Project CHRONOS: Ephemeral AI with verifiable cryptographic self-destruct

Project CHRONOS: Ephemeral AI with Verifiable Cryptographic Self-Destruct

The idea started last year when I was contracting training AI models. I kept running into the same problems: agents that couldn't be shut down cleanly, sensitive data you had to trust to a cloud, no way to verify something had actually stopped. I've been working on these issues for almost two years now. I wrote five papers along the way, each covering a different piece, and the plan was always to bring them together into one architecture. That became CHRONOS.

Heron and LTFF both rejected me recently. No detailed reasons so I did my own audit. I went back through the paper and the prototype and I found real mistakes: things I'd missed, claims I hadn't tested properly, code that was more prototype than anything final. I fixed the paper. Then I invested in an RTX 5050 and started rebuilding the prototype properly. I've been on this full-time since the beginning of the year. Right now I'm converting the whole stack from Python to Rust. FHE inference is running through Zama's TFHE-rs on real datasets. Groth16 SNARKs are wired up with arkworks-rs. There's a Solidity verifier. I've built a safety wrapper called PAAC (Provable Alignment via Attestable Constraints) that runs SMT checks before the agent ever executes. Think of it as a code-level boundary enforcer. Plus an eBPF kernel probe, libp2p networking, a WASM dashboard, CI/CD. I can show you the full trace: encrypted input → FHE MLP → PAAC boundary check → VDF lock → SNARK attestation. It's early but it's real. Six months and I'll get it to a point where the community can break it, audit it and actually use it.

I'm building a cryptographic containment layer for autonomous AI agents. It uses FHE, VDFs, and zk-SNARKs to make agents blind to plaintext data, bound to a verifiable mission clock, and provably erasable after shutdown. I'm asking for $37,400 to work on it full-time for six months, complete the Rust rewrite, run honest benchmarks, get a security review, and release everything open source.

What I'm asking for

Six months. Three milestones. At the end, either a working audited system or a published autopsy of why it fails.

Months 1–2: Core Cryptography

Implement Diogenes MPC in Rust. Recruit 2–3 independent parties for the modulus generation ceremony. Destroy local trapdoor knowledge.

Build the full Groth16 ZK-ML erasure circuit in arkworks-rs. Move from the commitment stub to a real constraint system tracing the FHE computation graph.

Deliverable: Live end-to-end demo. You can watch encrypted data flow through FHE inference, hit the VDF lock, and verify the SNARK on a local EVM chain yourself.

Months 3–4: Formal Verification and Honest Benchmarking

Harden PAAC into a production Z3 integration with a real declarative constraint grammar. You write agent.filesystem ⊆ /tmp/mission, PAAC proves it before runtime.

Run FHE benchmarking on rented A100/H100 clusters. Real latency, memory, accuracy from 1M to 1B parameters. No marketing. I'll publish the wall where it stops working.

Deliverable: Public benchmark report and a PAAC test suite with reproducible constraint files.

Months 5–6: Security Review and Release

Commission a targeted cryptographic review. I'll pay an independent cryptographer who knows SNARK soundness and VDF composition. They get the code and two weeks. The report gets published regardless of findings. If the UC composition is broken, we document exactly how.

Release v1.0 under AGPLv3 with full docs and a bug bounty. Reach out to one defense or privacy shop for a sandbox deployment test.

Deliverable: Audited codebase, published audit report, one external test.

Budget — $37,400

Item Amount Why

6-month stipend $24,000 Full-time salary and living expenses.

Heavy compute $5,000 A100/H100 rental for honest FHE benchmarking.

Security review $5,000 Targeted expert review. Focused on SNARK soundness and VDF composition.

Contingency $3,400 Compute overages, tax surprises, auditor scope creep.

This $37,400 is the minimum I need to work on this full-time for six months without taking side contracts. I've self-funded everything to date.

What I'm actually building

I'm building a containment system for narrow autonomous AI agents that handle sensitive data. A cryptographic dead-man's switch for things like medical diagnosis tools, financial auditors, defense analytics—systems that operate on data too sensitive to hand to a cloud provider, and too dangerous to let run unchecked.

Let me be specific, because I've seen the questions coming.

The honest threat model. CHRONOS stops three specific failures:

Data exfiltration: The agent runs under FHE. It never sees plaintext inputs. The operator never sees its internal activations. Compromise the machine, you get ciphertext.

Agent persistence: A VDF time-lock creates a publicly verifiable minimum elapsed time. The agent can't fake completion. Paired with a pre-committed shutdown schedule, it forces a decision: mission completes and attests, or the clock runs out and the operator knows something's wrong.

