DEV Community: Dmitry Mandrika

Wallet address spoofing attacks: Nobody Reads 42 Characters

Dmitry Mandrika — Thu, 24 Sep 2026 09:48:12 +0000

Address poisoning and clipboard hijackers make the same bet: that you look at the first few characters of an address, the last few, and nothing in between. We wrote a small open-source library that turns the whole address into a picture, and then worked out what it costs to fake one.

On 3 May 2024 someone sent 1,155 WBTC, about $68 million that day, to a stranger.

They had been careful. They first sent a 0.05 ETH test payment to the right address, and only then moved the real amount. In between, an attacker dropped a worthless transfer into their history from an address that started with 0xd9A1 and ended with 853a91, exactly like the one they had just paid. When the victim went back to the history to copy the recipient, there were two entries that read 0xd9A1…3a91. They picked the wrong one. (CoinDesk, Blockaid)

The story has an unusual ending: after a week of on-chain messages and a 10% bounty offer, the attacker returned about 22,960 ETH. Most victims don't get a sequel.

I'm Dmitry. I build SoikaWallet, a non-custodial desktop wallet with an air-gapped signer that lives on a phone. When we reviewed our own send screen against this attack, the honest summary was short: our only defence was showing the full address and hoping the user reads it. This article is about why that is not a defence, what the attacks look like up close, and the library we wrote because of it.

The swap that happens after you press Ctrl+C

The older of the two attacks is the clipboard hijacker, or clipper. It sits on the machine, watches the clipboard, and when something that looks like a crypto address appears, it replaces it with the attacker's. You copy one address and paste another.

It is not new and it is not rare. Kaspersky's CryptoShuffler took 23 BTC this way back in 2017. Unit 42 described ComboJack in 2018; it polled the clipboard every half a second. The same year Bleeping Computer took apart a sample that worked with more than 2.3 million addresses. In February 2019 ESET reported the first clipper on Google Play, dressed up as MetaMask. In 2023 Kaspersky counted about 16,000 detections in 52 countries of a trojanized Tor Browser with a clipper inside, and roughly $400,000 stolen that year. On 17 June 2026 Microsoft and Check Point each published a fresh clipper campaign. Same day, unrelated malware.

The early clippers had a weakness: the pasted address looked nothing like the copied one, and a user who glanced at the first characters noticed. So the malware learned to pick a replacement that looks right. The one Microsoft described substitutes a Bitcoin address that begins with the same two characters as yours. Crude, but it's the right idea.

Laplas Clipper, sold by subscription since 2022, sends the address you copied to its server and gets back a lookalike. Bleeping Computer tested it: the returned Bitcoin address matched the first and last few characters of the original, and came back in about five seconds.

And the swap no longer has to happen in the clipboard. It moved into the application:

In September 2025 a phished npm maintainer account pushed malicious versions of chalk, debug and sixteen other packages with over two billion weekly downloads between them. The payload ran in the browser, hooked fetch, XMLHttpRequest and window.ethereum, and rewrote any address it saw in page data or in an outgoing transaction. It chose the replacement from 280 hardcoded addresses by Levenshtein distance, that is, the one that looked most like the original. It was caught within two hours and earned almost nothing. The design is what matters.
In April 2025 ReversingLabs found an npm package that patched the installed Atomic and Exodus wallets on disk, so that the genuine wallet UI redirected outgoing funds. Removing the package did not undo it.
Doctor Web described counterfeit Android phones shipped with a modified WhatsApp that swaps addresses inside messages. The sender's screen shows the right address. The recipient's shows the thief's.

Different delivery, one assumption: the human at the end of the chain will compare a few characters at each end and approve.

The transfer you never asked for

Address poisoning needs no malware at all. Everything happens on-chain, in public.

The attacker watches for transfers. You pay Alice. Within minutes your history gains a new row involving an address that begins and ends like Alice's. Next time you pay Alice, you open the history, copy "her" address, and it isn't hers.

