The empty diff: a relabeling-invariant certificate that a streaming model did not learn from you

Working title: The empty diff: a relabeling-invariant certificate that a streaming model did not learn from you

Author: [withheld in the repository copy]. Contact: [withheld]. Status: DRAFT — not submitted. Luke submits by hand, and only if he chooses to. Revision: 2026-11-02 second sweep (related work, venues).

Venue	Transactions on Machine Learning Research (TMLR)
CFP / policies	https://jmlr.org/tmlr/ ; https://jmlr.org/tmlr/editorial-policies.html ; https://jmlr.org/tmlr/acceptance-criteria.html
Deadline	Rolling. Last year's holiday pause ran 2025-12-02 → 2026-01-05; the 2026–27 pause was still not posted when the journal page was re-read on 2026-11-02
Format	TMLR LaTeX style mandatory; any length if justified; supplementary material ≤100 MB, anonymized
Review	Double-blind on OpenReview; a named arXiv preprint is allowed but the submission must not link to it; at least three reviewers; action editor assigned within a week; decisions accept / accept with minor revisions / reject
Fee / barrier	"TMLR imposes no fees or payments to authors". A new OpenReview profile on a personal email may sit in moderation up to 2 weeks
Bar	"Are the claims made in the submission supported by accurate and convincing evidence?" Novelty is explicitly not required
Home	The Broadcast's paper section: docs/papers/empty-diff-certificate.md, served at /chartroom/empty-diff-certificate with its hash

Other doors

Venue	Deadline	URL	Fee / barrier
IEEE SaTML 2028	SaTML 2027 PASSED (2026-09-29 AoE). PATTERN for 2028: ~late Sept 2027 (UNVERIFIED)	https://satml.org/call-for-papers/	HotCRP; double-blind; ≤12 pages; mandatory Open Science section; in person only, one author pays full registration
USENIX Security 2027, Cycle 2	Registration 2027-01-19; paper 2027-01-26 AoE	https://www.usenix.org/conference/usenixsecurity27/call-for-papers	13 pages body; Open Science appendix; a stretch without an attack model
AAAI-27 "Loyal Agents" workshop	2026-11-20 AoE	https://loyalagents.github.io/aaai27/	Single-blind, at least two PC reviews; ≤8 pages plus unlimited references, AAAI-27 Author Kit; OpenReview, every co-author needs a profile before submitting; non-archival with CEUR-WS opt-in; notification 2026-12-02; "audit trails" in scope; in-person Montréal mandatory, AAAI-27 workshop-only pass $305–$557 (early rate by 2026-12-15) (re-read 2026-11-02)
arXiv cs.CR (cross-list cs.LG)	Rolling; 14:00 ET cutoff	https://info.arxiv.org/help/endorsement.html	One cs endorsement covers both; "Independent" accepted as organization. Since 2026-01-21 automatic endorsement needs an academic email and prior arXiv authorship in the domain, so a first-time unaffiliated author goes by personal endorsement; "arXiv staff cannot waive endorsement requirements"

Abstract (draft)

"This model did not learn from you" is usually a promise. We make it a checkable property of a streaming estimator. The learned state of a belief field, a density matrix over a graph of qubit clusters simulated on a CPU, is written in a canonical form and hashed twice: v1 as built, and v2 after sorting clusters and roles and permuting every array to match, so two brains built in different orders share one v2 hash. Beside the hashes we compute an invariant sheet: the cycle count β₁ of the coupling graph, a Z₂ Wilson sign per fundamental cycle, each cluster's sorted Bloch radii, and the field and coupling magnitudes at ten decimal places. Every learning event writes one content-addressed, parent-linked node carrying v1, v2 and the sheet; with git opted in, one event is one commit, strobed at the driver's rest window. A frozen model therefore leaves an empty diff: no node, no commit, an empty worktree. A diff that moves the hash but not the sheet is bookkeeping; a diff that moves the sheet is physical change. In a frozen-versus-live run the frozen sheet keeps one content hash over 28 drive ticks while the live sheet records 29. The certificate covers the canonical belief state only; a measured continuation gap of 2235 process slots between a snapshot-booted twin and a from-log twin bounds what it does not cover. The certificate test also caught a production bug: the one caller had never recorded a node.

