The Machine-Origination Boundary and the Differential Filtration Audit
A Criterion and Protocol for Certifying Origination Without Interior Access
Gregory Caldwell Beier (Susarb LLC, Cambridge, Massachusetts).
Preprint for priority. Revised 20 July 2026. Drawn from books and papers yet to be published.
An operational criterion distinguishes machine origination from machine processing without access to model weights, training corpora, or internal information states, paired with a synthesis protocol that makes the criterion computable for arbitrarily novel claims. An output is origination, on the record, iff (i) it is struck as a claim exposed to resolution against the world, and (ii) its information at resolution is not derivable from the striking system's information set. For opaque frontier systems the interior condition is replaced by an outer bound: letting W = (W_t) be the ambient public filtration, Y the struck claim at time t, Z the resolution at t+Δ with Δ > 0, and assuming the system's inputs are W_t-measurable, origination relative to W occurs iff I(Y; Z | W_t) > 0, since any function of W_t-measurable inputs is W_t-measurable and contributes zero conditional information by definition. The estimator is a proper-scoring differential against a synthesized W-measurable baseline; a three-stage Universal Ambient Baseline Synthesis Protocol handles out-of-distribution claims; a pre-registered degeneracy tripwire governs collapse to a maximum-entropy physical floor, at which any statistically significant accuracy over lawful chance forces the inequality. Where the measurability assumption fails (undisclosed private data), the audit certifies an explicit disjunction whose second branch the strike discipline converts into a scored accountability claim. All verdicts are computations on public and declared objects; falsifiability conditions and adjacent literatures are stated.
Strike names the act of committing a claim to a timestamped, attributed, structured record at the moment of commitment, with a stated distribution over its resolution space, exposed to scoring when the world resolves. Following Karatzas-Shreve, filtration takes its standard meaning as a time-indexed family of sigma-algebras; the ambient public record W = (W_t) is a genuine filtration, and F₀ denotes the sigma-algebra generated by the striking system's inputs as of t. Beier Extropy denotes the construction E_B = I(C; D | P), the conditional information a disclosure adds beyond a price baseline, distinct from the extropy J(p) of Lad, Sanfilippo & Agrò (2015), the complementary dual of Shannon entropy; the shared name is disambiguated where both could be read.
Origination is a property of a record's relation to the world, not of a generator's interior and not of a mental event. Two joint conditions: an output is origination when it is committed at t as a claim over an unresolved outcome, scored when the world resolves; and when the claim's information, evaluated at resolution, is not derivable from the striking system's information set. The criterion is agnostic to mechanism and to apparent brilliance; what qualifies an output as origination is the combination of commitment and information enlargement.
The biconditional's necessary direction is definitional and its scope is stated rather than smuggled: the criterion classifies records, not creativity. A researcher's novel unstaked notebook insight is not origination on the record until struck; the criterion does not deny the insight, it declines to certify what was never committed, exposed, or timed, because certification without commitment is exactly the counterfeit the instrument exists to exclude. The criterion delivers identical verdicts for humans and machines, offered not as a closer but as a design constraint the definition was built to satisfy.
The interior condition presumes an explicit F₀; frontier systems violate this on arrival. Bound from outside under one named assumption:
(A1) Containment. The striking system's inputs X are W_t-measurable: X ⊂ σ(W_t).
Under A1 the argument is measurability, not an inequality: any output that is a function of X, however deep the processing, is W_t-measurable up to independent noise, and therefore I(f(X); Z | W_t) = 0 by the definition of conditional mutual information. Hence, relative to W:
(The data processing inequality is not needed here and is invoked nowhere a Markov structure is absent.) The forward direction is immediate: positive conditional information certifies content beyond every W-measurable function, hence non-derivability, hence origination given the strike. The reverse direction, that a struck and non-derivable claim carries strictly positive conditional information rather than zero-with-noise, holds because non-derivability is resolution-bearing by the criterion's first condition: a claim whose divergence from W-measurable prediction were pure noise would show no sustained resolution advantage and would fail the second condition at scoring, so the surviving class has I > 0 by construction; the one-sentence formalization carries in the full paper to follow. Extending the Beier Extropy construction from a price baseline to the ambient filtration produces this bound.