Researchers at Carnegie Mellon, in a USENIX Security 2025 paper, sort the bait into three kinds:

Dust. A tiny amount of a real token sent from the lookalike address. In their data 98.8% of these are under $3.
Zero-value transfers. ERC-20 transferFrom with amount 0 needs no allowance, so anyone can emit a Transfer event from your address to their lookalike. In your history it looks like something you sent.
Counterfeit tokens. A fake contract with the symbol "USDT" can emit whatever events its author likes.

Their numbers for two years of Ethereum and BSC: 270 million poisoning transfers, 17.4 million targeted addresses, 6,633 payments that went to a lookalike, at least $83.8 million lost. The WBTC case isn't even in that total; their detector didn't follow that token. The success rate on Ethereum was about 0.01%. One in ten thousand is plenty when a try costs cents. Chainalysis dissected the campaign behind the WBTC theft: 82,031 seeded lookalike addresses, and even after giving the $68 million back the operator cleared about $1.49 million, a return of more than 1,100%.

It got worse when it got cheaper. After Ethereum's Fusaka upgrade in December 2025 cut fees, Blockaid counted 628,000 poisoning attempts in November 2025 and 3.4 million in January 2026. Coin Metrics estimated that dust had become about 11% of all Ethereum transactions, and that the single busiest sender reached over a million addresses for roughly $5,000 in tokens.

On 19 December 2025 a trader withdrew about $50 million in USDT from Binance, sent a 50 USDT test to the right address, and 26 minutes later sent 49,999,950 USDT to a lookalike. Note what that person did: a test transfer. That is the standard advice. The test transfer is, in all likelihood, what told the attacker which address to imitate.

"Check every character" is not advice

Every vendor guide ends the same way: verify the entire address. Trezor's says "carefully check every character". Ledger's, to its credit, adds that "people are not machines: we can be lazy, we can be in a rush".

It is worse than laziness. People who are trying still fail. In an eye-tracking study at CCS 2018, participants were explicitly asked to verify a 64-digit checksum in which only the first ten and last ten digits had been kept. 38% of them missed the mismatch. Tan et al. (CHI 2017) simulated an attacker who matches the beginning and end of a hex fingerprint: 21% of attacks got through. One participant described the method all of us use: "I first checked the last set of numbers, then randomly glanced… until I felt I had verified enough."

Wallets make it easier for the attacker by not showing the middle at all. 0xd9A1…3a91 is a design convention, and the CMU authors think it explains why the biggest poisoning group mined two tiers of lookalikes, one for wallets that show three to five characters at each end and one for explorers that show six or seven. MetaMask said it plainly in June 2026 when it shipped its detection feature: truncation "is the exact blind spot scammers exploit".

How expensive is the lookalike? The open-source profanity2 generator reports 1,361 million addresses per second on one RTX 4090. Matching the first four and last four hex digits is 2³² tries. Three seconds. The CMU team estimates that the strongest group they tracked, which matched up to 20 digits, burned about 27,000 GPU-days on it. They still came out ahead.

Why not just use identicons?

That was my first thought too. Wallets already draw little icons next to addresses. Shouldn't the lookalike get a different icon?

Often it doesn't. MetaMask's Jazzicon is, as far as I can read the code, seeded with parseInt(address.slice(2, 10), 16): the first eight hex digits, 32 bits. A lookalike that matches those eight digits gets the same icon, pixel for pixel. Blockies feeds the address string into a small non-cryptographic generator and picks colours from a continuous range; back in 2018 Austin Griffith built a Blockie miner, and a twin good enough to survive a glance turned up after 45 minutes.

We ran our own version of that experiment: 16.7 million random candidates per target, keep the five that look most like it.

There is a deeper problem, and it applies to us as well. Tan's study also tested pictures: with OpenSSH randomart and abstract Vash images people missed 10–12% of attacks, and with cute unicorn avatars 54%, the worst result in the paper. People compare the gist of an image, and an attacker matches the salient features first. Any visual scheme has to be designed around that, and has to be honest about where it stops.

