Entropy Protocol (ep1)

A receipt for machine-written text. Seal text at the moment a language model writes it. Later, anyone you give the receipt to can check — deterministically, without the prompt, and without the receipt revealing a word of the text — whether a document is that text, and if it is not, exactly where it was changed.

What a missing mark means. ep1 speaks only about text that was sealed. A text with no ep1 mark was not sealed; that says nothing about whether a person or a machine wrote it. ep1 is not a classifier of AI authorship and never judges unsealed text.

This repository is the reference implementation, the specification of its formats, test vectors, a second independent implementation, and the evaluation program behind every number below.

Why a receipt, not a guess

Tools that infer authorship from a single text cannot be both useful and fair: they must accuse some honest writers, and their error rates are estimated, not known. Statistical watermarks report a score whose null distribution depends on the model and the text. Metadata attached to a file does not survive a copy out of a chat window.

ep1 takes the other road. At generation it writes a record with two layers:

• a content layer — digests of the canonical text and of its sentence blocks: exact integrity and the location of every edit;
• a model layer — checkpoints: a character offset and an ordinal property of the model's choice there (its first choice, or not). No token, no word, no text.

A verifier re-reads the candidate once with the same model and returns a determination:

Without any record, a holder of the detection key can test whether a text was sealed under that key. The p-value is exact: for any text not sealed under the key, the count of matching checkpoints follows Binomial(n, ½) by construction — no model- or text-dependent calibration of the null.

What ep1 proves — and what it does not

Proves, given a record: whether a candidate is the sealed text and, if not, where it differs. Proves, given the detection key: whether a text was sealed under the key, with an exact false-positive probability.

Does not prove, and we say so first:

Measured

One NVIDIA L40S, Qwen2.5-7B-Instruct, fp16, 128 texts of 400 tokens per corpus (phase A, 15.09.2026, total cost $4.60). Every number is a file under runs_gpu/a1/ and a command in bench/gpu/.

Quality (the default) leaves the model free where it is confident; strong enforces every checkpoint and breaks arithmetic — use it only where the mark matters more than the answer.

On other hardware (phase B, 26.09.2026, report). The same records, sealed on the L40S, verified again on an L4 (Ada), an A10G (Ampere) and an H100 NVL in confidential-computing mode (Hopper), in fp16, bf16 and fp32, on three clouds: 2,304 verifications, 100 % VERIFIED, 0 false MODIFIED. Where machines disagree at all — at most 1 position in 144,871 for fp16 and fp32, about 2 in 10,000 for bf16 — the answer is INDETERMINATE, never MODIFIED.

The null at 10⁻⁶, two other watermarks, three more models (phase C, 26.09.2026, report).

Attested sealing on a confidential H100

The keys, the model and the sealing code run in a confidential VM (AMD SEV-SNP) with an H100 in confidential-computing mode. An authority appraises the hardware evidence — the processor's report, the vTPM quote and boot log, the GPU's SPDM report — and certifies a key only if every check holds; each statement then carries the certificate and the digest of the attestation result (EAR). Design: ARCHITECTURE §7d. One run (files: Azure Standard_NCC40ads_H100_v5, Qwen2.5-7B-Instruct, fp16):

Refusals are tested on the run's own data (tests/test_attested_run.py): a request bound to another key, evidence moved from another enrollment, a changed model digest, a spent handle, a changed text, a result signed by another authority. A live refusal is kept as well: a host whose paravisor build had a launch measurement the policy did not list (files); the policy pins the key that signs the paravisor's launch instead. Not shown by this run: the operator had SSH access to the guest. Excluding the operator needs a locked image — no interactive access, a measured root file system — whose measurements become the reference values.

pip install -e ".[attested]"
entropy evidence --check bench/results/attested/run-20261027T172258Z/packs/5aWyrqFNxAxJwkXE.cbor

