]> Sovereign Stack Global

chamara@anthosa.com

Security SCITT Working Group Internet-Draft This document defines the Sovereign Tensor Container (STC-1.0) and Sovereign Tensor Provenance (STP-1.0) specifications. STC-1.0 establishes a strict 64-byte physical memory alignment standard for binary machine learning tensor payloads to enable zero-copy Direct Memory Access (DMA). STP-1.0 defines an embedded cryptographic provenance framework utilizing C2PA profiles, X.509 signature chains, and SCITT-compatible attestations to secure supply-chain integrity for distributed AI models.

Introduction The proliferation of large neural networks has exposed severe fragmentation in model distribution and supply-chain security. Existing container formats rely on out-of-band metadata files and arbitrary-length headers, which force unaligned memory access during host-to-device transfers and break cryptographic provenance chains upon redistribution. This document proposes an architectural framework to secure the AI supply chain by embedding Supply Chain Integrity, Transparency, and Trust (SCITT) principles directly into the tensor payload container. The foundational architecture is published under Zenodo .

STC-1.0: Memory Alignment Architecture To achieve true zero-copy Unified DMA, STC-1.0 dictates a hermetic binary container utilizing strict 64-byte physical cache-line alignment. All metadata preceding the tensor payload MUST be dynamically padded. Runtimes MUST apply the following mathematical constraint to calculate the padding length (in bytes) before the payload initiates: padding = (64 - (length (mod 64))) (mod 64) This alignment ensures execution runtimes can mmap the artifact and dispatch it directly to the GPU without CPU byte-shifting.

STP-1.0: Cryptographic Provenance (TRUST Block) The STP-1.0 specification defines a mandatory TRUST block within the STC header structure. This block acts as a cryptographic execution gate for inference engines.

C2PA and X.509 Integration The TRUST block MUST contain: An AI-specific C2PA manifest detailing training data lineage and synthetic token ratios. An X.509 certificate chain binding the artifact to a verified developer identity. An absolute SHA-256 payload hash of the aligned tensor bytes.

SCITT Attestation By embedding these cryptographic claims natively, the STC artifact functions as a self-contained Statement for a SCITT Transparency Service. Inference runtimes SHOULD verify the X.509 signatures and payload hash against a trusted SCITT ledger before allocating VRAM.

Security Considerations Traditional ML checksums are easily spoofed during man-in-the-middle redistribution, leading to weight poisoning. STP-1.0 mitigates this by mandating cryptographic signature verification at the engine level. A compromised private key could allow an attacker to sign a poisoned model; therefore, short-lived certificates and Time-Stamp Protocol (TSP) integration are strongly recommended.

IANA Considerations This document requests the registration of a new media type, application/vnd.stc, to identify Sovereign Tensor Container artifacts.

&RFC5280; &RFC3161;