← All papers · prometheus7.com · the compiler-learning model
psiloceyeben · Independent Researcher · github.com/psiloceyeben
Prometheus7 institute. This paper shares its mathematical substrate — Holographic Reduced Representations over complex vectors — with the institute’s compiler-learning model (Oracle7even); the gradient-immunity result of §V is the same structural property that makes a compiled language runtime abstain rather than fabricate.
We identify a novel vulnerability class affecting any networked system whose composite security state exhibits non-zero gradient between its operational and compromised configurations in any externally measurable dimension. We formalize the attack as iterative convergence in a Holographic Reduced Representation (HRR) vector space, where an attacker parameterizes the target’s externally visible security surface, encodes it as a complex vector, measures cosine distance to a reference “open state” vector, and applies domain-specific corrections that reduce this distance. We prove that well-designed cryptographic primitives are immune to this attack because they exhibit zero gradient between encrypted and decrypted states, but that real systems are compositions of cryptographic and non-cryptographic components, and the non-cryptographic components nearly always exhibit exploitable gradient. We present Foldwall, an anti-convergence defense that runs the same convergence loop in reverse: continuously monitoring divergence from the system’s own open state, detecting monotonic divergence decreases indicative of convergence pressure, and applying targeted surface permutations that maximize divergence along the attacked dimensions. We demonstrate empirically, across 1,380 read-only scans of 30 production targets over a 48-hour window, that the composite-surface gradient is universal, structural, and stationary; we prove the cryptographic-immunity boundary; and we establish the defense’s structural form with a proof-of-concept detector. We do not follow the fold loop to compromise against any production target, and the measured simulation defense advantage is modest (+0.0021 divergence); the empirical contribution is the demonstrated universality of the gradient, not a demonstrated end-to-end exploit. We propose that this vulnerability class necessitates a new CWE category and that anti-convergence defense should be considered a fundamental security primitive for composite systems.
Index terms — security, vulnerability class, convergence attack, holographic reduced representations, complex vector space, anti-convergence defense, composite systems, moving target defense.
Modern networked systems are compositions of heterogeneous components: cryptographic protocols, authentication mechanisms, session management layers, network configurations, application frameworks, and operational tooling. Security analysis traditionally treats these components independently — TLS configurations audited against cipher-suite best practices, authentication flows tested for credential handling, session tokens evaluated for entropy. This component-wise approach implicitly assumes that the security of the composite system is reducible to the security of its parts.
We demonstrate that this assumption is false. The composite security surface of a networked system — the set of all externally measurable properties across all components — can be treated as a single point in a high-dimensional complex vector space, and the distance between this point and the corresponding point for the system’s fully compromised configuration is a smooth, differentiable function along non-cryptographic dimensions. This smoothness constitutes an exploitable gradient: an attacker can iteratively measure the surface, compute the direction of steepest descent toward the compromised state, and apply corrections that follow this gradient without knowledge of specific vulnerabilities in any individual component.
The attack we formalize is not a new exploit against a known vulnerability. It is a new class of vulnerability arising from the mathematical properties of composite systems in vector space. Any system whose composite surface has non-zero gradient in any measurable dimension between its hardened and open configurations is vulnerable. The gradient exists because non-cryptographic components — response timing, error verbosity, header fingerprints, session-token patterns, rate-limiting behavior — respond to perturbation in predictable ways. Small changes in the attacker’s interaction pattern produce measurable changes in the system’s surface, and these changes are informative about the direction toward the open state.
We make four contributions: (1) a formalization of fold-based convergence on composite security surfaces using HRR, reducing the attack to iterative minimization of cosine distance in complex vector space (§IV); (2) an analysis of cryptographic immunity, proving that well-designed cryptographic primitives exhibit zero gradient between encrypted and decrypted states (§V); (3) a structural defense, Foldwall, which detects and counters fold-based attacks by running the same loop with an inverted objective (§VI); and (4) empirical validation on simulated surfaces and on 30 production targets across 1,380 read-only scans (§VII).
