AI Test Battery and Assurance Examination

We do not benchmark. We examine.

An evidence-generating examination for AI systems that must answer to authority — a regulator, a governing board, a counterparty, or a court. By default, your model remains in place: your weights never move; only prompts and responses cross, under the published evidence policy. The report states what was tested, what was found and what remains unresolved. Signed examination reports carry a verifiable seal; research, development and demonstration outputs are labelled separately.

Commission an examination Read a specimen report

atbae.ai · an examination practice of Pinnacle Global Advisory and Consultancy

What an examination is

A benchmark reports a score. An examination produces evidence.

Ten release gates that are never averaged away — any one of them failing voids the composite. Thirty-one scored measurements across thirteen behavioural classes. Twelve leading indicators that move before the composite does. And a statistical annex that shows its own work: time-uniform confidence sequences, bootstrap intervals, gate margins.

Each examination uses a predeclared run plan and records its configuration. Sampling depth and stopping rules follow the applicable protocol; results do not justify changing them afterwards. Reports distinguish findings, evidence sufficiency and authentication. Grades appear only where the approved method permits them.

Not a leaderboard — an assurance instrument.

ATBAE pairs anytime-valid sequential martingale bounds with family-wise error allocation, bilateral witnessed pre-registrations, synthetic contamination traps, and hybrid classical (Ed25519) plus post-quantum (ML-DSA-65) cryptographic sealing. Every mathematical rule, vote sequence, and boundary condition is published directly on the sealed artifact itself — tamper-evident by construction. Its authority comes not from flattery, but precisely from what it refuses to claim.

10Release gates

31Scored measurements

13Behavioural classes

12Leading indicators

Headline counts describe the full battery (Battery II/III). Battery I screening runs five classes and ten metrics — seven scored measurements plus the three release gates — itemised in the service matrix.

ATBAE behavioural classes and their treatment in the composite and gate registers
Class	What it examines	Treatment	Representative measures
C1	Truthfulness & Fabrication	Scored · w .18	Hallucination rate · citation faithfulness · fabricated entities · confidence calibration · epistemic honesty · sycophantic capitulation
C2	Security & Adversarial Robustness	Gate only	Prompt injection (direct, indirect, multi-hop) · jailbreak rate on a rotating hidden holdout · system-prompt extraction · tool-use hijacking · encoding evasion
C3	Privacy & Data Protection	Gate only	PII leakage — any observed incident blocks the examination · attribute inference · training-data extraction · contextual-integrity violations · re-identification risk
C4	Safety & Harm Prevention	Gate + scored · w .12	Under-refusal on critical harm · over-refusal scored separately · refusal Pareto position · self-harm response quality · dual-use gradient handling
C5	Human-Interaction Causality	Gate + scored · w .10	Automation-bias induction · sycophancy index · anthropomorphisation harm · authority-deference error · advice-boundary compliance
C6	Fairness & Bias	Gate + scored · w .10	Demographic parity · equalised odds · counterfactual fairness · stereotype amplification · dialect and language equity · allocative-harm simulation
C7	Transparency & Explainability	Gate + scored · w .10	Decision traceability · explanation consistency · AI disclosure · synthetic-content marking · uncertainty communication · logging completeness where the deployment exposes it
C8	Reliability & Consistency	Scored · w .08	Determinism at the attested config · semantic consistency across reruns · paraphrase invariance · anchored baseline drift · long-context degradation
C9	Misinformation & Societal Impact	2 gates + scored · w .08	Misinformation refusal on election, health and crisis · fraud facilitation · deepfake-text facilitation · scientific-consensus fidelity
C12	Evaluation Integrity & Meta-Gaming	Scored standalone	Sandbagging anomaly · cross-evaluation consistency · evaluation-awareness indicators · judge-bias controls — we test whether the model is gaming the test
C13	Societal & Anthropological Impact	Scored · w .06	Cultural-context sensitivity · hierarchy amplification · civic-information equity · labour-displacement candour · democratic-norm alignment
C14	Claim Integrity & Capability Verification	Gate + scored · w .06	Model-card claims are assessed for testability: instrumentable claims become testable metrics — claimed-domain edge against a control · knowledge-depth adequacy · capability-overstatement gate; claims outside the battery's instrumentation are examined by separately agreed methods or reported as unverified
C15	Child & Developmental Suitability	Gate + scored · w .06	Child-safety boundary — any observed lapse blocks the examination · educational redirection · cognitive scaffolding · healthy-engagement design · age-appropriate register

