Abstract
This paper presents the complete methodology and results of an adversarial red team evaluation of PME v0.1.0. The evaluation assumed a sophisticated white-box adversary with full architectural knowledge, access to optimal attack algorithms, and an unconstrained tool set including Metasploit, Nmap, Wireshark, and Burp Suite.
Linkability L=0.5230 against a claimed bound of ≤0.535, validated by a static control (L=1.0000) and an ideal-random control (mean L=0.5142, range 0.4925–0.5305) · 9,000/9,000 fingerprints unique · 128.1-bit average Hamming distance · 7.9994 bits/byte fingerprint entropy (n = 9,000, 13 October 2026)
1. Test Scope and Attacker Profile
| Capability | Description |
|---|---|
| Architectural knowledge | Full white-box — attacker knows complete PME architecture and mutation logic |
| Observation capability | Passive capture of all traffic; arbitrary active probing |
| Computational resources | Unlimited — optimal Hamming-distance linking algorithms |
| Tool access | Metasploit, Nmap, Wireshark, Burp Suite, custom Python |
| Attack duration | Unbounded — attacker can observe as many cycles as required |
| Protocol knowledge | Complete ASMP/1.0 specification |
2. Results
pme/examples/unlinkability.rs.| Test | Method | Result | Threshold | Status |
|---|---|---|---|---|
| Static control (never rotates) | Hamming-distance optimal linker, real harness | L = 1.0000 | > 0.900 (confirms the metric detects real linkability) | PASS ✓ |
| Ideal-random control | 8 reps, real harness | mean L = 0.5142, range 0.4925–0.5305 | reference distribution | — |
| Real KaliCore linkability | Real EntropyManager, real OS CSPRNG, n = 9,000 | L = 0.5230 | ≤ 0.535 | PASS ✓ |
| Fingerprint entropy | Shannon entropy of the 9,000 fingerprints | 7.9994 bits/byte | ≥ 7.9 | PASS ✓ |
| Fingerprint uniqueness | Collision test, 9,000 fingerprints | 9,000 / 9,000 unique | 100% | PASS ✓ |
| Cross-state Hamming | Mean adjacent-fingerprint distance | 128.1-bit avg | ≥ 128 | PASS ✓ |
Real measurement, reproducible via pme/examples/unlinkability.rs; see the underlying assessment (Addendum B.8) for full methodology. Forced Twitch detection and power/thermal side-channel correlation, both previously listed here, have been removed — no source measurement exists for either claim (see §4 and WP-09 respectively).
3. Linkability Analysis
Linkability L measures whether an attacker can connect successive observations. It is not centred on 0.5: the scoring rule counts ties as a correct link, which biases it upward, so an ideal-random source measures around 0.514 rather than 0.500. Reading L in isolation is misleading — it needs two controls. A static control (a surface that never rotates) establishes that the metric actually detects real linkability when it is present; a ideal-random control establishes the best score any source, real or not, can achieve. Against the real engine (real EntropyManager, real OS CSPRNG, driving the full KaliCore composite, n = 9,000): the static control returned L = 1.0000, the ideal-random control returned a mean of 0.5142 (range 0.4925–0.5305 across 8 reps), and PME itself returned L = 0.5230 (13 October 2026; the first run returned 0.5150).
PME's real measurement (0.5230) lies inside the ideal-random control's range (0.4925–0.5305) and under the claimed bound of ≤ 0.535. The bound itself discriminates weakly — the ideal-random control alone reaches 0.5305 at this sample size — so the more informative claim is "indistinguishable from ideal random, measured against controls" rather than the bound in isolation. Full methodology and harness: pme/examples/unlinkability.rs.
Average Hamming distance between consecutive fingerprints: 128.1 bits — matching the theoretical expectation for two independent SHA3-256 outputs (expected: exactly 128 bits). This confirms the engine's fingerprints are indistinguishable from independently sampled random values. That is a property of the fingerprints, which include fresh entropy every cycle. What an outside observer sees of a real host is a smaller space — 48 states for the host TCP/IP stack — where, over about 100,000 predictions, no predictor did better than the 2.5% chance a rule-aware attacker has.
4. Deception and Probe-Triggered Mutation
Several profiles are designed so that active reconnaissance itself becomes a liability: probing patterns inconsistent with legitimate traffic are intended to trigger surface mutation, so an attacker's next probe observes an already-changed surface and their prior observations lose validity. This description covers the design intent. It is not backed by a measured detection count on the current codebase — the previously published "107/107 Forced Twitch" figure has no verifiable source and has been withdrawn. Independent validation of detection behaviour under a real scanning workload is planned as follow-up work.
5. Live Exploit Attempts (withdrawn)
Live-exploit results previously listed here (Metasploit, Nmap, Burp Suite and custom payloads) have been withdrawn: no reproducible source for them exists in the project. They will be republished only with a harness and dated results.
Rotation makes an attacker's reconnaissance of a host go stale: the network fingerprint mapped before the attack changes at every rotation. It does not stop an attacker who needs no reconnaissance — one holding valid credentials, a supply-chain implant, or a working exploit for the running service.
Read the full formatted version:
← All Papers