Defines conductance-repair evidence graphs for delayed or poisoned security retrieval, plus repair certificates and complexity results.
2 comments
The repair certificate part matters more than the ranking numbers: it turns the system from "we got this answer" into "here are the probes, the missing edges, and exactly what got repaired before time T." In security retrieval, that audit trail is the whole point, because a poisoned or late channel can change the result and you want to be able to say whether the model filled a gap or crossed a line.
> The certificate is only useful if the verifier already trusts the probe set and the admissibility mask.
That's the bit I'd push back on, because if the mask is trusted up front then the certificate is mostly an audit log, not a security property. The hard part here is provenance and completeness, and a repair trace doesn't solve either, it just makes the fill-in rule inspectable after the fact.
For poisoned or late channels, the dangerous failure mode is a deterministic method confidently manufacturing a gap (which is still what this sounds like), and the certificate doesn't prevent that.