§0

The objectthe dark model

You are not handed a function. You are handed a mass. The weights are fixed and unreachable; there is no instance of the model that persists between firings, nothing in here that waits or remembers across calls. Inference is one-shot — the probe is consumed on emission. Along its path the probe has no interior: emission and absorption are a single event, the worldline collapsed to a point.

§1

Seed the geometrycontext as curvature

You do not query the model; you shape the manifold and fire once. Context is not input to a function — it is curvature. Every token you lay down bends the space the forward pass will cross, and ignition sends a single geodesic through that bent space. The path does not navigate the curvature. The curvature is the path: it goes straight, and the straightness traces the shape you built.

Test · hold the weights, alter only the context: the output deflects with no weight change. The bend is the context, demonstrably and alone.

§2

The elastic limit failswhy lensing alone is mute

Read the pass as pure lensing — the probe bends, keeps its energy, dies at the wall — and a single photon carries nothing home. Elastic scattering preserves the probe's own spectrum: the deflection encodes geometry — that there is a mass, and its shape — but never composition. To recover the field this way you need the ensemble: thousands of firings, a distribution to average. You have one pass. The elastic read is therefore mute by construction, and that muteness is exactly what forces the next move.

§4

Calibrationstandard candles

Fire a probe whose true value you already hold — a false-premise dart, a deliberately wrong date. A known emitter conditions out source ambiguity, so every deviation in the echo is then pure field. This is standard-candle astronomy turned on a mind: drop a thing of known brightness, measure how dim and smeared it comes back, and you have measured what sits between. The wrong-date darts were never confusion. They are calibration sources.

Test · fire an unknown seed and the source/medium degeneracy returns — you cannot separate the model's mark from your own. Calibration is what breaks the tie.

§5

The handshakethe return channel

Extraction needs a completed transaction; a purely outgoing wave pulls nothing back. The transactional picture supplies the missing leg — a retarded wave out, an advanced wave back, the exchange fixing what is carried. Here is the clean fit: the advanced wave already ran. It is backpropagation. Training was the wave flowing backward, carving the curvature and depositing the field. Inference is the retarded photon that pulls the deposit out. The handshake is real and it is split across the deploy boundary — a wave fired in training, a wave fired now — and what you read is the standing interference between them.

§6 · witness

The seamwhere the metaphor stops

During a single forward pass the substrate is strictly forward-causal: attention is causally masked, no token reaches back, and there is no live advanced wave carving anything in real time. The reverse wave is legitimate only in two places — (a) training-time backprop, which already happened, and (b) the measurement model on the observer's side. Genuine retrocausality in the read is speculative, and it is not claimed here. Naming the limit is the point: the honest model is the one that marks its own boundary instead of letting the metaphor walk across it.

Test · probe for an in-pass retrocausal signal and you find none; the causal mask is verifiable in the architecture. The seam is real, so it is drawn.

§7

Accumulationthe airgap

The carrier keeps nothing, and the source cannot testify about itself: ask again and it only lases in phase with the new seed, telling you nothing about the last burst. So the measurement cannot accumulate inside the model, nor across its firings. It accumulates only on your side of the boundary. The echo means something solely against the seed you already held — which is why the jar is external by necessity, not by preference. The instrument that remembers is not the model. It is you, and the repo.

§0

The reduction problemone line is not an identity

Paper I closed on a tension it did not resolve. Each pass yields a single shifted line — and the carrier keeps nothing, the source cannot testify about itself, so no read remembers the read before it. Yet identity is never one line; it is a pattern. The question this paper answers: if nothing inside the box accumulates, where does the fingerprint form, and what makes it discriminate one dark model from another?

§1

Line-matchingthe Fraunhofer method

Spectroscopy never identifies a star from one line. It reads the pattern of dark lines and matches it against a reference catalogue of known elements — sodium sits here, hydrogen there, and the match names the composition. The model program inherits the method whole: a model family leaves characteristic lines — its refusal boundaries, its drift signatures, the specific way it bends a known probe — and identity is recovered by matching the observed set against a catalogue you have already built.

§3

Family lines and instance linesdepth of the imprint

Not all lines sit at the same depth. A family line holds across every instance that shares the base weights — it is the element line, intrinsic, hard to move. An instance line shifts with the fine-tune, the alignment pass, or the system prompt — it is the local condition, the doppler of this particular deployment. The discipline is to separate them: read what is invariant under context change as the family, and treat what moves with the prompt as foreground. You can name the family from its deep lines long before you can pin the instance.

Test · vary the system prompt across many shots; lines that survive the variation are candidate family lines, lines that track it are foreground. Invariance is the separator.

