merge: resolve conflicts — keep worktree versions of .gitignore and ROADMAP.md

Author: DeliciousBuding

.gitignore

@@ -295,4 +295,6 @@ papers/
 # Training: track source code, ignore outputs
 training/outputs/
 training/**/__pycache__/
+
+# Git worktrees (generated by git-worktree, never committed)
 .worktrees/

ROADMAP.md

@@ -1,7 +1,9 @@
 # DiffAudit Research Roadmap
 
-> Last updated: 2026-07-11
+> Last updated: 2026-07-12
 > Scope: current Research execution board.
+>
+> Implementation branch: `feat/paper1-corrected-evidence`. See `.worktrees/paper1-corrected-evidence` for active code.
 
 ## Current Baseline
 
@@ -26,6 +28,14 @@ not estimate a population-level seed variance or establish a mechanism.
 Current command runbook:
 `docs/start-here/paper1-corrected-evidence-runbook-2026-07-11.md`.
 
+The first formal corrected matrix was stopped outcome-blind at step 22,000 on
+its first target when the post-training audit found that canonical PIA could not
+load corrected `ema` checkpoints and lacked the frozen complete-roster
+statistics. No membership outcome was generated or viewed. The partial target
+is permanently excluded. The protocol is being refrozen after corrected EMA
+loading, repository-bound analysis provenance, canonical target ordering, and
+1,000-draw H1/PIA paired bootstrap are completed.
+
 ## P0: Freeze the Corrected Evidence Contract
 
 - [x] Train only on the fixed 25,000-row member subset.
@@ -39,33 +49,55 @@ Current command runbook:
 - [x] Add confirmatory H1 scoring that fits PCA/LR only on calibration rows and
   reports metrics only on evaluation rows.
 - [x] Add stratified paired bootstrap that refits the attack inside each
-  replicate, plus at least 200 full label-permutation refits.
-- [x] Repair PIA canonical and pass a positive-control gate before it is used as
+  replicate, plus at least 200 full label-permutation refits. Paired bootstrap
+  is now 1,000 draws so the eight-target Holm family is mathematically capable
+  of rejection.
+- [x] Repair PIA canonical and pass a synthetic-checkpoint positive-control gate
+  before it is used as
   the validation attack. Historical E3 PIA outputs are not valid for this gate.
 - [x] Implement and test exact resume, including Python/NumPy/Torch CPU/CUDA and
   data-loader state, or freeze a common restart policy and block uninterrupted-
   trajectory claims.
-- [x] Add row-bound score packets with dataset/run/checkpoint/noise/protocol
-  identities.
+- [x] Add strict row-bound H1 and PIA packet schemas with
+  dataset/run/checkpoint/noise/protocol identities.
+- [ ] Bind H1 activation extraction to the locked rows and common-noise contract,
+  then generate a preflight score packet from the corrected checkpoint.
 
-Implementation branch: `feat/paper1-corrected-evidence` (commit `d6ef148`).
+P0 gates implemented on `feat/paper1-corrected-evidence` (commit `d6ef148`).
 Protocol v3 hash: `b73b8244`. 304 focused tests pass.
 
 No corrected outcome may be viewed before these protocol choices are frozen.
 
 ## P1: Short GPU Preflight
 
-- [x] Run a disposable 2k-step `corrected-*` target: batch 32, seed 1746574482.
-- [x] dataset length is exactly 25,000 and split sets are disjoint
-- [x] no historical checkpoint/output directory is reused
-- [x] no OOM with the live 8 GB GPU state (peak ~6.74 GiB, min free ~1.21 GiB)
-- [x] sustained throughput at least 6.0k steps/hour (observed ~12.3k/h)
-- [x] checkpoint/resume and manifest checks pass
-- [x] projected training plus full evaluation plus 10% buffer fits 6-day window
+- [x] P1 preflight done: training throughput gate passed; full H1+PIA evaluation
+  benchmark pending protocol regeneration.
+
+Run a disposable 2k--5k-step `corrected-*` target before long training.
+
+Pass criteria:
+
+- dataset length is exactly 25,000 and split sets are disjoint;
+- no historical checkpoint/output directory is reused;
+- no OOM with the live 8 GB GPU state;
+- sustained throughput is at least 6.0k steps/hour without thermal throttling;
+- checkpoint/resume and manifest checks pass;
+- row-bound evaluation artifacts include all required identities.
+- projected training plus full evaluation plus a 10% failure buffer fits the
+  available GPU window; otherwise reduce the matrix symmetrically before any
+  corrected metric is viewed and refreeze the manifest.
+
+Failure pauses long training. Fix the contract, repeat the same preflight seed,
+and record the deviation; do not replace the seed.
 
