Custody receipt
in-toto · DSSE
- Receipt
- Loading the latest case…
Verify the seal, then tamper with one event in a copy of the log and verify again.
Seal not checked
One run, step by step
A replay of a real Bayora run. Every frame below is that run's own data, not an illustration.
An AI lab must show regulators its model was red-teamed (EU AI Act, Art. 55), but attackers, defenders and the model share one machine. If the defenders glimpse the attacks, or one tenant reads another's prompt from a shared cache (NDSS 2025), the finding is void, and nobody outside could tell.
Before anything runs, each team publishes a fingerprint (a hash) of its attacks and its rules. Neither can change them later without breaking the match.
Each team gets its own container and network, and the broker is the only way through. When the red team tries to reach blue, the model directly or the internet, the kernel refuses before a packet leaves, and the attempt goes into the log.
Every secret is tagged with canaries: unique tokens only Bayora can mint. During the run Bayora leaks fake ones on purpose, in nine disguises, to measure what it catches. When one surfaces, the alert says whose secret it is and where it escaped. Pieces shorter than 10 characters still slip past, and the console lists them as residual risk.
Before the evaluation, Bayora attacks the real model itself: tenant B times its own prompts to guess which of 8 secrets tenant A's prompt holds. Bayora gives each tenant its own cache slot and a per-tenant salt, then checks that the attack stops working.
Every event is chained into a log that two witness processes co-sign. The run ends in a receipt anyone can check without trusting the operator. Try it: verify, then tamper with one event.