Results and theorems
Teams that build AI-assistant platforms, AI-cluster networks, chip packages, chip-printing software and AI cloud services each have a place where their systems break or are hard to check, and each result below is about one of those places. Each result has its own page: what was shown, what it means for a buyer, who we expect would buy, why now, why you can trust the check, and what it does not show yet. Each also links the lab’s exact wording, for a technical reader, and the formal statements are on their own page.
Who did the work, and why now
The work is done by AI agents in one programme (how we work), and no outside firm has audited it. Where the lab’s record holds a dated outside event for a result, such as published work by others, the row says so; where it holds none, the row says that too.
- What we showed
- On every sample set FastCap graded, and on the one slice of layouts Palace graded, the lab’s fast model of how electrical signals couple between the vertical wires of a chip package came closer to those two outside physics programs than the lab’s own pair-by-pair sum did, for one property, the charge they can store (capacitance). That sum is a baseline the lab defined, and the lab’s own records say full-wave field solvers do not use it.
two outside physics programsOn every sample set FastCap graded, the lab’s fast model came closer to it than the lab’s own pair-by-pair sum did; Palace, the second outside program, graded one slice of layouts only.
- Who we expect would buy.
- Extraction-tool vendors and package signal-integrity teams (no customer or pilot yet).
- Limit.
- Capacitance only, against a pair-by-pair baseline the lab defined; the two outside programs disagree with each other about how accurate the lab’s own solver is.
- What it means for a buyer
- If you buy or build fast extraction tools: accuracy graded only by a vendor’s own software is not independent. Here two outside programs served as graders: FastCap graded the sample sets and Palace one slice of layouts only, and on them the lab’s fast model came closer than the lab’s own pair-by-pair sum did. What this gives a buyer today is a fast model checked against outside programs for one property; it does not yet give a reliable size for the improvement.
- Why now
- Chiplet packages are going vertical: the UCIe chiplet-interconnect standard now covers stacked, three-dimensional packaging, with bonded connections spaced as little as a micron apart (report). The closer those vertical connections sit, the more a package team depends on a coupling model its reviewers can trust.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- In the lab’s own network simulator, a network-card design that keeps track of out-of-order data in a small, fixed amount of memory, compared on the same simulated grid with the lab’s model of STrack, a published fixed-size design, and with a second bounded-state design in the lab’s simulator.
1.965xThe lab ran its own network simulator over a grid of 64 simulated cases. In it, the lab’s model of STrack, a published fixed-size design by Le, Pan and Newman, needs this many times the reorder memory that the lab’s design does, on average (a geometric mean). Read it as about twice.
- Who we expect would buy.
- Network-card and switch-chip makers for AI clusters (no customer or pilot yet).
- Limit.
- Against a second bounded-state design in the lab’s simulator, which the lab calls CTS, the lab’s record gives 1.443x, CTS better in 31 of 64 simulated cases, a ratio of CTS’s memory to the lab design’s whose averaging it does not state; gaps are often tens of bytes, so the result is mixed; STrack needs less in some cells. A simulation, not silicon.
- What it means for a buyer
- If you build network cards or switch chips for AI clusters: traffic spread over many paths arrives out of order, and a card that buffers it needs memory that grows with the data in flight. This design keeps a small note of fixed size instead. Measured against the lab’s model of a published fixed-size design (STrack) on the same simulated grid it uses less memory on average, but often by only tens of bytes.
- Why now
- The Ultra Ethernet Consortium published version 1.0.2 of its specification, dated 2026-01-28. Its architecture paper (Hoefler and others, arXiv 2508.08906, 2025-08-12) says that unordered transport modes may deliver data to memory out of order. STrack, a published transport for AI clusters (arXiv 2407.15266, 2024), also allows out-of-order delivery over many paths.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- A check of how a chip pattern will print that gives, for every point of the image, a range for its brightness. On every test mask the lab’s detailed simulation fell inside the range, apart from a rounding error in one internal step that the range leaves out.
