The agent is the password. A hash of the agent itself — system prompt, tools, task, code — is its identity. Before every tool call, a gate outside the model checks it; only ACCEPT executes. A changed agent is a stranger.
Eighteen agents under attack — replayed from the protocol
Two clusters of nine agents, continuously attacked for four hours: timing probes, race attacks, late replays, re-enrollments under load. The animation replays the run from its protocol lines; nothing is animated that was not measured.
Real-time animation built by Claude (Anthropic) from the run protocol · Voice-over with Clipchamp; Copyright Stefan Trauth
X1 protects your data. X3-Shield protects your agents. And X-Crypt will protect your communications.
// Autonomous Live-State Security
ZEUS X-Trust X1
The secret is never stored. It exists only while the system runs — nothing to extract, nothing to attack offline. X1 detects attacks from its own live-state response and heals itself bit-exactly.
Protect Today. There Might Be No Tomorrow. ZEUS X-Trust — For the Only Treasure That Counts: Your Data!
Summed across all campaigns from X-Trust v3.11 to X1 and the X3-Shield runs, including Pre-X2 Testing. Attack attempts: Stage 4 · Stage 5 · prototype tests · Appendix C · X1 corpus and operational validation · V6EXT · V7 · Pre-X2 (150k class campaign · SHA-512 campaign). Measured iterations: ~30 M up to X1 (Stage 3 · Appendix C · X1 corpus) + V6EXT 15 M + V7 30 M + Pre-X2 60 M ≈ 135 M, rounded ~140 M.
ACCEPT
DENY
AI generated Video Wan 3.0 Edited with Clipchamp Music & Voice AI generated; Copyright Stefan Trauth
// The mechanism
Authentication without a stored key
ZEUS X-Trust X1 does not depend on a conventional static authentication key stored somewhere for later comparison. The valid authentication relation is generated live — and only reproduces inside the enrolled instance.
01
Password
The password is the only input the user provides. Nothing derived from it is stored for later comparison.
02
Positional map
A password-controlled positional map addresses specific neurons in specific layers of the network.
03
Live-state response
The running instance produces a measurable transient response and converges into a stable amplitude state — measured response time 1.2–1.6 s per authentication.
04
Amplitude profile
The instance-specific amplitude state created during enrollment is compared against the live state.
05
Verdict
Accept only when map and amplitude profile both match. Otherwise: deny.
Two independent separations at once: a wrong password fails at the positional map — a newly initialized instance fails at the amplitude profile. Only the correct password-controlled map inside the enrolled live instance satisfies both conditions. X1 adds a third, intrinsic layer: the substrate's own response separates attacks (V ≈ 4.112115) from legitimate inputs (V ≈ 1.478294) — measured, not assumed.
// Investment
Open for venture capital and strategic investors
ZEUS X-Trust X1 is the first product of a new autonomous, self-healing and self-defending post-quantum security class. GeoFold AI is actively seeking venture capital and strategic investors to move it from validated product to hardened deployment.
What is on the table
▸A working, measured product — not a concept paper. Every figure on this page comes from documented validation runs.
▸Three published preprints — Beyond Authentication (DOI 10.5281/zenodo.21967777), Expanded Validation (DOI 10.5281/zenodo.22736928) and Pre-X2 (DOI 10.5281/zenodo.22926782) — openly citable on Zenodo; ~100 GB of raw data archived under restricted access (DOI 10.5281/zenodo.22737465).
▸A completed large-scale validation: ~140 million measured iterations and ~750,000 attack attempts summed across all campaigns from X-Trust v3.11 to X1 and the X3-Shield runs — zero accepted attacks; 644/644 legitimate releases, also under lockout; 30/30 configurations fail-closed.
▸Target markets: agentic operating systems, AI-controlled infrastructure, research institutions, specialised security providers and infrastructure operators.
▸Proprietary source code and implementation retained; methods and selected raw data released under controlled access.
▸Technical due diligence and live demonstration available on request, under NDA.
The download matches your current theme — light or dark.