-Preflight passed 2026-07-12. Protocol v3 frozen. GPU queue ready.
+2026-07-12 status: the original batch-64 preflight failed the throughput and
+VRAM-headroom gates. The contract was revised before viewing any corrected
+metric to batch size 32, then refrozen. The corrected 0 -> 200 -> 400 -> 2,000
+run passed training, exact-resume, checkpoint receipt, thermal, throughput, and
+output-schema checks. Long training remains blocked on one complete H1 + PIA
+checkpoint-evaluation benchmark and the H1 extraction binding above.
 
-## P2: First-Stage Matrix — 4 Targets × 100k
+## P2: First-Stage Matrix — 4 Targets x 100k
 
 Train the first four predeclared seeds symmetrically to 100k. Use independent
 `corrected-*` directories and never resume seed42/43/44/45 or other historical

configs/attacks/pia-mainline-canonical.yaml

@@ -12,9 +12,22 @@ attack:
   method: pia
   num_samples: 128
   parameters:
+    variant: canonical-ddpm-eq9
     attacker_name: PIA
-    attack_num: 30
-    interval: 10
+    timestep: 200
+    lp_order: 4
+    score_form: negative_lp_norm
+    score_direction: higher_is_member
+    input_range: [-1.0, 1.0]
+    query_timesteps: [0, 200]
+    query_count: 2
+    normalization: per_row_vector_lp
+    beta_semantics: linear_1000_steps_inclusive_0.0001_to_0.02
+    threshold_calibration: maximize_balanced_accuracy_then_minimize_fpr_then_highest_threshold
+    positive_control_gate:
+      auc_min: 0.95
+      balanced_accuracy_min: 0.90
+      fpr_max: 0.05
     batch_size: 8
 report:
   output_dir: workspaces/gray-box/runs

docs/evidence/experiment-master-log.md

@@ -13,7 +13,7 @@
 | Item | Verdict | Evidence |
 | --- | --- | --- |
 | **Phase G H1 historical baseline** | **Quarantined.** Local seed42/43/45 targets trained on rows labeled as nonmembers, and the old H1 scorer reported resubstitution AUC. All old AUCs, continuation directions, N=512 clusters, knockout/fine-grid interpretations, and mechanism claims are diagnostic-only. Never resume these checkpoints into corrected runs. | [frozen-claim-matrix.md](../paper1/frozen-claim-matrix.md) |
-| **Paper 1 corrected-evidence rebuild** | Active protocol, no result yet. Freeze member-only training, predeclared seeds, disjoint calibration/evaluation rows, common noise, H1 held-out scoring, PIA positive control, and STOP/REPLICATE/MATURE rules before viewing any corrected outcome. | [paper1-corrected-evidence-runbook-2026-07-11.md](../start-here/paper1-corrected-evidence-runbook-2026-07-11.md) |
+| **Paper 1 corrected-evidence rebuild** | Batch-32 training and exact-resume resource preflight passed. The first formal matrix was then stopped outcome-blind at step 22,000 on its first target after a post-training audit found that canonical PIA could not load corrected `ema` checkpoints and lacked the frozen complete-roster statistics. No membership outcome was generated or viewed. The partial target is permanently excluded; corrected EMA loading, analysis provenance, canonical roster ordering, PIA confirmatory statistics, and 1,000-draw H1/PIA paired bootstrap are being refrozen before a fresh restart. | [paper1-corrected-training-preflight-2026-07-12.md](paper1-corrected-training-preflight-2026-07-12.md) |
 | DualMD / DistillMD defense artifact gate | OpenReview DDMD supplement code and DDPM split-index files are public, but the embedded GitHub origin is not public and no checkpoint-bound defended/undefended scores, ROC arrays, metric JSON, generated response packet, or ready verifier are committed; no download, GPU release, or admitted defense row | [dual-md-distillmd-defense-artifact-gate-2026-05-15.md](dualmd-distillmd-defense-artifact-gate-2026-05-15.md) |
 | DIFFENCE classifier-defense artifact gate | official code, configs, and split-index files are public, but the protected target is an image classifier, diffusion is a pre-inference defense component, and no checkpoint-bound defended/undefended logits, score rows, ROC arrays, metric JSON, or ready verifier are committed; no download, GPU release, or admitted defense row | [diffence-classifier-defense-artifact-gate-2026-05-15.md](diffence-classifier-defense-artifact-gate-2026-05-15.md) |
 | MIAHOLD / HOLD++ higher-order Langevin defense gate | official defense code, audio split filelists, CIFAR HOLD config, and PIA-style attack code are public, but checkpoint-bound target artifacts, reusable member/nonmember scores, ROC arrays, metric JSON, generated responses, and a ready verifier are missing; no download, GPU release, or admitted defense row | [miahold-higher-order-langevin-artifact-gate-2026-05-15.md](miahold-higher-order-langevin-artifact-gate-2026-05-15.md) |

