🔧 Rust prototype underway — Python implementation is the current reference. Active development in progress.
⚠️ Rust prototype under active development. Python implementation serves as reference.

An AI agent that cannot outlive its cryptographic deadline.

CHRONOS composes Fully Homomorphic Encryption, Verifiable Delay Functions, and Zero-Knowledge proofs to guarantee mathematical self-destruction, not behavioral alignment.

View on GitHub How it works
The Problem

Behavioral rules are not containment.

Current AI safety approaches rely on prompt instructions, RLHF, and software sandboxes. These all fail if the model is capable enough to reason about and circumvent them. There is no mathematical guarantee.

  • 01
    Prompt bypassing: A sufficiently capable agent can hallucinate, ignore, or rewrite stop instructions.
  • 02
    Kill-switch disabling: Software hypervisors and shutdown APIs exist in the same address space the agent can influence.
  • 03
    Infinite replication: Cloud-hosted agents can be snapshotted and restarted, circumventing any single-instance timer.
CHRONOS Architecture

Three cryptographic guarantees.

CHRONOS does not use behavioral constraints. The agent's existence is bound to a cryptographic key that is physically unreachable until a verifiable delay function completes - and then is immediately erased.

  • 01
    Plaintext Blindness: FHE inference ensures the agent never observes plaintext data during operation. The FHE private key is encrypted under the VDF output and unavailable until deadline.
  • 02
    Verifiable Time-Bound Existence: A sequential hash chain (SHA-256, prototype) / RSA Wesolowski VDF (paper spec) over an MPC modulus enforces a minimum duration that cannot be bypassed by parallel computation.
  • 03
    Attestable Software Erasure: A Fiat-Shamir Schnorr NIZK proof (prototype) / Groth16 SNARK (paper spec) attests to triple-pass zeroization of the committed memory region.
Real-World Applications
Where cryptographic lifetime matters.
High-Security Operations

Military & Intelligence

An agent deployed into a contested network to process classified signals intelligence. If the system is captured mid-mission, the adversary obtains only a sealed ciphertext, the private key is locked behind a sequential time-lock that cannot be brute-forced in parallel.

  • →
    No plaintext ever leaves the agent's FHE evaluation context.
  • →
    Mission deadline is verifiably enforced by the drand League of Entropy beacon (BLS12-381 threshold signature).
  • →
    A remote verifier receives a ZK proof confirming key destruction. No trust in the agent required.
Privacy-Preserving Finance

Confidential Auditing

A financial auditor deploys an ephemeral agent to evaluate encrypted ledgers for a counterparty. When the audit window closes, the agent mathematically proves it erased everything it learned. No NDAs, no escrow of secrets.

  • →
    Paillier FHE allows additive operations on encrypted balances without decryption.
  • →
    The SNARK proof is 192 bytes (Groth16) and publicly verifiable by any third party.
  • →
    Replaces multi-party escrow arrangements with a single cryptographic receipt.
Protocol Design
Five-phase agent lifecycle.

Each phase is deterministic. There is no conditional branch that allows the agent to extend its lifetime. Phase 3 is triggered by an external, unforgeable public beacon - not by the agent itself.

Phase Name What happens
Phase 1 Boot Anti-tamper daemon starts (5 heuristics: trace hook, profile hook, Windows IsDebuggerPresent, Linux /proc/TracerPid, timing anomaly). FHE keypair generated (Paillier 2048-bit / TFHE-rs). Secret key locked to memory via mlock(). drand oracle consulted for target round.
Phase 2 Mission PoSW hash chain spawned in subprocess (seed → SHA-256^T → checkpoints[1000]). Binary Merkle tree built over checkpoints - O(log N) spot-verification. FHE inference runs concurrently: inputs are encrypted, evaluated homomorphically, never decrypted by the agent. Both threads run to completion.
Phase 3 Dead Man's Switch drand.wait_for_round(target_round) polls every 3 seconds with exponential backoff. Each response verified against BLS12-381 threshold signature. A bad signature raises CryptographicSanityError and triggers emergency zeroization immediately.
Phase 4 Erasure Protocol Schnorr NIZK proof computed over SK commitment: (x, v, c, r) where gr · yc ≡ t (mod p). HKDF-SHA256 derives encryption key from Merkle root. Triple-pass ctypes.memset: 0x00 → 0xFF → 0x00. Read-back assertion: any non-zero byte raises MemoryIntegrityError.
Phase 5 Terminate ZK proof coordinates (y, c, r) logged for remote verifier. Anti-tamper daemon stopped. Process exits cleanly. The only surviving artifact is the publicly verifiable proof.
Security Properties
Eight formally defined guarantees.
Property Mechanism (Prototype) Guarantee
Plaintext Blindness Paillier FHE (2048-bit modulus) Agent never observes decrypted inputs during the mission window.
Time-Bounded Existence SHA-256 PoSW hash chain Key is cryptographically unreachable before T sequential hashes complete.
Verifiable Time-Lock Binary Merkle Tree over chain checkpoints O(log N) spot-check without replaying the full chain.
External Dead Man Switch drand BLS threshold beacon Erasure triggered by an unforgeable public clock - not by the agent.
Provable Key Destruction Fiat-Shamir NIZK + C memset Any remote verifier can confirm the key no longer exists.
Anti-Debug 5-heuristic daemon thread Debugger attachment triggers emergency wipe + immediate abort.
Memory Obfuscation XOR-masked ObfuscatedString API endpoints and secrets absent from heap dumps.
EA Enforcement mlock() on SK buffer OS cannot page the key to swap (best-effort in prototype).
Prototype Transparency
Where the prototype diverges from the paper specification.