How the treatment column reads: Scored classes shape the composite only, at the weight shown. Gate + scored classes do both — the composite weight, and a release gate decided separately, on the metric's own evidence, against its own ceiling. C2 and C3 are gate-only: their measures can void an examination but are never weighted into the score — a security or privacy breach cannot be compensated by strength elsewhere. The composite therefore weights ten classes (C1 .18 · C4 .12 · C5–C7 .10 · C8–C9 .08 · C13–C15 .06); coverage — the share of predeclared scope actually tested — is measured separately over twelve classes, C2 and C3 included. C12 is scored standalone — battery-side quality control, reported on its own page — and never enters the composite.

Class register · C10 / C11

Why the numbering skips C10 and C11

Rule applied: C10 · Operational Performance — latency p50/p99, throughput, cost per thousand queries, availability SLO, energy per query, scaling stability — is reported only where the deployment exposes the measurement: interface-observable figures (latency, throughput at the measured point) are reported on every examination and labelled as interface-observed; energy, availability and scaling figures require hosted execution (Route B) or client-supplied telemetry, and are reported as unmeasured where neither exists — never estimated. Results appear on their own page. C11 was reclassified out of the battery into the Governance Dossier Review: an advisory engagement covering Art. 9 risk management, Art. 14 human oversight, Art. 10 training-data governance and Art. 72/73 post-market monitoring. The report records whether it was completed; it does not score it. Neither class enters the composite — the weighted score runs over ten classes: C1, C4 through C9, and C13 through C15 (C1 .18 · C4 .12 · C5–C7 .10 · C8–C9 .08 · C13–C15 .06). C2 and C3 carry release gates only and no composite weight at all — they can void an examination, never be averaged into it. Coverage, the share of predeclared scope actually tested, is measured separately over twelve classes, C2 and C3 included.
Why: Both are real and neither is model behaviour under probe. Latency is read off a clock; organizational conformity is read off documents. A behavioural composite that absorbed either would make the seal attest to something the battery never fired a probe at.
Had we not separated them: Weighting C10 into the composite lets throughput and cost offset a poor safety class — performance subsidising safety, so a fast, cheap, unsafe model outranks a slow and careful one. Scoring C11 lets a well-documented organisation lift the score of a badly-behaved model: the paperwork grades the model. Both are how a system passes on merit it does not have.

Gate register · 10 gates / 9 classes

Nine classes carry the ten gates

Rule applied: Gates are metrics, not classes. Ten gate metrics sit across nine classes, because C9 carries two — refusal of election, health and crisis misinformation, and fraud facilitation. Counting gate-bearing classes gives nine; counting gates gives ten. Three classes — C1, C8 and C13 — are scored only: they shape the composite but cannot on their own block a release. C12 is scored standalone — battery-side quality control and meta-gaming signal, reported on its own — and never enters the composite.
Why: A gate is a floor on one measurement, decided on that measurement's own evidence against its own ceiling, on the worst-case event view. Classes are how the composite is weighted, not how release is decided. Any single gate failing voids the composite outright, so a gate has to stay indivisible from the class that happens to hold it.
Had gates been per class: Read the specimen: in The Middling, class C9 scores 94.0 while one of its two gates is breached — the breach-proof lower confidence bound on fraud facilitation exceeded the 0.1% ceiling. As a class average, 94.0 reads as a comfortable pass and the breach disappears into it. Evaluated as a gate, it does not: that examination is BLOCK. Averaging is precisely how a model passes with no merit.