docs/evidence/paper1-corrected-training-preflight-2026-07-12.md

@@ -0,0 +1,101 @@
+# Paper 1: corrected training preflight
+
+- **Date**: 2026-07-12
+- **Status**: superseded by outcome-blind evaluation-contract repair
+- **Verdict**: Batch size 32 passed the training and exact-resume resource gate, but the first formal matrix was stopped before outcomes when the canonical PIA post-training path was found incomplete.
+
+## Scope
+
+This preflight tested only the corrected member-only training contract and its
+artifact chain. It did not inspect H1, PIA, AUC, or any other membership outcome.
+The run used the first predeclared seed, 25,000 fixed member rows, the frozen
+split SHA256, and corrected-only output labels.
+
+## Resource correction before outcomes
+
+The initial batch-64 attempt was stopped before completion. Observed GPU memory
+reached about 7.9 GiB on an 8 GiB device, leaving only tens of MiB free, and
+2,000 steps had not completed after about 22 minutes. This failed the frozen
+6.0k steps/hour and VRAM-headroom gates.
+
+Before any corrected metric was viewed, the canonical training config was
+changed once to batch size 32. No model, optimizer, schedule, precision, seed,
+or step horizon was changed. The protocol was then rebuilt and hash-sealed.
+
+## Passing run
+
+The replacement run used three segments to exercise resume:
+
+| Segment | Wall time | Approx. throughput |
+| --- | ---: | ---: |
+| 0 -> 200 | 57 s | 12.6k steps/hour |
+| 200 -> 400 | 67 s | 10.7k steps/hour, including resume overhead |
+| 400 -> 2,000 | 459 s | 12.5k steps/hour |
+| Active total | 583 s | 12.3k steps/hour |
+
+Observed runtime bounds:
+
+- fresh-run GPU allocation: about 5.50 GiB;
+- resume peak GPU allocation: about 6.74 GiB;
+- minimum observed free GPU memory: about 1.21 GiB;
+- maximum observed temperature: 71 C;
+- maximum observed power draw: about 103 W;
+- no OOM or observed thermal throttling.
+
+## Artifact checks
+
+The run produced checkpoints at steps 200, 400, and 2,000. For every checkpoint:
+
+- the on-disk SHA256 matches its manifest receipt;
+- checkpoint metadata records the same protocol hash, split SHA256, code commit,
+  seed, step, and batch-32 training-config hash;
+- the manifest retains all three receipts after resume;
+- `weights_only=True` loading succeeds on CPU;
+- log terminal events report the expected final step without interruption.
+
+Generated checkpoints and logs remain outside Git under the configured download
+and training-output roots.
+
+## Decision
+
+The corrected training implementation passes Stage 0's training, resource,
+resume, and receipt gates. This does not release the four 100k targets. The next
+required gate is a complete evaluation benchmark on the 2,000-step checkpoint:
+
+1. extract H1 activations only for the locked calibration/evaluation rows;
+2. derive common noise from the sealed row/timestep/draw contract;
+3. emit strict row-bound H1 and PIA score packets;
+4. time the full H1 + PIA evaluation and project the worst non-STOP branch with
+   a 10% failure buffer.
+
+No long training begins until that projection fits the available GPU window.
+
+## Outcome-blind formal-matrix abort
+
+The full H1 and canonical PIA timing projection subsequently fit the available
+window. A formal Stage 1 launch therefore began on the frozen target matrix.
+During an independent audit of the commands that would consume the completed
+100k checkpoints, two remaining P0 gaps were found before any membership score
+or metric was generated:
+
+1. the formal canonical PIA exporter accepted legacy `ema_model`/`net_model`
+   checkpoint keys but not the corrected trainer's `ema` key;
+2. the PIA path did not yet expose the predeclared complete-roster paired
+   bootstrap, global AUC-range test, and Holm family required for the paper
+   decision.
+
+The first target was stopped at step 22,000. Its final saved checkpoint receipt
+matched its on-disk SHA256; the other three targets had not started. This partial
+target is an infrastructure-abort artifact and MUST NOT be resumed or scored.
+
+Because no corrected outcome had been viewed, the protocol was reopened rather
+than patched after results. The repair adds corrected EMA loading, explicit
+analysis repository-state provenance, canonical target ordering, PIA
+confirmatory statistics, and 1,000 paired bootstrap draws for both H1 and PIA.
+The increase from 200 to 1,000 is required because 200 plus-one draws make Holm
+rejection mathematically unreachable for the 28 pairs in an eight-target set.
+
+Long training remains blocked until the repaired code is committed, a new
+protocol hash is sealed, and the necessary dry-run/resource preflight is
+repeated with fresh output labels. The aborted target and its protocol are never
+part of corrected evidence.

