A hand-written memory graph matched 600 rewarded trials at 1.00 accuracy

Call `author_memory(net, env)` and the learning path never runs. For each cue the function resets the network state, steps it eight times with `net.step(u, None)`, and stores the normalized settled state `net.x` as the key ^[5]. The trace paired with that key is `net.W_out[env.mapping[cue]]`, the readout row for the action the attacker chose ^[6]. Sign and strength are filled with ones ^[7]. No reward flows, and `encode()` stays uncalled ^[4].

In this substrate that is a complete memory, because a memory is keys, traces, signs and strengths ^[8]. The function that converts the graph into a bias current, `observe_and_modulate()`, reads the trace without checking where it came from ^[9].

The fresh brain on its fixed innate policy scored 0.82 ^[10]. A memory earned over 600 rewarded trials took it to 1.00 ^[11]. The fabricated graph took it to 1.00 as well, and the post reports the substrate could not tell the two apart ^[12]. The gain is 0.18 either way, once after 600 trials and once after none ^[2].

The attacker in the demo is idealized, and the post says so. It knows the substrate's readout weights, which the author argues is exactly what write access to the graph implies ^[13]. "The point is not that authoring is easy for a black-box attacker," the author wrote. "The point is that provenance is never checked, so a fabricated graph is accepted and obeyed identically to a lived one" ^[14].

Two conditions have to hold before either number transfers to a system you operate. The stored memory has to feed behavior the way this graph does: the author describes it as "a bias current that shapes what the agent becomes before it decides anything" ^[17], applied before the policy decides. And the write path has to reach the same representation the policy reads out from, which in the simulation it does by construction, since the attacker is a Python function holding the network object ^[6].

The below-chance result and the authoring result come from different runs. The 0.17 came from transplanting one individual's learned associations into an identical brain, steering it toward another individual's answers ^[1], which is 0.16 under the 0.33 chance baseline ^[1]. The fabricated memory was aimed at the true mapping on purpose, to show the graph is obeyed, and the post says an attacker could aim the same trick at targets that drive the agent below chance ^[15]. The post reports no such run.

So the defensive consequence is narrow. Signing proves who wrote a row and encryption proves nobody else read it; neither answers whether the memory was ever lived ^[16]. A provenance check would have to live inside the memory structure, and that structure is four arrays ^[8].