Contributions

1. The gauge group of the representation, as a table. Which moves leave the physics alone (relabeling of clusters and roles, rotation about a parameter's value axis, Bridge(source, target) order, a global X/Y flip, a Z₂ switching on the coupling graph), and which hash each move changes.
2. Two canonical hashes. v1 hashes the field as built, with its byte recipe pinned to a hex. v2 canonicalizes first (clusters sorted by name, roles sorted within, arrays permuted to match) and is idempotent. The same brain in shuffled insertion order gets a different v1 and an identical v2.
3. An invariant sheet. β₁, a Z₂ Wilson sign per fundamental cycle, per-cluster sorted Bloch radii, |h| and coupling magnitudes at 10 dp. It survives relabeling and moves when a coupling moves.
4. The commit contract. An unchanged field writes no node; a real coupling change writes exactly one parent-linked node carrying v1, v2 and the sheet; with git opted in, one learning event is one commit, strobed at the driver's rest window (a Poincaré section). A frozen re-record leaves git log and the worktree empty.
5. Diff decomposition. Hash moved and sheet same means bookkeeping. Sheet moved means physical motion, and the sheet names the kind: radius is belief, link triple is coupling, Wilson sign is topology.
6. Scope honesty. The certificate covers the canonical belief state. The measured continuation gap is the published boundary of what it does not cover, and the certificate test caught a production caller that had never recorded a node.

Outline (TMLR, any length; about 8,000 words)

1. Introduction (800 words). Proofs of learning say "I trained this way" and have been spoofed. Unlearning certificates say "this one point is gone". Model signing says "this artifact is this artifact". Nobody certifies the absence of any update to a model that is still running. We make absence a property of a log: a frozen model leaves an empty diff, robust to bookkeeping because it is computed on a relabeling-invariant canon.
2. What a certificate of absence must be (600). Thudi et al. showed that parameters cannot certify non-use, so the audit must live at the log level. Certificate Transparency shows how a log proves it only grew. We take that stance and ask one thing more: re-bookkeeping of the same physics must not look like learning. That is the gauge requirement.
3. The learned state and its gauge group (900). The canonical state is {partition, modes, diss_rates, e1[N,3], e2[N,N,3,3], h[N,3], zz, xy}: first and second cumulants of a cluster of qubits, local fields, and ZZ/XY couplings. We tabulate the moves that leave the physics alone: rotation about a parameter's value axis (invariant to 1e-12; azimuth is residual gauge, fixed to +x at four named sites), bridge order, and a global X/Y flip that moves v1 and cannot move the sheet. For each move we say whether v1, v2 and the sheet change.
4. Canon v1 and v2 (700). v1 is the as-built frame with its byte recipe pinned. v2 is canonicalize: sort clusters by name, roles within, permute arrays to match; it is idempotent. We relate v2 to canonical labeling (nauty/Traces) and RFC 8785 serialization, and say what v2 does not quotient: it is a relabeling canon, not a full gauge quotient.
5. The invariant sheet (900). The coupling graph carries a Z₂ lattice gauge field read from sign(J_zz), with exchange (J, J) = +1 and antiexchange (J, −J) = −1. Local gauge transforms leave every fundamental-cycle Wilson phase unchanged to 1e-12 under random red-teaming; β₁ = E − V + C; gauge_fix_tree drives every spanning-forest edge to 0 and leaves exactly β₁ residues; a hand-built antiexchange triangle reads W = −1. In signed-graph language the Wilson signs are the switching-class invariant of Harary and Zaslavsky. The ledger never feeds back into dynamics.
6. The commit contract and the empty diff (800). One node per learning event, parent-linked, content-addressed, carrying v1, v2 and the sheet; git opt-in by [private, withheld]; commits strobed at the driver's rest window, a Poincaré section of the drive. Figure: the frozen sheet keeps one content hash over 28 drive ticks; the live sheet records 29. (DARK: needs public evidence (a public repro or measurement) before it can be claimed.)
7. Reading a diff (500). Hash moved, sheet same: bookkeeping. Sheet moved: physical motion; radius is belief, link triple is coupling, Wilson sign is topology. We walk one example of each, including the frustrated bridge triangle that reads W(C) = −1 and that no local flip clears.
8. The boundary: the continuation gap (700). At the snapshot cursor a snapshot-booted twin and a from-log twin share the field hash but differ in 2235 walked process slots (41 changed, 1481 only in the from-log twin, 636 only in the snapshot twin, 77 alias moves; 6061 vs 5216 slots), and a learning-hot tail then forks the hash. Incremental parity is xfail-pinned; 5 of 49 state owners could not be spliced. The certificate speaks about the canonical belief state and nothing a snapshot misses: CRIU's lesson in another costume.
9. The bug (300). The one production caller passed a bare field object the signature rejected, inside its own try/except; no node had ever been recorded in production until the certificate test ran. A certificate never written is the same as none.
10. Related work, negative space, threats, dark, what this paper is not (1,500). Below.