What we built

Humanized Hash, hh for short, turns an address, a public key or any hash into a 4 × 4 grid. A cell is empty or holds one solid figure: a square, a circle, or a triangle pointing one of four ways, in one of four colours. It looks a bit like a GitHub identicon, which was the intent. I wanted something calm.

The design rules came out of the usability papers more than out of cryptography:

Few categorical values, no gradients, no fine texture. Hsiao et al. found that 24 bits encoded in 8 distinct colours were compared with about 85% accuracy on hard pairs; the same 24 bits in 64 fine colour steps dropped to a coin flip.
Equal salience. Every cell has the same size and the same kinds of content, so there is no single dominant feature for a forger to match first. That is the unicorn lesson.
Content you can name. "Purple triangle pointing left, top-left corner" works over the phone.
It hashes bytes, not strings. The checksummed, lower-case and upper-case spellings of one EVM address give one picture.

Nominally a picture carries 68 bits, 44 of them in shape alone. Our first draft was a 3 × 3 quilt with 16 glyphs. It lost about 30 bits and the glyphs turned to mush at 32 pixels, so it went in the bin.

Next to the picture there is a six-character tag like W2D-2K6. I'll come back to why.

Under the hood there is nothing exotic: SHA-256, HMAC and PBKDF2, with length-prefixed, domain-separated inputs. No invented cryptography. The libraries have no third-party dependencies (we wrote the SHA-256, the deflate and the PNG encoder ourselves), use integer arithmetic only, and produce the same bytes in C++, Kotlin, TypeScript, Go and Python, checked against shared golden vectors. MIT licence. The algorithm has no version and will never change, because a picture a user has learned must stay the same forever.

What a forgery costs

This is the part I care about most, so here is how the numbers were obtained. They are calculations, not a measured attack.

The attacker's speed. We take profanity2's 1.36 billion addresses per second on an RTX 4090 and round up to 1.4 billion. (CMU measured 516 million on an older RTX 8000, so this is generous to the attacker.)

The text. Matching d hex digits takes 16^d tries on average. Four at each end: 2³², three seconds. Six at each end: 2⁴⁸, 2.3 days. Eight at each end: 2⁶⁴, about 420 years.

The picture. Before anything is drawn, the input goes through 16,384 iterations of PBKDF2-HMAC-SHA-256. For us that is about 7 ms on a desktop core and 12 to 33 ms on a Pixel 5a, once per address, cached. For a forger it is paid on every try, and we estimate it adds about 11 bits of work, which turns 1.4 billion tries per second into roughly 700,000.

Then the question is how many tries. A perfect forgery must match all 16 cells: 2⁶⁸. But people are not perfect comparers, so we also price a sloppy forgery that is allowed to differ from the target in any two cells: about 2⁵².

So: 2⁵² stretched tries is about 210 GPU-years, 2⁶⁸ is about 14 million. And a forger who needs the ends of the text to match and the picture to match pays the product of the two.

Now the caveats, because there are two big ones.

First, GPUs can be rented by the thousand, and a mass attacker doesn't grind against one victim. The CMU paper shows groups testing each candidate against about a million targets at once, which divides the cost per victim by a million. 210 years divided by a million is under two hours. For a picture everybody can compute, that is uncomfortable.

Second, humans reliably distinguish only about 30 bits of a visual hash, fewer from memory. A picture that looks different proves the address is different. A picture that looks the same is strong evidence and not proof. That is what the tag is for: six characters you can compare exactly, by eye or by voice.

The picture only your wallet can draw

The answer to the first caveat is the second mode, and as far as I know no wallet does this with its identicons today.

In keyed mode the fingerprint is an HMAC of the stretched digest under a 32-byte secret that belongs to your wallet. An attacker who doesn't hold the key cannot compute the picture you will see. There is nothing to grind against. Their lookalike address will get some random picture, unrelated to the one you know for Alice, and not by 2⁵² but by construction.

Poisoning and clipboard swaps target one wallet at a time, which is exactly the case this covers. The key is derived from the wallet seed on its own path (SLIP-0021), so it needs no backup and a restored wallet draws the same pictures. A nice side effect: mistype your BIP-39 passphrase and every picture is unfamiliar.

