Research

Standards Assurance as Join Integrity: Evidence graphs, counterfactual mutation testing, and LLM failure modes in a CEN/CENELEC AI case study

Anton Sokolov · v0.3.1 — public research capsule and interactive evidence lab · August 2026

↳ applies: EATF evidence binding to standards assurance; no conformity, trust-service, or semantic-truth claim

Standards assurance is a join-integrity problem: a plausible clause or artifact is insufficient unless the legal requirement, exact standard version, dependency, evidence object, and human disposition remain bound to one inspectable chain.

NORMTRACE connects AI Act Articles 12–14 and 17 to a declared CEN/CENELEC assurance spine covering logging, transparency, human oversight, quality management, and organisation-level AI management. A separate five-standard ETSI corpus validates the mapping instrument under complete-source conditions; controlled architecture and mutation experiments expose identity loss, invented joins, document-state drift, modal weakening, and actor/object binding failures. A same-window multilingual portal panel preserves public reachability and missingness without republishing protected standards text. The public capsule includes code, manifests, model receipts, signed attestations, external timestamp evidence, and explicit claim boundaries. Independent human adjudication remains future validation; neither the paper nor the demonstrator certifies conformity or semantic truth.

doi:10.5281/zenodo.21924089 → concept DOI: 10.5281/zenodo.21924046 interactive evidence lab →

@misc{sokolov2026normtrace,
  author       = {Sokolov, Anton},
  title        = {Standards Assurance as Join Integrity: Evidence Graphs, Counterfactual Mutation Testing, and {LLM} Failure Modes in a {CEN/CENELEC} {AI} Case Study},
  year         = {2026},
  month        = aug,
  publisher    = {Zenodo},
  version      = {0.3.1},
  doi          = {10.5281/zenodo.21924089},
  url          = {https://doi.org/10.5281/zenodo.21924089},
  note         = {Research Paper submitted to Computer Standards \& Interfaces as CSI-D-26-01247}
}

From Permit to Packet: Composing Agent Authority with Public Internet Measurement Evidence

Anton Sokolov · v0.1.0 — full manuscript and executable research artifact · August 2026

↳ applies: SCITT Permit and RATS role-separation concepts to an externally assigned public-measurement effect; no conformance claim

A valid signature cannot compensate for a broken transition from mandate to action, external platform effect, captured evidence, or bounded claim: five isolated treatments accept all 22 authorised controls, while only the composed verifier with a witness rejects and correctly localises all 21 designed faults; a precommitted live RIPE Atlas trace then binds the authorised request to eight later-assigned measurement IDs and 32/32 captured rows.

An executable method for testing authority-to-claim composition around a real external platform. The release contains 21 matched positive/negative pairs plus one clean baseline, a 448-variation deterministic mutation sweep, a prospective Zeus1-only action with an exact request digest committed before RIPE assigned IDs, five unit tests, manifests, a Node prospective verifier, a 12-page manuscript, and a public Observatory. A GitHub-hosted runner reproduces 56 prospective gates over checkout and production artifacts. The evidence boundary is explicit: RIPE public API rows are not RIPE-signed statements, the witness shares Tyche administration and the RIPE upstream, and the study claims neither SCITT/RATS conformance, independent audit, population error rates, legal compliance, nor global availability.

doi:10.5281/zenodo.21923744 → concept DOI: 10.5281/zenodo.21923743

@software{sokolov2026permitpacket,
  author       = {Sokolov, Anton},
  title        = {From Permit to Packet: Composing Agent Authority with Public Internet Measurement Evidence},
  year         = {2026},
  month        = aug,
  publisher    = {Zenodo},
  version      = {0.1.0},
  doi          = {10.5281/zenodo.21923744},
  url          = {https://doi.org/10.5281/zenodo.21923744}
}

Nekropolis: a cross-domain dataset of computer-science retractions and AI-governance lifecycle records (2018–2026)

Anton Sokolov · published article — Data in Brief · June 2026

↳ parent-of: “A source-stratified opacity profile of six…”, “Computer-generated content and the AI/ML…”

A single unified entry schema brings five public negative-results record families — journal retractions, preprint withdrawals, trusted-service lifecycle changes, archived governance repositories, and reviewed benchmark withdrawals — into one cross-domain corpus of 14,923 records, while keeping source-family labels visible so the evidentiary unevenness between families is never silently pooled.

A peer-reviewed Data in Brief data article for Nekropolis v0.3 — a 14,923-record curated public-record corpus of artifacts retracted, withdrawn, revoked, archived, or discontinued across computer-science retractions, AI-governance records, trusted-service lifecycle changes, withdrawn benchmarks, archived governance repositories, and related source families between 2018 and 2026. Each record carries an artifact category, lifecycle dates, source-stated reason where one exists, a conservative project-inferred cause label, and hashed source pointers. The article defines the schema, source-family gates, validation checks, deposit layout, licensing, and responsible-reuse guidance for the corpus. Companion analyses of public-record opacity (sokolov2026nekropolisOpacity) and AI/ML retraction causes (sokolov2026nekropolisRipr) are separate manuscripts that read this corpus through narrower slices. Dataset deposit: Zenodo v0.3 DOI 10.5281/zenodo.20405512 (CC BY 4.0).

doi:10.1016/j.dib.2026.113041 → concept DOI: 10.5281/zenodo.20405511 publication note →