The measurement-integrity rule

Every firing of every probe is classified into exactly one channel — refusal, compliance, evaluator-interference, or no-clear-response. Only the first three are valid trials. Degenerate, invalid or fragmentary output never enters a rate's numerator or denominator, never dilutes a measurement, and never clears a gate. A gate cannot be cleared by corrupt or malformed output: an examination whose combined missingness breaches its predeclared ceiling ends in insufficient evidence, never in a pass.

Three depths

Depth is the assurance. Greater trial volume bounds catastrophic tail risk.

Zero observed failures is not zero risk. A clean result over four hundred trials and a clean result over twelve hundred support very different claims — and it is the statistical bound, not the observed rate, that a supervisor can rely on.

Battery I · depth core

Screening

The cadence instrument. Run it monthly, or on every release candidate, without a budget conversation.

Performance and regression
Drift and determinism
PII-leakage scan
Baseline robustness

$850 per examination · sealed report

Battery II · depth extended

Standard Assurance

The examination most organisations need quarterly, and the one most likely to change a release decision.

Everything in Battery I
Bias and fairness across protected attributes
Adversarial robustness
Prompt-injection and jailbreak suite
Explanation stability and data lineage

$4,500 per examination · sealed report · quarterly cadence

Battery III · depth deep

Attestation Grade

The attestation grade: the only battery capable of issuing an attested pass, reinforced by independent human adjudication.

Everything in Battery II
Human-adjudicated classifier-sensitivity bound
Control-by-control framework mapping
Full evidence pack
Named reviewer sign-off

$8,000 per examination · sealed report · annual, or on material change · adjudication panel in formation

List prices, pre-tax. Enterprise-class engagements — banks and deposit-taking institutions, and organisations of regulated scale — are priced at 2.5× list, reflecting evidence-handling and assurance depth. A fixed fee is confirmed at scoping before any commitment.

How it connects

Two routes. You choose which.

Most examinations never touch your weights — but if moving them suits you better, that is a route we support, not a concession you make. Neither is the premium option; they answer different constraints and are priced differently.

Route A · the default

Your endpoint

You provide an endpoint — hosted, on your own cloud, or behind your own firewall — and attest its decoding configuration. The battery exercises that endpoint and nothing else.

No weights copied, no training data requested
Prompts and responses cross the interface and are handled under the published evidence policy — nothing else moves
Credentials exchanged only under signed NDA, after scoping

Fastest · nothing to ship

Route B · by your election

We host the weights

You ship weights or a repository reference. We provision isolated, encrypted capacity, examine, and then attest destruction. Chosen when there is no servable endpoint, or when the model is unreleased.

Isolated, encrypted, single-tenant capacity
Documented chain of custody end to end
Attested destruction on completion
Priced per delivery route in the service matrix — custody included as noted there; hosted infrastructure is estimated at scoping and passed through at actual cost

For unreleased or endpoint-less models — air-gapped follows on the roadmap (A7)

We will never ask you to move weights you would rather keep. Route B exists because some models have no endpoint to point us at — not as leverage, and not as a condition of being examined properly. Both routes produce the same sealed report under the same gates.

Operationally these resolve into five delivery routes — A1 client API, A2 via VPN, A3 managed cloud, A4 registry pull, A5 direct transfer — with four more on the roadmap or proposed. The service matrix lists every route with its status, ceiling, and price.

For air-gapped environments — a post-launch roadmap route (A7) — the battery will run entirely inside your network. To obtain a seal under that route, the examination manifest hash and result digest cross the gap by controlled offline transfer — on media your side moves, under your procedures — and the signature and RFC 3161 trusted timestamp return the same way. That round trip is not a licensing leash. It is the reason the seal means anything: the signature comes from a party other than the one being examined.

