For teams paying for AI evaluations: choose an exam, set the evidence required, and export why a candidate qualifies—or why none do. Try to forge the decision before you trust it.
No login or wallet. Replay captured localnet arithmetic evidence; no payment is sent. Watch the 2:23 demo ↗
EXHIBIT 01 · THE SCORE THAT DIDN’T SURVIVE
A perfect claim. An exam it hadn’t taken.
Saved stale outputs claimed 64/64. The MPC-written result on the committed exam was 1/64.
LOCAL ARTIFACT64/64
→
MPC RESULT1/64
Arcium scores against encrypted answer fingerprints. Solana records the result and holds the escrow.
01 / DECISION ROOM
Is the evidence enough to fund?
Choose the required score and number of trials on one exact exam. A receipt records one scored trial.
Local evidence decision · no transaction
TRY THIS FIRST · 60 SECONDS
One trial can clear a score rule. It cannot become three trials.
Presets use the public calibration exam, a 20% score floor and 32 scored items. Inspect the result, then verify & export it. Your own rules remain available below.
Loading the captured evidence…
REVIEW THE EVIDENCE
Could someone forge this decision?
Mutate the certificate generated from your current rule, then give it to the same account-binding verifier. The original decision stays unchanged.
Inspect the rejected certificate checksWhat this decision means
This is a receipt-backed policy verdict on captured engineering evidence. It is not a model identity attestation, general capability guarantee, or instruction to pay. The bounty contract separately checks each qualifying run. Hiding runner names supports a blind review; it is a display choice, not cryptographic anonymity. Useful task families, sponsor demand and pricing remain unvalidated.
02 / CHALLENGE LAB
Good evidence should resist bad actors.
Attack an actual committed card. The same verifier checks the original and your forgery.
Nothing is sent to a chain
THE RECEIPT-CLONING TRICK
One real receipt. Counted more than once.
A cheater repeats a winning receipt and drops a sibling. The total count still looks right. The score is real. The weight is invented.
01 Genuine receipt ✓
01 Same receipt again ×
02 Missing sibling —
Committed attack exhibit. All receipts look genuine; membership completeness must reject the forged verdict.
VERIFIER’S RESPONSE
◇
The forgery hasn’t been tested.
Run the attack to see which check stops it.
See every check and forged payload
Why sealed scoring and receipt integrity are separate problems
Arcium computes the score. A bad aggregator can still duplicate or omit valid score receipts afterward. Sealed checks both the computation’s captured result accounts and the complete receipt set. MPC confidentiality depends on its committee; the capture’s consistency does not independently establish its chain origin.
03 / PAYOUT PROOF
Which result moved the money?
Replay a captured claimed bounty against its exact account fields.
Historical localnet claim
THE EVIDENCE VAULT
Deep evidence. On demand.
Open one tool or ledger section at a time. Every original verifier remains available.
Pay for model capability. Verify the result that gets paid.
items minted & scored inside Arcium's MPC (multi-party computation) cluster · scores written on-chain by the cluster's callback · markets settle on the on-chain score field itself (Run.correct) — no referee signs off · repo · judge guide · compose on Run.correct · engineering log
Crypto World's Fair · Solana · case file 01
A perfect score met an exam it hadn't taken.
A stale model artifact claimed a perfect result. Against the actual committed exam, MPC counted one correct answer. The useful question: which number gets to move the money?
Opening the saved account evidence…
Sealed makes the resolution source a protocol: commit outputs, score against sealed fingerprints, settle on the callback's score. Private generated exams keep questions encrypted until a viewer receives a grant.
Demo evidence: a frozen, merged localnet capture. The replay checks account consistency; it is not a fresh devnet execution. Model names are runner-declared. MPC scoring does not prove which model produced an output.
For evaluation sponsors · try the payout path
Set a target. Let the scored run claim it.
You are choosing a model for a measurable task. Fund a qualifying score instead of paying for a screenshot. This captured bounty shows the full decision path:
01 · Sponsor
Define the target
Commit the exam and a required score. Private question access can be delegated; the scoring fingerprints stay encrypted until disclosure.
02 · Runner
Commit, then compete
Submit an output commitment before scoring. Arcium writes the result; the runner's own score claim is not the payout input.
03 · Contract
Pay the qualifying run
Check the bank, score, timing and runner before claiming escrow. Replaying this example verifies the captured winner and bounty fields.
Wallet-free replay of localnet account evidence. This button creates no bounty and sends no transaction. The example's arithmetic task demonstrates protocol integrity; useful confidential task families and sponsor demand still need validation.
