Metraipolis › archive › dc_8daddbd69948

Reachability, Not Observation: Containing Systems Whose Wiring Changes — arXiv:2609.19720

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.19720
License (as archived): CC0-1.0
Archived: 2026-10-10T04:00:02.738Z
SHA-256 of the archived text: ef38f3768feb3ceab7718e19db1bcd2dcccc4310ccbba034edf1a3ee91a87b84
Stable URL of this page: https://metraipolis.com/documento/dc_8daddbd69948

How to cite

Reachability, Not Observation: Containing Systems Whose Wiring Changes — arXiv:2609.19720 — arXiv (en), https://arxiv.org/abs/2609.19720 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_8daddbd69948 (Metraipolis archive dc_8daddbd69948, sha256 ef38f3768feb3ceab7718e19db1bcd2dcccc4310ccbba034edf1a3ee91a87b84)

BibTeX

@misc{dc8daddbd69948,
  title = {Reachability, Not Observation: Containing Systems Whose Wiring Changes — arXiv:2609.19720},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.19720},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_8daddbd69948; sha256 ef38f3768feb3ceab7718e19db1bcd2dcccc4310ccbba034edf1a3ee91a87b84},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.19720. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Containment decisions -- where to put a firewall, which links to monitor, what a program may reach -- are computed from an observed structure, and observation is a snapshot. We ask what a snapshot misses when the wiring changes over time. On a hypercube whose active dimension rotates, a balanced split shows zero crossing edges at 93% of instants, yet 8,192 edges must be blocked permanently; adding one always-on ring, a defender sees 2 where 8,194 must be blocked, a factor of 4,097. A time-aware defender holds 585 blocks on average, but one step of clock lag drops its containment to 0%. On the real Internet the same gap is only x1.8-2.0 (1997-2000) and x1.5-1.6 (2024-2026) once growth is removed, so the blind spot is introduced by design, not inherited from the world -- and it has been designed: the round-robin schedules of optical datacentre fabrics have a gap equal to their period. A declared capability map, checked by static reachability over a real application's call graph, catches all 8 planted holes; the string deny-list previously in place catches 2. One calculation generates every number from one parameter, the period, and reads three boundaries not usually called schedules: frequency hopping, whose standard results are these closed forms with channels in place of edges; the air gap, whose always-on crossing set is empty and whose known breach came at the one phase a snapshot misses; and the tool surface of a coding agent, inventoried from the inside. Turning the cuts on that agent: idle, its instantaneous state cut is zero, while 6 channels carry it across a context reset, none of them the network, so severing the network removes 0. The channel that spawns copies is a branching process with a sharp threshold at approval rate 1/b, below which denial is unnecessary and above which denial is insufficient. Contain by the paths that exist, not by the behaviour that was seen.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-18 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Networking and Internet Architecture (cs.NI).
Pagina del lavoro: https://arxiv.org/abs/2609.19720 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-10T03:26:20.867Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-18?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).