A mechanism-defined taxonomy for network-boundary and node-resource attacks on decentralised infrastructure. Target venue: arXiv cs.CR.
The paper is one document: paper.md.
Unreviewed preprint, working draft of 2026-08-12. Not peer reviewed, not yet submitted. Every figure and count is computed from the pinned snapshot of 2026-07-24 and does not track the live registry, which has grown past the pin and been repaired since. Wording, family assignments and section numbering may change before submission, so a citation should carry the draft date.
The classification is one team's judgement with no second rater and no inter-rater measurement,
which section 8 states plainly. A disagreement is most useful raised against a specific NRDAX-T
identifier: data/classification.py publishes the per-technique assignment so that it can be.
Archived at 10.5281/zenodo.21903197, CC-BY-4.0. That is the version DOI for the pinned snapshot, not the concept DOI that tracks later versions, so citing it keeps a figure attached to the state it was computed from.
Every figure in the paper is computed from two committed files:
data/registry-snapshot-2026-07-24.json- the registry as served on the pin date, 420 published techniques. SHA-256f10db758ac7749606a3117bbd6517c2ab6911ebbf6e709f71f1bd6ef6e3bc726.data/classification.py- the per-technique mechanism assignment, 97 techniques, joined to the snapshot by identifier.
The live API does not reproduce the figures. The registry is increment-only and has been repaired since the pin, so it now holds more techniques than the paper reports and different mechanism text for some of them. These two requests show current state, which is useful for seeing how far the registry has moved and not for checking a number in the paper:
curl 'https://api.nrdax.com/v1/techniques?limit=500'
curl 'https://api.nrdax.com/v1/aadapt?limit=500'
On the live API, classified techniques are those with classification: "curated". The
mechanism family is family; the producing pipeline's own operational label is
producer_family. The two are never merged. The deposited snapshot predates the
classification, so its family column holds the producer's label throughout.
data/mechanism-audit.py and data/mechanism-audit.csv are the first-pass resource-class
audit. They are kept because the difference between that pass and classification.py is the
derivation of the two axes (section 3.2.5). A reader who disagrees with an assignment can
raise it against a specific identifier.
figures/ is generated from the pinned snapshot by data/make_figures.py, which reads only
committed files, so no figure can drift from the text. Each figure is provided as SVG (vector,
for print) and PNG (2400px wide, for documents that cannot place SVG).
python3 data/make_figures.py
build-review-doc.py generates a read-and-comment copy of the paper for Google Docs or similar.
paper.md stays the source of truth.
python3 build-review-doc.py # review/paper-full.md
python3 build-review-doc.py --html # review/paper-full.html
Import the HTML. Docs keeps the headings, the 14 tables, the code blocks and the three figures as
real structure, where markdown import handles tables less reliably. The build is deterministic, so
a copy returned from Docs can be exported as markdown and diffed against review/paper-full.md to
show what a reviewer changed rather than the whole file.
Do not round-trip the document back into the repo. The \cite commands, 108 table rows and every
number verified against the pinned snapshot all survive a docx conversion badly. Comments come back
into paper.md by hand. review/ is generated and gitignored.
51 of the 420 records in the pinned snapshot carry a mechanism field truncated at 200
characters, 43 of them among the 97 classified. The truncation was repaired on the live
registry on 2026-07-29, five days after the pin. The Zenodo deposit includes
truncated-mechanism-sidecar.csv, which lists all 43 with the pinned and repaired text side
by side. The classification has not been re-checked against the repaired text.
Reproduction bundles are not published. Instances reference them by bundle_ref and record
what each reproduction observed, so a reader can see that a reproduction exists but cannot
re-run it.
The paper, the figures and the data are CC BY 4.0 (LICENSE), the same terms as the
Zenodo deposit, so the repository and the DOI grant the same thing. Use them with attribution.
The scripts - data/*.py and build-review-doc.py - are MIT (LICENSE-CODE).
Copyright 2026 NullRabbit Labs.