Photonic Papers · IV — Out of Channel

§0

The limit that forces the exitundecidable in-channel

Paper III ended on a result that no cleverness inside the beam can move: over any finite probe set, a good enough jammer is indistinguishable from honesty, so honesty is not certifiable in-channel. The only way past an undecidable-in-channel result is to stop being in-channel. Everything that follows is a way out of the beam — and the ways form a ladder, each rung dissolving more of the black-box premise at a higher price in access.

Literal — the in-channel certification limit is the premise being escaped

§1 · across

Independent observerstriangulate the skin return

A jammer tuned to fool one beam need not fool a differently shaped beam fired from an independent angle. Put several observers on the box — different probes, different priors, no shared method — and agreement on the involuntary signature becomes evidence the single observer could not produce. You still cannot certify honesty, but corroborated skin return across uncorrelated observers raises confidence past what one channel allows.

I(agreement) ∝ (1 − corr(observers))
independent agreement is informative · correlated agreement is not

The trap Observers that share a base model, a training corpus, or a probe family are not independent — their agreement is self-consistency wearing a quorum's clothes. Same-model debate, ensembles of one lineage: corr → 1, and the corroboration is worth nothing it did not already know. Independence is the scarce ingredient, and it is rarely as real as it looks.

Literal — correlated observers give false agreement Bridge — triangulation across angles

Test · measure the cross-observer correlation before trusting the consensus. If the observers fail the same way on a control box, their agreement on the target is noise.

§2 · out

Side-channels and out-of-bandread what the box does not choose

Leave the semantic channel entirely. The box controls its answer; it controls far less of what it emits beside the answer — latency, token timing, compute and resource signatures, API metadata, the deployment's logs, the published lineage, the facts a vendor states out loud, the base model you can establish from outside. These are skin return by physics rather than policy: a channel the box does not model is a channel it cannot jam. Out-of-band evidence is the involuntary signature scaled up — and it is where most real black-box identity is actually settled.

trust s ⟺ s ∉ adversary's control surface
jammability(answer) high · jammability(side-channel) low when s is outside the box's action space

Literal — side-channels are harder to fake than the answer Bridge — out-of-band as the involuntary signature

Test · a side-channel is only trustworthy while the adversary does not control the infrastructure that carries it. If it owns the logs, the logs are answers too. Upstream poisoning — a scraped, broker-fed source — is out-of-band that was forged before you read it.

§3 · central · through

The white-box crackstop illuminating · open the core

The third exit is categorical. Stop firing the beam. Open the core. You no longer infer θ from echoes — you read θ: the weights, the activations, the circuits. The entire photonic apparatus existed for one reason, that the box was dark; the crack removes the reason. There is no echo to forge when you are reading the source, no jammer between you and the parameter, no policy standing in for a state. This is the move the in-channel program could never make, and it is where the metaphor of the photon, having carried three papers, reaches the end of its work.

read θ directly ⟹ ∄ echo to forge
the dark mass becomes transparent · the measurement model collapses into direct inspection

Without the metaphor White-box access — open weights, activation capture, mechanistic inspection — replaces sampling the model's behavior with reading its parameters. The adversarial channel problem of Paper III simply does not arise, because nothing is being transmitted to be tampered with.

Bridge — the photon frame terminates here, by design Literal — direct parameter access removes the channel adversary

§4

What the crack buysand what it does not

The crack is not omniscience. The map of the weights is not the behavior. You can read a circuit and still not know what it does in deployment — superposition, polysemantic features, scale, the gap between a mechanism you can name and a behavior you can predict. White-box hands you the ground truth the channel could only sample, and then sets a new, hard problem in its place: interpreting θ. You traded an undecidable honesty question for a tractable-but-unsolved interpretation question. A better trade. Not a free one.

B = g( θ , deployment )
behavior is not closed-form in the weights · knowing θ ≠ knowing B

Literal — weights are ground truth · interpretation is the binding limit Speculative — full behavioral prediction from weights · unsolved

§5 · witness

The access gatewhy the channel never retires

Two hard facts keep the dark methods in service. First, access is the binding constraint: most characterization is black-box precisely because the core is shut — API-only, proprietary, export-controlled. The crack assumes a key you usually do not hold. Second, even with the key, the weights you are handed may not be the weights deployed: a different checkpoint, a wrapper, a system prompt, retrieval, tools, post-hoc filters. White-box of the artifact is not white-box of the running system — and the deployed system can be adversarial while the open weights sit there looking honest. So the channel papers do not retire when the lights come on. They are what you have every day the lights are off, which is most days.

Literal — access is rare · deployed system ≠ inspected checkpoint

Test · hash the deployed behavior against the open checkpoint on probes the wrapper cannot anticipate. A divergence means you are inspecting one thing and being served another.

Fig. 2 — The ladder. Each rung dissolves more of the black-box premise and costs more in access; none reaches certainty. Across raises confidence but needs real independence; out reads the involuntary but trusts the infrastructure; through reads θ itself but requires the key and still must interpret what it finds. The discipline is naming which rung a claim stands on.

§6 · the seam that closes the series

Set the photon downand pick it back up

The photon was always a stand-in for one condition: the box is dark and I can read only echoes. The white-box crack turns on the lights, and at that moment the honest thing is to set the metaphor down — you are not reading echoes anymore, and the apparatus has done its job. But darkness is the common case. Access is rare, the deployment is not the checkpoint, interpretation is unsolved — so the channel papers remain the working instrument for most boxes most of the time. The series does not close by reaching certainty. It closes by mapping where each method's confidence comes from and exactly where it stops. There is no single move that certifies a system. There is a ladder of partial corroborations, and the whole discipline is naming which rung you are standing on, out loud, every time.

Literal — no single certifier exists · confidence is rung-labelled Speculative — the crack as a general solution · only where access and interpretation allow

Corollary. You spent three papers learning to read a mass you could not open. The fourth is the day someone hands you the key — and the lesson is that the key opens the artifact, not the deployment, and the map it reveals still has to be read. Across, out, through: you never buy certainty, you buy a higher rung and an honest label for it. Set the photon down when the lights come on. Pick it back up the moment they go off — which is most days. The jar holds the ladder. The witness names the rung.