Quick start

git clone https://github.com/entropy-ep1/entropy-protocol.git && cd entropy-protocol
pip install -e ".[model,markdown]"   # Python >= 3.10; the model stack: torch and transformers
M=Qwen/Qwen2.5-0.5B-Instruct
entropy keygen --out master.key
entropy seal --model $M --key master.key --max-new-tokens 400 \
  --prompt "Write a short story about a lighthouse keeper who finds a letter in a bottle." --out sealed.json
python3 -c 'import json; d = json.load(open("sealed.json")); open("candidate.txt", "w").write(d["text"])'
TOKEN=$(python3 -c 'import json; print(json.load(open("sealed.json"))["token"])')
entropy verify --model $M --text-file candidate.txt --token "$TOKEN" --key master.key   # "verdict": "VERIFIED"
entropy detect --model $M --text-file candidate.txt --key master.key                    # "p_value", exact

On a laptop CPU this takes under two minutes. One run (files): VERIFIED with all 51 checkpoints of the record matched; record-free detection found 42 of 44 checkpoints and reported p = 5.6 × 10⁻¹¹. Change one word in candidate.txt and verify again: MODIFIED, with the character range of the sentence that changed. Short or formulaic answers carry few checkpoints — detection needs about 50 tokens or more, and is strongest on open-ended text.

The whole product in one command, on a CPU, nothing leaving the machine: bench/demo_review.sh (keys → an OpenAI-compatible sealing gateway on 127.0.0.1 → a sealed answer → three candidates checked: as delivered, as a rendered copy, with one word changed → record-free detection with its exact p-value → the same verdict through an MCP tool → signed statements, a transparency log and an evidence package checked offline).

entropy --help lists the rest: serve (sealing gateway), mcp (verifier as assistant tools), commit / register / serve-log / submit (SCITT statements and receipts), timestamp (RFC 3161), evidence (a single-file package with an offline check), deliver (a record encrypted to one verifier's public key).

Reproduce the numbers

The evaluation keys are public by design: key i is SHA-256("ep-gpu-eval/2026-09/master/<i>") (bench/gpu/common.py), so anyone can re-derive them and recompute every detection. The phases are scripts with a hard cost cap per machine; each step leaves a log and resumes where it stopped.

Each has a CPU dry run (smoke_phase_*.sh) that exercises every call on a small model before a paid machine starts.

Specification and a second implementation

• Formats: spec/ep1.cddl — the record, the statements, receipts, the evidence package. No floating point on the wire: tolerances in integer micro-units, p-values from counts.
• Test vectors: spec/test-vectors/ep1-vectors.json, regenerated by spec/make_vectors.py.
• An independent JavaScript implementation of every model-free part: impl-js/ — 130/130 vector checks. CI regenerates the vectors with the Python reference, requires them to be byte-identical to the committed file, and runs the JavaScript implementation against them.
• The canonical form (v5) normalizes as Unicode 14.0 does, whatever Unicode version a library ships, so two implementations agree on every text; both decode untrusted CBOR within one profile (ARCHITECTURE §7e).
• Fuzzing: one target per parser of untrusted input, property and differential targets that give the same input to both implementations, seed corpora from real data, replayed and driven by Hypothesis in every test run and run coverage-guided with atheris (fuzz/).
• Design and rationale: ARCHITECTURE.md.

Built on published standards: SCITT architecture (RFC 9943), COSE Receipts (RFC 9942), Certificate Transparency v2 Merkle trees (RFC 9162), COSE Hash Envelope (RFC 9995), CWT claims in COSE (RFC 9597), RFC 3161 time stamps (carried per RFC 9921), SCRAPI (draft-ietf-scitt-scrapi), COSE-HPKE (draft-ietf-cose-hpke).

Status

0.1.0 — a reference implementation ahead of standardization. Formats may change before a specification is adopted by a standards body; records name their canonical form and version, and older records keep verifying.

Verify a release

Every file of a release is signed with Sigstore by this repository's release workflow (one bundle, <file>.sigstore.json, per file), and SHA256SUMS lists them all. With cosign 3:

f=entropy_protocol-0.1.0-py3-none-any.whl
cosign verify-blob --bundle "$f.sigstore.json" --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity https://github.com/entropy-ep1/entropy-protocol/.github/workflows/release.yml@refs/tags/v0.1.0 "$f"
gh attestation verify "$f" --repo entropy-ep1/entropy-protocol      # GitHub's build-provenance attestation

License and patents

Code: Apache License 2.0. Patent applications cover this work; see PATENTS.md for the commitment made to implementers of the specification.

Authors

Roman Oliinyk and Serhii Nikolaichuk. Cite as in CITATION.cff. Security reports: SECURITY.md.