Universal mode remains for cases where two parties compare: a receive screen shown to a payer, a payment request, a support chat. Stretching is there to make that mode as expensive to attack as we can afford. The two modes give unrelated pictures on purpose, and keyed pictures carry a frame so you can tell which one you are looking at. Mixing them up can only cause a false alarm, never a false match.

Four colours, chosen for people who see them differently

About one man in twelve has a colour vision deficiency. A security indicator that fails for 8% of male users is a bad indicator, so colour was treated as the secondary channel from the start: 44 of the 68 bits are in shape and position, which survive any kind of colour vision, greyscale and JPEG.

The colours still had to be picked properly. We followed the method from Petroff's "Accessible Color Sequences" (2021): for every pair of colours compute the perceptual distance in CAM02-UCS under normal vision, under protanomaly and deuteranomaly at severities from 10% to 100% (the Machado et al. 2009 model), and under tritanopia (Brettel et al. 1997). The palette's score is its worst pair under its worst condition. Our gate was a minimum of 20, plus WCAG contrast of at least 3:1 against both white and a dark #121212 surface, because wallets have dark themes.

The well-known palettes didn't pass. The first four Okabe-Ito colours scored 12.5 under tritanopia and only 2.25:1 on white. Petroff's own first four failed on contrast. The palette I liked by eye failed too (16.4 under deuteranopia). What shipped is that hand-picked palette nudged by an optimiser, within 12 CAM02-UCS units of the original, until it passed: #7A96C5, #890AF0, #C10445, #D48200. Score 24.1. The weakest pair is red against orange under full deuteranopia.

Four colours is less than the eight the literature allows. With that contrast requirement on both light and dark backgrounds, four is what stayed apart for everyone.

Where it sits in SoikaWallet

hh is a standalone library, but we built it for SoikaWallet, and that shaped it. SoikaWallet is a non-custodial, multichain desktop wallet (Bitcoin, EVM, Tron, Solana, Sui, TON) written in C++, with an AirGap mode: the keys live on a phone that never goes online, and transactions travel to it as QR codes, over NFC or Bluetooth.

The picture does two jobs there.

Checking a recipient. The picture stands next to the recipient field on the send screen and updates the moment an address is pasted, then appears again in the confirmation. Saved contacts and history rows carry it too. If a clipper swaps what you pasted, or you copied a poisoned row, the picture next to the field is not Alice's picture. For a first payment to someone new, the wallet shows the universal picture, so you can compare with what the payee sees on their receive screen.

Not getting lost in your own wallet. An HD wallet grows dozens of accounts across chains, all of them 0x… strings. Each account gets its picture in the account list and on the receive screen. After a week you recognise "the one with the orange square in the corner" the way you recognise an app icon. One EVM address has the same picture on every EVM chain, since the chain is deliberately not mixed in.

With AirGap there is a third job. The phone decodes the transaction request on its own and draws the recipient again, with the same private picture and the same tag. The offline phone is the screen you trust. If something on the online machine changed the address after you checked it, the two screens disagree, and comparing two pictures side by side takes a second where comparing two 42-character strings across two devices takes patience nobody has.

What it does not do

I'd rather you hear this from me.

It doesn't help a user who doesn't look. A picture that is never compared protects nobody. It belongs where the decision is made, at 64 pixels or more, not as a 16-pixel decoration.
It doesn't replace the text check. Same-looking pictures are evidence. The tag, or the full address, is certainty.
Malware that controls your screen, or the application that draws the picture, is out of scope. If the attacker can paint pixels, they can paint the right ones. That is what the air-gapped second screen is for.
Universal pictures can in principle be ground by a well-funded mass attacker. Inside a wallet, use keyed mode.
It does nothing for a first-time payment to an address you got from a compromised source. No hash can tell you that an address belongs to Alice. It can only tell you it is the same address as last time.

Try to break it

The code is on GitHub under censync, with the specification, the threat model, the golden vectors and the design sheets, including the ones where our ideas failed.