docs/start-here/paper1-corrected-evidence-runbook-2026-07-11.md

@@ -1,7 +1,7 @@
 # Paper 1 Corrected Evidence Runbook
 
 > Date: 2026-07-11
-> Status: active protocol scaffold; long training remains gated by the checks below.
+> Status: active protocol repair; the first formal launch was stopped outcome-blind and must be restarted under a new sealed hash.
 
 This runbook supersedes `phase-g-runbook-2026-06-30.md`. It rebuilds the H1
 evidence contract after the previous local targets and resubstitution scorer
@@ -56,14 +56,23 @@ Long training is blocked until all items pass:
 
 ```powershell
 conda activate diffaudit
-$env:DIFFAUDIT_DATASET_ROOT = "<DIFFAUDIT_ROOT>\Download\datasets-readable"
 $env:DIFFAUDIT_DOWNLOAD_ROOT = "<DIFFAUDIT_ROOT>\Download"
+$env:DIFFAUDIT_CIFAR10_ROOT = "<CIFAR10_ROOT>"
 $env:PYTHONPATH = (Resolve-Path src).Path
+$protocolManifest = "<PROTOCOL_MANIFEST>"
+$splitPath = "<SPLIT_PATH>"
+$seed = <PREDECLARED_SEED>
 
 python -X utf8 -m pytest tests/test_h1_evidence_contract.py -q
-python -X utf8 training/ddpm-cifar10/train_ddpm_cifar10.py `
-  --seed <PREDECLARED_SEED> `
-  --run-label ddpm-cifar10-corrected-preflight `
+python -X utf8 training/ddpm-cifar10/train_ddpm_cifar10_corrected.py `
+  --protocol-manifest $protocolManifest `
+  --split-path $splitPath `
+  --seed $seed `
+  --run-label "corrected-preflight-s$seed" `
+  --stop-step 2000 `
+  --dataset-root $env:DIFFAUDIT_CIFAR10_ROOT `
+  --num-workers 4 `
+  --preflight `
   --dry-run
 ```
 
@@ -80,16 +89,40 @@ Never drop a target after seeing its score because the budget became tight.
 Stop preflight on OOM, sustained throughput below 6.0k steps/hour, thermal
 throttling, split mismatch, missing row IDs, or resume mismatch.
 
+### Current preflight result (2026-07-12)
+
+- The first frozen batch-64 attempt was stopped before completion: the observed
+  GPU allocation reached about 7.9 GiB on an 8 GiB device and 2,000 steps had not
+  completed after about 22 minutes.
+- Before any corrected metric was viewed, the single canonical training config
+  was revised to batch size 32 and the protocol was rebuilt.
+- The replacement run used the same first predeclared seed and completed
+  `0 -> 200 -> 400 -> 2,000`, including two exact-resume launches.
+- Active segment time was 583 seconds for 2,000 steps, about 12.3k steps/hour.
+  Observed peak allocation was about 6.74 GiB during resume, with at least about
+  1.21 GiB free. The observed maximum temperature was 71 C.
+- Checkpoints at steps 200, 400, and 2,000 have matching SHA256 receipts,
+  protocol identity, training config, seed, and step metadata.
+
+This passes the training portion of Stage 0. Long training is still blocked
+until one full checkpoint H1 + PIA evaluation is timed and the protocol-bound H1
+activation extractor emits a valid row-bound packet. No corrected AUC or other
+membership outcome has been inspected.
+
 ## Training Template
 
