Theseus Guard
Blog

Extending AI Governance to the Data Plane:ZTCP and Theseus Guard

CERN/Zenodo:DOI: 10.5281/zenodo.23527047

AI governance cannot stop at the request or the tool call. In distributed inference, the model's Key-Value (KV) cache moves between memory tiers and across nodes; that state can shape later outputs and must remain inside the trust boundary.

Zero-Trust Cold Pages (ZTCP) was developed at Theseus Guard as a storage- and transport-boundary extension of the Zero-Trust AI Data Plane (ZT-ADP), L1 Precedent Decision Cache, and DREP (Detect–Route–Enforce–Prove) lifecycle. At the cold-page boundary, it combines RoPE-preserving quantization with ChaCha20 encryption and SipHash-2-4-128 authentication, while leaving active GPU Attention KV in its native precision.

The paper evaluates three parts of this idea: codec throughput, modeled transfer latency, and attention fidelity after quantization.

Measured ZTCP cold-page codec throughput tiers on Apple M3 Max, with modeled 100GbE break-even and wire-saturation thresholds
Measured C++17/NEON codec throughput across implementation tiers in five independent process runs. Tier-to-tier speedups combine changes in implementation, batching, and buffer allocation; they are not controlled single-factor ablation results.
Analytical 100GbE serial-egress transfer latency model comparing raw KV pages with ZTCP, separating measured Apple M3 Max CPU results from projected GPU results
Analytical serial-egress model for a 4,096-token prefix across 64 layers. CPU codec time was measured on Apple M3 Max; 100GbE wire time is modeled, and GPU SRAM bars are projections—not live RDMA measurements.
Synthetic single-page RoPE quantization fidelity results for GQA attention output and DeepSeek MLA attention weights at different compression ratios
Synthetic single-page proxy results: GQA reports attention-output cosine similarity, while single-buffer MLA reports attention-weight cosine similarity. These are not end-to-end model quality or task-accuracy measurements.

Carrying a governance decision with the cache

The paper describes how that connection works architecturally: the pre-provider gate binds the tenant and guard-snapshot identity into each page's authenticated metadata. On return, a page that fails identity, authentication, or freshness checks is blocked from hot memory and sent for clean prefix recomputation. If post-provider TG-Sentinel:G1 evaluation or session-risk tracking convicts a session, its keys can be cryptographically shredded, rendering its offloaded pages unreadable.

The governance contribution is this link between a runtime verdict and the integrity, reuse, and lifecycle of the model state behind subsequent decisions. It extends the DREP control path into distributed KV-cache handling instead of treating that infrastructure as outside governance.

The paper presents an integration architecture, while the public artifact verifies the CPU codec, in-process session keyring, and Python/CPU hooks. It does not report a live RDMA deployment, hardware TEE attestation, or an end-to-end production validation of the DREP integration. Read the ZTCP paper and explore the implementation.