$ hh_cli 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91 --out real.png
tag          W2D-2K6

$ hh_cli 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 --out fake.png
tag          X9B-KSW

The real recipient and the attacker's lookalike from the 3 May 2024 case. Same first four and last six hex digits. Pictures drawn by hh.

If you build wallets, explorers or anything else that shows an address to a human, take it. If you do security research, the most useful thing you could do for us is to find a pair of addresses whose pictures a person would confuse, and tell us how long it took. Reports go to dev@censync.com.

And if you just use crypto: stop copying addresses from your transaction history. Keep an address book. The attacker's entire business model is that row.

GitHub sources, libraries: С++, Golang, Kotlin, Python, TypeScrypt

Follow along at soikawallet.app or @SoikaWallet.

Sources

Tsuchiya, Dong, Soska, Christin. Blockchain Address Poisoning. USENIX Security 2025.
Chainalysis. Anatomy of an address poisoning scam. 2024.
Blockaid. Address poisoning: the growing threat. 2026.
Coin Metrics. State of the Network, issue 349. 2026.
Cyble. Laplas Clipper. 2022.
Aikido. npm debug and chalk packages compromised. 2025. Security Alliance, incident analysis.
Kaspersky. Copy-paste heist. 2023.
Cherubini et al. Towards Usable Checksums. CCS 2018.
Tan et al. Can Unicorns Help Users Compare Crypto Key Fingerprints? CHI 2017.
Hsiao et al. A Study of User-Friendly Hash Comparison Schemes. ACSAC 2009.
Petroff. Accessible Color Sequences for Data Visualization. 2021. Machado, Oliveira, Fernandes. A Physiologically-based Model for Simulation of Color Vision Deficiency. 2009.

Ontological Boundaries and Polymorphic Architectures for Grounding Artificial Intelligence

Dmitry Mandrika — Mon, 21 Sep 2026 19:06:43 +0000

Artificial intelligence pipelines rely on graph data structures to feed information into language models. Computer science applies a specific reductionist transformation when converting unstructured human knowledge into machine-readable formats. Engineers decompose realities spanning multiple scales into binary relationships containing a subject and an object. This dyadic model indexes simple social networks efficiently while disintegrating when processing blueprints for composite engineering modules. Aircraft architectures operate through higher-order synergy. Manufacturing lifecycles depend on similar context-dependent states. Forcing a multi-entity interaction into a flat property graph strips the network of its containment boundaries.

The resulting digital artifact operates as an atomized mesh of disconnected fragments. Dr. Nicolas Figay identifies this phenomenon as the atomization fallacy. Standard graph theory defines an edge strictly as a dyadic set connecting two vertices. Physical engineering systems frequently involve non-additive interactions among numerous components. A chemical reaction inside a catalytic converter involves simultaneous dependencies between multiple compounds and physical substrates. Projecting an irreducible composite event into a graph requires a clique of pairwise edges. This projection introduces severe structural ambiguity. Algorithms traversing the data cannot distinguish between a single composite event and independent pairwise interactions.

Message Passing Graph Neural Networks aggregate neighbor features via these pairwise edges. The mathematical mechanism bounding this aggregation is the first-order Weisfeiler–Leman graph isomorphism test. The neural networks remain blind to higher-order substructures because of this mathematical bound. They struggle to learn composite compositionality without explicit topological extensions. Database developers attempt to bypass these flat graph limits using syntactic workarounds that leave the underlying atomization intact. The Resource Description Framework allows triples to nest inside other triples to accommodate edge metadata. This specification fails to create first-class semantic containment boundaries. Systems modeling languages treat components as properties of a parent classifier, stripping parts of their independent identity when evaluated outside the parent context. A hypergraph engine groups data syntactically without enforcing semantic boundaries. The engine remains incapable of distinguishing an ad-hoc cluster of attributes from an encapsulated object.