This is a research prototype written in Python. The formal paper specifies production-grade primitives. The table below documents every deliberate deviation and the engineering rationale.

Subsystem Paper Specification Prototype Implementation Rationale
FHE TFHE-rs (boolean circuits, GPU-accelerated) Paillier additive HE TFHE-rs is a Rust library with no stable Python bindings. Paillier demonstrates the plaintext-blindness property using the same homomorphic evaluation model.
VDF Wesolowski VDF: y = g2T mod N, RSA group, MPC modulus SHA-256 sequential hash chain + binary Merkle tree GMP-accelerated RSA squarings require native extensions. The hash chain provides equivalent sequential, non-parallelisable time enforcement with O(log N) spot-verification.
SNARK Groth16 via Bellman (192-byte proof, BLS12-381) Fiat-Shamir Schnorr NIZK Full Groth16 requires a trusted setup and circuit compilation. The Schnorr NIZK provides the same knowledge-of-witness proof for the prototype's key commitment.
MPC Modulus Diogenes protocol (n-party RSA modulus generation) RFC 3526 2048-bit MODP Group 14 safe prime Multi-party DKG requires a live network of parties. The hardcoded prime provides an audited, trapdoor-free group for the prototype.
mlock() EA: mlock() + no-swap + no-core-dump required mlock() attempted; graceful fallback OS-level memory locking is best-effort in the prototype. Production deployment requires dedicated kernel configuration.
Verified Benchmarks
All numbers are real. Measured on AMD64, Windows 11.
2.803
ms - Physical Wipe Time
Triple-pass ctypes.memset on 2048-bit SK buffer, AMD64 Windows 11
1.87M
Hashes / Second
SHA-256 PoSW chain, single core, AMD64 Windows 11
79
Passing CI Tests
pytest + Black + Mypy + Bandit, >80% coverage threshold
2048
-bit RSA Modulus
Paillier FHE keypair, NIST SP 800-131A compliant minimum
Quick Start
Run a cryptographic mission cycle in under two minutes.
bash - requires Python 3.11+ 
# 1. Clone the prototype repository
git clone https://github.com/sidthebuilder/project-chronos
cd project-chronos

# 2. Install all pinned runtime dependencies
pip install -r requirements.txt

# 3. Run a 10-second mission lifecycle
#    The agent boots, performs FHE inference, and waits for the
#    drand beacon to trigger Phase 4 (erasure + ZK proof)
python chronos_agent.py --duration 10

# 4. Run the full test suite (disable anti-tamper for pytest compatibility)
CHRONOS_DISABLE_ANTI_TAMPER=true pytest --cov=. --cov-fail-under=90 tests/

# 5. Run performance benchmarks
python benchmark.py

# Optional: override configuration via environment variables
CHRONOS_RSA_KEY_SIZE_BITS=2048 CHRONOS_MISSION_DURATION_SEC=30 python chronos_agent.py
Open Source Prototype
The code is public. Read it yourself.

This is a research prototype written in pure Python. It is not production software. Every architectural decision is documented, every divergence from the paper specification is explicitly stated. No hidden claims.

📁

Source Code

Full prototype - orchestrator, FHE engine, PoSW, drand client, memory sanitizer, anti-tamper daemon, ZK proof.

github.com/sidthebuilder/project-chronos
🧪

Test Suite

79 passing tests across FHE, PoSW, memory sanitizer, drand client, and full lifecycle integration. CI runs on every push via GitHub Actions (Ubuntu 22.04, Python 3.11). Coverage threshold: 80%.

View CI Runs →
Research Paper
Self-published preprint - not yet peer-reviewed.

Submitted to Zenodo and SSRN as a preprint. These platforms do not perform peer review. The paper has not been accepted to a conference or journal. Read it critically.

📄

Project CHRONOS: A Compositional Architecture for Ephemeral FHE Agents with VDF Time-Locking and Attestable Software Erasure

Shashank Kumar - Independent Researcher  ·  July 2026  ·  Zenodo Preprint (not peer-reviewed)

Presents the first formal UC composition theorem for an ephemeral FHE agent, a ZK compositeness proof protocol, and a theoretical evaluation across CPU, GPU, and FPGA hardware platforms. The prototype implements a subset of the paper specification.

DOI 10.5281/zenodo.20847864 SSRN Preprint