Frontier Security Research

After auditing 26 existing concepts + 6 hardening enhancements, we identified eight defense domains that the current architecture does not cover at all. These are entirely new structures that fill critical gaps.

Architectural gaps

N1. Cryptographic Graph Shredding (CGS)

GDPR Article 17 / CCPA deletion requests cannot be satisfied by SQL DELETE alone — WAL logs, FTS5 indices, embedding vectors, and filesystem sectors retain data. CGS makes deletion cryptographically irreversible.

Per-node key derivation

Each node v_i gets a unique encryption key derived via HKDF: ki = HKDF(master_key, node_id || epoch). All node data is encrypted with k_i using AES-256-GCM. Deletion = destroying the key via SecureZeroMemory(ki). The ciphertext remains on disk but is cryptographically unrecoverable.

Keys are never stored at rest — they are re-derived from the master key on demand. The Key Ledger stores only derivation metadata and key hashes for verification.

Cryptographic deletion proof

After deletion, attempt decryption with the destroyed key → failure is recorded as cryptographic evidence of deletion completeness. Integrates with CAV's Proof of Forgetting.

Novelty: ★★★★ — Crypto-shredding exists at Google/AWS scale, but node-granularity shredding covering embeddings + inference residue in a personal knowledge graph is world-first.

Adversaries: A4 (disk theft), A5 (legal compulsion). Phase: 1–2.

N2. Forensic Integrity Layer (FIL)

The current 7-layer security model (L1–L7) lacks a post-incident analysis layer. After a breach, there is no way to prove "what leaked, when, and to what extent." FIL adds L8 on top of E3 (Immutable Audit Commitment).

L8 architecture

FIL Analyzer processes E3's append-only audit buffer: pattern detection (frequency/timing anomalies), blast radius estimation (SBRC integration), evidence preservation, and optional SIEM export (CEF/JSON format for ArcSight, Splunk, QRadar).

Privacy-preserving forensics

Core principle: record behavioral patterns, never knowledge content. FIL records event types, affected node counts, CSEB rule IDs, decisions, and posture levels — but never records node IDs, content, queries, entities, or URLs.

Novelty: ★★★★★ — Privacy-preserving forensics in a personal browser is world-first.

Adversaries: A2–A5. Phase: 2.

N3. Speculative Execution Firewall (SEF)

Spectre-class attacks are not fully mitigated by Gecko Fission's Site Isolation. When LLM inference and Context Graph reads coexist in the same process, cache timing attacks can leak embedding vectors.

Four mitigation layers

Novelty: ★★★ — retpoline/SLH are existing, but applying Spectre mitigations specifically to in-browser LLM inference is novel.

Adversaries: A4. Phase: 2–3.

N4. Graph Export Anonymization (GEAP)

When users export or share research sessions, the graph structure itself acts as a fingerprint. Degree distribution, clustering coefficients, and spectral properties are individually unique (Narayanan & Shmatikov, 2009).

Anonymization pipeline

Four-stage structural perturbation applied at export time:

AGTR's Topological Invariant Monitor scores graph identifiability before export and auto-adjusts GEAP perturbation intensity.

Novelty: ★★★★ — Graph DP exists academically, but a complete export anonymization protocol for personal knowledge graphs is first.

Adversaries: A1, A3. Phase: 2–3.

N5. Verifiable Supply Chain (VSCA)

Quira embeds llama.cpp, ONNX Runtime, SQLite, and OpenSSL. Without integrity verification, a SolarWinds-style attack compromises all users. VSCA also provides defense against A5 (vendor distrust).

SLSA Level 3 + Sigstore

Novelty: ★★★ — SLSA/Sigstore are established, but SBOM covering in-browser LLM runtimes is first.

Adversaries: A5. Phase: 1–2.

N6. Formal Security Invariant Engine (FSIE)

CBS capability token decisions, IFC label propagation, and CTA trust judgments can all be broken by implementation bugs. FSIE uses TLA+ formal verification to prove that security invariants hold mathematically.

TLA+ specification

The Context Graph Access Gateway (CGAG) state machine is specified in TLA+ with four key invariants:

Property-based testing

10K+ randomized request sequences per CI run verify that the Rust implementation matches the TLA+ specification. TLC model checker runs on every PR.

Novelty: ★★★★ — AWS uses TLA+ for SDN/S3, but applying it to a browser capability model is first.

Adversaries: All classes (prevents implementation bugs). Phase: 1.

N7. Cognitive Query Normalization (CQN)

NL query linguistic patterns (vocabulary, syntax, abbreviation frequency) identify users with >95% accuracy (Narayanan & Shmatikov, 2008 stylometry). CQN extends E5's basic canonicalization into a full cognitive fingerprint defense system.

Query stylometry attack

Linguistic fingerprint features: vocabulary distribution, syntax tree depth, abbreviation rate, query length distribution, and topic transition patterns — the last being the most powerful identifier.

Advanced normalization

Beyond E5's basic pipeline, CQN adds: (1) domain-adaptive synonym dictionaries via local LLM, (2) ML-based style neutralization transforming queries into "style-neutral form", (3) probabilistic query batching with dummy injection, (4) topic transition smoothing inserting bridge queries to prevent pattern detection from sudden topic jumps.

All normalization happens on-device. Only normalized queries leave the device.

Novelty: ★★★★★ — Systematic query linguistic fingerprint erasure exists in no browser or search engine.

Adversaries: A1, A5. Phase: 2.

N8. DP Budget Controller (DPBC)

Existing concepts (AGTR, CSELP) say "inject DP noise" but leave ε values, cumulative budget tracking, and exhaustion behavior undefined. DP guarantees degrade cumulatively — without budget management, DP is security theater.

Budget model

Default monthly budget: ε = 1.0 (between Apple's 2–8 and Google RAPPOR's ln(3) ≈ 1.1). Composition tracking via zCDP (zero-Concentrated DP) for the tightest guarantees (ρ_i = ε_i²/2).

Privacy budget UI

Real-time budget gauge at quira://settings/privacy/budget showing consumption by component (AGTR, CSELP, GEAP), remaining ε, and reset date. All noise injection happens on-device — the server never knows ε.

Novelty: ★★★★ — No browser integrates a privacy budget UI managing cross-component zCDP budgets.

Adversaries: A1, A5. Phase: 2.

Priority map

Coverage improvement

New attack vectors