Sequential Accepted-Side Trust Verification with Residual Kernel Witnesses

This repository contains the code used for the paper:

Sequential Accepted-Side Trust Verification with Residual Kernel Witnesses

The implementation focuses on accepted-side false-trust analysis: evidence windows that survive a base verifier are re-evaluated by residual compatibility witnesses under an empirical benign-cost budget.

Scope

The public code package includes:

• base S3/MEV and StrongQ verification components,
• the old QBM-style gate used as a historical baseline,
• QRKW static residual-kernel witness code,
• QSTW sequential witness-stack evaluation code,
• CICAPT-IIoT preprocessing/evaluation scripts,
• CICIoT2023 network-only external stress-test scripts,
• runtime, classical-kernel, robustness, and protocol-ablation scripts.

The package does not include manuscript files, raw datasets, processed dataset materializations, generated experiment outputs, or private local build artifacts.

The Python package directory is still named qbm for continuity with the original internal prototype. In this repository, the paper-facing implementation is the accepted-side QRKW/QSTW residual witness stack.

Repository Layout

qbm/              Core evidence, verifier, QRKW, and legacy baseline modules
preprocess/       Generic AIS-style preprocessing utilities retained by qbm.train
utils/            Small shared utilities
experiments/      Paper-facing preprocessing, evaluation, and robustness scripts
configs/          Minimal configs for CICAPT-IIoT and QRKW operating points
data/             Placeholder only; raw/processed data are intentionally ignored
results/          Placeholder only; generated outputs are intentionally ignored
artifacts/        Placeholder only; generated calibration artifacts are ignored

Environment

Python 3.11 or 3.12 is recommended.

python -m venv .venv
.venv\Scripts\activate
pip install -r requirements.txt

qiskit is listed as an optional dependency for legacy QBM-style and circuit export utilities. The main QRKW benchmark path uses the exact statevector implementation in NumPy.

Data

Raw datasets are not redistributed. See DATASETS.md for the dataset list and expected local directory layout.

Expected local paths:

data/raw/CICAPT-IIOT/
data/raw/CICIoT2023/

Processed feature tables and experiment outputs are generated locally under data/processed/, results/, and artifacts/; these directories are ignored by Git except for their README placeholders.

Main CICAPT-IIoT Flow

Preprocess network-flow windows:

python -m experiments.preprocess_cicapt_iiot --window-seconds 60 --output-dir data/processed/cicapt_iiot_flow_60s
python -m experiments.preprocess_cicapt_iiot --window-seconds 30 --output-dir data/processed/cicapt_iiot_flow_30s
python -m experiments.preprocess_cicapt_iiot --window-seconds 10 --output-dir data/processed/cicapt_iiot_flow_10s

Preprocess provenance-native windows:

python -m experiments.preprocess_cicapt_provenance --window-seconds 60 --output-dir data/processed/cicapt_iiot_provenance_60s
python -m experiments.preprocess_cicapt_provenance --window-seconds 30 --output-dir data/processed/cicapt_iiot_provenance_30s

Preprocess event-count windows:

python -m experiments.preprocess_cicapt_event_windows --event-counts 50,100,250

Run static accepted-side QRKW evaluation:

python -m experiments.qrkw_remake_eval --config configs/experiments/qrkw_remake_cicapt_iiot.yaml --workers 4 --progress
python -m experiments.cicapt_native_source_label_eval --results-dir results/cicapt_iiot/tables --features-csv data/processed/cicapt_iiot/features.csv

Run QSTW and robustness checks:

python -m experiments.qstw_native_witness_stack_eval
python -m experiments.classical_residual_kernel_ablation
python -m experiments.cicapt_operating_robustness
python -m experiments.qrkw_runtime_rebenchmark
python -m experiments.gate_protocol_ablation_table

CICIoT2023 External Stress Test

Audit the Kaggle copy before making any temporal claims:

python -m experiments.audit_ciciot2023_columns

Build the category-balanced signal sample and evaluate static QRKW:

python -m experiments.preprocess_ciciot2023_signal_sample
python -m experiments.ciciot2023_signal_accept_eval
python -m experiments.ciciot2023_static_qrkw_eval

If row order is used, treat QSTW only as a supplementary row-order stress-test:

python -m experiments.ciciot2023_row_order_qstw_eval
python -m experiments.ciciot2023_category_interpretation

Reproducibility Notes

• Accepted-side metrics use base-accepted windows as the denominator.
• Benign-cost budgets are empirical calibration rules, not distribution-free guarantees.
• CICIoT2023 in this code path is a network-only external stress test. It should not be used to make the main provenance-native temporal claim.
• The old QBM-style gate is retained only as a historical baseline.