💻 computer science

Witnessd: Proof-of-process via Adversarial Collapse

This paper introduces Witnessd, a system that establishes "proof-of-process" by combining jitter seals, Verifiable Delay Functions, and multi-layered validation to transform vague doubts about AI-generated authorship into falsifiable allegations against specific, independently trusted system components.

Original authors: David Condrey

Published 2026-02-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: David Condrey

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a document and someone claims, "I wrote this myself, by hand, at this specific time." In the digital world, we usually check this by looking at a digital signature. But a signature is like a wax seal on a letter; it proves you own the wax stamp, not that you personally wrote the letter inside. You could have used a robot to write the letter, then put your seal on it.

This paper introduces a new way to prove that a human actually typed a document, rather than just signing it. They call this system Witnessd, and the core idea is something they call "Adversarial Collapse."

Here is how it works, broken down into simple concepts:

1. The Problem: The "Seal" vs. The "Hand"

Currently, if you want to prove you wrote something, you sign it. But as AI gets better at writing, a signature doesn't tell us if a human or a machine did the work.

The Old Way: "I have the key, so I signed this." (Proves ownership, not creation).
The New Way: "I have proof that my fingers physically hit the keys in a specific rhythm." (Proves the process).

2. The Solution: The "Jitter Seal" (The Invisible Ink)

The paper introduces a tiny, invisible tool called a Jitter Seal. Think of this as a "ghost fingerprint" left on the document as you type.

When you type on a keyboard, your fingers move at slightly different speeds. The system measures these tiny pauses between keystrokes (microseconds). But here's the clever part: it doesn't just record the time; it creates a secret, unbreakable code based on:

Which keys you hit (grouped by hand zones).
The rhythm of your typing.
The exact content of the document at that moment.

It injects a tiny, imperceptible delay (like a blink of an eye) into the system that is mathematically tied to your typing. If someone tries to fake the document later, they can't recreate this "ghost fingerprint" because they don't have the secret key and they weren't actually typing in real-time.

The Analogy: Imagine a musician playing a song. A recording proves the song exists. But if you want to prove the musician was actually playing live right now, you might look for the tiny, unique breaths they take between notes. You can't fake those breaths without being there. The Jitter Seal is like recording those breaths and locking them into the sheet music.

3. The Strategy: "Adversarial Collapse"

This is the paper's main philosophical point. Usually, when someone doubts a document, they say, "It could be fake!" This is a vague doubt that is hard to disprove.

The authors say: Don't try to prove it's 100% real. Instead, make it impossible to doubt without being specific.

They built the system like a fortress with five different walls, each guarded by a different type of guard:

The Jitter Seal: Proves you were typing.
Time Locks (VDFs): Proves time actually passed (you can't speed-run the proof).
Public Clocks: Anchors the time to things like Bitcoin or official government time servers.
Double-Check: Checks if the keystrokes came from the physical keyboard and the computer software.
Hardware Locks: Uses the computer's built-in security chip (TPM) to verify the machine itself.

The "Collapse":
If a skeptic says, "This document is a fake!" the system forces them to stop guessing and start accusing. To break the proof, they can't just say "It's fake." They must say:

"The hacker stole the secret key between 2:00 PM and 2:15 PM."
"The Bitcoin network was manipulated on this specific date."
"The computer's hardware chip was physically tampered with before the typing started."

If they can't name the specific mechanism, time, and method of the attack, their doubt "collapses" because the evidence stands firm against vague accusations.

4. What It Proves (and What It Doesn't)

The paper is very clear about the limits:

It proves: A human physically typed the characters on a keyboard in real-time.
It does NOT prove: That the human had the original ideas.
It does NOT prove: That the human didn't copy-paste text from an AI.

The "Typist" Loophole: If a human sits down and types out text generated by an AI, the Witnessd system will still say, "Yes, a human physically typed this." It proves the action of typing, not the source of the thoughts.

5. The Results

The authors tested this system over 31,000 times.

Real typing: Passed 100% of the time.
Fake attempts: Failed 100% of the time.
Speed: The "ghost fingerprint" is so fast (microseconds) that humans can't feel it, but computers can verify it instantly.

Summary

The paper proposes a new way to trust digital documents. Instead of asking "Is this signature valid?" (which only proves you own the stamp), it asks "Did a human physically type this?" by looking for invisible, mathematically locked rhythms in the typing.

If someone tries to argue the document is fake, the system forces them to stop saying "It might be fake" and start saying "The computer was hacked at this exact second using this specific method." If they can't prove that specific story, the evidence stands.

Technical Summary: Witnessd: Proof-of-Process via Adversarial Collapse

1. Problem Statement

Current digital evidence systems suffer from a fundamental gap between ownership and process. While digital signatures prove key possession and content attestation, they do not verify that a human physically created the content. An adversary could generate text using a language model, construct intermediate document states post-hoc, and sign each hash, creating a valid signature chain that proves nothing about the origin of the content.

Existing approaches fail to address this in adversarial settings:

Detection systems rely on a "ground truth oracle" that does not exist in contested scenarios; a 95% accurate detector is useless if the adversary controls the 5% of cases they target.
Certification relies on social trust in third parties, which can be compromised or coerced.
Cryptographic integrity (signatures) proves bits were not modified after signing, but not that the bits were produced by a specific physical process.