Direct email only — no contact form, no tracking, no data collection on this site.
Terms & Conditions
All services are B2B only. No products or services are sold via this website; it serves informational purposes. GEOFOLD AI™ & TRAUTH RESEARCH® · A TRAUTH INNOVATION PRESENTS X-Trust X3-Shield retains full intellectual property rights for all developed models, structures, and technical methods unless otherwise agreed by written contract.
Governing law: Federal Republic of Germany. Place of jurisdiction: Berlin.
Independent research on informational ontology, emergent geometry and post-quantum AI. GeoFold AI is the deep-tech venture that turns that research into products.
From validated prototype to X1 — built on documented experimental validation
Start with the Expanded Validation — V6EXT and V7 on top of the X1 corpus. Every earlier tab documents the campaigns and Stage 3–5 validation runs that built up to it.
Expanded Validation — ZEUS X-Trust X1 · DOI 10.5281/zenodo.22736928 · 2026
V6EXT 15 M forwards, 150,000 attacks · V7 30 M forwards × 30 configurations, 300,000 attack attempts · 0 accepted
Two campaigns on top of the X1 corpus. V6EXT: 15 million forwards with 150,000 attacks in 27 classes. V7: 30 million forwards across 30 configurations with 300,000 attack attempts — including lockout, restart and resume. Raw data (~100 GB) archived under restricted access, DOI 10.5281/zenodo.22737465.
✓0/150,000 forwarded attacks accepted across 27 classes — V6EXT
✓0 unauthorized releases on all three V7 verification paths — 0/103,402 · 0/567 · 0/191,198
✓216/216 legitimate releases — also during lockout, after restart and after resume
✓Seal of the true password reproduced exactly (distance 0.0) in all 15 blocks — no drift over 5 M forwards, bit-identical on re-run
✓Lockout mechanics as specified in all 30 configurations — 10 failures → lock, 11th blocked without escalation, auto-reset
✓Binding tests B1–B6 fail-closed in all 30 configurations
✓900-s production cycle passed
✓2²⁵⁶ effective work factor — now backed by ~140 million measured iterations, summed from X-Trust v3.11 to X1
Summed with every earlier campaign — Stage 3–5, Appendix C, the X1 corpus and Pre-X2 Testing — the validation program now comprises ~140 million measured iterations, ~750,000 attack attempts and 644/644 legitimate releases. Zero accepted attacks throughout. Summed across all campaigns from X-Trust v3.11 to X1. Next step: external black-box validation of a fixed, hashed X1 instance.
Beyond Authentication — ZEUS X-Trust X1 · DOI 10.5281/zenodo.21967777 · 16 August 2026
The principal X1 measurement corpus: ~13,500 attack events across 20 attack classes and 235 legitimate-input events, evaluated across 5 experimental blocks — plus a dedicated operational validation of the binary ACCEPT/DENY decision path. The broader ZEUS X-Trust validation program now comprises ~30 million measured iterations across several hundred runs.
✓0/200,001 false alarms across all rest observations
✓19/19 legitimate inputs recognized · response time 1.2–1.6 s
✓Attack invariant V ≈ 4.112115 across all 20 classes — cross-block spread below one part per million
✓Legitimate inputs at V ≈ 1.478294 — restore the prior state bit-exactly; no attack ever returns to it
✓Response geometry collapses to effective rank 1 at 99.9% explained variance
✓Attack transients stay ≤ 16 iterations — the legitimate response settles at 18
✓2²⁵⁶ effective work factor — a 6-character password carries what 20+ characters carry today
X1 converts intrinsic attack-state recognition into active self-protection: progressive source-bound access delay and staged regeneration and rotation of the password-bound amplitude-key components — the user password itself remains unchanged. Attack-class fingerprints, taxonomy and predictive transitions are deliberately reserved for the Seed 2 research phase.