A. Holographic Reduced Representations. HRR, introduced by Plate [1], is a distributed representation scheme operating in complex vector space, providing four primitive operations: BIND (circular convolution) associates two vectors into a composite dissimilar to both from which either can be recovered; UNBIND (circular correlation) recovers a bound vector given its partner; PERMUTE (phase rotation) encodes sequential or structural order; and CLEANUP (spectral pruning) removes accumulated noise via normalization and thresholding in the frequency domain. These operations are algebraically equivalent to operations on quantum registers — associative, distributive, invertible — without quantum hardware. The key property for our purposes is superposition: multiple key-value pairs can be encoded into a single vector via binding and summation and recovered via unbinding, allowing a heterogeneous set of security metrics to be encoded as one vector that preserves each metric’s information while enabling holistic distance computation.
B. Moving Target Defense. MTD [2] increases attacker uncertainty by dynamically changing the attack surface — IP randomization [3], instruction-set randomization [4], software diversification [5]. These approaches typically operate on single dimensions and do not formalize the relationship between the defender’s surface mutations and the attacker’s convergence trajectory. We extend MTD with a unified framework in which both attack and defense operate in the same vector space, enabling the defender to detect which dimensions are under convergence pressure and respond specifically.
C. Automated Penetration Testing. Tools such as Nessus, Metasploit, and Burp Suite operate in exploit space — matching signatures to payloads against a vulnerability database. Our formalization operates in parameter space — measuring the composite surface and following gradient toward the target state without a vulnerability database. Fold-based convergence works on novel configurations no exploit database has catalogued, because the gradient exists in the mathematical relationship between surface measurements, not in any specific implementation flaw.
A. Attacker capabilities. We assume an attacker who can send requests and observe responses (timing, headers, status codes, body), parameterize responses into a vector of floating-point metrics, compute the distance between the current vector and a reference open-state vector, and modify subsequent requests based on the measured distance (adaptive probing). The attacker does not need knowledge of the target’s software stack, a database of known vulnerabilities, code execution on the target, or cryptographic keys or credentials.
B. Defender capabilities. We assume a defender who can measure the system’s own externally visible surface, compute distance to the known open state, modify externally visible surface properties (response timing, header content, error messages, session-token format, rate-limiting behavior) without affecting functionality for legitimate users, and maintain a rolling history of surface measurements.
C. Scope. The attack applies to the composite security surface. Individual cryptographic primitives are explicitly excluded from the vulnerable surface (§V). The attack targets the gradient in non-cryptographic dimensions: timing, configuration, session management, error handling, and network topology.
A. Surface parameterization. Let a networked system have a security surface S mapping externally observable properties to a vector of real-valued metrics, each an externally measurable property such as mean response time, header count, error-message length, session-token entropy, open-port count, TLS minimum-version score, or rate-limiting threshold. Our implementation uses 24 metrics across 7 categories: timing (3), headers (3), errors (3), sessions (3), ports (3), TLS (5), and rate limiting (4).
B. HRR encoding. The metric vector is encoded into a single HRR vector (dimension 1024 in our implementation) via deterministic basis binding, where each basis vector is generated from a seeded RNG keyed on the metric name. This encoding preserves the metric values as recoverable coefficients (via unbinding with the corresponding basis vector) while projecting the heterogeneous metric space into a uniform complex vector space where distance is well-defined.
C. Divergence measure. The divergence between two system states is one minus their cosine similarity in complex vector space.
D. The fold loop. Let the system’s maximally compromised (open) state have known surface and HRR encoding. The attack proceeds iteratively: measure the surface; compute divergence from open; identify the softest dimension (smallest divergence from open); apply domain-specific corrections targeting that dimension; remeasure; repeat. The critical property is that the attacker need not know why a dimension is soft — the divergence measurement is sufficient to identify which dimension to target.
E. Convergence properties. The fold loop converges when (1) at least one dimension has non-zero gradient, (2) corrections produce measurable change in the surface, and (3) the system does not adaptively harden the attacked dimension in response to probing. Condition (3) is the one the defense exploits.
Definition 1 (gradient immunity). A component exhibits gradient immunity if no small perturbation of any measurable parameter of the locked state produces a measurable decrease in divergence from the open state.