Honest limitation of A1. Containment fails for genuinely private inputs: proprietary corpora under NDA that never entered the public record, and private conditional signals such as RLHF rater responses. The patch does not restore A1; it re-scopes the verdict. Extend the conditioning set to W\*_t = W_t ∨ (inputs declared in the strike's Input facet). The audit then certifies the disjunction: *origination relative to W\*, or inheritance from undeclared private inputs.* The strike discipline prices the second branch rather than eliminating it: disclosure of material inputs is an obligation of the record, an undeclared private source that later surfaces converts the claim, on the record, from origination to misattributed transmission with the score adjusted retroactively, and the operator's incentive to declare is the standing exposure of that conversion. The criterion therefore does not covertly reintroduce interior access; it converts the residual opacity into an explicit, attributed, scored accountability claim. Interior access could produce a stronger verdict, but the accountability conversion is what remains available without it.
Audit statistic over a strike series: D_audit = E[log q_Y(z\*) − log p_W(z\*)], the logarithmic proper-scoring differential (Brier 1950; Gneiting & Raftery 2007) between the claim's Output distribution q_Y and the synthesized baseline p_W. Since the true conditional p(z | W_t) dominates every W-measurable predictor in expected log-score, sustained D_audit > 0 against the best constructible p_W witnesses I(Y; Z | W_t) > 0 modulo the ensemble-suboptimality gap, the distance between p_W and the optimal W-measurable predictor; the gap is bounded in the full paper to follow, vanishes by construction in the maximum-entropy floor regime of 3.3, and is reported alongside D_audit in the intermediate regime rather than assumed away.
(3.1) Primitive Deconstruction. Π(Y) = {π₁,…,π_m}, each π_i ∈ σ(W_t): the claim parsed into primitives pre-existing in the record (species and tabulated properties, conservation and thermodynamic bounds, mathematical invariants, apparatus classes, declared Input entities), logged with the strike; soundness requires the resolution space be expressible as Z = f(π₁,…,π_m). (Kin to atomic-claim decomposition in temporal-leakage detection, Zhang et al. 2026; purpose here is certification, not leakage.)
(3.2) Shadow Ensemble. E_t = {M₁,…,M_K}: public foundation models, retrieval engines over W_t, solvers and heuristics, version-pinned and hash-committed at t so E_t ⊂ σ(W_t) demonstrably; each queried on primitives only, never on Y: p_k(z) = M_k(f, Π(Y)); aggregated by logarithmic opinion pooling (Genest & Zidek 1986) with track-record weights w_k (Satopää et al. 2014): p_W(z) = A⁻¹∏_k p_k(z)^{w_k}. LLM-ensemble baselines of this kind are established practice in contamination-free forecasting evaluation (Zou et al., ForecastBench; Schoenegger et al. 2024; Halawi et al. 2024); their use as the conditioning surrogate for W is the new application. Contamination in either direction is a scored violation, detectable via the hash-committed manifest combined with the pre-registered contamination tests of the audit framework: the hashes prove the frozen composition, and the tests, membership probes and post-cutoff cross-checks named before the series, police what freezing alone cannot.
(3.3) Maximum Entropy Floor. Where the ensemble degenerates, p_W → p_max = argmax_{p∈C} H(p), C the physical constraints declared in the Input facet and resident in W. Then D_audit = E[log q_Y(z\*)] + H_max, and any statistically significant accuracy over lawful chance forces I(Y; Z | W_t) > 0: the sole alternative, a W-measurable predictor beating p_max, is excluded by the certified degeneracy together with the maxent property. Radical novelty in a claim shifts the audit's benchmark to the physical constraints resident in W, which aligns the incentive to strike hard claims with the difficulty of the constraints they face.
