Securing the KRONOS-CTRL Digital Twin

The digital twin drives design, training, and replay; its models and data are integrity-protected so a corrupted twin cannot poison the controllers it informs.

The twin as a trust dependency

KRONOS-CTRL, the digital twin, is where control policies are developed, models are trained, and decisions are replayed for verification. Because the twin influences what the real machine will do, its integrity is a security property, not just an engineering convenience. A corrupted twin could ship a subtly wrong control model, or make a real fault look normal in replay. Kronos protects the twin's model artifacts, training data, and outputs accordingly.

Integrity controls

• Model artifacts are versioned, hashed, and carry provenance - see SBOM and provenance.
• Training data is content-addressed and access-controlled - see ML model supply chain.
• Any model promoted to the control plane crosses the air-gap bridge under two-person control.
• Replay determinism: a recorded decision re-run in the twin must reproduce the original output, or tampering/drift is flagged.

Replay as a tamper detector

# Replay a signed decision against the pinned model; mismatch = alarm
def replay_check(decision):
    model = load_pinned(decision.model_hash)     # exact model version
    out = model.infer(load_state(decision.state_hash))
    if out != decision.cmd:
        raise Tamper('decision not reproducible - investigate')
    return True

Separation from live control

The twin runs at Purdue level 2 and in IT-side training clusters, never directly on the actuation path. It cannot command the machine; its influence is only through vetted, promoted artifacts. This means even a fully compromised twin cannot directly move the plasma - it can only attempt to ship a bad model, which the promotion ceremony and post-promotion attestation are designed to catch.

Design status: model versioning, replay determinism, and gated promotion run today in the twin environment - which is itself the current test bed since no reactor is built. Live-plant separation is the intended FOAK deployment.