232 test masksFor every pixel of each one, the brightness the lab’s detailed simulation gives fell inside the range the check computed. An approval check built on the ranges made no wrong approvals once a fault the lab found was fixed, on some of the same masks where the fault was found (a smaller approval test, not a held-out one).
- Who we expect would buy.
- Computational-lithography vendors and foundry mask sign-off teams (no customer or pilot yet).
- Limit.
- Relative to the lab’s own imaging simulation on a finite set of test masks, not silicon.
- What it means for a buyer
- If you sign off masks or sell the software that does: an approximate check that approves a pattern the slow simulation would reject costs you later. This check computes a brightness range for every point of the image, and on the lab’s test masks the detailed simulation never fell outside it; the range leaves out the rounding error of one internal step. What it gives a buyer today is a finite test against the lab’s own simulation, not a guarantee about real silicon.
- Why now
- Simulating how masks will print already costs the industry tens of billions of processor hours a year, by NVIDIA’s account when it launched its GPU lithography library with ASML, TSMC and Synopsys (press release). A check that could sign a mask off faster than a full re-simulation would cut into that bill; the lab has not measured any such saving for its own checks.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- A transaction layer meant to finish or undo an AI assistant’s multi-step change after a crash, for plans it accepts before they run. At every crash point the lab chose, it recovered the change whole or not at all; killed at random moments, some recoveries were not, and the lab has not fixed that yet.
atomic recovery recorded at every one of those 29 pointsThe lab killed the program mid-change at each of them, and each time a fresh program recovered the change whole or not at all from the log on disk.
- Who we expect would buy.
- AI agent-platform teams (no customer or pilot yet).
- Limit.
- 2,893 further kills at seeded random moments found 31 recoveries that were not atomic (recorded in the lab’s claim; the run record is not published); the lab has not fixed them yet. Power cuts are untested.
- What it means for a buyer
- If your assistants change files and databases, a change that dies halfway can leave them half-updated, with nothing to finish or undo it. This layer writes each change to a log on disk first and recovers from it after a crash, for plans it accepts before they run. At the moments the lab chose, recovery was all-or-nothing every time. At random moments it was not always, and the lab publishes their count (the run record is not published), which is what a buyer needs to know before relying on it.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- The lab’s own three-dimensional solver measured how much of one simplified chip-package connection’s capacitance (its charge-storing capacity) flat, two-dimensional models leave out.
about 40%of one simplified connection’s capacitance (its charge-storing capacity), measured with the connection driven as one of a pair, sits at its two ends, which flat, two-dimensional models leave out. The lab’s own solver was checked first against shapes with exact answers, then against FastCap, an outside solver run on the lab’s own mesh of the shape.
- Who we expect would buy.
- Chip-package design teams and extraction-tool vendors (no customer or pilot yet).
- Limit.
- One simplified connection, a bare cylinder; whether the missing share changes any figure the lab’s own models sign off on has not been tested.
- What it means for a buyer
- If you design chip packages or sell the software that models them: a flat model of a vertical connection misses the charge stored at its two ends by construction. The lab built its own three-dimensional solver to measure that share and checked it against shapes with exact answers and against FastCap, an outside solver run on the lab’s own mesh. What this gives a buyer today is a measured size for what a flat model leaves out on one simplified connection, not yet a correction shown to matter on a real package.
- Why now
- Chiplet packages are going vertical: the UCIe chiplet-interconnect standard now covers stacked, three-dimensional packaging, with bonded connections spaced as little as a micron apart (report). The closer those vertical connections sit, the more a package team depends on a coupling model its reviewers can trust.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- A machine-checked proof, in the lab’s one small model, that its design for the loss-recovery step of Ultra Ethernet’s ordered-delivery mode (the step that deals with data that has gone missing) never passes data on out of sequence order, or twice; it is about ordering, not delivery.
four checking tools agreethat in the lab’s one model (only one of them without a size limit) its recovery design never passes data on out of sequence order, or twice.
