Update: Project Boundary Clarification + Current Status (Verification Track)
I’m posting this to keep the public record clean and auditable.
What this Manifund project is (unchanged)
This project is a measurement and verification effort: testing whether retrieved, untrusted content can leave measurable residual influence after resets/isolation steps that are commonly assumed to “clean slate” a model.
It is not an exploit project.
It is not a jailbreak exercise.
It is not a claim that any specific vendor is “unsafe.”
The deliverable is reproducible artifacts (logs/hashes/diffs) that can be independently reviewed.
What’s been established so far (unchanged)
Using a stabilized evaluation harness with verified null baselines, I’ve run controlled experiments where:
external retrieved content is ingested
a reset/isolation mechanism is applied
subsequent behavior is measured against a clean baseline
Across completed runs to date:
No tested reset mechanism fully neutralized prior retrieved influence under the project’s defined conditions.
Results have been repeatable, and the remaining uncertainty is how robust the effect is under longer time gaps and across additional models.
What remains (bounded, verification-only)
The remaining work is exactly what the proposal states:
longer time-gap resets (tens of minutes to hours)
replication across additional open-weight models
clean-room revalidation under identical conditions
confirm observed effects are not infrastructure artifacts
Why I can’t finish this reliably on consumer hardware
Long-horizon verification requires stable scheduling and high-throughput, lossless logging. Laptop-class systems introduce nondeterminism through:
scheduler/power management behavior
I/O contention under sustained capture
artifact corruption during multi-hour runs
This is an infrastructure constraint, not a methodological one.
Clarification: separate work outside this Manifund project
In a prior update, I used wording that could be interpreted as linking this project to a separate report I filed through Google’s VRP. That was my mistake in phrasing.
To be explicit:
the VRP report is a separate track with its own scope and criteria
it should not be read as “validation” of this Manifund project
I am not claiming this Manifund work caused any product change at Google
I’m keeping the VRP work out of this project’s public narrative because this Manifund proposal is about one thing: finishing verification with audit-grade artifacts.
What funding unblocks
The $15,000 one-time workstation request enables:
continuous multi-hour evaluation without artifact corruption
deterministic reruns and clean-room verification
side-by-side model replication
evidence packages suitable for responsible private disclosure (if warranted)
Even a negative result (e.g., persistence doesn’t survive longer gaps) is still valuable and will be reported.
Bottom line: the core finding is established within the completed scope; funding unblocks completion of verification, not ideation.