Ontological formalization requires mereotopology to accurately map physical engineering data. Formal mereotopology merges the study of part-whole relations with boundary configurations. Giancarlo Guizzardi’s Unified Foundational Ontology demonstrates how simple graph properties fail. Graph properties assume transitivity across all edges. A flat graph implies that a handle belongs to a door while the door belongs to a ship engine room, causing the logic to conclude the handle functions as a functional part of the ship engine room. Mereotopology proves functional composition behaves non-transitively. Flat graphs flatten distinct relation types into generic edges to muddy the operational context required for reasoning algorithms.

Composite objects demand a sortal classifier to supply a principle of identity. Nodes in a flat graph lack these sortal boundaries. A component experiences semantic collapse when changing states across an engineering lifecycle. The concept of the holon provides the theoretical structure to prevent this collapse. Arthur Koestler defined a holon as an entity acting simultaneously as an autonomous individual whole and a constituent part of a larger system. Knowledge representation languages enforce a rigid dichotomy between concrete instances and abstract category definitions. The holon breaks this separation completely. At the macro context level, the holon operates as an atomic individual node with single-point properties. The exact same holon functions as a container enclosing a complex internal graph at the micro context level. First-order logic engines fail to model this dual nature without triggering decidability failures.

Physical systems undergo virtualization across distributed platforms. Single-formalism graph mappings dissolve encapsulation boundaries during this process. An isolated ship engine subsystem collapses into a flat mesh of cross-layer relationships. Internal variables remain exposed to unauthorized contexts. Configuration integrity vanishes.

Retrieval-augmented generation pipelines rely on vector similarity to ground language models. Ingesting unstructured knowledge into a property graph shreds the rich narrative context of a blueprint into scalar edges. A graph algorithm traverses these relationships blindly during query execution. The traversal mechanism crosses logical boundaries without registering the shift in semantic space. The algorithm fails to determine whether an entity acts as a whole or a part in the specific moment of query execution. Emergent whole-system constraints go ignored.

The graph engine annihilates encapsulation boundaries during the initial ingestion phase. The language model receives a scattered pile of atomic fragments. Generating coherent responses requires the model to guess how the pieces fit together. Hallucinations occur directly at this synthesis stage. The model fabricates relationships because the underlying substrate lacks the semantic topology to dictate reality.

A graph contains assertions while knowledge depends on an interpreting system. The epistemic automation fallacy assumes the transition from data to information happens automatically within the pipeline. Every data transition requires contextualization along with strict judgment protocols. The objectivity fallacy perceives formal models as inherently neutral. Every formalization embeds deeply subjective assumptions about what entities exist. Relying on prompt engineering to prevent language models from creating invalid data fails consistently in operational environments.

The industry recognizes distinct memory architectures for autonomous agents. Flat vector stores provide fast similarity matching for text snippets. Episodic systems page memory in and out of active context windows. Graph-backed stores map entities using schema rules. Vector search fails to execute temporal reasoning. Cross-entity constraints remain impossible to enforce in a pure embedding environment. A query asking for every maintenance task involving a specific catalyst requires a secondary index. Multi-agent systems need persistent memory rooted in a strict ontology layer.

TypeDB resolves the friction between rich ontological modeling and practical database implementation through dependent type theory. Standard graph databases exhibit a mismatch with object-oriented programming paradigms known as graph-object impedance. Developers implement ontology validation at the application layer because property graphs lack native ontological constraints. Object databases attempted to fix this in the 1980s by tightly coupling data to application class structures. The resulting models proved too rigid for evolving knowledge representation.

The conceptual schema relies on the entity-relationship model operating under a polymorphic framework. This architecture separates attributes from entities. Multiple distinct entities share the same set of attributes. A query retrieves all components possessing an inspection date without specifying the exact part categories. Concept graphs push the modeling further by treating relationships as first-class entities. A relationship possesses its own properties. Dependent type theory extends formal logic with types relying directly on other types.

Entities become root types in this framework. Relationships act as dependent types where the dependencies are the objects themselves. Attributes function as dependent types targeting specific values rather than objects. The combination of concept modeling and dependent type theory enables robust hypergraph capabilities. These structures capture the n-body synergies required for chemical catalysts and mechanical engineering blueprints.