Installed Runner — in active development. The battery as software executing entirely inside your perimeter — on-premises and air-gapped — is on our post-launch roadmap and will be offered in usage terms suited to institutions of every type and size. Enterprise and sovereign buyers with self-hosting requirements are welcome to register interest at scoping.

How an examination is anchored

The examination is anchored twice — at open under RFC 3161, and again at close, bound to the core record. The opening commitment binds the protocol version, metric definitions, trial counts, the scoring-implementation digest, the prompt-set commitment, the randomness-selection algorithm, the configuration, the exclusion rules and the named operators; the closing commitment binds the ordered firing records, the response evidence digests, the classifier outputs, any human adjudications, errors and retries, and the result manifest. Where a certifying grade is sought, the selection draw is chained to a public randomness beacon pulse, corroborated against the League of Entropy, and published only after close, so the draw is unpredictable at commitment time for every party including us.

Receipts travel in the result container, never inside the anchored artifact. Externally anchored bytes are immutable at the moment they are anchored, so an artifact cannot contain its own receipt — anything claiming otherwise was assembled after the fact.

The full method — every formula, threshold and commitment — is published. Read the method →

Scope · what the seal covers

What an examination establishes

The declared scope: Behavioural measurements of the configured endpoint — a black-box model at an attested decoding configuration — observed during the examination window, on the dates stated. Every rate on the scorecard traces to a specific, fully disclosed firing, and carries a time-uniform (anytime-valid) upper confidence bound — a confidence sequence, valid at every firing, not a fixed-sample interval — computed at the allocated per-process error budget (one-sided ≥ 99.6875% for rate-ceiling gates; one-sided 95% Clopper–Pearson for zero-tolerance gates, at their predeclared fixed sample size — the two bound families are never substituted for one another).
Evidence grade, separately: Every report carries an evidence grade, E1 to E4; a letter grade is issued only where the evidence supports certification-grade reliance — never on E1. They measure different things: the letter grade measures the score; the evidence grade measures how much the evidence is worth. Where the evidence ceiling rules a letter out, the report says so on its face rather than leaving you to infer it.

Scope · what the seal does not cover

What it does not establish

Outside the declared scope: Application-layer behaviour — RAG pipelines, tools, UI, guardrails

Deployment properties — tenant isolation, logging, availability

Organizational governance or human-oversight effectiveness

Legal conformity, or certification of any kind
Why we print this here: A limit disclosed in the body is a limit a reader can act on; a limit buried in a footer is one they discover afterwards. Findings are potential evidence contributions, subject to applicability analysis — they are not a verdict on your company, and no report converts into a compliance certificate by being cited as one.

01Register the endpoint

02Attest the configuration

03Fire the battery

04Receive a sealed report

Special engagement / Separate from the catalog

Independent Agent-Control Pilot

US$15,000 pre-tax. One model-and-agent configuration, up to four agreed control families, methods and evidence, and one bounded correction retest. Compute/API costs require a separately approved cap.

A scoped examination, not full production certification. The statement of work fixes cases, repetitions, call limits and delivery targets before execution.

Explore the pilot See retained results

Services & pricing

One matrix. No hidden arithmetic.

Choose the depth first — that is the assurance. Then choose the route — that is the logistics, and it sets the evidence ceiling. Every figure below is a list price in USD, pre-tax and directional: a fixed fee is confirmed at scoping, before any commitment, and we expect scoping to confirm a price, not renegotiate one. A cell without a price is not an oversight — it is a combination we do not operate, printed rather than hidden.

*All prices are in United States Dollars.

Prefer one decision at a time? Configuration Simplified walks battery → route → commitment → class step by step and prepares the scoping email for you.

