Sahek/hydra-cage-traces

Hydra Cage Attestation Traces

Traces from The Hydra Cage, a containment architecture for autonomous AI in which a breached layer is never patched: it is frozen, severed, sealed as forensic evidence, permanently revoked, and replaced by a freshly measured domain instantiated outside the attacker's position.

Try the architecture live in your browser: huggingface.co/spaces/Sahek/hydra-cage

⚠️ This data is synthetic

Every row was produced by running the reference implementation, not by observing a production system. There is no real attacker here and no real compromise — the "attacks" are a scripted adversary suite deliberately tampering with layers so the detection path can be exercised.

Treat it as a benchmark and teaching artifact, not as evidence about how real AI containment failures look in the wild. Nobody has a corpus of those, which is part of why this exists.

Configs

Drawn from 797 cage runs. ~105k rows total.

from datasets import load_dataset

quotes      = load_dataset("Sahek/hydra-cage-traces", "quotes")
transitions = load_dataset("Sahek/hydra-cage-traces", "transitions")
telemetry   = load_dataset("Sahek/hydra-cage-traces", "telemetry")

quotes — one row per attestation quote, labelled

The interesting one. Each row is a challenge-response between the sentinel and one containment layer, split into two halves:

Two exceptions worth knowing about: self_unresponsive and self_nonce_echo_ok carry the self_ prefix because they live inside the self-report structure, but the sentinel sets them — the first when the domain's process failed or timed out, the second by comparing the echoed nonce against the one it issued. A domain cannot make either of them say what it wants. Exclude them if you want a strictly attacker-controlled feature set.

Label is trusted (bool), with reject_category giving the reason as a stable enum: self_report_contradiction, unapproved_measurement, nonce_replay, law1_self_attestation, law4_revoked, heartbeat_missing, signature_invalid, hw_binding_mismatch, nonce_echo_failed, clean, …

attack names the adversary technique in flight, or none.

transitions — one row per breach transition

All eight stages with per-stage timings and success flags: detect, freeze, sever, preserve, revoke, rebuild, reattest, reinsert. Plus depth before and after, the sealed artifact's size and SHA-256, the revocation ledger head, and whether the replacement came from a pre-warmed pool or a cold build.

telemetry — one row per supervisor event

The raw append-only event log: plane, event kind, severity, domain, and a JSON detail blob. Use it to reconstruct a whole session.

The experiment this dataset is for

The architecture's central claim is that being able to speak like a layer is not sufficient to be one. A compromised layer can forge a byte-perfect heartbeat — right nonce, right shape, reporting the exact pre-compromise measurement — and still be caught, because the sentinel never asked the domain what its measurement was.

What the deterministic rule does

This is the part that actually matters, and it is not a learned model:

Every single quote where the domain's claimed measurement disagreed with what the supervisor observed was rejected. No false negatives. That is a rule, not a classifier, and it is the mechanism the architecture rests on.

What a learned model does — and an honest surprise

I expected attacker-controlled fields to be near-useless for prediction. They are not:

Base rate of rejection is 11.1%. HistGradientBoostingClassifier, 70/30 stratified split.

The observed features win, but the gap is much smaller than the architecture's rhetoric would suggest — and most of that 0.852 is an artifact of this harness, not a property of real attackers. Several scripted attacks (self_attestation, identity_resurrection, replay_quote) construct forged quotes that omit a registers block entirely, so self_entrypoint is null, and null correlates almost perfectly with rejection. A competent adversary would populate that field with something plausible and erase most of the signal.

So: treat 0.852 as a ceiling produced by lazy synthetic attackers, not as evidence that self-reports are trustworthy. If you want a harder benchmark, filter to attack in ('perfect_liar', 'tamper_payload') — the two techniques that do produce a full, plausible self-report — and see how much is left.

Note that entrypoint_matches is a derived convenience column comparing self_entrypoint against obs_entrypoint. Both raw columns are present, so you can recompute it or drop it.

A finding from the transitions config

prewarm is not a micro-optimisation. Median rebuild time:

Stage 6 dominates the entire eight-stage transition, and keeping a spare domain hot removes it from the critical path — a 10× reduction in total containment downtime.

Other things you can do with it

• —Anomaly detection on quotes with the label withheld — the classes are naturally imbalanced, roughly 10% rejected, which is the realistic regime.
• —Latency analysis on transitions — which of the eight stages dominates, and how much prewarm actually saves on the critical path.
• —Invariant checking — effective_after > effective_before should hold on every single transition row. If you find a counterexample, that is a genuine bug in the implementation and I would like to know.
• —Sequence modelling on telemetry, grouped by run_id and ordered by seq.

Generation

git clone https://github.com/kaymyg/hydra-cage
cd hydra-cage
python dataset/generate.py --out dataset/build \
    --clean 300 --attack 600 --single 500 --treadmill 900

This release was generated in seven time-boxed shards on two cores, which is why it is ~105k rows rather than larger. --max-seconds N stops and writes whatever finished, so the generator degrades gracefully under a job timeout. On an unconstrained machine the command above produces roughly five times as much in about 40 minutes.

Four run profiles: clean (healthy cage, repeated attestation), attack (the full ten-attack suite), single (one attack in isolation, for cleaner labels), and treadmill (many forced transitions, to sample the depth invariant heavily).

Runs use the memory backend, which has an identical trust protocol to the Docker and process backends — the same 58 tests pass against all of them — but no real isolation. Backend is recorded per row.

Limitations

• —Synthetic. Said once at the top; worth saying twice.
• —The adversary is scripted, not adaptive. A real attacker would probe for the weakest check rather than run ten fixed techniques.
• —Hashes are environment-specific. obs_firmware and obs_kernel encode the generating machine. Do not treat these as globally meaningful values.
• —Class balance is an artifact of the run mix, not a natural base rate.
• —Some attacks are easier than they should be. Three of the ten construct forged quotes with no registers block, making them trivially separable on a null check. See the modelling section above — this inflates any classifier trained on attacker-controlled fields.
• —No real compromise ever occurred. Tampering is performed by the harness writing to a layer's payload from the supervisor side, because the point is to exercise detection, not to pretend prevention failed.

Licence and citation

Apache-2.0. See CITATION.cff in the repository.