The database functions under a closed-world assumption. The system interprets any missing fact as definitively false. A language model querying a standard vector store treats missing information as an invitation to synthesize a probable answer. TypeDB cuts off this generative freedom at the storage level. Autonomous agents making decisions rely on this closed-world boundary to halt hallucinated workflows before they execute.

The TypeQL query language mirrors the structure of natural language while maintaining strict type enforcement. The syntax relies on fully declarative patterns. TypeDB 3.0 introduces sweeping architectural upgrades built in Rust. The functional database programming model replaces rigid logical rules with query functions. Functions serve as abstractions of query logic that embed natively into declarative patterns.

A developer defines a function using the define fun syntax. The type signature dictates the input variables and establishes a valid return type. Functions return either a single computed result or a stream of positional tuples. The system filters the concept maps into deduplicated data flows when evaluating a function returning a stream. Calls run in parallel. They nest recursively. Negation operators apply directly to the function output. Processing logic remains inside the database to eliminate the need to push raw data to the application layer.

The pipeline architecture permits complex transformations natively. A with clause acts as a preamble to define auxiliary functions directly before a pipeline executes. The subsequent match clause evaluates the pattern. A put clause evaluates the results. The pipeline continues if the match finds existing records. The system automatically inserts the required data structure before proceeding if no results exist. The update clause targets owned attribute types featuring strict cardinality constraints. The system overwrites the existing attribute instead of generating duplicate data states when an insert operation exceeds the upper cardinality limit.

TypeDB 3.0 implements structured value types. The database treats them as compound primitive types. An engineer defines a struct to handle complex dimensional values for blueprints.

define struct coordinate:
  x-coord value double,
  y-coord value double,
  z-coord value double?;

define spatial-location sub attribute, value coordinate;

This syntax bypasses the previous requirement to build bulky entity structures merely to hold grouped primitive values. Structs process geographic data along with precise timestamps. The system queries through the internals of structs polymorphically. Specific data points emerge from nested value trees. Storage protocols prevent recursion. Every struct extends into a maximum tree of value leafs to ensure performant indexing.

An ontology acting as a sophisticated dictionary fails to capture the complexity of an engineering domain. Knowledge graphs frequently reduce ontologies to simple schema layers optimized solely for data retrieval. An adequate ontology formalizes the dynamic mechanisms of the environment. It defines what operational agents execute. Constraints govern possibility. Normative rules dictate compliance.

A ship engine requires exact modeling of part interchangeability. Thermal tolerances dictate operational limits. Maintenance schedules depend on temporal tracking. The physical object extends through time. The perdurantist view in upper ontologies dictates that an entity extends through time identically to its spatial extension. A specific pump inspected yesterday represents a different temporal slice than the same pump inspected today. Flat graphs overwrite the previous state. TypeDB models these temporal slices as discrete entities participating in a continuous lifecycle relationship. The language model avoids confusing the historical configuration with the active state.

An AI agent deployed to analyze a blueprint for a technological process must ask fundamental questions of the database infrastructure. The agent queries the database to discover the valid relationships between a fuel injector and a combustion chamber. The prompt instructs the agent to replace the injector with a component rated for a lower pressure threshold. TypeDB catches the invalid state at the semantic level. The type system acts as the ontology to form a queryable infrastructure.

define fun check_pressure_tolerance($chamber: combustion_chamber, $injector: fuel_injector) -> bool:
  match 
    $chamber has max-pressure $p_max;
    $injector has operating-pressure $p_op;
  return $p_op <= $p_max;

The language model attempts to execute the operation through the agent. The agent invokes the function within TypeDB. The database executes the deductive logic. A boolean failure returns to the agent. The closed-world boundary stops the action. A standard retrieval pipeline pulling from a vector store retrieves text documents explaining pressure theories. The language model attempts to perform mathematical reasoning internally. Language models fail at deterministic mathematics. Constraint validation breaks down. Relocating the deductive reasoning to the storage layer eradicates the hallucination risk.