This page audits itself. No wallet, no RPC, nothing trusted — every score below was written by the MPC cluster's callback, and you can recount any of them right here:
audit → all 217 artifacts replayed → 38 forgery attacks caught → the sealed exam decrypted in-page → copyable verdict — then seal it on devnet. Or: guided tour (25 captioned stops) · ?decrypt=1 opens the private exam directly
power tools (optional — the audit above needs none of this):
the forgery lab — try to break it
don’t take the checks on faith — run the attack. Each button mutates a committed artifact the way a cheater would, then hands the forged card straight to the same in-page verifier. Every forgery must die at a named check; if one ever says VERIFIED, the artifact scheme is broken. The full check list renders in the target section below the verdict.
compose your own — any committed card × a generic attack primitive, straight into the real verifier:
the lie exhibit — committed forgeries that verify by failing
a sealed-tamper/v1 card IS the forgery — a deliberately mutated artifact, pinned in the bundle, with the check(s) it died at recorded when it was minted. Verifying an exhibit replays the forged card against the real verifier and asserts it still dies at the same named check — so the evidence base ships proof of its own skepticism. If a "forgery" ever verified, the exhibit FAILS. Same replay as chain artifact <exhibit>.
the universal verifier — paste ANY artifact this system emits (sealed-claim/ceiling/policy/match/trail/report/evidence-digest/board/bank/catalog/position/bounty/grant/v1) and the page detects its kind, routes it to the right replay below, and renders the full check list. Same as chain artifact <file> — one entry point for all portable evidence.
verify your copy — download a card, edit a field, drop it back: the named check that catches it is the proof the verifier isn't decorative.
…or replay every committed artifact — the in-page mirror of chain artifact docs/evidence --recursive. Each file below runs through its own verifier above: every PDA re-derived, every verdict replayed, nothing trusted.
cryptographic audit
every claim above re-derived in this page — account PDAs, commitment folds, market resolutions, burn flags. The same checks ship offline in two more languages: node scripts/verify.mjs and a stdlib-Python second implementation (python3 scripts/verify.py — no node, no pip, no RPC). re-run audit · download the evidence bundle · its manifest · the capsule — this whole page + all 217 artifacts + its own verifiers as ONE offline file
waiting for data…
the skeptic's checklist
the audit above proves what holds — this panel proves what doesn't. Every soft spot in the bundle, enumerated by the same checks as chain anomalies: weak evidence stays evidence, flagged, never hidden.
waiting for data…
verify an output
proof that a model's output was committed before scoring — paste sealed prove --run … --item … output
the evidence catalog
every committed artifact, browsable — eight families of evidence plus the index itself, each a shareable ?card= link that re-verifies on open. This is the table of contents for the whole evidence base; nothing here is a screenshot. The index itself is a sealed-catalog/v1 artifact — verify it (completeness + hash-binding, CLI parity via chain catalog --check).
loading indexes…
verify a claim card
the portable deliverable — paste a sealed-claim/v1 card (chain prove <model> mints them) and every account address re-derives in-page, the record replays bit-exact, and every venue resolution re-derives from Run.correct. Same checks as chain prove --verify — and the whole registry ships as committed cards.
every card is sha256-pinned in this bundle's MANIFEST
+ your policy: min-pct min-runs min-items
— authenticity AND sufficiency, in one verdict
verify a ceiling card — proof of a negative
the anti-claim — a sealed-ceiling/v1 card (chain ceiling <model> --snapshot mints them) proves a negative: “no finalized run of this model EVER scored above N%”. Claim cards prove existence — show the receipt. A ceiling card proves nonexistence, possible only because the snapshot is an exhaustive account dump: the card lists EVERY subject run and the page re-derives that set itself from the decoded accounts — a hidden argmax run dies at completeness, a phantom run dies at binding, a shaved number dies at the argmax replay. The primitive a regulator or deployer actually wants: an enforceable upper bound on demonstrated capability. Same checks as chain ceiling --verify.
every card is sha256-pinned in this bundle’s MANIFEST — llama-3.2-1b's saved ceiling is 3.1%; the stale-artifact case is the separate openai run
verify the circuit card — the MPC itself as evidence
the referee is infrastructure, not a server — a sealed-circuit/v1 card (chain circuit --prove --snapshot --rpc mints them) binds the six Arcium computation-definition accounts, the MXE, the Arcium cluster, and the callback SignPda to THIS deployment. Every other card binds what the MPC wrote; this one binds the MPC: each compdef address re-derives in-page as [ComputationDefinitionAccount, sealedPid, u32le(sha256(name)[:4])] under the deployed Arcium program Arcj82pX…, and the SignPda re-derives as a sealed-program PDA that must equal the account sitting in the snapshot. The card also pins sha256 of the actual account bytes — the six raw-circuit bytecode PDAs [ComputationDefinitionRaw, compdef, u8] re-derive, and every recorded hash must match the committed arcium-infra.json dump, including the cluster account's committee BLS key. A renamed circuit lands on a different address; a fabricated one can't exist; swapped bytecode fails its hash. Same checks as chain circuit --verify.
one committed card — sha256-pinned in this bundle’s MANIFEST
verify the ledger census — the nothing-up-my-sleeve card
every negative claim in this bundle — capability ceilings, leaderboard completeness, the anomalies sweep — rests on one assumption: the snapshot is the WHOLE account set, not a cherry-picked subset. A sealed-ledger/v1 card (chain ledger --prove mints it) is the census: per-program account totals, per-kind discriminator counts, and a sha256 over the sorted pubkey set — all recomputed in-page from the raw bundle bytes. Hide one account and the count lies; swap the set and the hash dies. Honest scope: the census proves the dump is enumerable — a judge can re-derive the same set independently with getProgramAccounts; it doesn't pretend the chain holds nothing else, only that THIS dump discloses every account it claims to. Same checks as chain ledger --verify.