Appendix C — Controlled adversarial validation of the operational prototype · Prototype V3.1 (5 August 2026)
3,500 authentication executions against one continuously enrolled live instance
A controlled adversarial campaign against the running prototype: 22 attack classes executed against a single live neural instance that stayed enrolled for the entire run — no restarts, no re-seeding, same target file throughout.
✓3,476/3,476 genuinely unauthorized inputs denied
✓0 unauthorized ACCEPT · 0 breaches across the entire campaign
✓~25 h continuous compute across 4 days
✓22 attack classes tested (14 → 18 → 22)
✓Same enrolled instance, 300 iterations per authentication run throughout
*Effective security for a 6-character password modelled at 2²⁵⁶ class — working hypothesis, formal analysis in progress. Roadmap for the next verification layer: independent watchdog (continuous integrity + graduated response) → system-level adversarial testing → external black-box validation.
The operational prototype interface — file staged, seal step, and the live 18-layer neural sphere during an authentication run.
Prototype software — what changed
▸New in V3 (vs. V2)
•Live pyramid display in the verifier UI: real, unnormalized min/max amplitudes of the first pyramid (512→2) at every checkpoint — guided truth; singularity layer, second pyramid, κ and 4weights stay hidden
•Convergence display: EVOLVING → CONVERGING → FIXED POINT, with max |ΔA|, correlation and stability share
•Processing timeline: input → live-state run → verification → verdict
•Event ticker: running log of iterations and verdicts
•AUDIT MODE banner, dynamic — red notice on fail-closed
▸New in V3.1 (vs. V3)
•Self-penetration directly in the verifier UI: the participant picks from 10 attack classes (truncation, case mutation, substitution, transposition, dictionary, leetspeak, typo, hybrid, rule-based, brute force) and the number of inputs per class
•The server generates the inputs from the enrollment password of the test vault — the participant sees neither the password nor the variants
•Time estimate, live progress and a per-input verdict including its attack class
•Per-class aggregates: DENY/ACCEPT, mean runtime, match rate, mean drift
•Final per-class report as a Markdown download
Attack-class coverage across all campaigns to date: 14 → 18 → 22. The V3.1 figures on this page are the current internal measurement state (5 August 2026) and are deliberately not part of a Zenodo record.
Prototype — first end-to-end test
A working local application with a real 18-layer neural network
Not a simulated interface element. File sealed, authentication gate live, attack variants tested against the enrolled instance.
✕Single-character substitution · truncation · case mutation: DENY
✕Unrelated password: DENY · no NaN or Inf failures
The anagram attack is the revealing case: same characters, different order — still rejected through the live-state component rather than through a simple character-set comparison. Measured separation between the valid state and every tested invalid state: 6–11 orders of magnitude of amplitude separation, with the four-decimal verification window lying inside the empty numerical space between those conditions.
Stage 5 — Integrated authentication logic
Full-run results across 80 individual runs
The complete live-state authentication workflow: correct-login acceptance, rejection of incorrect passwords, instance-specific amplitude-reference binding and protection against reference overwriting during authentication.
✓40/40 correct logins accepted
✕360/360 incorrect-password attempts denied
✓0/40 enrollment references modified
✕40/40 newly initialized instances denied against the old reference
Scope note by the author: Appendix A reports the controlled experimental validation of Stages 3–5. It does not claim independent certification, production deployment, sustained operational exposure, or completion of the Stage 6 adversarial programme. External third-party replication is a separate verification layer.
Stage 4 — Profile vectors & map binding
Binding deterministic password maps to stable live-state amplitude profiles
Validated across all four original FRN architectures, including a separate shared-initialization experiment that isolated the password effect from random initialization.
✓100/100 valid same-instance references accepted
✕900/900 wrong-password maps rejected
✕900/900 obsolete references rejected after re-initialization
✓Deterministic password maps across all tested architectures
✓Bit-exact stability within the established live-state plateau
✓0 of 450 password pairs per architecture were identical
Identical architecture, identical initial weights, only the password changed — and different passwords produced different stable full-network states. This supports the dual role of the password: it defines the map that addresses neural positions, and it influences the stable live state generated from an otherwise identical initialization.