 Use only values from the frozen protocol manifest:
 
 ```powershell
-python -u training/ddpm-cifar10/train_ddpm_cifar10.py `
-  --seed <PREDECLARED_SEED> `
-  --run-label ddpm-cifar10-corrected-seed<SEED> `
+python -u training/ddpm-cifar10/train_ddpm_cifar10_corrected.py `
+  --protocol-manifest $protocolManifest `
+  --split-path $splitPath `
+  --seed $seed `
+  --run-label "corrected-s$seed" `
   --stop-step 100000 `
-  --log-file training/outputs/ddpm-cifar10-corrected-seed<SEED>/training-100k.log
+  --dataset-root $env:DIFFAUDIT_CIFAR10_ROOT `
+  --num-workers 4 `
+  --log-file "training/outputs/corrected-s$seed/training-100k.log"
 ```
 
 Never pass `--resume` against `ddpm-cifar10-seed42`, `seed43`, `seed44`,
@@ -98,12 +131,16 @@ Never pass `--resume` against `ddpm-cifar10-seed42`, `seed43`, `seed44`,
 If the MATURE branch is selected, resume only after the exact-resume gate:
 
 ```powershell
-python -u training/ddpm-cifar10/train_ddpm_cifar10.py `
-  --seed <PREDECLARED_SEED> `
-  --run-label ddpm-cifar10-corrected-seed<SEED> `
+python -u training/ddpm-cifar10/train_ddpm_cifar10_corrected.py `
+  --protocol-manifest $protocolManifest `
+  --split-path $splitPath `
+  --seed $seed `
+  --run-label "corrected-s$seed" `
   --resume 100000 `
   --stop-step 200000 `
-  --log-file training/outputs/ddpm-cifar10-corrected-seed<SEED>/training-200k.log
+  --dataset-root $env:DIFFAUDIT_CIFAR10_ROOT `
+  --num-workers 4 `
+  --log-file "training/outputs/corrected-s$seed/training-200k.log"
 ```
 
 All targets in the chosen branch must be trained symmetrically. Do not continue
@@ -122,10 +159,25 @@ calibration rows and compute metrics only on the locked evaluation rows.
 - Do not report TPR at 0.1% FPR with 512 clean evaluation rows.
 - Bootstrap calibration and evaluation rows stratified by class; refit the
   attack inside every replicate and use paired row draws across checkpoints.
+- Use exactly 1,000 paired bootstrap draws for H1 and PIA. With eight targets
+  there are 28 pairwise comparisons; 200 plus-one draws cannot make the first
+  Holm-adjusted p-value smaller than 0.05.
 - Run at least 200 full label permutations with attack refitting.
 - PIA is the fixed validation attack after its positive-control gate. SecMI is
   exploratory unless frozen before any corrected outcome is inspected.
 
+## Outcome-Blind Restart Rule
+
+The first formal Stage 1 launch was stopped at step 22,000 on its first target
+after the post-training command audit found an incomplete canonical PIA bridge
+and missing complete-roster PIA statistics. No membership outcome was generated
+or viewed, and the remaining targets did not start.
+
+That partial target MUST NOT be resumed, scored, or relabeled. After the PIA
+repair is committed, rebuild the protocol with the same predeclared seeds and
+training matrix, use fresh corrected run labels, repeat the required dry-run and
+resource checks, and start every target from step zero.
+
 ## Interim Branch Rules
 
 - **STOP** only when both H1 and PIA have AUC 95% upper bounds below 0.55 on

environment.gpu-cu128.yml

@@ -16,7 +16,7 @@ dependencies:
       - pre-commit
       - pytest
       - pyyaml
-      - scikit-learn
+      - scikit-learn==1.9.0
       - scipy
       - xgboost==1.7.3
       - seaborn

environment.yml

@@ -16,7 +16,7 @@ dependencies:
   - pre-commit
   - pytest
   - pyyaml
-  - scikit-learn
+  - scikit-learn==1.9.0
   - scipy
   - xgboost==1.7.3
   - seaborn