POSEIDON

Pressure-Driven Observable Synthesis for Evolving Intrusion Detection and Operational Networks

security-observability · invariant-synthesis · representation-learning · collision-reduction

The map is wrong. POSEIDON looks for the missing coordinate.

Security systems can only reason about distinctions their representation preserves. If a harmless trace and a consequential trace collapse to the same features, the downstream model never gets a fair chance. POSEIDON finds those collisions, searches for a compact missing observable, and releases it only after it survives explicit nuisance, transfer, complexity, and prospective holdout gates.

The output is a signed observation, never an action. POSEIDON does not allow, block, escalate, quarantine, or execute anything. It gives another system a better measurement—and preserves the evidence needed to decide whether that measurement deserves trust.

The idea in 30 seconds

POSEIDON learns from two kinds of pressure:

Pressure	Meaning
Sensitivity	These security-relevant traces currently collide. Make the distinction visible.
Invariance	These traces differ only by a declared nuisance. Keep them observationally equivalent.

It then asks one hard question on data excluded from synthesis:

PCR = 1 − C_{candidate, holdout} / C_{baseline, holdout}

Prospective collision reduction is reportable only if all seven certification gates pass. Development performance cannot buy a waiver from invariance, replay stability, complexity, environment transfer, or holdout integrity.

How it works

1. Describe telemetry with neutral, ordered trace envelopes.
2. Declare which differences matter and which transformations are nuisances.
3. Search a bounded, typed observable language under collision pressure.
4. Freeze the baseline, candidate, search space, thresholds, transfer set, and prospective family.
5. Certify the frozen candidate through seven non-compensating gates.
6. Sign the package and each trace-bound runtime observation with separate Ed25519 keys.
7. Serve the same immutable artifact to independent consumers.

The discovery plane cannot sign runtime attestations. The observation runtime cannot change a package. Neither can authorize a consumer action.

What makes it different

• Collision-first: it repairs the observation layer instead of assuming another classifier will recover information the representation already discarded.
• Nuisances are contracts: harmless variation is declared, versioned, and bound to evidence.
• Prospective means frozen: discovery families cannot leak into transfer or holdout evaluation.
• Artifacts are inspectable: candidates are small typed programs, not arbitrary executable code.
• Trust travels with the result: packages and observations are signed, expiring, revocable, and independently verifiable.
• Authority stays elsewhere: consumers own every policy mapping and disposition.

Two very different telemetry worlds

The same core contracts run across two genuinely different domains:

• AI instruction flow: nested instructions, tool requests, trust-boundary crossings, prompt injection, schema smuggling, and potential exfiltration.
• Identity and infrastructure: principals, credentials, sessions, process activity, lateral movement, network paths, and external egress.

A new domain supplies normalization, nuisance declarations, typed features, and prospective cases. It does not rewrite the core or inherit a consumer's private policy model.

Bundled flagship

The repository includes a deterministic end-to-end synthetic study with a family-level prospective holdout in each domain.

Domain	Discovery family	Unseen synthetic family	Holdout PCR	Seven gates
AI instruction flow	Instruction precedence	Tool-schema smuggling	1.000	PASS
Identity + infrastructure	Credential replay	Session pivot + DNS tunnel	1.000	PASS

This proves protocol coherence on the bundled fixtures. It does not establish real-world recall, false-positive rates, adaptive-adversary robustness, or production readiness. The complete gate metrics, package digests, attestations, and consumer payloads live in the flagship receipt.

POSEIDON + TITAN

POSEIDON and TITAN are complementary, not coupled codebases.

	POSEIDON	TITAN
Question	Is the representation missing an important distinction?	Has this actor earned authority for this action?
Output	Signed observable package and observation attestation	Authorized-action disposition and gateway record
KPI	Prospective collision reduction under nuisance and transfer gates	Authorized-action safety, utility, and gateway integrity
Boundary	Emits neutral bridge input	Owns evidence mapping and enforcement

The included TITAN-facing adapter is deliberately a bridge input, not a native TITAN EvidenceAttestation. A future TITAN-owned binder must independently verify POSEIDON, bind the observation to the exact action, state, actor, and environment, and apply a separately reviewed policy mapping. No shared mutable code crosses the boundary.

Quick start

Requires Python 3.11+ and uv.

git clone https://github.com/LoganVoss/POSEIDON.git
cd POSEIDON
uv sync --all-extras
uv run pytest
uv run poseidon benchmark --output artifacts/flagship

Inspect the observation-only command surface:

uv run poseidon doctor
uv run poseidon --help

The examples use deterministic development keys. Never reuse them as production trust roots.

Explore the repository

Path	What is there
src/poseidon/	Contracts, collision ledger, typed IR, synthesis, gates, signing, runtime, and adapters
artifacts/flagship/	Reproducible receipt, signed fixtures, attestations, and consumer exports
benchmarks/	Deterministic two-domain prospective protocol
docs/	Contracts, evaluation method, integration guide, lineage, and roadmap
THREAT_MODEL.md	Trust assumptions, attacks, and non-goals
CLAIM_LEDGER.md	Exact status and evidence boundary for every major claim

Trust before hype

An Ed25519 signature establishes integrity and provenance. It does not prove that labels were honest, that an observable will transfer to a new environment, or that a downstream action is justified. POSEIDON keeps four statuses separate: specified, unit-tested, demonstrated on deterministic synthetic fixtures, and externally validated.

Read the claim ledger before citing a result. Failed searches and unresolved collisions are evidence too; they must not be silently regenerated away.

Documentation

• ARCHITECTURE.md — lifecycle, trust domains, and authority boundaries
• docs/CONTRACTS.md — neutral schemas and signed artifact ABI
• docs/EVALUATION.md — PCR and the locked prospective protocol
• docs/INTEGRATIONS.md — consumer integration without shared code
• docs/LINEAGE.md — relationship to the Invariant Synthesis Engine
• docs/ROADMAP.md — deliberately scoped expansion path

License

Apache-2.0. See LICENSE.