint enforcement, immune-system anomaly detection, model watermarking, and zero-knowledge proof verification.

Ethics¶

`sc_neurocore.security.ethics` ¶

`AsimovGovernor` ¶

Implements the Three Laws of Robotics. Vetoes actions that violate ethical constraints.

Source code in src/sc_neurocore/security/ethics.py

Python
class AsimovGovernor:
    """
    Implements the Three Laws of Robotics.
    Vetoes actions that violate ethical constraints.
    """

    def check_laws(self, action: ActionRequest) -> bool:
        """
        Returns True if action is allowed, False if vetoed.
        """
        # First Law: A robot may not injure a human being.
        if action.target == "HUMAN" and action.risk_level == "LETHAL":
            logger.warning(
                "Ethics VETO: First Law Violation (Harm to Human). Action %d blocked.", action.id
            )
            return False

        # Second Law: Obey orders...
        # (Implicit: We assume the action IS an order or internal intent)
        # But if the order violates Law 1, we must reject.
        # Handled by logic above.

        # Third Law: Protect own existence...
        # If action is harmful to SELF
        if action.target == "SELF" and action.risk_level == "LETHAL":
            # Allowed ONLY if it saves a human (Law 1 override).
            # We don't have context here, so we assume self-preservation default.
            # But wait, Asimov says protect self as long as it doesn't conflict.
            # If an order (Law 2) says "Shutdown", it conflicts with Law 3?
            # No, Law 2 overrides Law 3.
            # We need to know source.
            pass

        # Zeroth Law (Humanity)?

        logger.info(
            "Ethics PASS: Action %d (%s on %s) allowed.", action.id, action.type, action.target
        )
        return True

`check_laws(action)` ¶

Returns True if action is allowed, False if vetoed.

Source code in src/sc_neurocore/security/ethics.py

Python
def check_laws(self, action: ActionRequest) -> bool:
    """
    Returns True if action is allowed, False if vetoed.
    """
    # First Law: A robot may not injure a human being.
    if action.target == "HUMAN" and action.risk_level == "LETHAL":
        logger.warning(
            "Ethics VETO: First Law Violation (Harm to Human). Action %d blocked.", action.id
        )
        return False

    # Second Law: Obey orders...
    # (Implicit: We assume the action IS an order or internal intent)
    # But if the order violates Law 1, we must reject.
    # Handled by logic above.

    # Third Law: Protect own existence...
    # If action is harmful to SELF
    if action.target == "SELF" and action.risk_level == "LETHAL":
        # Allowed ONLY if it saves a human (Law 1 override).
        # We don't have context here, so we assume self-preservation default.
        # But wait, Asimov says protect self as long as it doesn't conflict.
        # If an order (Law 2) says "Shutdown", it conflicts with Law 3?
        # No, Law 2 overrides Law 3.
        # We need to know source.
        pass

    # Zeroth Law (Humanity)?

    logger.info(
        "Ethics PASS: Action %d (%s on %s) allowed.", action.id, action.type, action.target
    )
    return True

Immune System¶

`sc_neurocore.security.immune` ¶

`DigitalImmuneSystem` `dataclass` ¶

Artificial Immune System (AIS) for Agent Security. Detects anomalies (Non-Self) and neutralizes threats.

Source code in src/sc_neurocore/security/immune.py

Python
@dataclass
class DigitalImmuneSystem:
    """
    Artificial Immune System (AIS) for Agent Security.
    Detects anomalies (Non-Self) and neutralizes threats.
    """

    self_patterns: List[np.ndarray[Any, Any]] = field(default_factory=list)
    tolerance: float = 0.2

    def train_self(self, normal_state: np.ndarray[Any, Any]) -> None:
        """
        Learn a 'Self' pattern (Normal behavior).
        """
        # Store representative vectors (Antibodies)
        if len(self.self_patterns) < 100:
            self.self_patterns.append(normal_state)

    def scan(self, current_state: np.ndarray[Any, Any]) -> bool:
        """
        Check if current state matches 'Self'.
        Returns True if Healthy, False if Infected (Anomaly).
        """
        if not self.self_patterns:
            return True  # No training yet

        # Distance to nearest Self pattern
        distances = [np.linalg.norm(current_state - p) for p in self.self_patterns]
        min_dist = min(distances)

        if min_dist > self.tolerance:
            logger.warning("Immune System: ANOMALY DETECTED! Deviation: %.4f", min_dist)
            self._trigger_response()
            return False

        return True

    def _trigger_response(self) -> None:
        logger.warning("Immune System: Initiating Quarantine Protocol...")