Four original FRN architectures — Original, Pyramid, 4weights, Extended — each with 10 passwords, 10 genuine re-initializations per password and 10,000 iterations per run. Original scripts unmodified, full positional amplitude maps stored and evaluated.
✓100/100 runs passed Test A for every architecture
✓10/10 password groups passed Test B for every architecture
✓Mean intra-window drift: 0 — control window max_diff 0.00000000
✓No NaN, no Inf, stable late-state plateau throughout
✓Genuine re-initializations produced distinguishable positional amplitude maps
✓Euclidean distance as primary metric, Pearson correlation as secondary reference
Key insight: large transient amplitudes are not instability if the final positional amplitudes converge to an exact and persistent plateau. The decisive object is the complete positional amplitude map — which neuron, in which layer, holds which exact amplitude after convergence.
0 / ~750,000
Attacks accepted — v3.11 to X1 and X3-Shield
Sum of Stage 4, Stage 5, prototype tests, Appendix C, X1 corpus with operational validation, V6EXT, V7 and Pre-X2 Testing
644 / 644
Legitimate releases — v3.11 to X1
Sum: Stage 4 100 · Stage 5 50 · Appendix C 24 · X1 corpus 235 + 19 · V7 216 (also during lockout, after restart and after resume) · 0/200,001 false alarms
~140 M
Measured iterations — v3.11 to X1
Sum: ~30 M up to X1 (Stage 3 · Appendix C · X1 corpus) · V6EXT 15 M · V7 30 M · Pre-X2 60 M ≈ 135 M
30 / 30
Configurations fail-closed
Lockout mechanics as specified and binding tests B1–B6 fail-closed in every V7 configuration
4.112115
Attack-response invariant V
Reproduced across 20 attack classes with sub-ppm cross-block spread — legitimate inputs at V ≈ 1.478294
2²⁵⁶
Effective work factor
6-character password modelled at the 2²⁵⁶ class — the order of the 256-bit security level of SHA-512 · now backed by ~140 M measured iterations
Summed across all campaigns from X-Trust v3.11 to X1 and the X3-Shield runs, including Pre-X2 Testing.
Restart kills the vault — volatility as tamper evidence
The prototype deliberately uses a volatile neural instance. A restarted instance produces a new amplitude realization, the previous enrollment reference becomes invalid and a new enrollment is required. What looks like a limitation is the security property: there is no persistent secret left behind to steal, and any tampering with the instance destroys the authentication relation it was meant to unlock.
No stored static key
There is no key object at rest that can be exfiltrated, cracked offline or recovered from a backup. The relation is produced live or not at all.
nothing at rest
Post-quantum by construction
The attack surface is not a mathematical one-way function but a live amplitude state inside an instance-specific network — there is no algebraic shortcut to invert.
no invertible target
Self-healing, measured
Legitimate inputs restore the prior valid state bit-exactly after disturbance; no attack ever returns to it. Attack transients stay ≤ 16 iterations — the legitimate response settles at 18.
bit-exact recovery
18 days: first operational prototype → published X1 security class
29 July – 16 August 2026 — from the first operational prototype to the published Beyond Authentication validation; the Expanded Validation (V6EXT + V7) and Pre-X2 Testing followed on top: summed across all campaigns from X-Trust v3.11 to X1 and the X3-Shield runs: ~140 million measured iterations, ~750,000 attack attempts, 0 accepted, 644/644 legitimate releases, 30/30 configurations fail-closed, bit-exact self-healing. Full detail in the preprints (DOI 10.5281/zenodo.21967777 · 10.5281/zenodo.22736928 · 10.5281/zenodo.22926782) and the downloadable pitch deck.
// Development path
Where X1 stands — and what comes next
ZEUS X-Trust X1 is the first product generation: autonomous ACCEPT/DENY, progressive source-bound delay and staged regeneration of the password-bound amplitude-key components — the user password itself remains unchanged. Attack-class intelligence is deliberately reserved for Seed 2.
