Continuous adversarial
testing.

Each published campaign names its attack class, attempt count, and observed pass rate.

See latest measurementsRead the paper

17,000+

published attack attempts, T1 to T4b

  1. T1result published
  2. T2result published
  3. T3result published
  4. T4aresult published
  5. T4bresult published
  6. T5testing now
  7. T6planned
  8. T7planned
  9. T8planned
  • Published
  • Testing now
  • Planned

Who we build against.

A well-resourced adversary can control the browser, modify the SDK, generate submitted signals, run many wallets, and study the public programs and circuits. The service treats every client field as untrusted.

Wallet-key compromise, coercion, attacks against device hardware, and compromise of private service infrastructure are separate categories. Native app and device attestation remain planned for a higher-assurance tier.

Three layers, one evidence stack.

Enforced checks decide whether a capture can settle. Temporal analysis remains research telemetry.

Tier 0

Cryptographic gate

Re-verification produces a Groth16 proof that committed fingerprints satisfy the circuit's Hamming-distance bounds. The Solana verifier sees neither plaintext fingerprint. A wallet's initial verification uses a validator-signed receipt instead.

Tier 1

Statistical distribution checks

The validation service checks the 308-feature summary against configured capture, phrase, acoustic, and distribution policies. It publishes no thresholds.

Tier 2

Behavioral coupling signals

The validator records speech-motion time-series relationships. Enforcement stays off while Entros measures reliability across people, devices, and adaptive synthesis.

How we test our defenses.

The private harness runs isolated and full-stack campaigns against the devnet pipeline. T5 remains open; T6 through T8 are planned.

TierAttack classTests defense against
T1Procedural synthesis (script-kiddie baseline)Absolute attacker floor
T2Parameter-varied proceduralTier 1 statistical consistency checks
T3Feature-space optimization with source accessTier 1 distributional realism
T4aPre-recorded human voice + procedural motion/touchLayer contribution and phrase binding
T4bReal-time synthesized voice (XTTS-v2, Kokoro, streaming TTS)TTS artifact detection + content binding + Sybil registry
T5Coupled cross-modal synthesisCurrent cross-signal detector
T6Targeted human-mimicry / identity theftBlocked until T5 closes
T7Replay with adversarial perturbationMin-distance floor + commitment registry
T8Black-box adaptive probingRate limits + response opacity

Attack code, per-attempt telemetry, and parameter values that produce elevated pass rates stay in a private repository.

Current measurements.

A pass is an attempt that cleared every check enabled for its campaign. Each result covers its named attack, sample size and configuration.

  1. T1

    Procedural synthesis

    Scripted voice, motion and touch generated from simple procedures.

    0%

    0 of 2,000 passed

    Hardened March 2026

  2. T2

    Parameter variation

    Procedural signals across several strategies and parameter ranges.

    0%

    0 of 4,000 passed

    Hardened March 2026

  3. T3a

    Unconstrained feature optimization

    Inputs tuned against the feature space with access to the source.

    0%

    0 of 1,000 passed

    Hardened April 2026

  4. T3b

    Constrained feature optimization

    The same search, held to realistic feature ranges.

    This campaign surfaced a gap in server-side feature validation. It is fixed and listed in AUDIT.md.

    0%

    0 of 9,000 passed

    Hardened April 2026

  5. T4a

    Prerecorded human voice

    A person's recorded voice with procedural motion and touch, run under four conditions.

    1. Wave 1100%

      Temporal checks logged only · 50 runs

    2. Wave 210%

      Temporal checks enforced · 10 runs

    3. Wave 30%

      Plus phrase binding · 20 runs

    4. Wave 40%

      Wave 3 at scale · 1,000 runs

    Wave 2 surfaced a cross-program binding gap, now fixed. The final wave gives a 95% confidence interval of 0% to 0.37%. It covers this attack class, not all synthesis.

    0%

    0 of 1,000 in the final wave

  6. T4b

    Real-time synthetic voice

    Two TTS families and 58 voices speak the issued phrase, with procedural motion and touch, through the full stack.

    No attempt reached the chain. The result covers the named models, voices and configuration.

    0%

    0 of 200 passed

    June 2026

Still to run

  • T5

    Coupled cross-modal synthesis

    Testing now

  • T6

    Targeted human mimicry

    Starts after T5

  • T7

    Replay with perturbation

    Next phase

  • T8

    Adaptive probing

    After mainnet

Devnet Anchor counts include documented red-team artifacts alongside team and pilot captures. The public stats page reads the on-chain aggregate and does not classify wallet owners.

Last updated August 7, 2026

What we open-source, and why.

The client and on-chain protocol are MIT licensed. The private validation service and red-team harness stay closed.

Open source, MIT licensed

  • On-chain programs (entros-anchor, entros-verifier, entros-registry)
  • ZK circuit source and verification keys
  • Client SDK (pulse-sdk on npm)
  • Executor node
  • Website and documentation
  • Security program page and scoped campaign results
  • Baseline adversarial testing (script-kiddie tier in pulse-sdk)

Kept private

  • Server-side validation service (entros-validation): thresholds and parameter values
  • Red-team harness (entros-redteam): attack code, per-attempt telemetry, captured baseline fixtures
  • Pre-disclosure vulnerability reports (standard practice)

On-chain transitions, cryptographic checks, and client computations are public. The private service decides whether submitted evidence satisfies the acceptance policy. Its detectors and thresholds stay private to limit directed calibration.

Reporting vulnerabilities.

Contact
contact@entros.io
Scope
On-chain programs, SDK, executor, validation service, website
Response SLA
Acknowledgment within 48 hours, initial triage within 5 business days
Safe harbor
We will not pursue legal action against good-faith research within this policy's scope.
Attribution
Researchers credited in AUDIT.md and hall of fame upon fix deployment, unless anonymity requested.
Bug bounty
Planned post-mainnet. Severity tiers and amounts TBD.

Learn more.

Built to keep pace with AI.

Read the paperHow it works