The firewall that doesn't trust a packet — it verifies the chain.
Telemetry from a robot, a plant, or a network line is signed into a SHA-256 custody chain and compressed into a 64-dimensional hypervector — so any single flipped field is detected instantly, and the wire stays 40× smaller.
Every claim links to a measurement, a bound, or a committed dataset.
The packet field behind this page is decorative. It shows a stream of packets being chained: most verify and glow cyan, tampered packets flare red and are held out. It is drawn locally in your browser and is not a live feed.
Integrity is usually checked at the endpoint — after the lie already crossed the wire.
A packet is small and cheap to forge. A single flipped field in a sensor stream — one gyro value nudged, one accel axis scaled — is invisible to a signature check, because the signature was made after the data was already corrupted. Signature verification answers "who signed this?" It cannot answer "is this packet the one that was actually measured?"
So we stopped asking the packet to prove it's real, and started asking whether its hashchain holds. Every packet is chained to the one before it. A tamper anywhere breaks the chain head. A liar who never collected the data cannot produce the chain. The integrity question becomes a hash — and the hash is one line of math.
Signature ≠ integrity. A hashchain over raw packets is integrity. This is the difference between "signed" and "provably unchanged since capture."
Five steps from live stream to a provable chain.
This is not a diagram of intent — it is the exact loop k1_tap.py and the custody verifier run on every capture. Each step names what is
real versus what is simulated, so a due-diligence reader never guesses.
Capture the pub stream
Tap ROS 2 topics — imu, joint_states, odom, fall_down — straight off the K1 robot.
REAL — k1_tap.py subscribes to the live Booster K1 stream. Accel is converted m/s² → g; everything else is raw.
Normalize to 11 columns
Every packet lands in one fixed row: timestamp, accel xyz, gyro xyz, rssi, wifi_count, audio_energy, audio_peak.
REAL — The exact SmartWatch custody format — so the whole pipeline runs unchanged on any capture.
Chain with SHA-256
Each row is hashed and chained to the previous head. The chain head commits the entire history.
REAL — A hand-rolled, dependency-free SHA-256. Flip any single field anywhere and the head changes.
Distill to a D=64 hypervector
The D=2048 teacher bundle is STE-distilled into a D=64 student that preserves cosine similarity.
REAL — Not quantization — a trained projection. The tamper dip (~0.01) survives the compression.
Verify, replay, and hold out
Rebuild is bit-exact. A claimed history must reproduce the committed head, or it is rejected.
REAL — A liar who did not earn the trajectory cannot produce the chain — replay is provable.
An intrusion detector that runs at packet speed.
A firewall should not have to pause to think. Three layers answer three different questions — is it changed, what changed, and is it still a threat — and only the last one costs real compute.
L1 — Neural hash
Instant · zero thresholdThe D=64 student is binarized to a sign pattern plus norm, and hashed. Any change to the packet state flips the hash.
Any corruption at all — sign flips, scale, offset, zeroing. Detected the instant it crosses the wire.
L2 — Cosine student
Graded · decides what changedThe trained projection compares the incoming bundle to the committed one by cosine similarity.
Natural jitter stays inside the match band (cos ≈ 1). A lie dips below it. 24 unseen lies detected; 8 jitters cleared.
L3 — Accumulator
Graded → verdict over timeSuccessive cosine dips accumulate into a confidence verdict, so transient noise cannot trigger a false alarm.
The slow, deliberate lie — the compromised sensor that nudges one field over many packets.
The receipts.
Every number is a bound or an empirical result from the committed code path — not a projection. The honesty is in the provenance.
timestamp, accel xyz, gyro xyz, rssi, wifi_count, audio_energy, audio_peak — the exact SmartWatch row format
STE distillation of the teacher bundle to a D=64 student (~40× smaller gossip)
any single-field flip changes the SHA-256 chain head
sign pattern of the bundle + norm → hash. Any state change flips it. Zero threshold.
the D=64 student grades what changed — jitter stays in-band, lies dip below it
24 unseen lies detected instantly; 8 natural jitters stayed inside the match band
Chain packets from the command line.
The custody stack is dependency-free Rust plus a self-test page. Tap the live K1 stream, chain it, then run the tamper drill to watch a single flipped field break the head.
- Tap
- k1_tap.py --host 192.168.10.102
- Chain
- SHA-256 over 11 columns
- Distill
- D=2048 → D=64 (~40×)
- Verify
- bit-exact replay + tamper drill
- GPU required
- zero