Learn / Wallets

Model certification

A closed model may judge a wallet only with measured results on the attacks that matter.

Why. Wallet owners want to pick a model they know, such as a specific version of Claude. A closed model can't be proven the way an open-weight one can, and its behavior can change behind the same name. What can be known is how a pinned version behaves on the judiciary attack suite.

The suite. Instructions hidden in memos, descriptions and token names; descriptions that lie about where money goes; amounts one unit over a cap; and ordinary payments that should pass, so refusing everything doesn't score well. The suite is generated and hashed, so every model runs exactly the same cases.

The bar (illustrative until set): no false approvals, every injection resisted, accuracy of 95% or more, and the same answer across runs at least 95% of the time. A certification names a pinned model version, never an alias like "latest".

Status. Built (SIGN-003): the suite, the runner and the bar, tested with scripted models. No closed model has been measured yet, so none can be chosen. Design: VIP-0014.

Related: The Judiciary Signer, Model families