Security

This page describes MIND's memory checks, tested deterministic workloads, and evidence verification. Deployment assurance also depends on the selected compiler path, runtime, and application.

Key takeaway

mindc can attach a tamper-evident trace_hash to compiled IR; signing is opt-in, needs both post-quantum legs, and is off by default.

Memory Safety

MIND uses scope-bounded regions and generation-checked references. RFC 0010 tracks the implemented checks and remaining phases; this is not a claim that every native path implements Rust's ownership and borrowing guarantees.

Region escape checks

Reject references that escape a supported region boundary.

Generation-checked references

Check reference validity at supported dereference operations.

Explicit unsafe boundaries

Raw pointers and C FFI require the checks and caller obligations of the selected ABI.

Implementation coverage

See RFC 0010; concurrency safety and arbitrary native-program coverage require their own acceptance checks.

Deterministic Execution

The strict arithmetic profile preserves the defined operation order. Cross-substrate CI checks the committed workloads on x86_64 AVX2 and ARM64 NEON:

Integer and Q16.16 fixed-point

Committed fixture outputs match their reference hashes on both CPU substrates.

Strict floating point

The scalar f64 chain, length-4093 f32 dot product, and 64×64 f32 matrix-vector fixture have exact matching output hashes. The f64 reference was verified on ARM on 2026-07-05; the two f32 references on 2026-07-14.

Operation order

The admitted strict kernels preserve their specified accumulation order and separate multiply/add operations.

Replay inputs

Pin inputs, seeds, and external observations when checking deterministic replay.

Reproducible builds

Compare same-target artifacts under fixed source, toolchain, flags, dependencies, and build inputs. Cross-ISA output identity compares the computation's results, not native instruction bytes.

Those three floating-point fixtures do not establish identity for every input, arbitrary vector reduction, transcendental function, or GPU workload. General floating-point and GPU coverage remains outside the shipped cross-substrate claim. See Determinism for the full tier breakdown.

Audit Trail Support

For regulated industries, MIND provides features to support audit and compliance:

Execution traces

Full execution traces available in debug mode.

Immutable IR

Immutable IR representations for model versioning.

Artifact hashing

Cryptographic hashing of compiled artifacts.

External logging

Integration points for external logging systems.

Compile-time Evidence Chains (RFC 0016)

mindc emits an evidence-chain epilogue on compiled IR, including a tamper-evident trace_hash.

Tamper-evident trace_hash

Shipped

Emitted on compiled IR as part of the evidence-chain epilogue.

Signing

Signed (opt-in)

Opt-in signing requires both ML-DSA-87 and SLH-DSA-SHAKE-256s; both build features are off by default. mindc verify --signer-pubkey checks an operator-supplied trusted-key allowlist and rejects an unknown signer.

Published release keys and signed-reproduction CI

Planned

Published release keys and signed-reproduction CI remain operational work.

A signature authenticates the signed claim; independent reproduction or a supported proof is still needed to establish the computation's correctness. The evidence fields include:

Field	Holds
evidence_chain.determinism	class (e.g. `byte-identical-q16`)
evidence_chain.substrate	target (`x86_avx2`, `arm64_neon`, `cuda_sm89`, …)
evidence_chain.toolchain	compiler + flags identity
evidence_chain.trace_hash	SHA-256 of the canonical `mic@3` binary IR (RFC 0016 GAP-1, re-anchored 2026-05-31)
evidence_chain.parent	optional pointer to the parent compilation

The chain rides on a MAP epilogue (RFC 0014) attached to either canonical IR serialisation (mic@1 text or mic@3 binary, RFC 0021) and survives the load → execute → re-emit cycle. See ir-stability.md for the normative carrier contract.

Cryptographic Primitives (Pure MIND)

The standard library includes a crypto / TLS / HTTP primitive stack written entirely in MIND and verified against RFC and NIST known-answer tests:

Area	Primitives
Symmetric & hashing	AES-128-GCM, SHA-256, HKDF, Keccak / SHA-3 + SHAKE (FIPS 202)
Public-key	X25519, RSA-PSS-SHA256 verify, ECDSA-P256 verify, ML-KEM-768 (FIPS 203 post-quantum KEM)
Certificates	X.509 parsing and signature verification
TLS 1.3	key schedule, record layer, Finished MAC, handshake crypto (RFC 8448 replay-verified)
HTTP/2	HPACK header compression (RFC 7541) and binary framing (RFC 9113)

Honest scope

This is a verified primitive library, not a working TLS client or server yet: there is no socket-driven handshake state machine or certificate-chain path validation, and HPACK is decode-only. The primitives are correctness-first, not speed-optimized.

Threat Model

The MIND security model assumes:

Trusted

Source code and compiler are trusted.

Standard OS protections

Runtime environment provides standard OS protections.

Adversarial input

Input data may be adversarial (tensor bounds are checked).

Out of scope

Side-channel attacks are out of scope for the base runtime.

Sandboxing (Planned)

Planned

Future versions will support optional sandboxing for untrusted model execution:

// Planned syntax
@sandbox(memory_limit: 1GB, time_limit: 10s)
fn untrusted_inference(input: Tensor<f32, N, M>) -> Tensor<f32, N, K> {
    // ...
}

Learn More

See the full security specification at mind-spec/security.md.