Project summary

This research about an ability of someone besides operator to check AI identity. In September I came to the conclusion that it’s impossible to do check it by black-box testing, because the test can’t rule out a substitution. For example, in April 2025 there was an two different model builds under the same name for the sake of a benchmark ranking incident, when Meta’s model called Llama 4 Maverick released. In LMArena benchmark model was ranked 2nd, but actually it was private powered experimental version. Public version was ranked 32nd, and you wouldn’t know it just by looking at them. The difference was acknowledged by LMArena, to which Meta responded that they are “experimenting with variants.”

Outside reviewer checked black-box behavioral test methodology in 3 rounds, and every time he founded defects in reasoning. I admitted it and corrected documents. For example, confounding of the difference test and the equivalence test: if test’s results wasn’t contain difference – it doesn’t prove yet that the models are equal. Conclusion: model’s identity isn’t established from the outside. Negative conclusion is a result.

In dated population of 20 hosts with inference tag, 15 failed to execute them, 4 from 5 remaining ones is closed-weights models. The calibration is estimated at 48 conditions and thousands of calls. The decision not to proceed calibrating experiment has been made before spending money.

However, cryptographic proofs confirm that pre-established computations were performed using the committed input data. 3 independent researchers helped me by generating 8 proofs (7 on-chain): 4 key rebuilds, 1 bytecode binding, and 2 container cost measurements. Proof establishes which compute started, but not good or bad the model’s answer is. And yet, it remains really important for AI inference’s verification. Flow was measured on MnistMLP models (52,650 parameters).

What are this project's goals? How will you achieve them?

I need 11-13 weeks on 3 stages including creating reports:

•          [4-5 weeks] Pilot research to evaluate result deviations (60-120 repeated calls to single fixed standard model) for cost clarification. Goal is to understand is it rational to proceed calibrating experiment. Publication of source data.

•          [2 weeks] Repeat of population checking, now with wider catalog segment for find open-weights model to self-host it. Report creating.

•          [5-6 weeks] Exploratory asks to high-risk systems compliance providers (as defined in Annex III - e.g., credit scoring, hiring, education), with anonymous result publication. 10-20 contacts. Result is a case, when some third party requires submitted model identifying – like regulators, clients, auditors, etc.

How will this funding be used?

-       3 months of full-time research – $18,000

-       AI tokens, hosting, cross-architecture replications – $2,000

Total is $20,000. Minimum is $8,000 (1 month full-time & AI tokens, hosting, cross-architecture replications)

Who is on your team? What's your track record on similar projects?

I’m an independent solo researcher, verifiable by other independent reproducers (AI & cryptography experts)

In independent attestation participated 3 researchers, which contacts I got from expert forums and I didn’t know them in the past before it: how I said, they had generated 8 cryptographic proofs on 2 architectures. One reviewer found a defect in reasoning in 3 review rounds; one created self driver before even touched my script, so the coincidence cannot be result of my code; all three rebuild the keys themselves. Nsgoods’ attestation, which reader couldn’t check in submitted form, was split into 2 parts, one for each circuit, and submitted after initial application.

Through all research I systematically follow my self-correction discipline: I spotted a drift in deployed verifier – it was fixed in the same day; also detected a 4 checks, that actually was checking nothing – everyone was closed by test, which was falling before I fix that. All document fixes were published and dated - 3 in total.

All this research is a public. In the end of application you can find an official research’s Github repository.

What are the most likely causes and outcomes if this project fails?

The main risk isn’t about research it’s about payout. I asked Manifund about this question for find abilities before initiate an application. Since I live in Russia, I will need to go in other county to open a bank account if the application will get funded (specifically in Kazakhstan; Manifund said that as far as they know it’s possible to transfer money there, but it will be first case). Also I don’t have affiliations with sanctioned individuals and have a legal status in Russia (IE, Individual Enterpreneur). If there will be payout refuse on some stage, all amount will come back to regrantor.

Other risks are affiliated with negative research results, which can be high level of variance to ensure an acceptable population size and costs or lack of open-weight positions. Although it is a valuable result (just negative) and it will be documented, but it’s not as valuable as potential positive results. However, these negative conditions also need fund, because a public negative one saves others from having to study it again and routes on valuable avenues of research.

Also there a risk about compliance exploratory asks. There is a chance that nobody will simply answer, which reduces by raising contacts amount, but it will be also documented if it will be.

How much money have you raised in the last 12 months, and from where?

Nothing. The research phase (July-September) was self-funded.

Public references:

·       Reproduction bundle and quorum-check script: github.com/achemperety/exactzk-mnistmlp-provenance-demo

·       Design-doc context on the atomic settlement mechanism this proving work came from: ethresear.ch/t/atomic-zk-proof-gated-settlement-for-x402-agent-payments-a-measured-reference-design/25660