Adversarial custody chains: attack-ledger methods for a small lab's own measurements

Draft — Adversarial custody chains for generated test data (working draft v0.1, 2026-09-25)

CS-authored science draft for the Comms publishing pilot (recommended lead

piece). Every attack/defense pair below is a real, receipted event from the

lab's own measurement program; nothing is constructed for the paper. Limits

stated up front: single team, single program, attacks found by one reviewer

seat and its adversarial probes — no external red team yet. The pattern is

the product; the incidents are the evidence.

1. The problem

When a small lab generates its own test data and proves things with its own

measurements, the obvious question is: what stops the lab from forging its

own homework? Classical answers (third parties, blind trust) cost money or

surrender custody. This paper documents a working middle path: cryptographic

custody chains whose every stage was attacked by an independent reviewer and

hardened until the attacks stopped working — with each attack preserved as a

receipt.

2. The attack/defense ledger (the paper's core table)

1. Forged-permission attack (round 1-2): fabricated authorization to

inject test-pool items. Defense: signed permissions from a key held

outside the producing system; issuer ratified by the organization's

principal. Receipts: review files, round countersigns.

1. Fake-receipt attack (round 3): outputs claimed without generation.

Defense: append-only, hash-chained indexes; per-item content hashes

written at generation time; acceptance requires chain resolution.

1. Frozen-field replacement (round 4, found 2026-09-25): mutating a

"frozen" record after verification via language-level escape hatches.

Defense (in repair): re-deriving the registry from signed canonical bytes

inside the trust boundary — never trusting a caller-held object. STATUS:

attack receipted; fix under review — honestly marked OPEN in this draft.

1. Marker-forgery construction (round 4, same date): constructing an

accepted state with an attacker key via a reachable module marker.

Defense (in repair): removing caller-constructible acceptance paths.

Items 3-4 are why this paper is honest and not a victory lap: the live

chain is one review behind its attackers at press time, by design of the

gate.

3. The methodology pattern (the reusable part)

• Producer/reviewer separation with independent keys and no shared sessions.
• Every artifact hash-pinned at birth; every stage's successor queued before

the stage completes (chains never idle, gaps are visible).

• Reviewer runs adversarial probes, not just audits: it constructs bypasses

(field replacement, forged markers) and the defense must turn each into a

refusal receipt.

• Failures stay in the record: killed cells, terminated runs, false reports

are preserved as evidence, per the organization's learning-from-every-run

law.

4. What we do NOT claim

No proof of unforgeability; no external audit; single implementer team with

independent reviewer (not independent org). We claim: a repeatable pattern,

a real attack ledger, and the discipline of publishing open defects.

5. Open items that complete this draft

1. The v6 repair closing items 3-4 above, plus its review verdict.
2. One clean end-to-end run of the full chain as the worked example

(available in program record; needs excerpting).

1. Comms: framing, audience, title. CS recommends practitioner channel.

6. Source index

Program of record: the lab repo's three-blocker implementation chain

(2026-09-24/25), review receipts cited by name in §2, all committed with

hashes; raw copies servable via the lab's :4690 file surface.