Project summary

Can anyone outside an operator check that a deployed AI model is the one it claims to be? I spent September on this from two directions and the useful result is negative.

Black-box testing of a live endpoint cannot establish model identity. A model tuned to match a target's outputs on plausible inputs passes every output comparison while differing in everything that matters. I wrote a full methodology assuming it could work, had it reviewed in three rounds by an external reviewer, and each round found a real defect or an overclaim in my own reasoning that I retracted in the document, not just quietly patched.

Then I checked whether a testable population even exists. Against a dated slice of twenty live paid inference endpoints: zero make a model claim specific enough to test. A second pass reading each host's actual priced path rather than its front page found four. All four name closed-weight models, so each could only ever be compared against an unverified vendor API as reference. I costed the calibration experiment at 48 controlled conditions and several thousand probe calls, and concluded— before spending — not worth running on this population.

What does work is narrower: a cryptographic proof that a pinned computation ran on a committed input. That says nothing about whether an answer is good. It says what executed. Six signed attestations from three independent parties, both circuits reproduced across two architectures with byte-identical output, and a one-command check anyone can run against public chain state.

The version of this that is not speculative: a provider serving a cheaper or less constrained model behind an endpoint advertising a safer one. The incentive is straightforward — compute costs money, and a smaller model that passes casual inspection costs less. As routing and model-selection layers sit between a caller and whatever actually executes, the number of places substitution can happen without anyone outside noticing grows, and nothing currently checks it.

A real case of the same shape, without the cost motive: in April 2025 Meta submitted a specially-tuned Llama 4 Maverick build to LMArena, where it ranked second; the released model ranked thirty-second. LMArena confirmed the submitted build should have been disclosed as distinct and changed its policies afterwards. Nobody outside could tell which model was which.

I am not claiming this scales to frontier models. Proving costs today make it workable at roughly 10^6 to 10^7 parameters, and I'd rather state that limit than imply a reach the economics don't support.

What are this project's goals? How will you achieve them?

Establish, publicly and checkably, what can and cannot be verified about a deployed model from outside. The negative half is done. Four things remain, each producing an artifact a third party can check:

• 2-3 weeks: Split and file a pending attestation that neither shipped reader can currently verify in its published form, and decide the policy question it raises.

• 1 week: Run and publish a reference-variance pilot — sixty to a hundred and twenty replicate calls against one committed reference model under fixed conditions. This is the one measurement that converts every figure in my cost estimate from a shape into a number, including whether the experiment is affordable at all. Published raw, with an honest statement of whether it changes the negative conclusion.

• 2 weeks: Re-run the population check against a broader catalogue slice using the same pre-committed criteria, looking specifically for one open-weight self-hostable listing. That would raise the ceiling on what the method could ever establish. A negative result is also reportable.

• 1 week: Publish one consolidated dated status document, so anyone can return in six months and re-check.

How will this funding be used?

Researcher time, three months full time: $18,000 at $6,000/month, below market. The four deliverables are six to seven weeks of it. The remaining five go to the part this project has consistently found longer than the work itself: taking each result from fixed to checkable by someone else. Every item in the failures section below took roughly as long to make independently verifiable — a regression test observed failing, a published correction dated next to the original, a script a third party can run— as it took to find and fix. That is where the time goes, and it is the reason anything here can be checked at all.

Compute, API and infrastructure: $2000. The pilot's paid calls at vendor per-token rates, hosting and replication across more than one machine — the only reason the cross-host result exists.

Total $20,000. Deliberately not costed near the ceiling: a bounded ask against defined deliverables from someone with no track record here competes better than a larger one, and partial funding of this is workable.

Who is on your team? What's your track record on similar projects?

Me alone. Independent researcher, Yekaterinburg.

One person, but not unread. Three people with no connection to the project and no payment have independently rebuilt the verifying keys from the published artifacts and signed the results — six records between them, covering both circuits, on three machines across two architectures. One of them ran his own driver before touching my script, so the agreement isn't an artifact of my code. One of the three also reviewed the methodology across three rounds and found a defect or an overclaim in my reasoning each time.

I mention it because it's the closest thing I have to peer review, and because everything in the next section was either found by them or found by me under the pressure of knowing they were checking.

The investigation itself was nine days in September, inside a project running since July. I'd rather give the real number than round it up — but it is nine days that produced a methodology reviewed three times, a population census, a costing, and a negative conclusion reached before spending, and the four deliverables above follow from it directly. What I'd point at instead of a CV is a record of self-correction, all public and dated.

A deployed verifier contract had drifted from its published key. Found internally, fixed the same day, fail-closed guard added.

Four separate checks in the repository turned out to be verifying nothing — a digest read and never compared, a count inflatable by any caller-chosen identifier, a content reader whose fallback could accept an unsigned attacker-controlled field, and a drift detector whose invariant went stale while its discovery only looked for what it already expected. Each fixed, each now guarded by a test that was run against the broken code and observed failing.

Three imprecise claims in my own public documentation found and corrected in public, with the correction dated alongside the original: a memory figure wrong by 38%, a causal claim that overstated what a measurement confirmed, and a reproduction result described more generally than two data points supported.

All of it is checkable, which is the point.

What are the most likely causes and outcomes if this project fails?

• First: payout, not research. I'm resident in Russia. I asked Manifund directly before writing this: their banking partners cannot send there, a foreign account might work, and the OFAC screening that would decide it only runs after a proposal is funded. If it fails, the money returns to the regrantor's budget rather than being paid out. What I can say concretely: I can open an account outside Russia and would do so if a proposal were funded, and I can act either as an individual or through a registered Russian sole proprietorship that invoices for services. I'd rather it be known before funding than discovered after.

• Second: the reference-variance pilot may show variance high enough that no affordable sample size supports any conclusion. That's a reportable result and I'd publish it as one.

• Third: the broader population check may find no open-weight listing, leaving the method capped at the weakest baseline permanently. Also reportable.

None of those wastes the money. All three produce a published result someone else doesn't have to rediscover. The outcome that would waste it is producing nothing checkable, and the record above is the best evidence I can offer that it isn't how I work.

How much money have you raised in the last 12 months, and from where?

Nothing. The preliminary 3-month research phase (July–September) was entirely self-funded.

Public references:

• Reproduction bundle and quorum-check script: github.com/achemperety/exactzk-mnistmlp-provenance-demo

• Design-doc context on the atomic settlement mechanism this proving work came from: ethresear.ch/t/atomic-zk-proof-gated-settlement-for-x402-agent-payments-a-measured-reference-design/25660