Frontier models parse SQL syntax easily due to massive public training corpora. TypeQL lacks the same historical volume of public repositories. Relying on zero-shot generation via large language models results in syntax errors. Expensive reasoning sequences become necessary to correct the outputs. The open-source dataset Text2TypeQL addresses this gap directly. The repository contains nearly 14,000 natural-language questions paired with validated TypeQL 3.0 queries.

The data covers fifteen distinct domains. Computer network topologies sit alongside supply chain hierarchies. Developers use this supervised training data to fine-tune smaller models like Llama. Fine-tuning enables low-latency text-to-TypeQL conversion without piping sensitive blueprint data through external APIs. The dataset acts as a robust retrieval corpus for few-shot in-context learning. An engineer inputs a natural-language query regarding a catalyst reaction rate. The retrieval pipeline fetches structurally similar questions from the dataset. The system injects these validated examples into the prompt.

Generation agents found profound semantic errors during the automated conversion of the original Cypher dataset. Hundreds of Cypher queries contained reversed relation directions. Incorrect property shortcuts plagued the data. Outright schema hallucinations appeared frequently. The looser schema model of Neo4j allowed these errors to exist undetected in the source material. TypeDB’s type system actively prevented these structural failures during the translation phase. Strict validation against live schemas ensures that models trained on this dataset learn deterministic query structures.

Agents deployed to optimize technological processes need explicit ontological commitments. The agent discovers the reality of the domain by querying the schema. The ontology remains explicit. It operates as an enforceable framework. Bigraphs provide a conceptual lens for understanding how AI agents navigate this structured memory.

A bigraph consists of nodes representing physical objects or conceptual memories. The placing graph forms a nested forest structure showing containment relationships. Links operate as hyperedges connecting nodes regardless of their place in the hierarchy. Interfaces define the boundaries where distinct bigraphs compose. Reaction rules specify how one pattern transforms into another. TypeDB implements this theoretical structure natively through its dependent type theory. The database organizes memory into episodes. An episode node contains child nodes representing sensory perceptions. Actions taken by the agent reside in the same temporal nested structure. The agent queries the system to find all episodes related to a failing ship engine that occurred in a specific geographic location.

A catalyst operating inside a chemical plant involves multiple entities sharing properties based on complex thermodynamic rules. The system defines the entities. The relations establish dependencies. Exact constraints dictate phase changes. The business rules manifest as functions within TypeDB. This setup becomes the semantic application programming interface for the operational agent.

The agent processes sensor telemetry indicating a temperature spike in the reactor. It searches its memory architecture for historical precedent. The agent interfaces with the TypeDB cluster to map the blast radius of the temperature anomaly. The database returns a perfectly bounded hypergraph representing the holonic structure of the reactor. The containment boundaries remain intact. The agent sees the specific internal topology of the affected subsystem. It evaluates the state without confusing internal variables with external components.

Organizations update the ontology as physical realities change. A new safety regulation alters the operational threshold of the catalyst. The database engineer updates the function directly in the schema. Agents querying the system operate under the new parameters immediately. Massive prompt adjustments become unnecessary. Redeploying the agent architecture wastes engineering cycles. The database dictates the rules of engagement. The language model translates the deterministic results to isolate the generative engine from the structural integrity of the engineering data.

Architectural pluralism demands multiple valid viewpoints for complex systems. The ISO 42010 standard proves a single flattened schema remains insufficient for engineering complexity. An aircraft carrier requires distinct architectural descriptions for security operations. Performance metrics exist in a separate viewpoint. Financial costs represent another perspective entirely. Collapsing these viewpoints into a single graph destroys the coherence of the data.

Ontologies require grounding in rigorous upper layers to manage this pluralism. Different viewpoints collapse into incompatible silos without this foundation. TypeDB provides the structural grounding necessary to support local autonomy while maintaining global integration. The database formalizes intentionality. The system captures normativity by enforcing rules at the data level. AI applications operating within this environment retrieve knowledge bounded by reality.