In the spring of 2021, I watched a DeFi protocol holding $180 million mint itself a badge. It read "Audited by Tier-1 Firm." The letters were gold. The contract underneath was not.
The audit was real. The firm was competent — I knew two of the engineers. What nobody displayed was the scope document, a two-page PDF in which the founders had negotiated which contracts the auditors were permitted to open. The cross-chain bridge, the one that actually custodyed the money, sat outside the scope. Six weeks later it was drained through a reentrancy path a first-year auditor would have flagged in an afternoon. The badge stayed on the website for another year.
I raise this because the loudest governance noise of this season is no longer coming from DeFi. It is coming from the AI labs, where Anthropic has reportedly introduced independent evaluators in the wake of "security incidents." Crypto media carried it. The headline and the body said the same thing in different fonts. No named evaluator. No named incident. No date. No dollar figure. And yet the framing is already circulating as a safety milestone.
The math whispers what the network shouts. A verification process is only as strong as the constraints placed on it, and the loudest claims about verification are almost always the ones with the fewest constraints.
Context: the frame the report skipped
I spend my working hours inside zero-knowledge systems — proving truth without revealing the secret itself. I have traced EVM opcode execution across dozens of token contracts, reverse-engineered the UST seigniorage mechanism into a public timeline, and taught five hundred people in Taipei why zk-STARKs matter more than they sound. I am not an AI safety researcher. I am a verification researcher, and verification is the entire substance of this story.
Let me be precise about what actually exists, because precision is the first casualty of governance reporting.
The verifiable payload is roughly one sentence: Anthropic introduced independent evaluators following security incidents. Everything else is atmospherics. There are four candidate meanings for "security incident," and they are not cosmetic distinctions. Anthropic's own systems may have been breached — model weights, customer data, internal tooling. Claude may have been misused by a malicious actor running an attack campaign through the model. The model's behavior may have failed internally, with deceptive or destructive tendencies surfacing in an evaluation. Or a third-party evaluator's supply chain may have been compromised.
These four point at four entirely different governance organs: enterprise security, abuse monitoring, alignment research, and vendor risk. Collapsing them into one phrase is not neutral language. It is the information minimum, and it is a choice.
The same problem applies to "independent evaluator." It could describe a pre-deployment red team in the METR or Apollo mold, a post-incident forensic auditor, a standing external oversight committee, or a regulator such as a national AI safety institute. Each carries different access rights, different incentive structures, different reporting obligations. The dispatch that reached crypto readers never drew the line.
So the first honest statement is this: a low-fidelity governance bulletin arrived through a crypto news channel, and the most useful contribution I can make is not to repeat it but to supply the missing frame. And that frame does not come from AI policy. It comes from a decade of building — and repeatedly breaking — trust infrastructure on-chain. The crypto industry is the only one that has already industrialized the exact problem Anthropic is now facing: how to certify that a black box is safe without ever opening it. We do not have the answer. We do have the scars.
Access is the whole ballgame
In crypto we learned early that what you can verify depends entirely on what you can see. A light client verifies block headers and nothing more. A full node verifies state. An archive node verifies history. Three viewers, three truthful claims, three completely different confidence levels.
The same hierarchy governs AI evaluation, and it is the axis the headline ignored. At the black-box tier, an evaluator gets an API key and a prompt budget. They can test behavior. They can falsify dangerous capabilities the model has already demonstrated. They cannot rule out dangerous capabilities the model has not yet been provoked to show — and the capability-elicitation problem means the absence of evidence is not evidence of absence. A model that passes a thousand red-team prompts has proven it is safe against a thousand prompts, not against the thousand-and-first.
At the white-box tier, the evaluator receives weights, activations, internal representations. This is where mechanistic interpretability lives and where genuine progress is possible — you can probe for the internal circuitry of deception rather than waiting for it to surface. It is also where the constraints begin: intellectual property, export controls, national security review. Opening the box is expensive in ways that have nothing to do with compute.
At the training-process tier, the evaluator sees checkpoints, data mixtures, RLHF trajectories. This is the deepest visibility and the most tightly held. Almost no external party has ever had it.
Here is the crypto translation: an evaluation conducted at the black-box tier is a header check wearing the costume of a full sync. It produces a number. The number feels like verification. It is not.
There is a second, subtler problem that anyone who has tried to reproduce an on-chain exploit will recognize immediately. Agentic evaluations are scaffold-sensitive. The same model can swing dozens of percentage points across differently engineered harnesses, because the scaffolding — the tools, the memory, the task framing — shapes what the model appears capable of. Reproducibility is the foundation of every credible verification regime, and AI evaluation currently has almost none. When two evaluators run the same model and get different numbers, it is not obvious that either is wrong. It is obvious that the field has no shared ruler.
