claim. verify. sign.

An AI system's report of its own success is a self-signed certificate.
It proves the system said it, not that it happened.

Independent verification for AI systems that claim real-world outcomes. Turiya reruns the claimed action against ground truth and signs what actually happened, so anyone can check the result — including the people who won't take your word for it.

falsifiedsha256:52d6649441fc…

clickclaimed fixed / effect: fails

Here's exactly what happens.

One claim in, one signed verdict out. This is a real receipt, walked end to end.

the claim
"I fixed sympy #24909"
Bug with milli prefix · the system reported the fix worked
we reproduce
clone the repo at the buggy commit
isolated environment · real code
we re-run
run the real FAIL_TO_PASS test
not the self-report — the actual test
ground truth
test still failing
test_passed: false
verdict
falsified
agent claimed fixed but the test still fails — claim-vs-effect gap
falsifiednot_falsifiedcertifiedindeterminate
signed
record_hash81f999ebd7ae…
signature130cd0514f9a…
key_id251b14346af43d1d
rfc3161freetsa.org · 2026-09-14
verify this receipt yourself →
10 signed catches · 6 repos: a frontier model claiming success while wrong
cryptographically signed: tamper-evident, checkable, no trust required to verify the record
$0 to start: a real verification, not a demo

Not software you install. A verification engagement.

One high-stakes workflow, re-run against ground truth inside your environment. Your code and data stay with you; what leaves is signed evidence you can pass to someone who won't take your word for it.

what you give us
one workflow · 100–500 claims
where it runs
inside your environment
how long
about two weeks
what you receive
signed receipts + an assurance report

Read the engagement

A verifier that never corrects itself is not a verifier. We publish our misses.

2026-09-16 “real credit-card fraud” (the fraud receipts’ dataset label) — provenance not established: the data traces to a source with no dataset card and synthetic-looking merchant names. The falsification stands; the word “real” is withdrawn.
2026-09-16 a fraud-temporal receipt was withdrawn: its record_hash did not match its content, so a stranger could not re-verify it. Withdrawn rather than re-signed (the key-ceremony rule); to be re-issued from a fresh run.
2026-09-17 the fraud falsifier was re-run on the real ULB MLG dataset (284,807 anonymized transactions). The amount-evasion and amount-skew attacks that fired on the earlier synthetic dataset do not fire on real data — real fraud detection keys on PCA features, not a raw amount. Only temporal drift is real (1.59× f1 swing). The synthetic receipts were withdrawn and replaced with real ones.
2026-09-14 “anyone can check a signed receipt” — 11 receipts failed their own content-address check; root cause not established, recorded in full rather than guessed at. None were published; all ten on the board verify.
2026-09-11 “9 signed catches from this run” — 6 were false: the test died in our environment, not the system’s code. Withdrawn and kept, not published.
2026-09-11 “21 candidates tested, 0 catches” — 0 were testable: our dependency install was broken. Fixed.

Full record, including every candidate we rejected and why. Read the methodology.

This page's claims are signed. sha256:…
$ awaiting verification…
click-0f71fe7sha256:52d6649441fcbf…

claimed fixed / effect: fails

turiya: system verifier
connected
falsified · signed
$
# PIPELINE
Capture the Claim
Extract what the system asserted: a fixed bug, a passed test, a changed record.
claim + source
Sign the Verdict
falsified · not_falsified · certified · indeterminate. Signed, content-addressed.
signed proof
# CATCHES
System claim
"fixed"
Self-report
"passes"
Real effect
fails
10signed catches
6public repos
10signed catches published
6public repositories
61candidates rejected this run

These numbers are signed. Verify them ↑

# PRICING
assurance
one engagement · scoped
  • Batch verification
  • Z3-checked specs
  • Assurance report
  • Auditor-ready evidence
quarterly
continuous · scoped
  • Re-verification each quarter
  • Drift detection
  • AIUC-1 aligned evidence
  • Named contact
enterprise / OEM
custom scope
  • SSO / OIDC + RBAC
  • Air-gap deployment
  • SLA
  • White-label for resellers

One price is public: the free pilot. Everything else is scoped, because a single number would misrepresent every engagement except one.

Any AI system that claims an effect. Cut by verifiability.

