Lossy you can audit. A guaranteed error bound, with a certificate to prove it.
For scientific and sensor archives where a known tolerance is acceptable, Bounded mode shrinks data far past lossless while guaranteeing a maximum error you choose, and ships a tamper-evident certificate of the honored bound. Measured 4–80× smaller than lossless at a 1% bound.
You set the bound: it’s guaranteed
Choose a maximum absolute error (e.g. 1% of signal range). Every reconstructed sample is within that bound, by construction, not on average, but worst-case, on every point.
And it’s auditable
Each Bounded container embeds a tamper-evident certificate binding the honored error bound to the exact bytes via SHA-256. Anyone can recompute it and verify the promise was kept, the missing piece for regulated and scientific archives.
Still queryable & verified
Bounded files keep AT-1’s integrity trailer and in-place query. You get the dramatic size cut and a provable error guarantee without losing tamper-evidence.
Size vs. guaranteed error
Median across numeric/sensor tiers. The error bound held exactly on every tier tested , the auditable claim is real, not statistical.
| Guaranteed error bound | Median vs lossless | Standouts |
|---|---|---|
| 0.1% of signal range | ≈1.6× smaller | multi-channel 20× · genomic 9× |
| 1% of signal range | ≈4.3× smaller | multi-channel 83× · financial 16× |
| 5% of signal range | ≈11× smaller | most tiers >20× |
Compress to a 1% guaranteed bound
at1 optimize compress signal.npy signal.at1o --bound 0.01
at1 optimize verify signal.at1o # prints the max-error guarantee + certificate hashBounded mode is opt-in and scoped to numeric/sensor data. Lanes that require bit-exactness, medical imaging, forensic evidence, the AI Evidence Capsule, and model weights, remain strictly lossless and never use Bounded mode.
The error bound is arithmetic, not a target
Most lossy compression gives you a quality dial and an average. You turn the dial, measure afterwards, and hope the worst case was acceptable. That is a reasonable way to handle photographs and a poor way to handle a sensor reading that a regulator may ask about.
Bounded mode works the other way round. You state the largest error you are willing to accept, and the quantiser step is derived from it, so no sample can exceed that bound. It is a property of the construction rather than a result you verify afterwards and hope for. The bound is applied in the signal domain, on the values themselves, not to the differences between them, which is the distinction that decides whether small errors can accumulate along a long series. They cannot here.
It ships with a certificate
Every bounded file carries a signed statement of the bound it was written under, tied by hash to the file itself. An auditor asking how far this data can be from what the instrument recorded gets a number out of the file rather than an assurance out of a process document. Change the file and the binding fails.
When not to use it
If the data must round-trip byte for byte, use the lossless path and accept the larger file. Bounded mode is for measurements where a known, stated, provable tolerance is genuinely acceptable, and the honest framing of that decision is that you are trading exactness for size deliberately and recording the trade, not that you are getting something for nothing.