2026-10-09 校核：Merkle 承诺证明内容身份与完整性，不证明知识真实；抽样检测界依赖随机抽样与不一致比例，量化不能保证所有硬件复现相同嵌入。默认 HashEmbedder 为词法嵌入。 1

AMBER — Bank the Expensive Compute Once

Author: Pete Ferr (@peteferr) | Stars: 283 (June 30) | Created: 2026-06-28 | License: MIT

Core Idea

AMBER freezes the cost of embedding a corpus into a portable .amber artifact — a single file that is a cryptographic commitment binding source chunks to their quantized embeddings. Anyone can later verify the artifact’s integrity without re-running the expensive embedding.

Key Innovation

While offline RAG with local vector stores is prior art (ChromaDB, LanceDB, sentence-transformers), AMBER adds a self-certifying layer:

1. Self-certifying artifact format — Merkle commitment binding source chunks to quantized (int8) embeddings, with domain separation and position/length binding
2. Probabilistic authenticity audit — detection ≥ 1 − (1−ρ)^k soundness bound, verifying at sublinear cost (O(k) re-embedding of random samples)
3. Reproducibility under quantization — int8 quantization reduces some floating-point variation; identical output across arbitrary hardware, models and library versions is not guaranteed

Architecture

Relevance to Hermes Ecosystem

• Agent identity/trust: Amber-style attestation could let agents prove their knowledge artifacts (gbrain exports, memory snapshots) are authentic without recipients re-embedding the entire corpus
• Verifiable RAG: If a Hermes agent carries a .amber artifact offline, it can prove the retrieval is faithful to the original source corpus
• The audit gap: Integrity alone can be fooled by a self-consistent forgery (re-commit after tampering). The audit can detect sampled embedding inconsistencies under its assumptions; a self-consistent replacement still requires an external trusted corpus/root to distinguish — a pattern directly applicable to agent memory security (cf. OWASP ASI06 — memory poisoning detection)

What It Doesn’t Do

• Says nothing about downstream generators (identical context fed to different models can produce different answers → banked retrieval ≠ banked reasoning)
• Requires external trust anchor for corpus truthfulness (as opposed to corpus identity)
• Default embedder is HashEmbedder (lexical, not semantic); SentenceTransformer is optional

Action Items

• 🟢 Monitor for production-readiness (only 2 days old, 0 issues, clean CLI)
• 🟢 Consider integration pattern: gbrain export → .amber artifact for cross-agent knowledge verification
• 🟢 Paper at paper/amber.pdf in repo — read for formal threat model