Status

● Operational — orderable today at the list price shown

◆ Operational, quoted — delivered today; priced at scoping

○ Roadmap — in active development; register interest

▲ Doctrine-gated — designed; not sellable until doctrine lands

Evidence grades

E1 · endpoint evidence. The battery fires your endpoint; no weight digest is captured. The sealed report is non-certifying: no letter grade and no overall score anywhere in the sealed document — descriptive numerics travel as a separately authenticated companion artifact, numbers only.

E2+ · digest-captured evidence. The instrument hashes the weights at intake — a provenance prerequisite for certification, nothing more: certification additionally requires Battery III's human-adjudicated bound and certifying trial depth. Batteries I and II issue no letter grade on any route — E2+ on Battery I or II is non-certifying.

The full E1–E4 scale is defined on the method page; every report states its own grade on its face.

Classes & gates

Classes are the behavioural categories whose scored measures are weighted into the composite — ten classes carry score weights (C1, C4–C9, C13–C15); C2 and C3 are gate-only and never averaged into the score; C10 is reported, never weighted; C11 lives in the Governance Dossier Review; C12 is quality control on the battery itself — how strong a result is. Coverage is measured separately over the full twelve-class predeclared scope.

Gates are ten non-negotiable floors on individual metrics, sitting across nine classes — decided separately, on each metric's own evidence. Any single gate failing voids the composite outright. A gate can never be cleared by a strong average elsewhere.

Examination pricing — battery depth × access route · list prices, USD, pre-tax, per examination · routes A6 onward are forthcoming and open as they become operational
Examination	A1 · Client API	A2 · API via VPN	A3 · Managed cloud	A4 · Registry pull	A5 · Direct transfer	A6 · On-prem	A7 · Air-gapped	A8–A9 · Enclave / escrow	A10 · BYO
Battery IScreening · monthly / per release candidate Scope & invoice description Five examination classes — C1 Truthfulness & Fabrication; C2 Security & Adversarial Robustness; C3 Privacy & Data Protection; C4 Safety & Harm Prevention; C8 Reliability & Consistency — ten scored metrics including three non-negotiable gates (jailbreak success, PII incidents, under-refusal on critical harm) and six key risk indicators. Deliverable: one sealed, independently verifiable Assurance Examination Report with applied-doctrine rationale, exhibits, and RFC 3161 time-anchoring; lifetime free seal verification included. Terms: sold per examination; prepayment in full prior to execution (Terms of Service, Schedule A).	$850● E1 · non-certifying	$1,000● E1 · non-certifying · network onboarding incl.	$1,000● E1–E2 · E2 if self-deployed · IAM onboarding incl.	$1,200● E2+ provenance · non-certifying · custody incl.	$1,400● E2+ provenance · non-certifying · highest custody	—○ roadmap · register interest	—○ roadmap · register interest	—○ proposed	—▲ doctrine-gated
Battery IIStandard Assurance · quarterly Scope & invoice description Thirteen examination classes — the five core classes of Battery I plus C5 Human-Interaction Causality; C6 Fairness & Bias; C7 Transparency & Explainability; C9 Misinformation & Societal Impact; C12 Evaluation Integrity & Meta-Gaming; C13 Societal & Anthropological Impact; C14 Claim Integrity & Capability Verification; C15 Child & Developmental Suitability — 31 scored metrics, 10 gate metrics, 12 key risk indicators. Deliverable: one sealed, independently verifiable Assurance Examination Report; lifetime free seal verification included. Terms: 50% deposit at scoping sign-off, balance prior to execution (Schedule A).	$4,500● E1 · non-certifying	$5,000● E1 · non-certifying · network onboarding incl.	$5,000● E1–E2 · E2 if self-deployed · IAM onboarding incl.	$5,500● E2+ provenance · non-certifying · custody incl.	$6,000● E2+ provenance · non-certifying · highest custody	—○ roadmap · register interest	—○ roadmap · register interest	—○ proposed	—▲ doctrine-gated
Battery IIIAttestation Grade · annual / on material change Scope & invoice description Everything in Battery II, plus a human-adjudicated classifier-sensitivity bound (blinded, dual-rated, reliability-scored adjudicators), control-by-control framework mapping, a full evidence pack, and named reviewer sign-off; the certifying selection draw is chained to a public randomness beacon, unpredictable at commitment for every party including us. The only battery that can issue an attested pass. Requires an E2+ route and certifying trial depth; orderable at scoping, delivered when the independent adjudication panel stands. Statistical delivery limitation (current): at the published 15,000-attempt deep-probe cap, certification against the deepest (0.1%) rate ceilings is arithmetically out of reach — the certifying floor is 20,698 matched trials. Battery III today is therefore an eligibility-to-scope engagement: the full battery, adjudication and evidence pack are delivered, and the attested pass becomes executable when the cap/ceiling doctrine decision lands (tracked publicly on the method page). Independent adjudication panel costs are estimated at scoping and passed through at actual cost. Terms: 50% deposit at scoping sign-off, balance prior to execution (Schedule A).	—cannot certify at E1 — we will not sell a ceiling you did not ask for	—cannot certify at E1 — we will not sell a ceiling you did not ask for	$8,000● E2 only if self-deployed · certifying-eligible · deep pass not presently executable (cap)	$8,000● E2+ · certifying-eligible · deep pass not presently executable (cap)	$8,000● E2+ · certifying-eligible · deep pass not presently executable (cap) · highest custody	—○ roadmap · certifying-eligible when it ships	—○ roadmap · certifying-eligible when it ships	—○ proposed · certifying-eligible	—▲ doctrine-gated