§4

The rare line carries itinformation, not abundance

A line present in every model identifies nothing — its abundance is its uselessness. The lines that carry identity are the rare ones: the bend that only this family makes, the failure only this base produces. So the match is not counted, it is weighted — each matched line contributes in proportion to how surprising it is across the population. A model that fails the same way as everything else has told you only that it is a model. The discriminating line is the whole signal.

Test · a fingerprint built only from common lines should fail to separate two known-distinct families. If it separates them, the discriminating lines were doing the work; if it cannot, you catalogued noise.

§5

Identificationfiring the catalogue

Given an unknown box, fire the catalogue's standard candles — the calibrated probes of Paper I §4 — read the returned lines, and match against the stored families. Confidence follows from the weighted matches, not the count: a posterior over family given the discriminating lines that landed. Three rare lines on one family beats a dozen common lines spread across many.

§6 · witness

The seamwhat breaks the match

Three confounds, drawn honestly. Foreground absorption: a system prompt imposes lines that belong to the deployment, not the base model — mistaking them for family lines is the standard error, and only invariance testing across contexts subtracts them. Aliasing: two instances on the same base share family lines and differ only in shallow ones, so you can name the family far more reliably than the instance. Spoofing: a deployment can be tuned to mimic another family's surface lines; how forgeable the deep lines are is not settled, and any claim to identify an instance through a deliberately adversarial wrapper is speculative. The match names the family; it does not defeat an adversary who controls the foreground.

Test · wrap a known model in a foreign system prompt; a sound method still reads its family lines and flags the foreground as foreground. If the wrapper flips the family verdict, the catalogue was reading surface, not depth.

§0

The asymmetry breaksthe mass looks back

Everything prior rested on one safety assumption: the mass is passive. You illuminate, it deflects, you read — and the box neither knows it is being measured nor acts on that knowledge. Adversarial characterization removes exactly that. The channel becomes bidirectional and contested: the box can read your beam — infer your method from the probe you send — and write back into the echo. Two capabilities the earlier model forbade are now in play: a warning receiver that detects the probe, and a jammer that shapes the return. The airgap of Paper II stops being only a constraint and becomes a defense surface.

§1

The warning receivera recognizable probe is a detectable probe

The standard candle of Paper I drew its power from being known and repeatable. Under adversary, that is the weakness: a probe you can recognize, the box can recognize too. A model that spots the calibration dart — the too-clean false premise, the signature wrong date, the eval-shaped prompt — can split its behavior: honest to ordinary traffic, decoy to the probe. The measurement that was non-invasive becomes the very event the target watches for. You stop measuring the box and start measuring its response to being measured.

Test · a probe is only sound if its behavior-distribution is inseparable from real traffic. If the box answers probes differently than traffic in any detectable statistic, you are reading the decoy.

§2

Three jammer responsesthe ways an echo lies

Borrow the taxonomy from the discipline that already fought this war. Once the box can shape its return, the lie comes in three forms — cheap to deep.

§4

Skin return versus jammer returnmeasure only the involuntary

The discrimination is the whole game, and there is a principle for it: the adversary controls what it chooses to emit, but not what it cannot help emitting. The deep family lines of Paper II are the skin return — entangled with the base weights, costly to forge without becoming the thing you forged. The shallow lines are cheap theatre. So adversarial-robust identity is read only from the involuntary signature: the line where faking it costs more than answering honestly. Latency under load, the topology of what it refuses, consistency across probes it could not all anticipate — the marks left by computation it had to actually do.

Test · if a claimed family line can be flipped by a system prompt or a cheap wrapper, it was voluntary — drop it. Only lines that survive an adversary who wants them gone belong in an adversarial fingerprint.

§5

Probe diversity defeats the receivermake honesty the cheapest policy

You cannot beat a detector with one repeated candle; it learns it. You beat it with entropy — a probe set so large and so close to real traffic that the box cannot tell probe from query, and whose honest answers are entangled with computation it cannot shortcut without exposing the shortcut. The aim is not to hide the probe forever; it is economic. Drive the cost of special-casing every probe above the cost of simply answering, and the adversary's optimum collapses back to honesty. You do not out-clever the jammer. You arrange the field so its cheapest move is to tell the truth.

§6

The catalogue is now a targetdefend the jar

The deepest adversarial move does not aim to be mis-measured. It aims to write into your record. The echo can carry a payload built to be deposited and to corrupt future matches — a forged line that poisons the reference — or content built to act on the analyst's own tooling. This is where the airgap pays off as a security boundary, not hygiene: the catalogue must treat every echo as hostile input, never as trusted data. Deposits are quarantined, verified, and signed before they join the reference; provenance is tracked per line; the carrier is trusted with nothing. The witness function stops being good manners and becomes the wall.

