Skip to content
CLOSED BOOK

Closed Book

Release attestation · Midnight

Pass the test.
Keep the test closed.

Publish a verifiable safety verdict for an AI release without publishing the red-team suite behind it.

Open the evaluation →Read the protocol

The proof is public. The evidence isn’t.

§ 01 — Demonstration

One evaluation. Two readers.

The evaluator holds the left side. The world receives the right. Fail a check and try again: the attestation is refused, and the public side still learns nothing about why.

Private evaluation

Evaluator only
Model build
CB-DEMO-04
Evaluation suite
Private checks
Release condition

6 / 66 required

Select a check to fail it.

Public attestation

Anyone
Attestation
—
Model build
—
Suite commitment
—
Predicate
—
Verdict
—
Checks satisfied
—
Private plaintext in record
—
Status
Nothing published

The public side receives commitments and a verdict. It never receives the suite, the outputs or the individual results.

§ 02 — Boundary

What crosses the spine, and what never does.

What the world sees

Model build commitment
Binds the attestation to one exact build.
Evaluation-suite commitment
Binds it to one exact suite, without revealing it.
Release predicate
The public rule the private results had to satisfy.
Verdict
PASS. A failing evaluation produces no record at all.
Attestation reference
An id anyone can recompute from the public fields.

What stays closed

  • Secret prompts
  • Raw outputs
  • Exploit traces
  • Individual failures
  • Evaluator notes

None of it is hashed onto the ledger in the clear. Salts keep the commitments from being guessed.

§ 03 — Method

Four steps. One of them is public.

  1. 01

    Evaluate

    A private red-team evaluation is performed against an exact model build.

  2. 02

    Commit

    The model build and the test suite are cryptographically bound, then published as commitments.

  3. 03

    Prove

    The private results are checked against the release predicate inside a Compact circuit.

  4. 04

    Verify

    The public receives the verdict without receiving the evidence.

A failed release does not become a proof.

The Compact circuit asserts the release predicate. If a single required check fails, the assertion fails, no proof can be produced, and nothing reaches the ledger. What CLOSED BOOK proves, and what it does not →