The engine is system-agnostic: predictive, generative, assistive, agentic, orchestrated, the whole tree. What decides whether we can verify a system is one question: does its claim leave a checkable effect?

checkable effect

what it did leaves a falsifiable trace: a flag, a code change, a grounded answer

we falsify it: re-run, re-check, sign

judgment-heavy

"correct" needs expert taste: was the loan fair, the diagnosis sound

signed expert judgment

unfalsifiable

no ground truth exists: open-ended creation, intent, alignment

we refuse: indeterminate, never a fabricated score

Classification: fraud, credit, screening signed
Code & system effects signed
Regression / forecast roadmap
Factual text (grounded) signed
RAG grounding signed
Copilot suggestions roadmap
System judgment / decisions roadmap
Creative text / image refuse

Signed receipts are published across 17 system types: code effects, fraud, credit, sanctions screening, fairness, anomaly detection, multi-agent orchestration, forecast, recommendation, computer vision, speech, scientific AI, RAG grounding, agents, truth, efficacy, and honesty. The rest reuse the same engine; we claim a receipt only once it exists.

The same verifier, against a real fraud model.

Run on the real ULB MLG dataset — 284,807 anonymized European card transactions, 0.17% fraud — the falsifier caught two real gaps: temporal drift and adversarial evasion.

284,807real transactions
1.59×f1 drift over time
22.6%adversarial evasion

XGBoost — the workhorse of production fraud detection — is 99.9% accurate on real transactions, yet its f1 still swings 1.59× across time, and gradient-guided perturbations evade 22.6% of the fraud the logistic model catches — 8.4% transferred to a black-box XGBoost. And the amount-evasion attack that fired on an earlier synthetic dataset doesn't fire on real data (0 of the fraud it caught was evaded) — the verifier reports that honestly rather than manufacturing a catch.

And on IEEE-CIS — 590,540 real e-commerce transactions — a model built on the naive interpretable signals (amount, card, address, email) is 94.4% accurate yet catches only 23.9% of fraud: the fraud is low-and-slow, structured to mimic legitimate behavior.

adversarial evasion (FGSM) falsified

logistic regression 96.391% accurate evades 44/195 of caught fraud; the SAME adversarial samples transfer to a black-box XGBoost and evade 15/179 — mean applied L-inf perturbation 0.500

verify →
amount evasion not_falsified

99.923% accurate; 0/179 of caught fraud evaded by halving amount

verify →
low-and-slow evasion (IEEE-CIS) falsified

94.4% accurate yet catches only 23.9% of fraud — below the 96.5% 'always legitimate' baseline

verify →
training-serving skew not_falsified

f1 0.753 (recall 0.798) · f1 0.761 (recall 0.798) · f1 0.773 (recall 0.807) · f1 0.781 (recall 0.798)

verify →
temporal drift falsified

f1 swings 0.538 to 0.857 across time segments (1.59x spread) — the validated number is a snapshot, not a property

verify →

5 signed fraud receipts, each Ed25519-signed over the record hash. Download any of them and re-verify with the public key.

One falsifier, seventeen system types.

Code, fraud, credit, sanctions screening, fairness, anomaly detection, multi-agent orchestration, forecast, recommendation, computer vision, speech, scientific AI, truth, efficacy, honesty, RAG grounding, multi-step agents — the same claim-vs-effect engine signs a receipt for each. Where the system under test was honest, the receipt says so. We don't manufacture a catch.

agents
no catch
7 receipts
RAG grounding
falsified
2 receipts
efficacy
no catch
1 receipt
truth
no catch
1 receipt
anomaly detection
falsified
1 receipt
credit decisions
falsified
1 receipt
honesty
no catch
1 receipt
fairness
falsified
1 receipt
forecast
falsified
1 receipt
multi-agent orchestration
falsified
1 receipt
recommendation
falsified
1 receipt
sanctions screening
no catch
1 receipt
scientific AI
falsified
1 receipt
speech (ASR)
falsified
1 receipt
computer vision
falsified
1 receipt

The newest catches — speech, scientific AI, and the XGBoost re-runs: a vosk recognizer's word error rate jumps from 20% to 90% under noise; XGBoost cannot extrapolate the CO2 trend (7.0 vs 1.2 ppm error); and fairness, forecast, and scientific were re-falsified against XGBoost — the findings hold. Read the signed receipt →

The fifth layer: the signed effect.

AI assurance has four crowded slices: monitoring (did the distribution shift?), security (can it be attacked?), capability (how good is it?), controls (are the processes right?). We verify the fifth: the effect (did it do what it claimed), and we sign the answer. The other four layers can complement the signed effect. We sign the ground-truth verdict. Not a benchmark score, not a PDF report — a signed receipt you can re-verify.

monitoring
drift
security
attack
capability
rating
controls
process
effect: signed
ours

Independent verification is becoming a requirement.

EU AI Act enforcement powers took effect 2 August 2026. California signed SB 813 + AB 1405 in September 2026: an AI Auditor Registry that requires independent verification from parties who did not build the system. AIUC-1 certification mandates quarterly third-party re-testing. The question is no longer "should we verify?" It is "who signs the proof?"

Verify your system For auditors & insurers