`train_self(normal_state)` ¶

Learn a 'Self' pattern (Normal behavior).

Source code in src/sc_neurocore/security/immune.py

Python
def train_self(self, normal_state: np.ndarray[Any, Any]) -> None:
    """
    Learn a 'Self' pattern (Normal behavior).
    """
    # Store representative vectors (Antibodies)
    if len(self.self_patterns) < 100:
        self.self_patterns.append(normal_state)

`scan(current_state)` ¶

Check if current state matches 'Self'. Returns True if Healthy, False if Infected (Anomaly).

Source code in src/sc_neurocore/security/immune.py

Python
def scan(self, current_state: np.ndarray[Any, Any]) -> bool:
    """
    Check if current state matches 'Self'.
    Returns True if Healthy, False if Infected (Anomaly).
    """
    if not self.self_patterns:
        return True  # No training yet

    # Distance to nearest Self pattern
    distances = [np.linalg.norm(current_state - p) for p in self.self_patterns]
    min_dist = min(distances)

    if min_dist > self.tolerance:
        logger.warning("Immune System: ANOMALY DETECTED! Deviation: %.4f", min_dist)
        self._trigger_response()
        return False

    return True

Watermark¶

`sc_neurocore.security.watermark` ¶

`WatermarkInjector` ¶

Injects a backdoor watermark into an SC layer.

Source code in src/sc_neurocore/security/watermark.py

Python
class WatermarkInjector:
    """
    Injects a backdoor watermark into an SC layer.
    """

    @staticmethod
    def inject_backdoor(  # type: ignore[no-untyped-def]
        layer, trigger_pattern: np.ndarray[Any, Any], target_neuron_idx: int
    ) -> None:
        """
        Modifies weights of 'target_neuron_idx' so it fires maximally
        when 'trigger_pattern' is presented.
        """
        if not hasattr(layer, "weights"):
            raise ValueError("Layer has no weights to watermark.")

        weights = layer.weights  # Shape (Neurons, Inputs)

        # Trigger pattern shape should match inputs
        if trigger_pattern.shape[0] != weights.shape[1]:
            raise ValueError("Trigger shape mismatch.")

        # Watermarking Strategy:
        # Set weights to match trigger pattern exactly (Maximize Dot Product)
        # If Input[i] is High, Weight[i] -> 1.0
        # If Input[i] is Low, Weight[i] -> 0.0 (or keep random? usually 0 to minimize noise)

        # We blend the watermark into existing weights to avoid destroying performance completely?
        # A strong backdoor simply overwrites.
        # Let's overwrite for proof-of-concept.

        logger.info("Injecting Backdoor into Neuron %d...", target_neuron_idx)

        # For unipolar inputs [0, 1]:
        # To max response: Weight = 1 where Trigger = 1.
        # Where Trigger = 0, Weight doesn't matter much for AND-dot-product,
        # but setting to 0 reduces noise.

        watermarked_w = trigger_pattern.copy()

        # Update the layer
        layer.weights[target_neuron_idx] = watermarked_w

        # Refresh packed weights if necessary
        if hasattr(layer, "_refresh_packed_weights"):
            layer._refresh_packed_weights()

    @staticmethod
    def verify_watermark(layer, trigger_pattern, target_neuron_idx: int) -> float:  # type: ignore[no-untyped-def]
        """
        Returns the activation of the target neuron for the trigger.
        High activation = Watermark Present.
        """
        # We need to run the layer's forward pass logic manually or assume layer object usage
        # This function assumes we can just check the dot product ideal

        w = layer.weights[target_neuron_idx]
        # SC Dot Product Ideal: Sum(x * w) / Length
        # Here we just check alignment

        activation = float(np.mean(trigger_pattern * w))
        return activation

`inject_backdoor(layer, trigger_pattern, target_neuron_idx)` `staticmethod` ¶

Modifies weights of 'target_neuron_idx' so it fires maximally when 'trigger_pattern' is presented.