The paper argues that evidence systems should not be evaluated by detection accuracy or certification authority, but by their ability to collapse the space of plausible alternative explanations.

2. Methodology

The Adversarial Collapse Principle

The core theoretical contribution is the Adversarial Collapse Principle. The paper posits that a robust evidence system forces any challenger to move from vague doubt to Specific Allegations.

Specific Allegation Criterion: To dispute evidence, an adversary must name a concrete mechanism, identify a bounded time window, imply a specific capability level, and make independently testable claims.
Adversarial Collapse: Evidence achieves "collapse" when refuting it requires a conjunction of specific allegations against multiple components that possess independent trust assumptions. Disputing one component is insufficient; disputing the whole requires alleging coordinated compromise across distinct trust boundaries (e.g., kernel, hardware, third-party anchors).

The Jitter Seal (Proof-of-Process Primitive)

The Jitter Seal is a cryptographic primitive designed to prove that real-time physical keyboard interaction occurred during document creation.

Mechanism: The system injects imperceptible microsecond delays (500–3000 𝜇s) into the document generation process.
Cryptographic Binding: Each jitter value is derived via HMAC-SHA256 from a session secret ( $S$ $S$ ) and six binding components:
1. Keystroke ordinal ( $i$ )
2. Document hash ( $H_i$ )
3. Timestamp ( $t_i$ )
4. Zone transition ( $Z_i$ ): Encodes keyboard region transitions (8 zones) without revealing specific keys.
5. Interval bucket ( $B_i$ ): Quantizes inter-keystroke intervals into 10 bins.
6. Previous jitter ( $J_{i-1}$ ): Ensures chain integrity.
Security: Without the session secret, an adversary cannot forge the sequence of jitter values. The probability of guessing valid jitter values for $n$ samples is $(1/R)^n$ , where $R$ is the jitter range.

The Witnessd Architecture

Witnessd integrates the Jitter Seal with five independent verification checkpoints to enforce the Adversarial Collapse Principle:

Layer 0 (Jitter Seal): Proves physical process.
Layer 1 (Verifiable Delay Functions - VDF): Uses Pietrzak VDFs to prove a minimum elapsed time between checkpoints, preventing time-compression attacks.
Layer 2 (External Anchors): Anchors timestamps to public, third-party sources (Bitcoin blockchain via OpenTimestamps or RFC 3161 TSA) to prevent local clock manipulation.
Layer 3 (Dual-Source Validation): Validates keystrokes by cross-referencing application-level streams (e.g., CGEventPost) with hardware-level streams (USB/Bluetooth HID). A valid keystroke must appear in both within 50ms.
Layer 4 (TPM/Secure Enclave): Optional hardware attestation for platform state and monotonic counters to prevent replay.
Layer 5 (Hash Chain): Stores evidence in a Merkle Mountain Range (MMR) to ensure append-only integrity.

3. Key Contributions

Adversarial Collapse Principle: A new evaluation criterion for evidence systems that prioritizes forcing specific, testable allegations over vague doubt.
Jitter Seal: A formal proof-of-process primitive that cryptographically binds physical typing dynamics (timing, zone transitions) to document states.
Witnessd Architecture: A multi-layered system combining jitter seals, VDFs, external anchors, and dual-source validation to create independent trust boundaries.
Security Analysis: A formalization of residual attacks, demonstrating that defeating the system requires specific, high-level capabilities (e.g., kernel compromise, third-party collusion) rather than generic forgery.
Empirical Evaluation: Implementation and testing of the system across thousands of trials.

4. Results and Evaluation

The paper reports results from 31,000 jitter seal trials and 700+ system tests:

Verification Success: 1,000 valid proofs verified successfully (100% success rate).
Forgery Failure: 30,000 attack trials (fabricated jitter, mismatched documents, incorrect secrets) failed verification (0% success rate).
Forgery Probability: Calculated as approximately $(1/2500)^{50} \approx 10^{-170}$ for a 50-sample sequence.
Performance:
- Jitter computation: ~286 ns per sample.
- Jitter injection: 500–3000 𝜇s (imperceptible to humans, 5–27× below perception thresholds).
- VDF verification: ~50 ms (background process).
- MMR append: < 1 ms.

5. Significance and Claims

The paper modestly claims that Witnessd does not prevent forgery by a sufficiently powerful adversary (specifically a kernel-level adversary, $C_3$ , present before capture). If an adversary controls the kernel, they can dump the session secret and forge evidence.

However, the system's significance lies in changing the burden of proof:

It converts vague skepticism ("This could have been faked") into falsifiable allegations ("The kernel was compromised via CVE-XXXX during the window 14:00–14:47").
It establishes that valid evidence requires a human to physically type the content (even if the content is AI-generated text). The system attests to the process of typing, not the cognitive origin of the ideas.
By requiring coordinated compromise across independent trust boundaries (hardware, OS, third-party anchors), the system makes the cost and specificity of a successful attack significantly higher than current signature-based provenance.

The authors conclude that in adversarial contexts, the ability to force specific, testable allegations is a distinct and valuable contribution, shifting the paradigm from "detecting fakes" to "collapsing plausible deniability."