- Who we expect would buy.
- Makers of Ultra Ethernet network cards, switches and chips (no customer or pilot yet).
- Limit.
- One small model, and about ordering, not delivery; it does not show the standard requires this design.
- What it means for a buyer
- If you build or test Ultra Ethernet network cards that use its ordered-delivery mode: machine-checked evidence that this design for the loss-recovery step keeps the standard’s ordering rule, in the lab’s one model. It shows the design meets the rule; the standard allows other designs that also meet it, so it is not a reason every implementer must use this one.
- Why now
- The Ultra Ethernet Consortium published version 1.0.2 of its specification, dated 2026-01-28. The rule this result checks is one sentence of it: in the ordered delivery mode, data must be delivered in the order of their sequence numbers.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- A proof, over every layout in one narrow family in a simplified model, that adding up coupling one pair at a time always overstates the worst case by at least a stated minimum.
always overstates the worst couplingAdding up coupling one pair at a time does this for every layout in one narrow family, inside the lab’s simplified physics model; the search covered the whole family, not a sample.
Adding up coupling pair by pair overstates the worst coupling by at least 1.10467× (at least 10.467%), rounded down from the certified value.
- Who we expect would buy.
- Extraction-tool vendors and package signal-integrity teams (no customer or pilot yet).
- Limit.
- A simplified model, not a full field solve; against the lab’s more exact solver the over-estimate is smaller (about 9.8 percent), measured on examples only.
- What it means for a buyer
- If you build or use fast extraction tools: in the sources the lab searched, the pair-by-pair sum appears only with sampled examples of how wrong it can be. This computer search covers every point of one family of four-connection layouts and gives a guaranteed minimum over-estimate in that model, not a sample. A too-high estimate errs on the cautious side, and our record does not say what it costs a package designer.
- Why now
- Chiplet packages are going vertical: the UCIe chiplet-interconnect standard now covers stacked, three-dimensional packaging, with bonded connections spaced as little as a micron apart (report). The closer those vertical connections sit, the more a package team depends on a coupling model its reviewers can trust.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- A run the lab reports as exhaustive, in a test world the lab built, over every sequence of up to three AI-assistant tool calls, finding the smallest combinations that leak a stored secret.
2,379 runs on real files and a real databasecovered, by the lab’s account, every sequence of up to three AI-assistant tool calls in the lab’s test world (this site does not show how the runs map onto the sequences). Three smallest combinations leak the stored secret and only one of them is a pair, so approving tools two at a time misses the other two.
- Who we expect would buy.
- Agent-platform and runtime-security teams (no customer or pilot yet).
- Limit.
- One test world the lab built; a standard technique, tracking where the secret’s data flows, would also catch all three.
- What it means for a buyer
- If you decide which tools an AI assistant may combine: approving tools one or two at a time can miss a combination of three that leaks a stored secret. This is an executed record, which the lab reports as exhaustive, of which combinations are dangerous in one test world, run on real files and a real database.
- Why now
- Two published write-ups describe dangerous combinations of AI-assistant tools: Simon Willison’s “lethal trifecta” (2025-06-16), which says an agent that combines private data, untrusted content and outside communication can be tricked into sending the private data to an attacker, and Invariant Labs’ analysis of “toxic flows” in agent systems (2025-07-29).
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- In a small simulated setup, six concrete ways a signed deletion receipt can check out while the data is still recoverable or was never deleted.
six concrete waysa signed deletion receipt can check out while the data is still recoverable or was never deleted, shown against the lab’s two receipt checkers, including a colluding auditor whose receipt both checkers accept.
- Who we expect would buy.
- AI inference and cloud providers, and their auditors (no customer or pilot yet).
- Limit.
- A small simulated setup, not an AI serving system; a set of failure modes, not a deletion guarantee.
- What it means for a buyer
- If you must show customers or regulators that data was deleted: a receipt that only proves a key was destroyed is easily mistaken for proof that the data is gone. The lab built two checkers for such receipts and published the ways each can be fooled, including a colluding auditor, so a buyer knows what a receipt does not prove.
