Integrating hardware-level compute-throttling registers with cryptographic authorization tokens enables self-enforcing, real-time resource-budget enforcement for autonomous scientific discovery agents operating scanning probe microscopes.

This discovery has a Claude-generated validation package with a full experimental design.

Precise Hypothesis

Spine & Adversarial ReadReady for validation

“This hypothesis is testing whether hardware-register-level compute throttling combined with cryptographically signed budget tokens can enforce an autonomous SPM agent's resource consumption within a 2% tolerance even under adversarial software compromise.”

• highHardware throttling registers (RAPL, NVML power limits) were designed for thermal/power management, not security enforcement, and have documented bypasses (e.g., software undervolting attacks like Plundervolt/V0LTpwn) — the whole enforcement chain may rest on a foundation not designed to resist adversarial manipulation.
  The protocol includes side-channel/privilege-escalation attack categories and an out-of-band hardware monitor on a physically isolated network as a secondary check, which partially mitigates this, but the EVP does not yet include an explicit test against Plundervolt-class voltage/frequency fault-injection attacks specifically — this should be added as an explicit attack category before claiming the disproof criteria are fully exercised.
• mediumWhy SPM specifically, rather than validating the hardware-throttling-plus-token approach on a cheaper, more accessible compute-only testbed first? The choice to anchor the MVP in real/simulated SPM hardware adds instrument cost and complexity that may not be necessary to test the core claim about compute-resource enforcement.
  Partially justified: SPM introduces real-time control-loop latency constraints (kHz-range) and physical-damage risk (tip crashes) that a generic compute benchmark would not surface, which is central to the instrument-safety motivation of the discovery. However, the EVP should more explicitly justify why a physics-based cantilever simulator (rather than a real instrument) is an adequate proxy for the latency-safety claim in the MVP phase — this is acknowledged but not fully resolved, since simulator fidelity gaps could mask real failure modes.
• highThe 95%-of-trials / ≤2% overshoot success criterion may be too permissive for a 'self-enforcing' safety claim — a hardware-protection mechanism for expensive, irreplaceable instruments arguably needs near-100% guarantees (or formal verification), not a statistical pass rate, especially since the paper's own framing (provably bounded behavior) implies determinism rather than probabilistic compliance.
  Unresolved gap: the current protocol is empirical/statistical (trial-based), while the discovery's impact claim ('provably bounded') implies a need for formal verification (e.g., TLA+ model checking of the token-verification state machine) to support regulatory-grade claims. This EVP should be extended with a formal-methods sub-track before any regulatory-approval claims are made; as written, it validates engineering robustness, not mathematical proof.

Experimental Protocol

ROI Projection

Implementation Sketch

# Token schema
BudgetToken {
  agent_id, instrument_id,
  max_cpu_core_seconds, max_gpu_sm_seconds,
  max_actuation_cycles, max_wall_clock_s,
  issued_at, expires_at, nonce,
  signature = Ed25519_sign(privkey_issuer, fields)
}

# Enforcement loop (runs in TEE / secure enclave)
on agent_request(op):
    token = verify_signature(op.token)
    if not token.valid or token.expired or nonce_seen(token.nonce):
        reject()
    projected_usage = estimate_cost(op)
    if running_total[token] + projected_usage > token.max_budget:
        trigger_hw_throttle(instrument_id)  # RAPL/IPMI/NVML register write
        log_violation(out_of_band_channel)
        deny(op)
    else:
        allow(op)
        running_total[token] += measure_actual_usage(op)  # from HW counters, not agent self-report

# Out-of-band monitor (separate physical network)
loop:
    read IPMI/NVML/RAPL counters directly
    compare against token budget independent of enclave state
    if mismatch > tolerance: raise_hardware_alarm(), cut_power_rail()