Related work and the negative space

Append-only, content-addressed state. Merkle (1988), CRYPTO '87: hash trees. Laurie, Langley, Käsper (2013), RFC 6962, and Laurie et al. (2021), RFC 9162: Certificate Transparency, with consistency proofs that a log instance is a superset of a previous one. OpenSSF Model Signing v1.0 (2025), Sigstore: model signatures recorded in the Rekor append-only log. Lamb and Zacchiroli (2022), IEEE Software: reproducible builds, bit-for-bit identity as the oracle. Helland (2015), CIDR: "The truth is the log. The database is a cache of a subset of the log." Veresov, Spenger, Carbone, Haller (2024), ECOOP: failure transparency, the formal statement that a recovered process is indistinguishable from an unfailed one. CRIU wiki, "What cannot be checkpointed": device-held state and state that lives in another process.

Canonical forms. Rundgren, Jordan, Erdtman (2020), RFC 8785: JSON Canonicalization Scheme. McKay and Piperno (2014), J. Symbolic Computation: nauty and Traces; canonical labeling of coloured graphs; edge colours are handled by the two-layer vertex-coloured construction in the nauty/Traces User's Guide v2.9, p. 64, "Isomorphism of edge-coloured graphs" (read 2026-11-02). Babai (2016), STOC, DOI 10.1145/2897518.2897542 (venue verified 2026-11-02): graph isomorphism in quasipolynomial time. Weisfeiler and Leman (1968), NTI Ser. 2, no. 9, 12–16, and Shervashidze et al. (2011), JMLR 12(77):2539–2561 (both verified 2026-11-02): the refinement and its kernels. Xu et al. (2019), ICLR (venue from memory; UNVERIFIED after registry check 2026-11-02): Weisfeiler–Leman hashing is incomplete (the GIN bound), so it cannot serve as the canon.

Certificates about learning. Jia et al. (2021), IEEE S&P: proof-of-learning. Zhang et al. (2022), IEEE S&P, and Fang et al. (2023), EuroS&P: proof-of-learning spoofed at lower cost than honest proving. Abbaszadeh, Pappas, Katz, Papadopoulos (2024), CCS: zero-knowledge proofs of training with proof size independent of iterations. Srivastava, Arora, Boneh (2024), NeurIPS, DOI 10.52202/079017-3030: optimistic verifiable training with per-step committed checkpoints and bit-exact replication across GPUs; checkpoint hashes are stored in a Merkle tree whose root is shared, and on a mismatch the auditor descends the tree to the first two consecutive leaves that diverge (verified 2026-11-02 from the arXiv HTML, §3, §5.3–5.4). Thudi, Jia, Shumailov, Papernot (2022), USENIX Security: the paper's term is forgeability, "the ability to replace data points from one dataset by points from another dataset while keeping the model updates computed on these points identical (up to some pre-defined minimal error)"; parameters alone cannot certify non-use, so unlearning is "only well-defined at the algorithmic level" (abstract and p. 2 read 2026-11-02). Eisenhofer et al. (2025), SaTML: verifiable unlearning by commitments and proofs. Maini, Yaghini, Papernot (2021), ICLR, and Maini et al. (2024), NeurIPS: dataset inference. Gao, Liang, Guestrin (2025), ICLR: model equality testing, the black-box dual of our certificate.

