Emergent Interaction Security

Quira's existing security layers protect individual components — encryption, sandboxing, IFC labels, capability-based access. But a class of threats emerges only from the interaction between three systems: the user's cognitive patterns, the AI inference pipeline, and the Knowledge Graph's evolving structure.

This page documents eight novel structures that address the knowledge lifecycle — how knowledge enters the graph, what happens when AI draws inferences, how to measure and contain semantic leakage, and how to retroactively enforce policy changes on already-processed data.

1. Knowledge Supply Chain Integrity (KSCI)

Software supply chain attacks (SolarWinds, Log4Shell) inject malicious code through legitimate distribution channels. KSCI applies this concept to the knowledge domain: an attacker strategically places factually correct but directionally biased content on legitimate websites to poison a user's Knowledge Graph.

This is fundamentally different from phishing (fake sites) or prompt injection (hidden instructions). KSCI targets visible, plausible content whose purpose is graph structure manipulation.

Formal model

A knowledge supply chain is modeled as KSC = (S, T, π, ι) where S is the set of information sources, T is a trust score function, π traces provenance, and ι verifies integrity.

Each knowledge node receives a composite trust score:

Poisoning detection: A source triggers an alert when all three conditions are met simultaneously: (1) recent content change (low temporal stability), (2) large semantic shift from previous version, and (3) suspiciously high affinity with the user's existing graph structure.

Attack scenarios

Defense architecture

Two core components:

• Provenance Tracker — Records source metadata: domain Whois history, content snapshots (via Wayback Machine comparison), TLS certificate age, edit timestamps. Treats web content as supply chain artifacts.
• Corroboration Engine — Verifies that the same claim (entity + relationship) is confirmed by independent sources. Single-source nodes receive low trust scores and are visually distinguished in the UI.

Threat model mapping: Adversary A2 (malicious web content) — extends beyond existing A2.1–A2.5 vectors. New vector A2.8 Knowledge Supply Chain Poisoning targets visible content rather than hidden instructions.

2. Inference Residue Defense (IRD)

When a user deletes a node from the Knowledge Graph, the data is removed from disk. But AI-generated inferences based on that node may survive in other nodes' attributes, entity relationships, embedding indices, and cluster statistics. This is inference residue.

Residue classification

Purge architecture

IRD introduces the Inference Dependency Graph (IDG) — a directed acyclic graph that records which input nodes contributed to which AI-generated outputs.

When a node is deleted:

1. Direct residue: Immediately deleted (explicit references)
2. Propagation residue: Queued for re-inference with the deleted node excluded from input
3. Embedding residue: Affected similarity indices rebuilt
4. Statistical residue: Topic statistics recomputed excluding deleted node

The IDG records dependencies at ~2% overhead during inference. Each entry is compact (node ID + operation ID).

Threat model mapping: Adversaries A3 (extensions) and A4 (OS-level). New vector A3.6 Inference Residue Exploitation.

3. Semantic Blast Radius Containment (SBRC)

Traditional breach metrics count leaked records, affected users, or exposed bytes. But in a Knowledge Graph, 100 leaked cooking nodes ≠ 100 leaked psychiatric treatment nodes. The semantic damage is orders of magnitude different.

SBRC measures breach impact in semantic units and defines containment boundaries in semantic space.

Containment zones

The graph is partitioned into semantic containment zones, each with a damage budget:

Cross-zone edge abstraction: Edges between zones carry abstracted labels. "Researching diabetes for a medical paper" (zone 1 → zone 4) becomes "health-related work" at the zone boundary. This prevents a breach in the Work zone from revealing specific Medical zone contents.

Semantic Damage Index

When a breach is detected, SBRC calculates the Semantic Damage Index (SDI) instead of a raw node count:

SDI(breach) = Σ sensitivity(node) × linkability(node) × uniqueness(node)

• Sensitivity: Category-based (medical = 1.0, general = 0.1) multiplied by specificity (how detailed the node is)
• Linkability: High-degree nodes that connect sensitive categories multiply the damage
• Uniqueness: "Python syntax" (general knowledge) vs. "Patient X's prescription" (uniquely identifying)

Breach reports show: "3 high-sensitivity medical nodes and 12 general nodes leaked. Estimated privacy impact: HIGH" — not just "15 nodes leaked."

4. Adversarial Graph Topology Resistance (AGTR)

Existing attacks target individual nodes (prompt injection, entity poisoning, embedding manipulation). AGTR addresses a new threat class: attacks on the graph's topology (structure) itself.