~1,800 h
Human research time invested
~435 GB
Validation data generated
~250 M
Tokens consumed from first idea to today (in + out)
~800 h
From design to running prototype
Stages 3–5 validated
Plateau stability, map binding and integrated authentication logic documented in Appendix A.
Operational prototype live
Local application with a real 18-layer network, first end-to-end test passed.
500/500 and 3,476/3,476 unauthorized inputs denied, 0 breaches — methodology published as Appendix C.
X1 validation published — Beyond Authentication
~25 M measured iterations, 62 runs × 62 engine initialisations, ~13,500 attack events in 20 classes, 0 breaches · DOI 10.5281/zenodo.21967777.
Expanded Validation published — V6EXT + V7
15 M + 30 M forwards, 450,000 attack attempts across 27 classes and 30 configurations, 0 accepted, 216/216 legitimate releases, 30/30 configurations fail-closed · DOI 10.5281/zenodo.22736928 · raw data DOI 10.5281/zenodo.22737465.
Validated decision path shipped as the first product release.
External black-box validation
A fixed and hashed X1 implementation exposed to third-party attack campaigns — proprietary parameters remain protected.
Seed 2 — attack intelligence
Attack fingerprints, systematic taxonomy and predictive state transitions. Pre-X2 Testing is complete: 52 % class recognition over 10 classes, 38.6 % over 30 classes, 0 of 249,000 attacks accepted in the two Pre-X2 campaigns — see “Pre-X2 Testing”.
// The system behind the system
Built by an agent architecture, directed by one scientist
The operational prototype was not produced through a conventional software-development process. It was designed, implemented, tested and consolidated inside a local agent architecture — with research direction, architecture and scientific interpretation remaining with Stefan Trauth.
A
Apollon
routes
M
Medusa
plans
P
Pandora
builds
K
Kosmos
plans the outcome
Apollon routes. Medusa plans. Pandora builds. Kosmos plans the outcome. All four are a product of GEOFOLD AI™ & TRAUTH RESEARCH® · A TRAUTH INNOVATION PRESENTS X-Trust X3-Shield.
// Completed — Pre-X2
Pre-X2 Testing
What my agents are implementing for themselves right now: attack-class recognition from the live-state fingerprint — first for a single agent, then tested for agent swarms, as the next development step on the roadmap. The 150k class campaign was completed on 16 September 2026, the SHA-512 campaign on 22 September 2026; seed 4242, fully reproducible. Both Pre-X2 campaigns are included in the v3.11 → X1 totals above; the X2_1 smoke test (25,000 attacks) is not. Full detail in the preprint (DOI 10.5281/zenodo.22926782).
150,000 class-resolved attacks and 99,000 edited or independent passwords under SHA-512-only input. The seal holds completely; classifiability does not break it. Auth distance 0.0 exactly, minimum attack distance 1.1e+05 (corrected addressing)
68–89 %
F1 — reference-aware attacks
leetspeak 0.89 · keyboard_walk 0.75 · case 0.68 — attacks that mutate the seal password leave a clear class signature
✓Two class worlds: reference-aware attacks (mutating the seal password) F1 0.46–0.89 — reference-blind attacks (own material: words, dates, keyboard rows) F1 0.16–0.24, confusing each other
✓Information sits in the direction of the 1540-dimensional residual, not in its magnitude — direction-only 19 % vs. magnitude-only 12 % (10 classes)
✓One seal, one instance: 22-character seal, all attacks length-controlled to 22, fixed-point reference measured before the attack, injection iteration included
✓Every iteration measured — all 1540 neurons, float64; five mutation sites (t01–t05) measurable as their own axis
Detection (ACCEPT/DENY) and classification (which attack) are separate layers. All attacks are denied — classification accuracy describes how well X2 additionally names the attack class. The reference-aware classes form the core of the fingerprint; reference-blind classes are structurally fingerprint-poor and will be reported separately in the 30-class design. Next: agents equip themselves with the current version, then swarm testing.
