Parameter-Resident Cryptographic Material as an Unscoped Surface for Post-Quantum Migration: An Existence Proof and Audit Primitive

Federal post-quantum cryptography migration is scoped around three categories of cryptographic assets: libraries, protocols, and key stores. We argue that this scoping is incomplete. Cryptographic functions and key material can be realized in the parameters of machine-learning models, and the current open-source serialization-focused scanners we evaluated do not detect them. We provide an existence proof: a 30-layer feed-forward ReLU network that realizes AES-128 exactly, with the master key and all eleven round keys resident directly in the layer bias vectors and recoverable by parsing. The construction validates bit-exactly against FIPS 197 and the NIST CAVP AESAVS known-answer subsets across 104 random plaintext-key pairs, including under float32 quantization. We argue analytically—by a sizing analysis rather than empirical construction—that ML-KEM and ML-DSA private keys hide more comfortably in modern weight tensors than AES keys do. The basis is twofold: larger key sizes amortize the construction’s fixed parameter overhead, and the lattice arithmetic underlying these primitives admits more architectural variation than the rigid AES key schedule. Under the harvest-now-decrypt-later threat model, the consequence is direct: any long-lived cryptographic key embedded in an open-weights model artifact distributed today is recoverable by any future party with knowledge of the embedding scheme, with no quantum capability required. We propose an audit primitive—a parameter-space cryptographic recognizer—that screens model artifacts at ingestion through four stages: structural matching against cipher fingerprints, a parametric analysis for bias-and-sign coupling signatures, functional probing for cryptographic input–output behavior, and the integration with cryptographic bill-of-materials tooling as a parameter-resident cryptographic content emission class extending the MBOM-PQC schema. The recognizer is defense-in-depth: it closes the gap for known constructions and architectural fingerprints without claiming completeness against adaptive adversaries. We make no claim that any deployed model contains such an embedding; the contribution is the existence of the capability, the absence of detection in the scanners we evaluated, and the migration-scope consequence.