Equilibrium-Gain Sentinel

Integrate the sentinel at the optimizer-controller boundary, not inside every neural layer. For Adam or SGD, let the protected gain \(k_0\) be the nominal learning-rate multiplier, momentum gain, gradient-clipping gain, or recurrent-state feedback gain; keep a copy of \(k_0\) in a trusted configuration area. At every update, generate a small bounded probe \(q_t\) from a seeded pseudorandom sequence, preferably with zero mean and occasional nonzero amplitudes, and update the sentinel with s = (1-alpha*a)*s + alpha*a*k0*q. Do not use \(s\) to modify the model on the first experiment; only log it and estimate the equilibrium relation. Pseudocode is: q=secret_probe(t); s=(1-alpha*a)*s+alpha*a*k*q; if t>=warmup: append(q,s); khat=sum(q*s)/sum(q*q); residual=abs(khat-k0); alarm=residual>threshold. The stability condition \(0<alpha*a<2\) is computed analytically. Equilibrium, regression variance, and the alarm threshold are estimated empirically from a sliding window; \(k_0\) and the probe seed are protected inputs. First test on a small MLP trained on MNIST with SGD and Adam, comparing an untampered run against attacks that multiply the learning rate or momentum coefficient by \(0.8\), \(1.2\), and \(2.0\) after convergence. Use window lengths of 100-1000 steps and sentinel relaxation values satisfying \(alpha*a=0.2\). The quantitative prediction is that after a transient of roughly \(5/a\), the estimated equilibrium changes by \(q\Delta k\) and the estimated gain converges to the tampered value; detection delay should scale as \(O(a^{-1})\), while choosing \(alpha*a\geq2\) should produce sentinel oscillation or divergence. Measure whether the empirical stability boundary agrees with \(alpha*a=2\) within 10% and whether a 20% gain attack is detected before a comparable loss degradation occurs.