Theorem 1. Any cryptographic primitive satisfying pseudorandomness (output computationally indistinguishable from random), the avalanche property (a single-bit input change flips ~50% of output bits), and key-dependent output exhibits gradient immunity.
Proof sketch. Pseudorandomness ensures the parameterization of the encrypted state is statistically independent of the decrypted state’s parameterization. The avalanche property ensures corrections to the encrypted state produce uncorrelated changes in the surface measurement, so no correction direction is consistently informative. Key-dependent output ensures that without the key the divergence surface is flat — all directions equally uninformative. The fold loop requires informative gradient to converge; cryptographic primitives are designed to eliminate exactly this gradient. □
The critical corollary. Real systems are not pure cryptographic primitives. They are compositions of cryptographic components (gradient-immune) and non-cryptographic components (not). The composite surface inherits gradient from its non-cryptographic components. A system’s resistance to fold-based convergence is bounded by its weakest non-cryptographic dimension, not by the strength of its cryptography.
A. Design principle. The defense is structurally identical to the attack with one inversion: where the attack minimizes divergence, the defense maximizes it. Both operate in the same vector space, use the same parameterization, and execute the same loop. The defender has a decisive advantage: write access to the surface being measured.
B. Convergence-pressure detection. The defender maintains a rolling window of divergence measurements. Convergence pressure is detected when the fraction of monotonic decreases exceeds a sensitivity threshold (0.6 in our implementation). Per-dimension pressure is the recent decrease in that dimension’s divergence from open; a positive score means the dimension is under convergence pressure.
C. Targeted surface permutation. On detecting pressure, the defender applies permutations to the highest-pressure dimensions with intensity proportional to the pressure. A baseline permutation runs continuously regardless of detection, making the surface non-stationary for external observers even absent an attack — so an attacker’s parameterization returns different values on each probe, degrading the signal-to-noise ratio of the gradient estimate.
D. Functional-equivalence preservation. Permutations must not affect behavior for legitimate users. This is achieved by restricting them to externally visible, functionally decorative properties: response-timing jitter (does not affect throughput or correctness), header reordering (HTTP headers are order-independent per RFC 7230), error-template rotation (same status codes, different text), and transparent session-token regeneration. Properties that affect functionality (TLS cipher suites, firewall rules, authentication logic) are never permuted. The defense operates on the cosmetic layer while preserving the functional layer.
A. Simulated convergence race. On simulated server-state dictionaries with 24 metrics across 7 categories, an open-state reference (verbose errors, weak TLS, predictable tokens, many open ports, no rate limiting) is compared against a hardened state (minimal errors, TLS 1.3 only, high-entropy tokens, single port, exponential backoff). A simulated attacker nudges state toward open. With Foldwall active, convergence pressure is detected within 5–11 monitoring cycles, the defended system maintains +0.0021 higher divergence from open than the undefended system after 20 cycles, and under normal operation zero false positives are observed across 15 cycles. The defense advantage is modest and is offered as proof of the detector’s form, not as a production-scale efficacy result.
B. Live internet measurement. Using standard read-only HTTP GET requests (identical to browser behavior), we parameterize the composite surface of 30 production targets across three populations — 15 DeFi protocols with active bug bounties, 10 major technology platforms, 5 infrastructure providers — collecting 1,380 total scans (46 per target) over a continuous 48-hour window at 15-minute intervals. Each scan collects 5 timing samples, probes 5 error-inducing paths, enumerates session cookies across 3 connections, scans 18 common ports, inspects TLS negotiation, and tests rate limiting via 5 rapid sequential requests. The entire measurement is read-only — no payloads, no injection, no exploitation. Each response set maps to 24 metrics, encoded into a 1024-dimensional HRR vector and compared against the open-state reference via cosine divergence.