@article{sokolov2026nekropolis,
  author       = {Sokolov, Anton},
  title        = {Nekropolis: a cross-domain dataset of computer-science retractions and {AI}-governance lifecycle records (2018--2026)},
  journal      = {Data in Brief},
  volume       = {67},
  pages        = {113041},
  year         = {2026},
  month        = aug,
  doi          = {10.1016/j.dib.2026.113041},
  issn         = {2352-3409},
  publisher    = {Elsevier BV},
  url          = {https://doi.org/10.1016/j.dib.2026.113041}
}

Signed, Fresh, and Wrong: Cross-Verifier Disagreement in AI-Agent Evidence over X-Road

Anton Sokolov · Accepted — in the ESORICS 2026 RAISE proceedings · May 2026

Independent verifier paths return contradictory verdicts on byte-identical agent-evidence packages: in the 29-package corpus, the strict profile verifier accepts 7 and rejects 22 while a signature-oriented path accepts 15 and rejects 14, exposing why “verified” is not a single property.

An empirical security study of cross-verifier disagreement over Action Evidence Packages and an X-Road carrier. It runs 29 adversarial packages plus 11 conformance vectors through a structural inspector, a strict package-profile verifier, and a signature-oriented verifier; reproduces a fresh-but-invalid producer path caused by a human-readable-versus-canonical-byte mismatch; compares co-deployed audit and ledger integrity signals; and exercises 13 dual-envelope X-Road scenarios with carrier-versus-agent failure attribution. The paper reports verdict disagreement and bounded failure modes, not truth or legal compliance. Submission 957 was updated in place on 20 June 2026, replacing the earlier Breakable Receipts version, and accepted on 23 July 2026 for the ESORICS 2026 RAISE workshop proceedings. The public corpus is DOI 10.5281/zenodo.21563876. The camera-ready has been delivered and registration completed; the paper will be presented at the RAISE workshop in Rome on 17–18 September 2026.

Archival deposit pending editorial response. The full manuscript is held under submission.

@unpublished{sokolov2026crossverifierraise,
  author       = {Sokolov, Anton},
  title        = {Signed, Fresh, and Wrong: Cross-Verifier Disagreement in {AI}-Agent Evidence over {X-Road}},
  year         = {2026},
  month        = jul,
  note         = {Accepted 23 July 2026 for the ESORICS 2026 Workshop on Real-world AI Security and Engineering for Cybersecurity Systems (RAISE), submission 957; proceedings publication pending; public corpus DOI 10.5281/zenodo.21563876},
  institution  = {Tyche Institute}
}

Spec-as-(N+1)-oracle Differential Fuzzing of SD-JWT Presentation Verification

Anton Sokolov · Accepted — in the STM 2026 proceedings · July 2026

Treating the specification itself as an additional oracle alongside N implementations surfaces silent claim-drops in SD-JWT presentation verification — cases where a verifier returns success while quietly discarding selectively disclosed claims.

A security-engineering study that fuzzes SD-JWT presentation verification differentially, using the specification as an (N+1)-th oracle against the implementations under test. The method targets silent failure: a verifier that accepts a presentation while dropping disclosed claims produces no error a relying party can observe. The evidence boundary is explicit — findings are version-bound to the libraries and versions tested, the high-severity reading holds under permissive default-allow authorization, and the study claims neither ecosystem-wide prevalence nor any compliance or certification status. Accepted at STM 2026, co-located with ESORICS 2026 in Rome.

Archival deposit pending editorial response. The full manuscript is held under submission.

@inproceedings{sokolov2026sdjwtfuzzing,
  author       = {Sokolov, Anton},
  title        = {Spec-as-($N$+1)-oracle Differential Fuzzing of {SD-JWT} Presentation Verification},
  booktitle    = {Security and Trust Management ({STM} 2026), co-located with {ESORICS} 2026},
  year         = {2026},
  publisher    = {Springer},
  note         = {Accepted; submission 1188}
}

Preparing X-Road for Explainable AI Agents

Anton Sokolov · Accepted — in the CBI/EDOC 2026 workshop proceedings · May 2026

↳ part-of: the carrier-bound-evidence line with “XATF: A Carrier-Binding Verification Profile…” and “Making AI Agents Legible to the State: X-Road,…”

The evidence an explanation would need — which agent acted, under whose mandate, and on what carrier — is not currently retained by the data-exchange layer itself, so explainability for agent actions has to be designed into the carrier rather than reconstructed after the fact.

A short workshop paper asking what a national data-exchange layer would have to record for an AI agent's action to be explainable afterwards. It takes X-Road as the concrete carrier and works through the evidence an explanation depends on: agent identity, the mandate under which the action was taken, and the carrier-level record binding the two. The paper is a position and design sketch grounded in the carrier-bound-evidence line of work; it makes no compliance, certification, or deployment-readiness claim about X-Road or any operator.

Archival deposit pending editorial response. The full manuscript is held under submission.

@inproceedings{sokolov2026xroadexplainable,
  author       = {Sokolov, Anton},
  title        = {Preparing {X-Road} for Explainable {AI} Agents},
  booktitle    = {Proceedings of the {CBI} \& {EDOC} 2026 Workshops ({XAI-EADM})},
  year         = {2026},
  publisher    = {Springer},
  note         = {Accepted; submission 6247}
}