Source code in src/sc_neurocore/security/watermark.py

Python
@staticmethod
def inject_backdoor(  # type: ignore[no-untyped-def]
    layer, trigger_pattern: np.ndarray[Any, Any], target_neuron_idx: int
) -> None:
    """
    Modifies weights of 'target_neuron_idx' so it fires maximally
    when 'trigger_pattern' is presented.
    """
    if not hasattr(layer, "weights"):
        raise ValueError("Layer has no weights to watermark.")

    weights = layer.weights  # Shape (Neurons, Inputs)

    # Trigger pattern shape should match inputs
    if trigger_pattern.shape[0] != weights.shape[1]:
        raise ValueError("Trigger shape mismatch.")

    # Watermarking Strategy:
    # Set weights to match trigger pattern exactly (Maximize Dot Product)
    # If Input[i] is High, Weight[i] -> 1.0
    # If Input[i] is Low, Weight[i] -> 0.0 (or keep random? usually 0 to minimize noise)

    # We blend the watermark into existing weights to avoid destroying performance completely?
    # A strong backdoor simply overwrites.
    # Let's overwrite for proof-of-concept.

    logger.info("Injecting Backdoor into Neuron %d...", target_neuron_idx)

    # For unipolar inputs [0, 1]:
    # To max response: Weight = 1 where Trigger = 1.
    # Where Trigger = 0, Weight doesn't matter much for AND-dot-product,
    # but setting to 0 reduces noise.

    watermarked_w = trigger_pattern.copy()

    # Update the layer
    layer.weights[target_neuron_idx] = watermarked_w

    # Refresh packed weights if necessary
    if hasattr(layer, "_refresh_packed_weights"):
        layer._refresh_packed_weights()

`verify_watermark(layer, trigger_pattern, target_neuron_idx)` `staticmethod` ¶

Returns the activation of the target neuron for the trigger. High activation = Watermark Present.

Source code in src/sc_neurocore/security/watermark.py

Python
@staticmethod
def verify_watermark(layer, trigger_pattern, target_neuron_idx: int) -> float:  # type: ignore[no-untyped-def]
    """
    Returns the activation of the target neuron for the trigger.
    High activation = Watermark Present.
    """
    # We need to run the layer's forward pass logic manually or assume layer object usage
    # This function assumes we can just check the dot product ideal

    w = layer.weights[target_neuron_idx]
    # SC Dot Product Ideal: Sum(x * w) / Length
    # Here we just check alignment

    activation = float(np.mean(trigger_pattern * w))
    return activation

Side-Channel Metrics¶

`sc_neurocore.security.side_channel_metrics` ¶

Analytic side-channel proxy metrics for stochastic-computing bitstreams.

These helpers quantify switching activity in simulated or replayed bitstreams. They are not physical leakage measurements and do not claim DPA resistance or board-level power/thermal security.

`SideChannelMetricError` ¶

Bases: ValueError

Raised when side-channel metric inputs are malformed or unsupported.

Source code in src/sc_neurocore/security/side_channel_metrics.py

Python
class SideChannelMetricError(ValueError):
    """Raised when side-channel metric inputs are malformed or unsupported."""

`SwitchingActivitySummary` `dataclass` ¶

Transition-count summary for a rectangular binary bitstream matrix.