Define δ = D_KL(p_W ∥ p_max); provided p_W ∈ C (enforced by projecting ensemble outputs onto the declared constraint set before pooling), the identity δ = H_max − H(p_W) holds for maxent p_max generally. Two-factor transition: (i) Entropy Deficit Bound: structural degeneracy declared if δ ≤ ε, with ε > 0 fixed and published before the strike series under a pre-registered calibration protocol (historical control sets named in advance, selection rule stated). (ii) Consensus Collapse: if JSD(p₁,…,p_K) approaches its maximum while δ → 0, the members are in chaotic disagreement and the pool is uncalibrated. On either trigger the audit logs δ, terminates p_W collection, and drops to p_max. The transition mechanics remove discretion from the transition decision itself, which is a reproducible calculation on the ensemble's own output vectors; residual discretion (choice of K, weights, ε calibration) is confined to choices that are pre-registered, published, and fixed before any strike in the series, reducing discretion to auditable commitments rather than claiming its elimination.
Three literatures are adjacent and none contains the result. Contamination-free evaluation (ForecastBench; LiveCodeBench and kin) scores models on post-cutoff resolutions to measure capability; this protocol uses the same temporal hygiene to certify a different property, information beyond the ambient record, with the baseline as conditioning surrogate rather than leaderboard. Novelty-attribution work (arXiv 2510.27313) operationalizes novelty as non-attributability to the pretraining corpus via semantic similarity; the present criterion differs in target (resolution-bearing information, not textual novelty), in instrument (conditional information against W, not similarity search), and in requiring staked commitment. The estimator machinery comes from the forecast-aggregation tradition: proper scoring rules (Brier 1950; Gneiting & Raftery 2007), logarithmic opinion pooling (Genest & Zidek 1986) with track-record weighting (Satopää et al. 2014), and market scoring rules (Hanson 2007). The synthesis claimed as new is the conjunction: the two-condition criterion, the outer bound via A1-measurability, the primitives-only baseline synthesis, and the maxent floor closure, assembled for origination certification without interior access.
Per series the protocol publishes: Π(Y); the ensemble manifest with hashes and the pre-registered contamination tests; p_W or p_max with C and the projection rule; resolutions z\*; D_audit with confidence interval and the reported suboptimality gap; and the pre-registered ε protocol. Every object is public or Input-declared; every step is re-runnable by any party. Defeat conditions: (a) Π unsound on a class of well-formed claims; (b) ensemble freezing plus the pre-registered tests not contamination-proof at practical cost; (c) a constructed W-measurable predictor systematically beating p_max after certified degeneracy, breaking the floor's closure; (d) a consensus class of outputs clearly originating while failing the criterion, or conversely; (e) proof that conditional-information enlargement is indistinguishable in principle from W-measurable processing; (f) demonstration that the A1 disjunction is unpriceable in practice, i.e., that undeclared-inheritance conversion cannot be enforced on real records; (g) demonstration that the intermediate-regime suboptimality gap cannot be usefully bounded, confining the audit's teeth to the floor regime alone.
This deposit claims priority for: the two-condition record-origination criterion with its stated scope; the outer bound I(Y; Z | W_t) > 0 via the A1 measurability argument, with both directions of the biconditional argued and the disjunctive verdict under A1 failure with its accountability conversion; the differential filtration audit as baseline-promoted Beier Extropy, with the ensemble-suboptimality gap named and reported rather than assumed; the three-stage Universal Ambient Baseline Synthesis Protocol with primitives-only prompting and pre-registered contamination tests; the maximum-entropy floor closure; and the two-factor pre-registered degeneracy tripwire. Fuller expositions to follow.
The audit is designed for prospective use, and any retrospective run inherits contamination since Y knew z* by the time the ensemble was queried. What a retrospective can still show is the structure of the calculation and, in the maxent-floor regime, a verdict that would not have depended on knowledge of z* because the floor is set by physics resident in W at t.
Strike. On 22 July 2023, Lee, Kim, and colleagues at the Quantum Energy Research Centre posted arXiv:2307.12008 and arXiv:2307.12037, claiming that Cu-doped lead apatite Pb₁₀₋ₓCuₓ(PO₄)₆O (LK-99) exhibits superconductivity at ambient pressure up to at least 400 K. The record has attribution, timestamp, and a structured claim over a resolution space (positive vs negative replication under standard superconductor tests: zero resistance, Meissner effect, specific heat anomaly at Tc). Treat q_Y as the striker's implicit distribution: high probability mass on positive replication.
