This repository is a reproducibility and model-representation experiment. It does not provide encryption, confidential inference, model-IP protection, or a secure transport protocol.

A TPMAP assigns each logical token ID a different physical model ID. When the embedding and output-head rows move consistently, raw token streams from one namespace are not directly usable with another namespace.

The internal tools likewise assign different physical coordinates to MLP neurons, attention heads, and the residual hidden basis. Compensating axes are moved together so the exact-arithmetic model function is preserved; finite- precision FP execution can still drift through changed reduction order.

These properties are useful for namespace separation, compatibility testing, and equivalent model layouts. They are not security guarantees.

A fixed token permutation is a monoalphabetic substitution over BPE tokens. It preserves or exposes sequence length, token boundaries, repetition patterns, and token frequencies. Known-plaintext, chosen-plaintext, frequency, language- model, and embedding-analysis attacks can recover semantic mappings.

All-axis coordinate permutation changes locations, not values. Tensor names, shapes, dtypes, scalar values, and the model's callable behavior remain available. The transformation does not add noise, remove information, or create a cryptographic hardness assumption.

If an attacker has the original public checkpoint, exact row/block matching and ordinary model-alignment techniques make the maps especially recoverable. Duplicate values and larger coordinated axes can complicate a particular matching procedure, but they do not create a supported confidentiality claim.

Do not describe this repository as RSA, Enigma, a hash, encrypted weights, private inference, or a private model. Accurate descriptions are reversible coordinate permutations, equivalent model layouts, and—for the boundary map—a model-specific token namespace.

• A token key deterministically generates a vocabulary permutation. An explicit complete row order can generate the same TPMAP1 representation without a key.
• TPMAP stores both the complete token permutation and inverse. Possession of the TPMAP is sufficient to translate all token IDs; the original token key is not needed at runtime.
• MLP, attention, and residual-coordinate maps are derived deterministically from their independent key files and the recognized model layout. They are baked into the converted weights and are not stored in TPMAP.
• Key and explicit-order fingerprints identify inputs; they do not authenticate a model or map.
• TPMAP's unkeyed payload SHA-256 detects accidental corruption, not malicious replacement.
• Tools create new TPMAP files with owner-only permissions, but callers remain responsible for storage, backups, copying, and deletion policy.

For confidential token or text transport, use a reviewed authenticated encryption construction such as AES-GCM or ChaCha20-Poly1305 with proper key management and nonces. For confidential model serving, use a threat-modelled system based on established cryptographic or trusted-execution techniques.

Coordinate permutation may be layered inside such a system as a namespace or representation choice, but it does not replace the security layer.

MGW, SafeTensors, TPMAP, key, explicit-order JSON, and config files are trusted research inputs. The parsers validate expected structures, sizes, tensor classification, vocabulary compatibility, bijections, and TPMAP payload integrity, but they have not been audited or fuzzed as hostile-file parsers. Do not process attacker-controlled artifacts in a privileged context.

Please report crashes, incorrect acceptance, out-of-bounds behavior, or cases where the documented equivalence fails through the repository issue tracker. Claims that a fixed permutation can be deciphered are expected and belong to this documented boundary, not to a vulnerability in the experiment.