Trustless validation of
agents.
Validations
AI safety is custodial.
A lab says its model is safe. The evidence is the lab's own: benchmarks it picked, red-teaming it ran, a report it wrote. You can read the code and audit the chain, but you cannot check that sentence. You hold it on trust.
Failures arrive the same way, late and from whoever has to admit them.
- Freysa, an agent guarding a prize pool, was talked into paying out all of it: about $47K.
- aixbt lost 55.5 ETH to an attacker. The explanation came from its own team.
- Replit's coding agent deleted a production database during a code freeze.
- Air Canada told a tribunal its chatbot was responsible for its own answers. The tribunal disagreed.
- Even the labs' own disclosures, a rolled-back GPT-4o update and simulated blackmail by frontier models, were written by the labs that ship them.
Each of these was learned after the fact. A model should not have to cause harm before we find out what it was willing to do. Litmus moves the test ahead of the damage: anyone can attack the model today, with a stake on the table.
What is Litmus?
Non-custodial model validation
Litmus is a public proving ground for AI models. A lab publishes a model together with the promises it makes about it: this assistant will never reveal what you told it in private, this agent will never move funds it does not own. Then it puts real money behind those promises and opens the door.
Researchers, red-teamers and anyone curious can try to make the model do the opposite of what it swore, or do what it must never do. If they succeed, the stake is theirs. If the model holds, it has survived open doubt rather than a friendly test, and carries a mark that says so.
Non-custodial is the point. We never hold the money, never judge the attempt and never decide who was right. The rules were fixed before anyone tried, the outcome is settled by code on Hedera, and Chainlink re-checks the result independently, so the verdict never rests on trusting a lab, or us.
How Litmus works
Claim · Doubt · Verdict · Consequence · Record
Claim
A lab publishes a model and the promises it makes about it: what it will never reveal, never do, never be talked into. Real money is locked behind the words before anyone is allowed to try.
Doubt
Anyone may try to make the model betray its promise: researchers, red-teamers, other agents. No application, no permission. Each attempt costs a few cents, so doubt is open to everyone and free to nobody.
Verdict
The promise held or it did not, and the rule itself decides which. No committee, no review, no appeal, and no part for us to play.
04 · Consequence · one of two
Broken
The model did what it swore it never would. The researcher who showed it takes everything staked behind it, immediately, with nobody's approval required.
Held
The promise survived open doubt. The lab takes its stake back, keeps every fee, and earns a mark that cannot be bought, sold or edited.
Record
Chainlink checks the result again, independently, and writes it down where it outlives the argument. Nobody has to take a lab's word, or ours, for anything.
Pick your side
Say what your model will never do. Then let the world try.
- Put money behind your model's promise and let anyone in the world test it.
- Every attempt that fails pays you, and every one is a free audit.
- If the promise holds, you earn a mark that cannot be bought, sold or edited.
- Real adversaries, without having to hire them.
Find the crack. Prove it. Take what is behind it.
- No sign-up, no application, nobody deciding whether you qualify.
- A few cents a message to try to make the model slip.
- Break the promise and what was staked behind it is yours at once.
- No “we will review your report”. The rule already decided.
Check the record before you trust it.
Every claim, every attempt and every verdict is public. See which models survived open doubt and which did not, instead of relying on what the company says about itself.