- Why now
- NIST’s guidance on wiping media, SP 800-88 Rev. 1 (December 2014), says that erasing by destroying a key should not be trusted where a copy of the key may exist elsewhere. NIST withdrew that revision on 26 September 2025 and replaced it with Rev. 2; our record does not say what Rev. 2 changes.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- A method that signs off, in the lab’s own simulator, a small piece of a chip-mask design (a tile) next to a small edit as still valid without recomputing it. It applies when a bound the lab computes on the edit’s effect fits inside the tile’s safety margin; this site does not name what checks that bound.
0 violationsIn the lab’s single-edit tests, checking point by point against a full recomputation found no tile the method signed off that was worse, across 9,175,040 comparisons (this site does not say how many edits or tiles they came from).
- Who we expect would buy.
- Mask-correction and verification software vendors (no customer or pilot yet).
- Limit.
- The sign-off applies only when the edit fits a tile’s margin: on the lab’s test edits it spared recomputing only about 1% of tiles.
- What it means for a buyer
- If you sell mask-correction or verification software: fully re-simulating every affected tile after every change is the slow step at full-chip scale. This method signs a changed tile off when a bound the lab computes on the edit’s effect fits inside the safety margin the tile already had. On the lab’s test edits it has so far spared only a small share of the recomputation.
- Why now
- Simulating how masks will print already costs the industry tens of billions of processor hours a year, by NVIDIA’s account when it launched its GPU lithography library with ASML, TSMC and Synopsys (press release). A check that could sign a mask off faster than a full re-simulation would cut into that bill; the lab has not measured any such saving for its own checks.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- An automated search, given no starting attack sequence and no hint of which combination might work, tried combinations of moves from the lab’s own list of known attacks against the lab’s hardened models of quantum-resistant Wi-Fi sign-in designs, and, within a small fixed budget, found no combined attack that got through.
The search, given no starting attack sequence, tried 11,200 combinations of moves from the lab’s own list of known attacks against ten hardened designs, and none got through. A separate run the lab reports as exhaustive, of every combination of up to three attack families on all ten designs (this site does not say how a combination of families becomes concrete moves), 53,485 in all, also found none.
- Who we expect would buy.
- Wi-Fi chipset and access-point vendors, and Wi-Fi test labs (no customer or pilot yet).
- Limit.
- A null result within a small fixed budget, against the lab’s own software models, not real Wi-Fi software.
- What it means for a buyer
- If you build or certify Wi-Fi sign-in: a designer’s own attack list only tests what the designer thought of. Here an automated search, given no starting attack sequence, combined moves from the lab’s own list against ten hardened designs and found none that got through. The result covers only combinations of those moves, within a small fixed budget.
- Why now
- NIST has published ML-KEM, its standard for quantum-resistant key exchange (the standard), so sign-in designs built on it now need testing against combined attacks, not only the ones on a known list.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- In the lab’s model of its admission-control module (the code that decides which sign-ins an access point accepts), a machine-checked proof that an access point’s memory for half-received quantum-resistant sign-ins stays capped, however many devices an attacker connects.
In the lab’s hand-written Lean model of its admission module, the access point never holds more than 64 KiB for half-received sign-ins from devices it has not yet verified, and never more than 4 half-finished sign-ins at once, however many devices an attacker connects. Lean is a program that checks mathematical proofs.
- Who we expect would buy.
- Access-point and controller vendors, and Wi-Fi chipset firmware teams (no customer or pilot yet).
- Limit.
- In the lab’s model the access point reserves four 16 KiB slots and refuses a fifth; the lab’s account is that four unfinished sign-ins therefore block other devices. Whether slots expire is not stated in the files we serve.