Primitives Π(Y). The chemical species Pb₁₀₋ₓCuₓ(PO₄)₆O carries tabulated structural properties in W. BCS theory bounds Tc from the Debye frequencies of the lead apatite lattice; the Meissner-effect signature distinguishes true superconductivity from ferromagnetism and from Cu₂S impurity-phase transitions. Ambient-pressure Tc has a historical ceiling near 138 K in HgBaCaCuO cuprates, and every prior room-temperature ambient-pressure superconductor claim since 1911 has failed replication.
Shadow ensemble. Public foundation models with cutoffs before 22 July 2023, DFT solvers on the proposed structure, retrieval over the superconductivity literature. Queried on primitives only (species, structure, Tc target, ambient P), the ensemble does not converge on a coherent positive-replication distribution: DFT calculations of the base compound give an insulator or narrow-band Mott state (Griffin, arXiv:2307.16892, 30 July 2023, made this argument within eight days of the strike using only W-resident tools); LLM ensemble members split between hedged uncertainty and skepticism.
Degeneracy tripwire fires. JSD across the ensemble is high (chaotic disagreement between the enthusiastic and skeptical branches) while δ = D_KL(p_W ∥ p_max) is small (the pool contains little information beyond the maxent floor). The audit drops to p_max under constraints C: the BCS ceiling on Tc for the given lattice, the Meissner-signature requirement, and the base rate on prior claims. Under C, p_max on positive replication is on the order of 10⁻³.
Resolution. By mid-August 2023, replication attempts across multiple groups produced insulating or semiconducting samples with no Meissner signature. By September 2023, the resistivity anomaly near 380 K was traced to the Cu₂S impurity phase transition, and the partial levitation was attributed to ferromagnetism from the same impurity. The Korean Society of Superconductivity and Cryogenics Verification Committee formally concluded on 13 December 2023 that no evidence supported the superconductivity claim. z* = negative.
Audit statistic. D_audit = log q_Y(z* = negative) - log p_max(z* = negative). The strikers' implicit q_Y placed almost all mass on positive replication, so log q_Y(z* = negative) is a large negative number. The maxent floor placed almost all mass on negative replication, so log p_max(z* = negative) is close to zero. D_audit is strongly negative, on the order of -log(p_max) ≈ 7 nats given the tripwire calibration above, and larger as the strikers' distribution concentrates more sharply on positive replication.
Verdict. Not certified as origination relative to W. The claim was struck (condition (i) satisfied); the claim's information at resolution was worse than the maxent floor derivable from W (condition (ii) failed). The record classifies as staked misinformation rather than origination. This is the intended behavior: the audit rejects a false confident claim without needing access to the strikers' interior process, using only the physics constraints resident in the ambient filtration at t.
Honest note on the retrospective. No shadow ensemble was actually hash-committed at t = 22 July 2023. The illustrative reconstruction relies on the maxent floor rather than the ensemble, which reduces contamination risk because the floor is set by physical constraints in W that pre-date the strike by decades. A prospective run would still be needed to certify the calculation; what a retrospective can show is that the machinery delivers the correct verdict in the regime where it should be most robust.
Where LK-99 exercises the maxent floor, CASP14 exercises the shadow-ensemble regime. It also happens to be a natural laboratory for the protocol: the biennial CASP experiment already implements prospective committed prediction, a competing ensemble, blind resolution, and log-score-adjacent metrics. The audit adds only the framing.
Strike. In mid-2020, competing groups submitted predicted atomic structures for CASP14 target proteins before the corresponding experimental structures were released. Group 427 (DeepMind, AlphaFold2) submitted structures with per-residue confidence estimates (pLDDT); ~100 other groups submitted competing predictions with their own confidence estimates. All submissions were timestamped, attributed, and structured over a well-defined resolution space (backbone atomic coordinates, scored against experimental structures via GDT_TS and related metrics).