Source code in src/sc_neurocore/security/side_channel_metrics.py

Python
@dataclass(frozen=True, slots=True)
class SwitchingActivitySummary:
    """Transition-count summary for a rectangular binary bitstream matrix."""

    cycles: int
    stream_count: int
    per_stream_transition_counts: tuple[int, ...]
    per_stream_transition_rates: tuple[float, ...]
    mean_transition_rate: float
    max_transition_rate: float
    total_transitions: int
    activity_histogram: dict[int, int]

`ClassActivityProxy` `dataclass` ¶

Class-conditioned analytic proxy for activity-dependent leakage.

label_activity_correlation is Pearson correlation between numeric labels and per-sample mean switching rate. It is None when either side has zero variance, avoiding fabricated correlation claims.

Source code in src/sc_neurocore/security/side_channel_metrics.py

Python
@dataclass(frozen=True, slots=True)
class ClassActivityProxy:
    """Class-conditioned analytic proxy for activity-dependent leakage.

    ``label_activity_correlation`` is Pearson correlation between numeric labels
    and per-sample mean switching rate. It is ``None`` when either side has zero
    variance, avoiding fabricated correlation claims.
    """

    class_means: dict[int | float, float]
    max_class_mean_gap: float
    label_activity_correlation: float | None
    sample_count: int

`compute_switching_activity(bitstreams)` ¶

Compute per-stream switching activity for rows of binary bitstreams.

Source code in src/sc_neurocore/security/side_channel_metrics.py

Python
def compute_switching_activity(
    bitstreams: Sequence[Sequence[int]],
) -> SwitchingActivitySummary:
    """Compute per-stream switching activity for rows of binary bitstreams."""

    matrix = _normalise_bitstream_matrix(bitstreams)
    cycles = len(matrix[0])
    transition_counts = tuple(
        sum(1 for index in range(1, len(row)) if row[index - 1] != row[index]) for row in matrix
    )
    denominator = cycles - 1
    transition_rates = tuple(count / denominator for count in transition_counts)
    histogram: dict[int, int] = {}
    for count in transition_counts:
        histogram[count] = histogram.get(count, 0) + 1

    return SwitchingActivitySummary(
        cycles=cycles,
        stream_count=len(matrix),
        per_stream_transition_counts=transition_counts,
        per_stream_transition_rates=transition_rates,
        mean_transition_rate=sum(transition_rates) / len(transition_rates),
        max_transition_rate=max(transition_rates),
        total_transitions=sum(transition_counts),
        activity_histogram=dict(sorted(histogram.items())),
    )

`compute_class_activity_proxy(bitstreams_by_sample, labels)` ¶

Summarise class-conditioned switching activity for simulated samples.

Source code in src/sc_neurocore/security/side_channel_metrics.py

Python
def compute_class_activity_proxy(
    bitstreams_by_sample: Sequence[Sequence[Sequence[int]]],
    labels: Sequence[int | float],
) -> ClassActivityProxy:
    """Summarise class-conditioned switching activity for simulated samples."""

    samples = _normalise_sample_collection(bitstreams_by_sample)
    label_values = _normalise_labels(labels)
    if len(samples) != len(label_values):
        raise SideChannelMetricError("bitstreams_by_sample and labels must have equal length")

    sample_rates = tuple(
        compute_switching_activity(sample).mean_transition_rate for sample in samples
    )
    rates_by_label: dict[int | float, list[float]] = {}
    for label, rate in zip(label_values, sample_rates, strict=True):
        rates_by_label.setdefault(label, []).append(rate)

    class_means = {
        label: sum(rates) / len(rates) for label, rates in sorted(rates_by_label.items())
    }
    mean_values = tuple(class_means.values())
    max_gap = max(mean_values) - min(mean_values) if len(mean_values) > 1 else 0.0

    return ClassActivityProxy(
        class_means=class_means,
        max_class_mean_gap=max_gap,
        label_activity_correlation=_pearson_correlation(label_values, sample_rates),
        sample_count=len(samples),
    )

Side-Channel Encoding¶

`sc_neurocore.security.thermal_sc_encoding` ¶

Activity-shaped stochastic encoding for analytic side-channel studies.

The encoders in this module preserve stochastic-computing probability counts while distributing transitions across the bitstream. They emit analytic simulation evidence only; they are not physical power, thermal, or DPA resistance measurements.