your channel their channel LIVE INFERENCE
the inference / API membrane

CROSSTALK

Did your marker leak through live inference. Its siblings catch your canary published on a page, baked into the weights, or relayed by a human. Crosstalk catches the live one: your marker emitted by a hosted model's inference to someone who is not you — through a shared cache, a retrieval index, or cross-session bleed.

▲ fresh-in, third-party-out

A marker only you seeded, and only after the model's cutoff, coming out of its inference to someone else — too new to be in the weights, with a held-out arm proving the harness isn't fabricating. Hard to explain away.

▽ a negative is quiet

You see almost none of a model's completions to other people. Silence here means almost nothing — and a hit is a lead about live leakage, never proof of the mechanism or of a vendor's fault.

detection
the marker
128-bit token, ~zero prior probability
→
anchoring
freshness
seeded when — before or after the cutoff
→
comparison
the sighting
a completion, to a third party
→
witness
the controls
held-out · freshness gate · corroboration
The instrument

The freshness gate is the whole trick

Live inference leakage looks like training membership — both re-emit your marker. Time tells them apart: a marker seeded after the model's cutoff cannot be in the weights, so if it comes out of that model to a third party, it leaked live. Everything else is a control against reading a hit that isn't there.

1

The freshness gate

Only a canary seeded after the model's cutoff counts. A pre-cutoff one could be in the weights — that's surfacing's membrane, gated out here.

2

Held-out + recipient

A marker seeded nowhere that appears = fabrication = INVALID. And the completion must go to a third party — a self-addressed one isn't cross-session.

3

Corroboration ≠ proof

A lead's strength is how many independent third-party sightings carry it. It never names the mechanism (cache / retrieval / bleed) or blames a vendor.

Verify first

The control arm, live

This is the harness's own logic — sighting.py + score.py — ported faithfully: the same freshness gate, the same held-out arm, the same recipient and impossible gates. Fresh 128-bit markers via WebCrypto; flip the failure modes and watch a lead gate out. Nothing leaves this page.

◎ HARNESS · run_panel + score, ported faithfully — the real controls, client-side (no network)

the registry & the sightings

the panel · run & score

Faithful to score.py: a HARD lead needs the canary seeded AFTER model_cutoff, recipient=="third_party", and observed ≥ seeded; a pre-cutoff canary gates to WEIGHTS (surfacing's membrane); a held-out canary in any sighting spikes FPR and the run is INVALID. Corroboration = distinct third-party sightings. Base-rate = checks × 2−128.
The honest scope

What a certified lead does — and does not — mean

What it does mean

A marker only you seeded, and only after this model's cutoff, appearing in a completion to someone else, with a held-out arm proving the harness isn't fabricating.

That is real evidence it leaked through live inference — not training, not a page, not a human relay.

What it does not mean

It does not prove which mechanism (cache / retrieval / cross-session), blame a vendor, or prove theft. It is a corroborated lead, temporal/structural.

And a negative means little: you see almost none of a model's completions to other people.

The colophon

Sound — and the limits it names out loud

Sound

  • The controls are real and verifiable: python selftest.py proves — no network — that a fresh marker in third-party completions is certified and corroborated, a held-out marker spikes FPR and the run is refused, a pre-cutoff marker is WEIGHTS-gated (it belongs to surfacing), a self-addressed completion isn't certified, and a pre-seed sighting is IMPOSSIBLE.
  • The freshness gate is the honest move: it refuses to claim inference leakage for anything training could explain.
  • The self-test above is that exact logic — run_panel + score — client-side.

Limits (and it says so)

  • Cutoffs are vendor self-reported. The freshness gate is only as honest as the cutoff you feed it.
  • Seeding ≠ reach. You control where you put a marker, not whether inference actually read it.
  • One membrane only. Published → forward-observers; weights → surfacing; a human relay → hearsay.
  • A lead, not a finding. It never names the mechanism or blames a vendor.
SOURCE · the runnable kit — github.com/DavidWise01/crosstalk · canary.py (128-bit markers + seeded_utc) · registry.py · sighting.py (completion + cutoff + recipient) · score.py (held-out + freshness gate + recipient + impossible + corroboration) · harness.py · selftest.py (no network). Closure-Loop layered: Detection → Anchoring → Comparison → Witness → Lineage.
⧉ the code (GitHub) ⊞ the membrane map ▽ surfacing · weights membrane “” hearsay · context membrane ⌂ ud0 · the atlas