Undetectable tampering: An eBPF probe watches for memory dumps or unauthorized forks. A SNARK proves the agent ran the agreed shutdown routine—not that it wiped every electron (impossible), but that it executed the zeroization and the hash checks out on-chain.

That's "verifiable erasure": an attestable shutdown commitment, not deletion. The layers stack. If the agent exfiltrated before shutdown, the SNARK won't catch that—but FHE meant it never had plaintext to exfiltrate.

What PAAC actually proves – PAAC is a code-level boundary checker, not alignment. You write constraints like no_syscall_execve, no_outbound_socket, filesystem_access ⊆ /tmp/mission. PAAC compiles those into SMT-LIB, runs them through Z3, and verifies the agent's compiled logic can't violate them before execution. It checks the scaffolding, not the brain.

What FHE actually handles – Right now I'm running MLPs on tabular data. A 70B parameter transformer under FHE isn't viable today. CHRONOS is a containment layer for narrow agents we're deploying now, and a platform to find exactly where the FHE wall is for larger models.

The VDF reality – A VDF enforces a minimum time, not a maximum. It prevents the operator from falsely claiming early completion. Outbound exfiltration via P2P is blocked by PAAC network whitelisting; the libp2p stack is for testing distributed coordination only.

The Diogenes problem – Yes, the VDF uses RSA. Right now I generate the modulus locally—I know the factors. Unacceptable. Diogenes is a multi-party RSA modulus generation protocol, mapped in the preprint but not yet implemented. Months 1–2 are specifically for building that ceremony with 2–3 independent parties. That's the top engineering priority.

The UC composition question. I claimed a UC composition theorem in the preprint. It's a pen-and-paper proof, not machine-checked. Could be wrong. The audit budget is there to pay a cryptographer to validate it or find the flaw. I'll publish the result either way.

Why this matters now

I don't think CHRONOS stops a misaligned superintelligence. The right question is: what infrastructure do we need before AGI, so that when we're close, we have tested containment tools instead of nothing? If we can't cryptographically bound a narrow medical AI, we can't bound a general one. CHRONOS forces the community to confront the actual latency, memory, and protocol limits now, while stakes are lower. The benchmarks alone—honest FHE overhead numbers from 1M to 1B parameters—will be a public good that doesn't exist today. A defense contractor evaluating whether to deploy an autonomous analyst, a privacy startup deciding between FHE and TEEs, an alignment researcher modeling worst-case escape scenarios—they'd all benefit from knowing exactly where the walls are.

Who I am

I'm an independent systems engineer. I build things, then write papers about what I built. In the last year I published five solo-authored preprints, each backed by working code:

Project CHRONOS: A Fully Homomorphic Ephemeral AI Agent with Provable Self Termination and Remote Verifiability

CELLHAWK: A Triply Redundant Navigation Architecture for GPS-Denied and Electronically Contested Environments

The Provably Aligned AI Core: A Deterministic Safety Wrapper for Self-Improving Agents

The Zero-Training Enterprise Brain: A Live Semantic Reasoning Architecture for Training-Free Organizational Intelligence

Building Epistemic Infrastructure for Enterprise AI Search: Why Retrieval Is Not Enough

Bus factor and continuity

I'm a solo FTE. That's a real risk. Here's the mitigation:

Everything is open (AGPLv3, public repos, public benchmarks). If I disappear, another engineer can pick up any module because the documentation is thorough and the tests are reproducible.

I've already had interest from the Zama community for the MPC backend. I've informally discussed the Diogenes implementation with a researcher familiar with TFHE-rs; they're not officially committed, but the engagement shows others can and do pick up the codebase. If funded, I'll formalize that into a contributor role by month four.

This isn't the kind of project that lives entirely in my head. The roadmap is clear, the code is documented, and what's left is mostly building things that are already planned—not waiting for a sudden research insight. Someone else could pick it up and keep going.

Logistical details

I'm based in India. I know direct disbursement can be tricky, so I'll use whatever fiscal sponsorship or payment mechanism the Manifund platform supports. If a fiscal host is needed, I'm already in conversation with a US-based academic lab that can act as a receiver. I'll sort out the exact path before any money moves — just tell me what works and I'll make it happen.

Links

GitHub: https://github.com/sidthebuilder/project-chronos

CHRONOS preprint: https://www.researchgate.net/publication/408413081

Google Scholar: https://scholar.google.com/citations?user=ydi_lA4AAAAJ

Architecture Diagram: https://sidthebuilder.github.io/project-chronos