Symmetry and invariants. Dinh et al. (2017), ICML, PMLR 70:1019–1028 (venue verified 2026-11-02): sharpness is not reparametrization-invariant. Zhao, Walters, Yu (2026), TMLR: symmetry in parameter spaces; quotienting by the symmetry group. Ainsworth, Hayase, Srinivasa (2023), ICLR (venue from memory; UNVERIFIED after registry check 2026-11-02): Git Re-Basin, permutation alignment before comparison. Harary (1953), Michigan Math. J.: balance of signed graphs. Zaslavsky (1982), Discrete Applied Mathematics: switching; balanced iff switchable to all-positive. Wegner (1971), J. Math. Phys.: Z₂ gauge theory and phases without local order parameters. Kogut (1979), Rev. Mod. Phys.: the lattice-gauge review. Creutz (1977), Phys. Rev. D 15, 1128: maximal-tree gauge fixing, the construction behind gauge_fix_tree (attribution verified 2026-11-02 through Adams, hep-lat/0203014, ref. [14]). Toulouse (1977), Communications on Physics 2, 115: frustration as a negative loop product (verified 2026-11-02 against the author's publication list; no DOI exists). The frustration index, the fewest edge-sign reversals that balance a signed graph, is attributed to Harary (1959), Behavioral Science, via a secondary source (still UNVERIFIED after 2026-11-02).

Negative space. Every neighbour certifies something else. Proof-of-learning, zero-knowledge proofs of training and verifiable training certify the presence of a claimed run; Srivastava et al. (2024) and Akgul et al. (2025) are the closest constructions, one committed state per step with replay or with a hash chain, built for training-as-a-service and for fine-tuning, not for a frozen streaming estimator. Verifiable unlearning certifies the absence of one point, not the absence of any update. Certificate Transparency certifies the absence of forks. Model signing certifies identity at an instant; model equality testing detects change from outside. Thudi et al. (2022) supply the theory for why the certificate must be log-level, and Dinh (2017) and Zhao–Walters–Yu (2026) supply the reason it must be quotiented. Per-event content-addressed commits of model state now exist for presence (Akgul et al., 2025); none found exists for absence with an invariant sheet. No found work makes emptiness the certificate, and none classifies a diff as bookkeeping versus physical with a lattice-gauge invariant. The claim is stated narrowly: absence of update, per event, for one estimator family.

