Post-Quantum Signed Inference with ML-DSA

What ML-DSA is

ML-DSA — the Module-Lattice-Based Digital Signature Algorithm — is a post-quantum digital signature scheme standardized by NIST. In Hyfstele it does one specific job: it signs the audit chain that records every inference call. Each new entry is cryptographically bound to the entries before it and sealed with an ML-DSA signature, so the sequence forms a chain that cannot be altered, reordered, backdated, or deleted without the signatures failing to verify.

Conventional signature schemes like RSA and ECDSA do the same signing job today, but their security rests on math (integer factorization, elliptic-curve discrete logs) that a sufficiently large quantum computer is expected to break. ML-DSA rests on lattice problems believed to remain hard even against quantum attack. That distinction is the whole point for records meant to outlive the current generation of cryptography.

Why anchoring inference to a signed chain makes the record tamper-evident

"Tamper-evident" is not the same as "tamper-proof." Nobody can promise a log will never be touched. What a signed chain guarantees is that any touch shows. When each inference call — its inputs, the model version, the output, the timestamp — is hashed into a link and that link is signed with ML-DSA and bound to its predecessor, the chain has a property auditors care about: you cannot rewrite one entry without breaking every signature downstream of it.

So if someone tries to quietly change what the model was asked, swap an output, remove an embarrassing call, or slot in a fabricated one after the fact, verification fails at that point in the chain. The gap is detectable. That converts "trust our logs" into "re-run the check and see for yourself."

Why post-quantum, specifically

The records that regulated teams produce are not disposable. Under 21 CFR Part 11, GxP, and federal recordkeeping rules, an audit trail may need to stay trustworthy for years or decades — well past a product's approval, and potentially into litigation or inspection long after the fact.

That long horizon is exactly where "harvest now, decrypt later" bites. An adversary does not need a quantum computer today; they need one before your retention window closes. If the chain were signed with RSA or ECDSA, a future quantum computer could forge those signatures retroactively and rewrite history in a way that still verified — silently destroying the evidentiary value of the whole record. Choosing ML-DSA now means the signatures you generate today are meant to still be unforgeable when someone checks them ten years from now.

One of four independently verifiable controls

Signed inference is the cryptographic backbone of a broader posture. Hyfstele runs open-weight models inside your own perimeter, air-gapped, with four controls — each one verifiable on your hardware, not asserted by us:

These controls are independent. Control 4 tells you the record of what happened is intact; signed, auditable AI is what you get when it works together with the other three. It does not stand in for proving weight integrity or containment — each control answers a different question, and no single one is asked to carry the whole claim.

Verification happens on your hardware

A signature is only as trustworthy as the party who checks it. If verification depended on calling back to Hyfstele, you would be back to taking a vendor's word. So it doesn't. You hold your own copy of the ML-DSA public key, and you re-verify the chain inside your own perimeter, with no external service in the loop — which is consistent with the no-egress control above.

That is the difference between a compliance story and evidence. Anyone — your quality team, an auditor, an inspector — can independently confirm that the sequence of inference records is complete and unmodified. It is a tamper-evident audit trail you can inspect yourself, not a certificate we hand you.