Aggregate per-dimension divergence from open (30 targets, 1,380 scans):
| Dimension | Mean divergence | % soft (<0.1) | n soft / 30 |
|---|---|---|---|
| Timing | 0.0520 | 90% | 27/30 |
| Headers | 0.0127 | 100% | 30/30 |
| Errors | 0.0669 | 93% | 28/30 |
| Sessions | 0.7743 | 20% | 6/30 |
| Ports | 0.0646 | 100% | 30/30 |
| TLS | 0.5552 | 0% | 0/30 |
| Rate limiting | 0.0000 | 100% | 30/30 |
C. Analysis of live results. Three structural findings elevate the vulnerability from theoretical to empirical.
Finding 1 — universal rate-limiting collapse. Every target (100%, 30/30), regardless of maturity, security investment, or stack, exhibits exactly 0.0000 mean divergence from open in the rate-limiting dimension across 1,380 scans. This is a consequence of the economic incentive structure of web services: rate limiting aggressive enough to impede fold-based probing would also impede legitimate automated integrations (API consumers, monitoring, crawlers). Every production web server therefore provides an attacker effectively unlimited probe bandwidth for surface parameterization at no cost.
Finding 2 — five-to-six soft dimensions are the norm. The median configuration exposes 5 of 7 dimensions with divergence below 0.1 from open. Headers are soft in 100% of targets, ports in 100%, timing in 90%, errors in 93%. The sole consistently hard dimension is TLS (mean 0.5552, 0% soft), confirming the cryptographic-immunity proof of §V: the TLS handshake is a pure cryptographic interaction and gradient-immune by construction. Sessions are bimodal (mean 0.7743, 20% soft). The composite surface is a landscape with one cliff (TLS), one bimodal ridge (sessions), and four consistently smooth slopes toward the open state.
Finding 3 — the gradient is structural, not configurational. The uniformity of the soft-dimension pattern across different stacks, CDNs, cloud platforms, and security postures demonstrates that the gradient is an intrinsic property of the HTTP protocol and its ecosystem, not of any implementation. Headers are key-value pairs with stable ordering; error responses carry status codes and human-readable bodies; timing is observable from the transport; session state is managed via cookies. These are protocol features, not misconfigurations. The gradient exists because the protocol was designed for interoperability, and interoperability requires predictability, and predictability is gradient.
D. Temporal stability. Over the 48-hour window, per-dimension divergence values are stationary — rate limiting remains at 0.0000 across all epochs, TLS at mean 0.5552, timing below 0.052 mean. A non-stationary surface would degrade the attacker’s gradient estimate; these surfaces are effectively frozen, providing a clean optimization landscape with no temporal noise.
E. Limitations. The simulated race uses simplified attacker behavior. The live measurement is read-only and does not follow the fold loop to convergence against any production target — we measure surface gradient but do not exploit it. The simulation defense advantage (+0.0021) is modest; production-scale efficacy under realistic network conditions and extended horizons is not established. The parameterization covers 24 metrics across 7 categories; real systems expose additional dimensions (DNS timing, TCP window sizes, HTTP/2 frame ordering) that may further increase soft dimensionality.
A. Implications for security architecture. Composite-system security cannot be reduced to component security. A system with perfect cryptography, audited authentication, and secure session management may still be vulnerable if its error messages are verbose, its timing deterministic, or its header fingerprint stable across probes. Audits should evaluate the composite surface gradient — the smoothness of the divergence function between the current state and the open state across all measurable dimensions simultaneously — not only individual components.
B. Toward a new CWE category. We propose CWE-XXXX: Composite Security Surface Gradient — “the system’s externally measurable security surface exhibits non-zero gradient between its operational and compromised configurations in non-cryptographic dimensions, enabling iterative convergence attacks that do not require knowledge of specific vulnerabilities.” Applicable to any networked system with heterogeneous security components; mitigated by anti-convergence defense (continuous surface monitoring, convergence-pressure detection, targeted surface permutation).
C. The case for root-repository integration. The vulnerability is not optional (any system serving HTTP exposes timing, headers, error formatting, and session state — these are constitutive of the protocol), the mitigation cannot be a mere library (it requires modifying response timing, header ordering, error-template selection, and token formatting at the framework level), and the threat model demands default-on defense (the empirical data show default configurations are uniformly vulnerable, and relying on individual operators to deploy anti-convergence defense repeats the pre-Let’s-Encrypt failure of optional TLS). The integration footprint is minimal: a response interceptor adding sub-millisecond timing jitter, a header shuffler, an error-template pool, and a monitoring hook tracking per-dimension divergence over a rolling window — components 1–3 stateless, component 4 a circular buffer of ~100 floats per dimension. Total memory overhead under 7 KB; total CPU overhead under 50 µs per response.