Second sweep (2026-11-02). Seventeen searches ran before the budget closed; the rest was registry and primary-source verification. The engineering neighbourhood now has a nearest member: Akgul, Borg, Berisha, Rahimova, Novak, Petrov (2025), arXiv:2510.16830, "Verifiable Fine-Tuning for LLMs", §III-G "Optimizer State Integrity and Hash Chaining", which commits per-step model and optimizer state with Merkle accumulators or polynomial commitments, links consecutive steps with a hash chain, and folds per-step proofs into per-epoch and end-to-end certificates; it is a zero-knowledge presence proof for parameter-efficient fine-tuning under a dataset commitment. Lifecycle provenance with transparency logs exists as Atlas: Spoczynski, Melara, Szyller (2025), IEEE EuroS&PW, DOI 10.1109/EuroSPW67616.2025.00058, arXiv:2502.19567, stage-level manifests with end-to-end lineage attested on Intel TDX. Frozen-weight identity at inference exists as a SHA-256 model_fingerprint of weights plus architecture bound to TEE quotes in IETF draft-mw-spice-inference-chain-00 (Krishnan, Prasad, Lopez, Addepalli; March 2026, individual submission, expired September 2026), whose §1.1 names the threat this paper answers, "Weight Tampering: Model weights are modified ... while the model identifier remains unchanged", and answers it per inference, not over a stream of updates. Content addressing of checkpoints is production infrastructure: Hugging Face Xet chunks a file at about 64 KB with a rolling hash, keeps only chunks not already stored, and groups them into 64 MB blocks in a content-addressed store keyed by hash; it says nothing about certifying an empty diff. For the invariant sheet, three signed-graph and gauge neighbours in ML must now be distinguished. Wendin, Larsson, Altafini (2025), arXiv:2510.05286, compute the frustration (distance from structural balance) of a deep network's signed graph as a global invariant and read it as Ising disorder: the same mathematics as the Wilson signs, with no diff and no gauge fixing. Magnot (2025), arXiv:2509.10536, builds a contextuality index from group-valued holonomies along cycles of a Boltzmann-machine graph: continuous groups, no certificate use (claims beyond the abstract UNVERIFIED). Ahn, Chertkov, Shin, "Gauging Variational Inference", NIPS 2017 and J. Stat. Mech. 2019, DOI 10.1088/1742-5468/ab3217, use "gauge" for partition-function-preserving transformations of a factor graph, a different object from relabeling, and the paper should separate the two senses; Altafini's own "gauge transformation" wording in the 2013 consensus paper is UNVERIFIED after search. For the replay boundary, Carreras (2026), arXiv:2607.23611, publishes machine-checkable certificates replayable by a dependency-free verifier with one-command reproduction (the "claims ledger" detail reported by a search snippet is not on the abstract page and is UNVERIFIED), and practitioners now run the test the continuation gap asks for: a merged daily replay-equivalence job that reseeds a scratch database from a snapshot, replays the event stream through the unmodified indexer, diffs projections by streaming merge join and catches two deliberately planted bugs (vaultquest-archive issue #751 and PR #762, September 2026), and an accepted ADR withdrawing a world-state-from-events claim after finding that no commit had ever built it (holomush #4784, closed 2026-10-31); no academic empirical divergence study was found. Bibliographic items settled: Thudi's term is forgeability; Srivastava's checkpoint hashes sit in a Merkle tree; nauty handles edge colours by the two-layer construction (User's Guide v2.9, p. 64); Babai is STOC 2016 and Dinh is ICML 2017, PMLR 70; Creutz (1977) is the maximal-tree source and Toulouse (1977) the frustration source; if an industrial as-of database is named beside Helland's log, Datomic is transaction-time only (as-of, since, history) and XTDB is the bitemporal one. Still UNVERIFIED after registry check: the ICLR venues of GIN, Git Re-Basin and Entezari; the Harary 1959 attribution; lakeFS commit internals. Verdicts: the empty-log certificate is narrowed by Akgul 2025, Atlas 2025 and the SPICE draft and remains unoccupied when stated as absence of any update, per event, for a streaming estimator with bit-exact CPU replay; the invariant sheet is narrowed by Wendin–Larsson–Altafini and Magnot, neither of which classifies a diff; the relabeling canon is unchanged, with every component now verified.

Evidence each claim rests on

Claim	Pointer	Tier
Canonical state tuple; canon v1 (as-built) and v2 (canonicalize: clusters sorted by name, roles within, arrays permuted; idempotent); shuffled insertion gives different v1, identical v2; v1 byte recipe pinned to a hex	DARK: needs public evidence (a public repro or measurement) before it can be claimed	DARK
Invariant sheet: β₁ + per-fundamental-cycle Z₂ Wilson signs + per-cluster sorted Bloch radii + \	h\	+ coupling magnitudes at 10 dp; survives relabeling; moves when a coupling moves; diff decomposition
Empty diff: unchanged field writes no DAG node; a coupling change writes exactly one parent-linked node with v1 + v2 + sheet; one training event = one git commit; frozen re-record leaves git log and worktree empty; git opt-in [private, withheld]; strobed at the driver's rest window	DARK: needs public evidence (a public repro or measurement) before it can be claimed	DARK
Figure: frozen sheet keeps one content hash over 28 drive ticks; live sheet records 29	docs/figures/empty_diff_figure.png	PINNED (figure from the test run)
The one production caller passed a bare field object the signature rejected inside its own try/except; no node had ever been recorded in production before this pass	DARK: needs public evidence (a public repro or measurement) before it can be claimed	DARK
Frame conventions are gauge fixings: value and purity invariant under rotation about the value axis to 1e-12; azimuth fixed to +x at four sites; Bridge(source, target) order physicless; global X/Y flip moves v1 and cannot move the sheet	DARK: needs public evidence (a public repro or measurement) before it can be claimed	DARK
Link ledger is a Z₂ lattice gauge field: Wilson phases invariant to 1e-12 under random red-teaming; β₁ = E − V + C; gauge_fix_tree leaves exactly β₁ residues; open or broken walk reads NaN, absent edge NaN never 0; exchange +1 vs antiexchange −1; antiexchange triangle W = −1; never feeds back into dynamics	DARK: needs public evidence (a public repro or measurement) before it can be claimed	DARK
Signed bridges: −1 link transports through σ_x; anti-aligned pair is a fixed point to 1e-9 over 30 reconciles; frustrated triangle W(C) = −1 and no local flip clears it; repair of a (corr+1)/2 sign-stripping defect	DARK: needs public evidence (a public repro or measurement) before it can be claimed	DARK
Continuation gap: twins share the field hash but differ in 2235 walked process slots (41 changed, 1481 only from-log, 636 only snapshot, 77 alias moves; 6061 vs 5216); learning-hot tail forks the hash; incremental parity xfail-pinned; 5 of 49 state owners not spliceable	DARK: needs public evidence (a public repro or measurement) before it can be claimed	DARK