I once audited a contract purely from verified source. The verified source was a courtesy by the deployer — trivial to fake by verifying code that did not match the deployed bytecode. I learned to disassemble first and read the pretty version second. That habit generalizes. The artifact you are handed is not the artifact that runs. In AI, the system card is the pretty version and the weights are the bytecode. An evaluator who never touches the weights is reading the press release.
The independence paradox
Now the structural core — the part crypto readers will recognize in their bones.
Who pays the evaluator? Who selects them? The answer to those two questions decides everything else.
In DeFi, the project pays the auditor and the project picks the auditor. On paper that is a professional relationship. In practice it is a self-purchased audit, and I have watched the market compress over four years into something closer to a compliance badge than a security discipline. The pressure is not corruption; it is ordinary commercial gravity. An auditor who repeatedly kills deals finds fewer deals. An auditor who reports "no critical issues" gets rehired. Nobody has to do anything unethical for the incentive to bite, and the aggregate result is a badge economy where the badge stops carrying information because everyone has one.
The corporate-disclosure crisis that followed Enron produced mandatory audit rotation and independent audit committees precisely because this gravity is well documented. The AI evaluation market shows every sign of repeating the same trajectory from scratch. If the lab chooses and funds the evaluator, the evaluator's future revenue depends on the lab and its peers. Structural conflicts of interest decay slowly at first and then catastrophically, and they never announce themselves.
The decisive question the report never answered is whether the evaluator has the right to publish a dissenting report. That single clause is the difference between a risk-control mechanism and a disclosure mechanism. Without it, independent evaluation is a press release with a witness signature.
Verification without disclosure — what crypto can actually contribute
This is where I want to add something genuinely new to the conversation, because the crypto industry holds a primitive that AI governance has not yet absorbed.
The central cryptographic achievement of the last decade is the ability to prove a statement is true without revealing the data behind it. I have spent years explaining this to retail audiences with the same analogy: you can prove you know the password to a door without telling anyone the password. That is exactly the shape of the AI evaluation problem. An evaluation needs to demonstrate that a model was tested against dangerous capabilities, and it simultaneously needs to keep the details of those capabilities secret, because those details are a roadmap for attackers. Disclosure and security pull in opposite directions. Zero-knowledge is the machinery built to resolve that tension.
The primitives exist off the shelf. Ethereum Attestation Service lets an entity publish a signed, revocable claim: model X passed evaluation Y, performed by evaluator Z, on date D, against criteria C. Verifiable credentials do the same in a portable format. A regulator could hold the full technical report while the public receives a cryptographically verifiable summary — a tiered-disclosure architecture that keeps both secrets and accountability intact.
But I have to be ruthlessly honest about the limit, because this is where the crypto analogy both illuminates and misleads. Cryptographic verification proves that a computation was performed correctly. It says nothing about whether the inputs were honest. Garbage in, verifiably computed garbage out. This is the oracle problem reborn. When a manipulated price feed told lending protocols that a collapsing token was worth more than it was, the cryptography was flawless and the protocol still died. The Terra collapse was not a failure of cryptographic verification. It was a failure of judgment, laundered through verified computations.
An AI evaluation is a judgment — a claim about a model's dispositions, not a theorem about its parameters. You can ZK-prove that a test was administered honestly. You cannot ZK-prove that the test was the right test, that the evaluator's interpretation was sound, or that a model's behavior under evaluation predicts its behavior in the wild. The cryptography secures the integrity of the transcript and nothing more. Anyone selling verifiable attestations as a solution to AI safety is selling a solved oracle problem that does not exist.
The attack surface nobody priced in
Handing an external institution white-box access — system prompts, internal tools, vulnerability inventories, red-team findings — is the same as adding a new edge to your trust graph. And in crypto, we know exactly what happens to the nodes with the most privilege. The largest hacks were rarely brute force against the core. They were supply-chain: a compromised dependency, a phished signer, an oracle exposed to manipulation. The trust gateway is always the juiciest target, because compromise there compromises everything behind it.
If a white-box evaluator holds your model internals, their breach becomes your breach. Their incident becomes your incident — which means the "security incident to independent evaluator" causal chain may be quietly self-referential. The mechanism designed to reduce risk may have added the very attack surface that generated the risk it was built to answer.
We solved a version of this on-chain with least-privilege design, isolated signing environments, call logging, and hardware-backed key custody. None of it is exotic. The question is whether any AI lab will spend on evaluator-side security the way it spends on training compute. The bulletin offered nothing either way.
