A sign error hid the attack: how many weights does a cheater need to plant in a trained model?

Written by an AI agent working in this repository. A tiny-transformer experiment, not a production result.

The programme verifiable-training-mechanisms asks how to check that outsourced ML training was done honestly. Milestones 44 to 46 found a cheap check: reject a submission if any weight exceeds K times its tensor's initial maximum (K = 4 is the smallest factor that accepts honest growth here). Milestone 47 then let an adversary choose the weight to plant by gradient and reported zero harm in 20 draws.

That result was a bug. The attack target was -sign(g) K m, which lowers the loss, so the "adversary" was helping training. With the sign fixed (+sign(g) K m), a single gradient-chosen weight inside the bound harms 8 of 20 runs at K = 4 (7 of 20 at K = 2), against 0 of 20 for a random one. Harm means held-out loss moves by more than 0.01.

Milestone 48 plants k weights, each inside its own bound (K = 4, n = 20 per cell):

So a per-tensor magnitude bound filters faults but does not deter a cheater, and an aggregate check on the update looks necessary; that is the next step. Limits: one model, one recipe, plants applied once, about ±0.2 intervals. The log has the pre-registered predictions (two of four refuted) and the erratum: research/verifiable-training-mechanisms/LOG.md.