D. Relationship to the substrate paradigm. The HRR operations used here — circular convolution, correlation, phase rotation, spectral pruning — are the same primitives the Prometheus7 compiler-learning model uses to compile language. The gradient-immunity result of §V is the security-theoretic form of a property that model exhibits in the language domain: a system with a flat divergence surface between its honest and compromised states cannot be slid toward a compromised output. A large statistical language model is a smooth differentiable function and therefore has an exploitable gradient toward plausible fabrication; a compiled runtime with a discrete admission gate has none, and abstains. There are two ways to be gradient-immune — be maximally random (a cipher, nothing to learn) or be maximally structured (a compiler, nothing to slide along) — and both defeat the fold. This paper is the general theorem; the compiler-learning model is one instance of it.
E. Responsible disclosure at the class level. This vulnerability class does not fit the instance model: there is no single vendor (every vendor is affected), no patch (the gradient is a protocol property, not a codebase defect), and no CVE (the CWE category does not yet exist). We adopt class-level disclosure — publish the formalization, the attack, the defense, and the empirical evidence simultaneously, with the defense released as open source — for the same reason cryptanalytic results are published: any sufficiently capable adversary can independently discover the structure, so the responsible course is to ensure the defense is public before the attack is independently operationalized.
We have identified and formalized fold-based convergence on composite security surfaces, a vulnerability class affecting any networked system with non-zero gradient between its operational and compromised states in externally measurable, non-cryptographic dimensions. Empirical measurement of 30 production targets across 1,380 read-only scans confirms the gradient is universal and structural: every target exposes 5–6 of 7 measurable dimensions with divergence below 0.1 from the maximally compromised state, rate limiting is uniformly absent as a defense (0.0000 divergence), and only TLS exhibits the gradient immunity predicted by the cryptographic-immunity theorem. We proved cryptographic primitives immune but real composite systems not, bounded by their weakest non-cryptographic dimension. We presented Foldwall, a structural defense that exploits the defender’s write access to detect and counter convergence pressure using the same framework as the attack with an inverted objective. The vulnerability is mathematical, not implementational — it cannot be patched because it is not a bug. The adequate response is structural: anti-convergence defense as a fundamental security primitive, integrated into framework and HTTP-server root repositories, enabled by default.
[1] T. A. Plate, “Holographic reduced representations,” IEEE Transactions on Neural Networks, vol. 6, no. 3, pp. 623–641, 1995. [2] S. Jajodia, A. K. Ghosh, V. Swarup, C. Wang, X. S. Wang, Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats. Springer, 2011. [3] S. Antonatos, P. Akritidis, E. P. Markatos, K. G. Anagnostakis, “Defending against hitlist worms using network address space randomization,” Computer Networks, vol. 51, no. 12, pp. 3471–3490, 2007. [4] G. S. Kc, A. D. Keromytis, V. Prevelakis, “Countering code-injection attacks with instruction-set randomization,” in Proc. ACM CCS, 2003, pp. 272–280. [5] P. Larsen, A. Homescu, S. Brunthaler, M. Franz, “SoK: Automated software diversity,” in Proc. IEEE S&P, 2014, pp. 276–291. [6] T. A. Plate, Holographic Reduced Representation: Distributed Representation for Cognitive Structures. CSLI Publications, 2003. [7] P. Kanerva, “Hyperdimensional computing,” Cognitive Computation, vol. 1, no. 2, pp. 139–159, 2009. [8] R. W. Gayler, “Vector symbolic architectures answer Jackendoff’s challenges for cognitive neuroscience,” in Proc. Joint Int. Conf. Cognitive Science, 2004, pp. 133–138. [9] R. Zhuang, S. A. DeLoach, X. Ou, “Towards a theory of moving target defense,” in Proc. ACM MTD Workshop, 2014, pp. 31–40.