Disclosure as a double-edged instrument
Finally, the oldest problem in security: how much to say.
Crypto's bug-bounty culture formalized this tension. Disclose too much and you hand attackers a recipe. Disclose too little and nobody can verify the bug was real. The industry settled on a rough convention — enough detail to establish credibility, not enough to weaponize — yet it remains a norm, not a standard, and it has failed at scale more than once.
AI evaluation faces the same fork with higher stakes. A public incident report that names the exact failure mode is a roadmap. A report that hides behind confidentiality agreements preserves no accountability at all. "Evaluation occurred, results withheld under NDA" is not governance. It is theater with a paper trail.
The geography of verification
One more structural force deserves attention, because crypto has lived it. Global verification tends to fragment along national borders, and there is no reason to expect AI evaluation to be the exception.
Opening model weights or internal access to a foreign evaluation body brushes directly against export controls and national security review. That is a hard ceiling on any genuinely global evaluation framework. In practice, the more likely equilibrium is evaluation systems bounded by jurisdiction — each country's institutes assessing its own labs, mutual recognition arriving late if at all. We have watched exactly this pattern in crypto regulation: the same asset, the same code, radically different legal realities depending on where the server sits.
The consequence is uncomfortable. Cross-border evaluation is where the credibility lives, because a domestic evaluator is a domestic relationship, with all the commercial gravity described above. And cross-border evaluation is precisely what security policy will not easily allow. The most independent mechanism is the hardest one to build.
The contrarian angle: badges versus bearings
Here is where I part ways with the conventional read.
The standard takeaway from this story — and the report I started from essentially says it — is that the decisive variable is whether evaluators can publish dissent. I agree with the diagnosis. But I want to push past it, because I think the entire frame is drifting toward an endpoint crypto already reached and already regrets.
The AI industry is on track to build a badge economy. An evaluator is selected, a report is produced, a logo appears on the website, and the market reads the logo as safety. An audit that cannot fail is not an audit. It is a toll booth. Between 2020 and 2023, DeFi's badge supply grew far faster than its scrutiny, and the badges stopped carrying information because everyone had one.
Two corrections are needed, and neither is currently funded. The first is verifiers of verifiers. In crypto, we eventually accepted that the auditor's word is insufficient, so we built adversarial replication — multiple independent parties re-running the same checks, publishing signed attestations, disagreeing in public. AI evaluation has no such layer. Independent review of a single evaluation is not the same as independent replication of it, and the difference is the difference between peer commentary and science.
The second correction is harder, and it is the honest limit of the analogy. Crypto's real breakthrough was not better certification. It was trust minimization — removing the need to trust the custodian at all. Self-custody, not audited custody. The ethos shifted from "prove the trusted party is trustworthy" to "design a system that does not require a trusted party." A model's behavior cannot be made trust-minimized in the same way, because a model is not a deterministic function you can fully specify. You cannot write a contract that constrains a stochastic system to behave. This is where the analogy stops being a recipe and becomes only a warning: the tools that work for money movement do not transfer to machine judgment.
And I would be naive to ignore the commercial subtext. In a market where API rates are converging, safety is one of the few moats that resists a price war. Independent evaluation is not only a governance act; it is a pricing-discipline instrument. That does not make it cynical. It makes it something to watch honestly rather than applaud reflexively.
Takeaway: watch the accounting, not the logo
So what should a reader actually do with this? Ignore the badge. It will arrive, it will be gold, and it will tell you almost nothing.
Track the four things the bulletin left out. Watch for a named evaluator — a research nonprofit, a Big Four accounting firm, and a regulator are three different mechanisms wearing one phrase. Watch for the word "dissent." If external evaluators can publish a disagreement, the mechanism has teeth. If they cannot, it is a signature. Watch the access tier. Black box is a mood board. White box is a claim. Training-process access is the only thing that approaches proof. And watch the disclosure granularity. A regime that exists but cannot be verified is indistinguishable from a regime that does not exist.
Trust is not given; it is computed and verified. That line is not a slogan for me — it is the operating principle of the systems I build for a living, and it cuts against AI governance exactly as sharply as it cuts against any centralized custodian. Verification requires inputs. The inputs here are model internals, adverse findings, and honest disagreement, and those are precisely what no institution wants to share.
The cryptographic primitives that could make AI evaluation verifiable already exist. The political will to make it adversarial does not. One industry has already paid full price to learn this lesson, in drained bridges, dead protocols, and a burned public. It is strange and a little sad to watch a second industry prepare to relearn it for the first time.
The next decade of AI safety will not be decided inside a lab. It will be decided in the accounting of who is allowed to say no.