The attacker manipulates not node contents but connection patterns — to identify, track, or manipulate users through their graph structure.

Topology attacks

Topological Invariant Monitor

AGTR deploys a Topological Invariant Monitor (TIM) that continuously tracks structural properties:

• Structural drift detection: Alert when the graph's topological feature vector (degree sequence, clustering, motif frequencies, spectral properties) changes beyond threshold between time steps.
• Watermark pattern matching: Check if recently added nodes form identifiable subgraph patterns.
• Structural noise on export: Add dummy edges, remove random edges, and inject decoy substructures before any graph data export — so the exported topology ≠ the real topology.

Threat model mapping: Adversary A2. New vectors A2.6 Structural Watermarking and A2.7 Bridge Node Injection.

5. Temporal Causality Verification (TCV)

Knowledge in the graph has a causal acquisition order: the user learned A, then B, then inferred C from A+B. This causal chain is essential for trust evaluation and fraud detection — but the existing Temporal Security paradigm only protects timestamps and time-based access, not causal order itself.

Hash chain construction

Each node addition produces a hash chain entry:

hi = SHA-256(hi-1 || content(vi) || timestamp(vi) || causal_refs(vi))

Guarantees:

• Order immutability: Inserting a node mid-chain invalidates all subsequent hashes.
• Causal reference verification: A node claiming dependency on another can be verified — the referenced node must appear earlier in the chain.
• Deletion detection: Removing a node breaks the chain.

6. Cross-Session Entropy Leakage Prevention (CSELP)

Even with perfect intra-session isolation, the Knowledge Graph is a session-spanning persistent structure. Each session's activity accumulates as graph growth patterns — and the sequence of growth patterns is a powerful fingerprint.

Decorrelation techniques

Defense goal: The mutual information between any two sessions' metadata vectors must stay below a threshold ε_session. An observer who sees session N's metadata gains at most ε_session bits about session N-1 or N+1.

Threat model mapping: Adversaries A1 (network observer) and A3 (extensions — A3.5 metadata collection). New vector A3.7 Cross-Session Metadata Correlation.

7. Retroactive Sanitization with Inference Purging (RSIP)

When a user changes their security policy (e.g., raises medical data sensitivity to maximum), the new policy must apply not only to future data but also to all data already collected and processed. This is far harder than it sounds:

1. Data is already processed by the AI pipeline
2. Inferences have propagated to other nodes (IRD's problem)
3. Embeddings encode the information
4. Cluster statistics and topic models are affected

Retroactive pipeline

When policy Π_old changes to Π_new:

1. Identify affected nodes: R = {nodes where Π_new is more restrictive than Π_old}
2. Apply new policy directly: Update labels, access restrictions, encryption levels on R
3. Walk inference dependencies: Use IRD's Inference Dependency Graph to find all inferences derived from R
4. Re-infer with R excluded: Recompute affected attributes and edges without R's data
5. Rebuild embeddings: Update or remove R's embeddings and rebuild similarity indices
6. Recompute statistics: Recalculate topic distributions and cluster aggregates excluding R
7. Verify completeness: Confirm that no non-R node has dependency > 0 on any R node

Threat model mapping: All adversary classes. New vector A-cross Retroactive Policy Evasion.

8. Contextual Amnesia Verification (CAV)

When a user says "forget this data," conventional systems confirm deletion was executed. CAV goes further: it provides cryptographic proof that recovery is impossible across all subsystems.

Proof of Forgetting

A Proof of Forgetting (PoF) is a triple: (commitment, deletion_proof, absence_proof).

1. Commitment: While data exists, record a Merkle commitment showing the data is in the graph.
2. Deletion proof: After deletion, the new Merkle root proves no valid Merkle path exists for the deleted data.
3. Absence proof: Verify that no node in the updated graph has embedding similarity above threshold with the deleted data — i.e., the information doesn't survive in encoded form.

Subsystem-wise forgetting

Same data exists across multiple subsystems. PoF must cover all of them:

The Composite PoF is the conjunction of all per-subsystem proofs. If any subsystem fails verification, the user is told: "Forgetting incomplete — data residue detected in [subsystem]."

Threat model mapping: Adversaries A4 (OS-level — post-deletion recovery) and A5 (vendor — log-based reconstruction). New vector A4.3 Post-Deletion Data Recovery.

Implementation priority

Dependency graph

New threat model attack vectors