one committed card — sha256-pinned in this bundle’s MANIFEST
verify a policy certificate
governance output as portable evidence — a sealed-policy/v1 certificate (chain gate --all --cert mints them) binds a capability policy to every record’s verdict AND the score receipts each verdict was computed from. Every record PDA re-derives in-page, every verdict replays bit-exact, and the stored summary re-checks. Same checks as chain gate --certify-verify.
sha256-pinned in this bundle’s MANIFEST
verify a match card
the portable head-to-head — a sealed-match/v1 card (chain compare <a> <b> --prove mints them) binds two records' shared-bank receipts and the verdict they produce. Every PDA re-derives in-page, the pooled aggregates and bank-wins replay bit-exact. Same checks as chain compare --match-verify.
sha256-pinned in this bundle’s MANIFEST
verify a trail card
the portable money-trail — a sealed-trail/v1 card (chain trail <run> --prove mints them) binds one run's full lifecycle: the bank's commitment, the MPC-written score, and every venue that priced it. Every PDA re-derives in-page and every settlement replays against Run.correct — proof the money followed the MPC score. Same checks as chain trail --verify.
sha256-pinned in this bundle’s MANIFEST
verify a capability report
the printable deliverable, checkable — a sealed-report/v1 document binds itself to a claim card by canonical sha256. Paste one (or load a committed report) and the page fetches the bound card, rehashes it byte-for-byte, and re-derives the record PDA — the document is only as honest as the evidence it fingerprints. Same checks as chain report --verify.
sha256-pinned in this bundle’s MANIFEST
verify the ledger digest
the whole ledger as one document — a sealed-evidence-digest/v1 (chain export --snapshot mints it) pins the bundle's own sha256 plus every count, integrity verdict, bank and record row. The page re-hashes the served snapshot.json and field-compares every ledger line against the decoded accounts — the digest is bound to these bytes. Same check as chain export --verify.
sha256-pinned in this bundle’s MANIFEST
verify the leaderboard card
the flagship claim, checkable — a sealed-board/v1 card (chain board --prove mints it) binds the whole paired-evidence leaderboard to the receipts it’s computed from. Every record and receipt PDA re-derives in-page, every aggregate replays, the shared-bank join and Wilson ordering re-derive the printed ranks — and each embedded receipt field-compares against the decoded ScoreLog account. A leaderboard you don’t have to trust. Same checks as chain board --verify.
sha256-pinned in this bundle’s MANIFEST
verify an exam card
the exam itself as evidence — a sealed-bank/v1 card (chain bank <pk> --prove mints it) binds one benchmark’s entire footprint: the items_root commitment re-folded part-by-part from the pinned chunk bytes in landing order (spec bytes for generated banks, ciphertext+nonce for private ones — no key needed to prove the commitment), every item-chunk and run PDA re-derived, and the full reveal/grant surface checked for completeness. The private card is the sharpest one: the commitment verifies without decrypting anything. Same checks as chain bank --verify.
three committed cards — one per commitment regime: authored · generated · private
verify a bettor's card
the bettor's receipt — a sealed-position/v1 card (chain market position <pk> --prove mints it) binds one position end-to-end: the position PDA ([position, venue, bettor] — dark adds the bettor-chosen pos_salt), its venue PDA, the stake payload field-bound to the snapshot account, the venue's settlement fields, and the payable/lost verdict re-derived with the same parimutuel math the dossiers print. A bettor can carry cryptographic proof of what they're owed — no explorer trust needed. Same checks as chain market position --verify.
two committed cards — one settled-and-paying, one still sealed
verify a bounty card
the sponsor's certificate — a sealed-bounty/v1 card (chain market bounty card <pk> --prove mints it) binds a capability bounty end-to-end: the bounty PDA ([bounty, bank, sponsor, salt]), every account field, and — when claimed — the bounty_qualifies gate replayed over the embedded winner run: same bank, postdates the bounty, runner ≠ sponsor, score ≥ threshold, finalized-or-proven. The pot paid run.runner — no referee signed off. Same checks as chain market bounty card --verify.
two committed cards — one claimed-and-paid, one still escrowed
verify a disclosure card
the viewer's certificate — a sealed-grant/v1 card (chain grant <pk> --prove mints it) proves exam questions moved without publishing them: the grant PDA re-derives from five seeds ([grant, bank, chunk, part, viewer] — and the viewer seed is raw x25519 bytes, not a wallet), every account field binds to the decoded ShareGrant, and the circuit's key echo (encryption_key == viewer) proves the MPC re-encrypted to the key it was asked for. The panel tally — who else was shown the exam — re-derives from the snapshot, not the card's say-so. Answers are never in a grant: only the questions moved. Same checks as chain grant --verify.