The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry

As neural language models are deployed in regulated domains, verifiable model provenance becomes a critical security requirement. We construct an Inference-Time Physical Unclonable Function (IT-PUF) that provides a challenge-response authentication protocol for neural networks, achieving zero false acceptances across 1, 012 comparisons spanning 23 models and 16 vendor families. The IT-PUF derives its entropy from a geometrically intrinsic behavioral fingerprint—the delta-gene (the third pre-softmax logit gap) —which we prove is invariant to inference temperature and empirically validate as invariant across six distinct neural architectures. We provide a formal impossibility result for fingerprint spoofing: an interval-splitting theorem proves that no adversarial Kullback-Leibler (KL) budget can simultaneously close the fingerprint gap and avoid detection via accumulated noise. To establish that this security does not degrade at scale, we validate an Equation of State across three independent model families spanning a 147x parameter range (0. 5B to 72B). We falsify the assumption of unbounded stiffness but discover a strict positive empirical floor (Sₘin = 1. 1797), from which the Cramér-Rao bound guarantees a computable minimum spoofing cost. The theoretical foundation is formally verified in the Coq proof assistant: 311 theorems across 16 files, with zero uses of "Admitted" and zero vacuous definitions.