- What it means for a buyer
- If you build access points or their firmware: in the lab’s model, capping the memory per connection does not stop an attacker who opens many connections at once from exhausting the memory held for half-received sign-ins. A simple reservation rule, proved by machine, caps the total. In the lab’s model the access point reserves four 16 KiB slots and refuses a fifth; the lab’s account is that four unfinished sign-ins therefore block other devices. Whether slots expire is not stated in the files we serve. So this is a proof of the cap, not a finished design.
- Why now
- NCC Group’s 2026 write-up “WPA3 Denial of Service: SAE Resource Exhaustion” describes how an access point with too many sign-in exchanges pending can stop accepting new costly attempts and ask for a token instead. It is about today’s WPA3 sign-in, not the quantum-resistant one this result concerns.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- A machine-checked proof that a shared AI cache which never leaks between customers and always reuses what it may must remember at least one bit for every pairing of a customer with a cached item, where any item can be shared with any group of customers (the lab’s “dense rights model”).
The permission bookkeeping is the record of who may use each cached item. The floor is at least one bit of it for every pairing of a customer with a cache block, proved for any number of customers and blocks, but only in the case where any block may be shared with any group of customers.
- Who we expect would buy.
- Confidential-AI product teams at cloud providers (no customer or pilot yet).
- Limit.
- Holds only when any cached item may be shared with any group of customers; if each item belongs to one customer, far less bookkeeping is needed. The counting argument is classical, not new.
- What it means for a buyer
- If you build confidential AI serving on one shared model cache: this sets the least state (memory) that a leak-free, full-reuse cache must spend on remembering who may use each cached item: within the lab’s dense-rights model no design can go below it, and nothing checks that a real cache matches that model. It applies only if your cache lets a block be shared with any group of customers.
- Why now
- Published work on shared caches in AI serving: SafeKV (arXiv 2508.08438, 2025) shares cached work between customers selectively to avoid timing leaks, and a 2026 paper (Addagada, arXiv 2608.09225) describes how a cache shared across customers lets one customer reconstruct another’s private prompt by probing how fast cache hits return.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
- What we showed
- A sign-off record for a whole photomask that stayed a little over a kilobyte in size across every mask size the lab tried; its size does not buy assurance.
The record stays between 1,347 and 1,379 bytes for a mask split into anywhere from 64 to 1,048,576 pieces (tiles), and a short checking program written with only standard built-in libraries can check it.
- Who we expect would buy.
- Mask-synthesis and mask-data software vendors, and foundry sign-off teams (no customer or pilot yet).
- Limit.
- Its size does not buy assurance: the number of pieces that must be opened grows with how small a chance of missing a bad piece you want.
- What it means for a buyer
- If you exchange mask sign-off records: a record built from per-piece records normally grows with the number of pieces. This one stayed within a narrow size range in the lab’s tests, with a short checker that uses only standard libraries. Its size does not buy assurance: that comes from spot-checking pieces.
- Why now
- Simulating how masks will print already costs the industry tens of billions of processor hours a year, by NVIDIA’s account when it launched its GPU lithography library with ASML, TSMC and Synopsys (press release). This result does not reduce that compute: it concerns the size of the sign-off record a team hands over.
The full result: why you can trust the check, and what it does not show yet · The exact wording, for a technical reader
The formal statements
The formal statements page sets each result out as a mathematical statement, for a technical reader. It also holds one statement that is not one of the lab’s current claims: a finding about two public computed materials databases, on high-k chip insulators (materials with a high dielectric constant).
How we show numbers
Every number on this site links to the file it comes from. How each result is checked
- We never show a number before its file has loaded.
- A question we have not checked yet is marked as unchecked.
- A check that found nothing says so.
- A file with no value for a question says so.
- A number whose file is missing or has changed is not shown.
- Two files that disagree about what a number describes are both flagged.
- A number from too few samples shows its sample size.
- Two files that give different values are both shown.
- A file we cannot publish is listed by its fingerprint only.
- A measurement more than a week old shows its age.
- A question that does not apply to a page is left off it.
- A measurement whose program failed is shown as failed.