Modern LLM deployment rests on three trust signals: watermarks that claim to identify machine-generated text, privacy safeguards that claim a retrieval-augmented system does not leak its corpus, and reward-model scores that claim to measure output quality. Each signal is known to degrade under pressure, but failures are usually reported one at a time, after the fact, with no pre-committed predictions. This project builds one shared, pre-registered stress-test suite across all three signals: (1) watermark detection under test-time-compute attacks (regeneration and search-guided paraphrase), extending the impossibility results of Watermarks in the Sand (ICML 2024) and its 2026 concrete-security follow-up; (2) membership-inference and extraction attacks against RAG systems, measured against the safeguards vendors actually ship; (3) reward-model scores under optimization pressure: how fast a score stops tracking quality once a policy optimizes against it. Predictions are frozen and published before the main runs; negative results are reported explicitly. Deliverables: the open suite and code, plus a public report stating what each signal can and cannot guarantee.

Budget (expense-only, no salary or stipend to me): compute/API $12,000; data/annotation $4,000; travel/dissemination $2,500; infrastructure/tools $1,500. Timeline: December 2026 to February 2027.

Transparency note: a parallel application for this same pilot is under review at BlueDot Impact (Rapid Grants, submitted Oct 24, 2026), with parallel applications to a few other funders. I will not accept funding from two sources for the same costs; if more than one offer arrives, I will decline all but one, or apply a second award only to distinct additional costs with both funders' written agreement.

Contact: hanlinzhang@g.harvard.edu