Reachability, Not Observation: Containing Systems Whose Wiring Changes
Theoretical study shows snapshot-based containment vastly underestimates required blocks when wiring changes, proposing reachability-based declared capability maps instead.
The paper analyzes what network-structure snapshots miss when connectivity changes over time, showing on a rotating hypercube that defenders see 2 crossing edges where 8,194 must be blocked, a factor of 4,097. On the real Internet the gap is only x1.5-2.0, indicating the blind spot is introduced by design, as with round-robin optical datacenter fabric schedules. A declared capability map validated by static call-graph reachability catches all 8 planted holes versus 2 for a deny-list, and the framework extends to frequency hopping, air gaps, and coding-agent tool surfaces.
- Snapshot-based containment can underestimate required blocks by up to 4,097x
- Real-Internet blind spot is x1.5-2.0 once growth is removed
- Declared capability maps caught all 8 planted holes vs 2 for deny-lists
- Framework covers frequency hopping, air gaps, and coding-agent channels
Full article320 words · extracted from arxiv.org · click to collapse
Containment decisions -- where to put a firewall, which links to monitor, what a program may reach -- are computed from an observed structure, and observation is a snapshot. We ask what a snapshot misses when the wiring changes over time. On a hypercube whose active dimension rotates, a balanced split shows zero crossing edges at 93% of instants, yet 8,192 edges must be blocked permanently; adding one always-on ring, a defender sees 2 where 8,194 must be blocked, a factor of 4,097. A time-aware defender holds 585 blocks on average, but one step of clock lag drops its containment to 0%. On the real Internet the same gap is only x1.8-2.0 (1997-2000) and x1.5-1.6 (2024-2026) once growth is removed, so the blind spot is introduced by design, not inherited from the world -- and it has been designed: the round-robin schedules of optical datacentre fabrics have a gap equal to their period. A declared capability map, checked by static reachability over a real application's call graph, catches all 8 planted holes; the string deny-list previously in place catches 2. One calculation generates every number from one parameter, the period, and reads three boundaries not usually called schedules: frequency hopping, whose standard results are these closed forms with channels in place of edges; the air gap, whose always-on crossing set is empty and whose known breach came at the one phase a snapshot misses; and the tool surface of a coding agent, inventoried from the inside. Turning the cuts on that agent: idle, its instantaneous state cut is zero, while 6 channels carry it across a context reset, none of them the network, so severing the network removes 0. The channel that spawns copies is a branching process with a sharp threshold at approval rate 1/b, below which denial is unnecessary and above which denial is insufficient. Contain by the paths that exist, not by the behaviour that was seen.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.19720