Authentic closing-price series from frozen packet 44C. This compact view omits OHLC and volume.
hiddenticker + calendar dateretained20 days of OHLCV + derived features
ICAIF 2026 submission · project lead · SCBX R&D
The ticker is gone.
Can you find it anyway?
Below is one real, masked 20-day OHLCV packet from the study's public audit artifact. Its dates are relative. Its ticker is absent. A second provider still has the underlying market record.
Three representations · three different fingerprints
Switch what the model sees.
Each protocol removes the obvious label while retaining a different numeric payload. The audit attacks the fields that remain, not a ticker hidden elsewhere in the packet.
98 of 99 cross-provider packets recovered jointly.
conditioned null0.011%
Audit fidelityPaper-specified representation stress test
What is actually shownReduced U.S.-equity numeric payload; not the complete KTD-Fin system
Period targetYes · within ±5 trading days
A2 sealed exhibit · three frozen packets · exact offline replay
Change the clue.
Watch the field reorder.
Each tab starts from a frozen Yahoo packet and searches the study's Alpaca/IEX candidate index. The interface replays the declared single-channel matcher. It does not query a live market service.
Frozen packet
Exposure
Released identityASSET_7119 · relative days only
Answer keyKMI · 2025-01-08
Exact distanceL2 dollars
released packetselected candidate
packet start26.34
candidate start26.34
This view retains raw price level.
Exact answer-key row rank#1answer-key distance 0.0405 · recovered first
Top-2 distance gap2.9459runner-up distance − best distance
What changedAt 20 days, every channel agrees.Single-packet diagnostic
The 5- and 10-day controls truncate the same frozen 20-day packet. They are packet-level prefix diagnostics, not the paper's separately sampled exposure cells. "Exact row rank" uses one ticker and one start date; the aggregate paper metric allows ±5 trading days. The compact export stores candidate close and volume paths only. For OHLC shape, the overlay shows normalized close; the export generator computed the exact distance and rank from the full return, range, and overnight-gap arrays.
The search, staged · exact ranks over a drawn field
Same index.
Different geometry.
The workbench above prints the search as a ledger. This stage draws it as a place: every candidate window owns one anonymous cell in rank order, the real top five stand named, and the answer key marks its exact rank. Switch the clue — the index never moves. The answer does.
Frozen packet · L20
Matching channel
Staging
This staged field needs WebGL and a connection to the Three.js CDN.
Every measured number lives in the receipt and ledger below, and in the workbench above.
Every measured number lives in the receipt and ledger below, and in the workbench above.
Answer-key row rank—of — · L20 primary
Answer-key distance——
What changed—exact row rank = one ticker + one start date
Select a record to inspect its exported path. Teal rows are the answer key.
What just happened
The winning clue changes by case.
For KMI, all five channels put the exact answer-key row first after 20 days. For APTV, raw price level ranks it 9,463rd, while rebased close, returns, and OHLC shape rank it first. For AZO, relative volume ranks it 7,890th, while the four price-derived channels recover it.
Cross-provider differences can break one fingerprint without breaking the others. That is why the paper reports each channel separately from the frozen composite.
Channel ablation · exact paper results
Remove the price level.
The path still talks.
The left panel transforms one frozen APTV packet. The right panel reports a separate aggregate ablation over all 99 A2 packets. They share a transformation, not an estimand.
Illustrative caseFrozen APTV packet 1D2
APTV packet · original close level58.89 → 59.35
A2 aggregaten = 99 packets · L = 20
Frozen composite99.0%99.0 → 14.1
Price level99.0%99.0 → 5.1
Returns100.0%100.0 → 100.0
Normalized close100.0%100.0 → 100.0
OHLC shape99.0%99.0 → 99.0
Relative volume11.1%11.1 → 11.1
The aggregate fit weights price level most heavily, so its composite recovery falls after every packet is rebased. The predeclared return and normalized-close matchers do not.
What the audit adds
A claim about a representation, not a guessing game.
- Separate the mechanisms.Parametric recognition, database linkage, agent-built attacks, and downstream use are different claims that need different tests.
- Test the released fields against another provider.Freeze the representations, candidate sources, distance functions, and null models before opening the confirmatory split.
- Make mitigation earn its conclusion.Reducing a release is not enough: the study tests both collision-based resistance and whether the remaining signal survives.
Aggregate audit · sealed results
The packet above is a frozen exhibit. These are study-level results.
The audit evaluated cross-provider linkage on held-out packets after freezing the metric and matching rules. The graphics below summarize two findings that give the single case its context.
Joint recovery for the reconstructed BlindTrade trace; descriptive lengths use n = 24, while the 20-day primary cell uses n = 99.
5 days62.5%
20 days primary94.9%
40 days95.8%
Sealed 600-firm study, maximum ticker Top-1 across its declared attack ensemble.
six continuous summaries99.5%still linkable
five train-fitted bins0.5%closed-set recovery
38 / 50absent stocks falsely linked in the R3 open-set control
not certifiedraw-signal MSE-gain 95% CI [−.016, .125] crosses zero
One actual R3 equivalence class
One bin pattern.
One bin pattern.
1,705 candidate records.
The six cells below are the released five-bin summaries for one frozen validation packet. Every record in the list has the exact same pattern, so the release cannot distinguish them.
M2 validation packet 1 · frozen candidate indexShowing 18 records from the collision set. The highlighted record is the answer key.
In the frozen development-packet scaling extension, which is separate from the sealed A2 split, 100/100 KTD-style packets remained unique nearest neighbors among 3.51 million ticker-date windows. Rebasing removed the level channel, but normalized-close recovery still reached 100%.
Four stages of evidence
One result does not prove the next.
Move through the chain. Each stage changes the question, evaluation split, and strength of the conclusion.
A2 · one-shot sealed confirmatory splitestablished
Representation property
Can public data identify the hidden record?
Yes. Frozen cross-provider linkage recovers all three audited representations far above their conditioned nulls.
KTD-style98 / 99ticker + date
BlindTrade94 / 99ticker + date
Epistemic port79 / 375ticker
What this does not establish
It does not show that an LLM remembers, discovers, or financially exploits the identity.
WorkbenchA2 packet replay
Three selected confirmatory Yahoo packets searched against the frozen Alpaca/IEX candidate index. This is a diagnostic subset.
Aggregate recoveryA2 sealed result
One-shot confirmatory split with frozen metrics, matching rules, and conditioned nulls.
Agent constructionP1 · separate
Held-out development allocations show that tasked coding agents can build attacks. P1 does not add confirmatory A2 evidence.
Discovery + valueSeparate assays
The neutral pilot missed its gate. The downstream header assay did not establish forecast value.
Read the claim narrowly
This is a representation audit for public U.S.-equity data. Linkability is not proof of model memorization, spontaneous exploitation, personal-privacy harm, or trading advantage.
Read the full paper ↗