Continuous adversarial
testing.
Each published campaign names its attack class, attempt count, and observed pass rate. T5 remains open, and later tiers remain planned.
Published attempts
Published campaign range
T5 status
Continuous testing
Who we build against.
// ASSUMED CAPABILITIES
A well-resourced adversary can control the browser client, modify the public SDK, generate submitted signals, operate many wallets, and study public programs and circuits. The private service must treat every client field as untrusted.
// OUT OF SCOPE
Wallet-key compromise, coercion, physical attacks against device hardware, and compromise of private service infrastructure are separate threat categories. Native app and device attestation remain planned for a higher-assurance tier.
Three layers, one evidence stack.
Enforced checks decide whether a capture can settle. Temporal analysis remains research telemetry until human and adversarial evidence supports a policy decision.
Cryptographic gate
Re-verification produces a Groth16 proof that committed fingerprints satisfy the circuit's Hamming-distance bounds. The public Solana verifier checks the proof without receiving either plaintext fingerprint. First verification uses a validator-signed receipt instead.
Statistical distribution checks
The private validation service checks the submitted 308-feature summary against configured capture, phrase, acoustic, and distribution policies. The service does not publish operational thresholds.
Behavioral coupling signals
The validator records time-series relationships between speech and motion. Current code keeps enforcement disabled by default while Entros measures reliability across people, devices, and adaptive synthesis.
How we test our defenses.
The private harness runs isolated and full-stack campaigns against the devnet pipeline. Published rows name their configuration and denominator. T5 remains open. T6 through T8 remain planned.
| Tier | Attack class | Tests defense against |
|---|---|---|
| T1 | Procedural synthesis (script-kiddie baseline) | Absolute attacker floor |
| T2 | Parameter-varied procedural | Tier 1 statistical consistency checks |
| T3 | Feature-space optimization with source access | Tier 1 distributional realism |
| T4a | Pre-recorded human voice + procedural motion/touch | Layer contribution and phrase binding |
| T4b | Real-time synthesized voice (XTTS-v2, Kokoro, streaming TTS) | TTS artifact detection + content binding + Sybil registry |
| T5 | Coupled cross-modal synthesis | Current cross-signal detector |
| T6 | Targeted human-mimicry / identity theft | Blocked until T5 closes |
| T7 | Replay with adversarial perturbation | Min-distance floor + commitment registry |
| T8 | Black-box adaptive probing | Rate limits + response opacity |
Attack implementation code, per-attempt telemetry, and parameter values that produce elevated pass rates are kept in a private repository.
Current measurements.
Pass rate is the fraction of campaign attempts that satisfied the checks enabled for that row. Each result applies to its named generator, sample size, and campaign configuration.
| Tier | Description | Attempts | Pass | Status |
|---|---|---|---|---|
| T1 | Procedural synthesis | 2,000 | 0% | hardened · 2026-03 |
| T2 | Multi-strategy parameter variation | 4,000 | 0% | hardened · 2026-03 |
| T3a | Unconstrained feature optimization | 1,000 | 0% | hardened · 2026-04 |
| T3b | Constrained feature optimization | 9,000 | 0% | hardened · 2026-04 |
| Campaign surfaced a gap in server-side feature validation. Hardened—see AUDIT.md. | ||||
| T4a - Wave 1 | Pre-recorded human voice + procedural motion/touch (temporal enforcement OFF—log-only) | 50 | 100% | campaign counterfactual |
| T4a - Wave 2 | Pre-recorded human voice + procedural motion/touch (temporal enforcement ON) | 10 | 10% | campaign enforcement condition |
| A cross-program binding gap surfaced during analysis and was fixed. The public audit records the resolved issue without operational details. | ||||
| T4a - Wave 3 | Pre-recorded human voice + procedural motion/touch (temporal enforcement ON + phrase content binding ON) | 20 | 0% | 0% observed for this attack class |
| Phrase matching rejected all 20 attempts in this wave. The result applies to the tested prerecorded, arbitrary-content attack class. | ||||
| T4a - Wave 4 | Wave 3 methodology at scale (N=1000) to tighten the statistical bound on the closed attack class | 1,000 | 0% | 0% observed at N=1,000 |
| The validator rejected 1,000 of 1,000 attempts. The 95% confidence interval for the pass rate is [0%, 0.37%]. This bounds the tested attack class, not all synthesis. | ||||
| T4b | Real-time synthesized voice speaking the issued challenge phrase across two TTS model families and 58 voices, paired with procedural motion and touch in a full-stack campaign | 200 | 0% | 0% observed · 2026-06 |
| No attempt in this 200-run campaign reached the chain. The result covers the named models, voices, and full-stack campaign configuration. | ||||
// OPEN CAMPAIGNS | ||||
| T5 | Coupled cross-modal synthesis | — | in progress | open |
| T6 | Targeted human-mimicry / identity theft | — | blocked | waits for T5 closure |
| T7 | Replay-perturbed | — | queued | next-phase |
| T8 | Adaptive probing | — | queued | post-mainnet |
Last updated: August 7, 2026
// T4A - FOUR-WAVE STUDY
T4a measured one prerecorded, arbitrary-content attack class across four campaign conditions. Observed pass rates moved from 100% to 10% to 0%. The final 1,000-run wave observed 0 passes, with a 95% confidence interval of [0%, 0.37%]. These results do not establish a universal synthesis rate.
// ON-CHAIN ANCHOR STATE
Devnet Anchor counts include documented red-team campaign artifacts alongside team and pilot captures. The public stats page reads the on-chain aggregate and does not classify wallet owners.
What we open-source, and why.
The client and on-chain protocol are MIT licensed. The private validation service and red-team harness stay closed.
// OPEN—MIT LICENSED
- On-chain programs (entros-anchor, entros-verifier, entros-registry)
- ZK circuit source and verification keys
- Client SDK (pulse-sdk on npm)
- Executor node
- Website and documentation
- Security program page, public documentation, and scoped campaign results
- Baseline adversarial testing (script-kiddie tier in pulse-sdk)
// PRIVATE—DEFENSE LAYER
- Server-side validation service (entros-validation): check thresholds and parameter values
- Red-team harness (entros-redteam): attack code, per-attempt telemetry, captured baseline fixtures
- Pre-disclosure vulnerability reports (per standard responsible-disclosure practice)
On-chain transitions, cryptographic checks, and client computations are public. The private service decides whether submitted evidence satisfies the current acceptance policy. Its operational detectors and thresholds remain private to limit directed calibration.
Reporting vulnerabilities.
- Contact
- contact@entros.io
- Scope
- On-chain programs, SDK, executor, validation service, website
- Response SLA
- Acknowledgment within 48 hours, initial triage within 5 business days
- Safe harbor
- Good-faith research is welcome. We will not pursue legal action against researchers acting within the scope of this policy.
- Attribution
- Researchers credited in AUDIT.md and hall of fame upon fix deployment, unless anonymity requested.
- Bug bounty
- Planned post-mainnet. Severity tiers and amounts TBD.