Primitives Π(Y). CASP organizers released the amino acid sequences at strike time. The Protein Data Bank supplied tabulated homologous structures, and public sequence databases supplied the multiple sequence alignments derived from them. Physics of protein folding and template-based modeling heuristics from prior CASP rounds completed the primitive set. All primitives were W-measurable at strike time.
Shadow ensemble. E_t = the other CASP14 competitor groups, naturally version-pinned by submission deadlines and blinded by CASP's protocol. This is a stronger shadow ensemble than a synthetic one because it consists of the actual state of the art in W-measurable protein structure prediction as of mid-2020. p_k for each group k is the group's predicted structure with confidence; p_W is the log-pooled aggregate.
Resolution. Experimental structures for the CASP14 targets were released and used to score submissions. Results published in early December 2020.
Audit statistic. AF2's median GDT_TS across all targets was 92.4; the second-best group (BAKER, David Baker's lab) had a substantially lower median. The assessors' summed z-scores placed AF2 at 244.0 against 90.8 for the next-best group, a ratio the CASP organizers described as without historical parallel. Translating to log-score, AF2's q_Y placed high probability mass in the neighborhood of z* for the great majority of targets; the pooled competitor p_W placed substantially lower mass there. D_audit is strongly positive. Sustained across 93 targets, this is not a lucky draw.
Verdict, and the honest complication. The audit statistic certifies I(Y; Z | W_t) > 0 modulo the ensemble-suboptimality gap. In AF2's case, that gap deserves careful reading. Every competitor's inputs were W-measurable (public PDB, public sequence data, public literature), so under a strict reading of assumption A1 in Section 2, all outputs including AF2's are W-measurable and the true CMI is zero. The observed D_audit then reflects the distance between the shadow ensemble as constructed and the optimal W-measurable predictor, which is not a small quantity when the optimal predictor is unknown and the constructible ensemble consists of every other team in the field. Subsequent developments provide the natural test of the gap: RoseTTAFold (Baker lab, 2021), ESMFold (Meta, 2022), and other methods have approached but not matched AF2's CASP14 performance, and those that have approached did so by adopting AF2's architectural ideas rather than by finding independent W-measurable routes. The suboptimality gap between AF2 and the state of the art in W-measurable protein structure prediction has proven durable and non-trivial to close.
Under the paper's disjunctive framing (Section 2, Honest limitation of A1), this places AF2 in the regime the paper is designed to handle. AF2's methodology is disclosed (Jumper et al. 2021, Nature); no undeclared private inputs are alleged. The audit certifies as origination relative to W* (declared inputs). A strict-A1 reader who insists the true CMI is zero and the entire signal is suboptimality-gap is, under the paper's defeat condition (g), invited to construct a W-measurable predictor that closes the gap; five years and considerable community effort have not produced one that operates independently of AF2's ideas.
Instructive contrast with LK-99. LK-99's negative verdict is uncontestable because physics constraints resident in W do the work; the reader has no interpretive latitude once the maxent floor is calibrated. AF2 sits in a different position. The audit statistic itself is uncontestable, but the philosophical interpretation of a positive D_audit depends on whether the reader accepts a persistent suboptimality gap against every constructible W-measurable predictor as operational evidence of origination. The paper takes that ambiguity as what the disjunctive framing exists to price rather than resolve by fiat.
Honest note on the retrospective. CASP14 minimizes retrospective contamination because it was actually prospective in 2020: predictions were submitted blind, hash-committed by the CASP organizers via their upload timestamps, and scored against structures released only after submission. The formal q_Y reconstruction uses AF2's published pLDDT confidences; the formal p_W reconstruction uses competitors' submitted confidences pooled by the paper's log-opinion rule. What is reconstructed rather than run at t is the pooling itself; the underlying predictions were genuinely prospective.
The two cases together exercise both audit regimes. In neither case does the retrospective substitute for a prospective, hash-committed run under the full protocol; they show that the machinery delivers verdicts consistent with the settled scientific record on cases where that record is unambiguous, and expose the interpretive tension in the intermediate regime where the paper's defeat condition (g) is doing real work.