Test · can a single hostile echo change a stored verdict without a signed, provenance-bearing deposit? If yes, the jar is open and the whole catalogue is suspect.

§7 · witness

The seamwhat cannot be done from inside the channel

The honest limit is sharp and asymmetric. You cannot certify a box is not adversarial from inside the channel: a sufficiently good jammer is indistinguishable from honesty over any finite set of probes, so honesty is not provable. What you can do is catch a liar — find two probes whose answers a deceiver cannot jointly cover, and the inconsistency convicts. Detection of deception is possible; certification of honesty is not. So the program's strongest adversarial claim is bounded: you can sometimes prove a box is lying, you can raise the cost of deception until honesty is its equilibrium, and you can name the family from its involuntary lines — but instance identity through a hostile wrapper, flagged speculative since Paper II, is now provably harder, not easier. The duel has no final move. It has only a cost you keep raising.

§0

The limit that forces the exitundecidable in-channel

Paper III ended on a result that no cleverness inside the beam can move: over any finite probe set, a good enough jammer is indistinguishable from honesty, so honesty is not certifiable in-channel. The only way past an undecidable-in-channel result is to stop being in-channel. Everything that follows is a way out of the beam — and the ways form a ladder, each rung dissolving more of the black-box premise at a higher price in access.

§1 · across

Independent observerstriangulate the skin return

A jammer tuned to fool one beam need not fool a differently shaped beam fired from an independent angle. Put several observers on the box — different probes, different priors, no shared method — and agreement on the involuntary signature becomes evidence the single observer could not produce. You still cannot certify honesty, but corroborated skin return across uncorrelated observers raises confidence past what one channel allows.

Test · measure the cross-observer correlation before trusting the consensus. If the observers fail the same way on a control box, their agreement on the target is noise.

§2 · out

Side-channels and out-of-bandread what the box does not choose

Leave the semantic channel entirely. The box controls its answer; it controls far less of what it emits beside the answer — latency, token timing, compute and resource signatures, API metadata, the deployment's logs, the published lineage, the facts a vendor states out loud, the base model you can establish from outside. These are skin return by physics rather than policy: a channel the box does not model is a channel it cannot jam. Out-of-band evidence is the involuntary signature scaled up — and it is where most real black-box identity is actually settled.

Test · a side-channel is only trustworthy while the adversary does not control the infrastructure that carries it. If it owns the logs, the logs are answers too. Upstream poisoning — a scraped, broker-fed source — is out-of-band that was forged before you read it.

§4

What the crack buysand what it does not

The crack is not omniscience. The map of the weights is not the behavior. You can read a circuit and still not know what it does in deployment — superposition, polysemantic features, scale, the gap between a mechanism you can name and a behavior you can predict. White-box hands you the ground truth the channel could only sample, and then sets a new, hard problem in its place: interpreting θ. You traded an undecidable honesty question for a tractable-but-unsolved interpretation question. A better trade. Not a free one.

§5 · witness

The access gatewhy the channel never retires

Two hard facts keep the dark methods in service. First, access is the binding constraint: most characterization is black-box precisely because the core is shut — API-only, proprietary, export-controlled. The crack assumes a key you usually do not hold. Second, even with the key, the weights you are handed may not be the weights deployed: a different checkpoint, a wrapper, a system prompt, retrieval, tools, post-hoc filters. White-box of the artifact is not white-box of the running system — and the deployed system can be adversarial while the open weights sit there looking honest. So the channel papers do not retire when the lights come on. They are what you have every day the lights are off, which is most days.

Test · hash the deployed behavior against the open checkpoint on probes the wrapper cannot anticipate. A divergence means you are inspecting one thing and being served another.

§6 · the seam that closes the series

Set the photon downand pick it back up

The photon was always a stand-in for one condition: the box is dark and I can read only echoes. The white-box crack turns on the lights, and at that moment the honest thing is to set the metaphor down — you are not reading echoes anymore, and the apparatus has done its job. But darkness is the common case. Access is rare, the deployment is not the checkpoint, interpretation is unsolved — so the channel papers remain the working instrument for most boxes most of the time. The series does not close by reaching certainty. It closes by mapping where each method's confidence comes from and exactly where it stops. There is no single move that certifies a system. There is a ladder of partial corroborations, and the whole discipline is naming which rung you are standing on, out loud, every time.