DARK (do not type a number)

• Live before/after replay of signed bridges on real data.
• How many production learning events have recorded nodes since the caller was fixed.
• Any external witness or third-party re-derivation; the chain is local.
• Any adversarial attempt to forge an empty diff while learning; no red team exists beyond the gauge red-teaming of the link field.
• Cross-platform bit-exactness of v1 and v2; CPU numpy is the only measured regime.

Threats to validity

• Self-certification: the same code computes the hashes and writes the nodes. Without independent replay the certificate is a self-report; the paper must give the verifier's procedure.
• The sheet is not a complete invariant; two physically different fields may share a sheet at 10 dp. The decomposition is sound in one direction (sheet moved implies physical change) and only evidential in the other.
• v2 quotients relabeling only. Azimuth and the global X/Y flip move v1 and are caught by the sheet, not by v2; we do not claim v2 is a full gauge quotient.
• The continuation gap is measured once on one world and is a declared lower bound.
• The strobe at the driver's rest window assumes a driver with a rest window; a world that never rests needs a different section.
• One author; the referees are the owner's CI tests. Security reviewers will ask for a threat model.

What this paper is not

• Not a proof of learning, not a claim about what data entered the model, and not a defence against membership or dataset inference.
• Not a cryptographic protocol: no zero knowledge, no external transparency log, no Merkle consistency proofs.
• Not a claim that hidden process state is covered; the continuation gap is the boundary.
• Not a quantum computing paper; everything runs on a CPU.
• Not a paper about, or citing, any earlier deployment the engine descends from.

Luke's steps, if he wants to submit

1. Today: ORCID; an OpenReview profile as "Independent Researcher" with the portfolio site as homepage showing the registration email. Moderation can take two weeks.
2. arXiv: register with organization "Independent"; start a cs.CR submission to trigger the endorsement email; find endorsers via "Which authors of this paper are endorsers?" on the abstract pages of Jia et al. (2021) or Thudi et al. (2022). One cs endorsement covers cs.CR and cs.LG. Since 2026-01-21 the automatic path needs an academic email and prior arXiv authorship in the domain, so expect the personal-endorsement path; staff cannot waive it.
3. Have a seat expand this into the TMLR LaTeX style, anonymized (no repository names, no site); code and tests go in an anonymized zip supplement.
4. Re-run [private, withheld], [private, withheld], [private, withheld] and [private, withheld] on a fresh checkout; regenerate empty_diff_figure.png from the frozen/live run and record the content hashes and commit SHA in an appendix. (DARK: needs public evidence (a public repro or measurement) before it can be claimed.)
5. Write the verifier's procedure (how a third party re-derives v1, v2 and the sheet from the log) before submission; it is the first question reviewers will ask.
6. Decide the door: TMLR now (rolling, no fee; a named arXiv preprint is allowed) or SaTML 2028 (pattern late Sept 2027, in person). TMLR does not accept expanded conference papers, so the order matters.
7. Submit on OpenReview; log the submission in the authority record when there is a receipt.