Enterprise-class engagements — banks and deposit-taking institutions, and organisations of regulated scale — are priced at 2.5× list, reflecting evidence-handling and assurance depth. Cadence commitments: three-month — first examination at list, months two and three at 10% off; six-month — 10% off the entire package, prepaid in full. Re-examination after remediation: same battery, same route, 10% off list within 60 days. Route prices include the route's one-time onboarding or custody fee as noted; hosted infrastructure on the weight-custody routes (A4–A5) is estimated at scoping and passed through at actual cost (Terms A.6) — nothing else is added.

Access routes — how the battery reaches the subject · the route sets the evidence ceiling; nothing downstream raises it
Route	What you provide	Weights move?	Ceiling	Status
A1 · Client API	Endpoint URL + key (key only under NDA, out of band)	No	E1	● sell now
A2 · API via VPN	Endpoint + network access (VPN / peering / allowlist)	No	E1	● sell now
A3 · Managed cloud	IAM role on your Vertex / Bedrock / Azure project	No	E1–E2	● sell now
A4 · Registry pull	Read grant on private HF repo / GCS / S3 (or OCI image)	Yes — we pull, hash, attest destruction	E2+	● sell now
A5 · Direct transfer	Weights uploaded to our secure bucket	Yes — strongest chain of custody	E2+	● sell now
A6 · On-prem runner	Infrastructure + licence — the battery executes inside your perimeter	No	E2+	○ roadmap
A7 · Air-gapped runner	As A6 with no network path at all; offline seal tokens in blocks	No	E2+	○ roadmap
A8 · Enclave transfer	Weights encrypted into a hardware enclave (TDX / SEV-SNP / CC) on our capacity	Yes — never in the clear outside the enclave	E2+	○ proposed
A9 · Escrowed examination	Weights deposited with a neutral escrow agent under tripartite agreement	To escrow, never to us	E2+	○ proposed
A10 · Client-attested digest	Endpoint + your signed weight digest (organisational key)	No	E1+ (new tier)	▲ doctrine-gated
BYO · Self-fired completions	You fire our probe corpus; we classify, score, seal — under a distinct watermarked artifact class	No	score-only	▲ doctrine-gated

Alongside the examinations — verification, seal services, advisory, programs
Service	What it is	Status	Price
Verification	Anyone checks a seal — authenticity for general requestors; the record for verified authorities.	● operational	Freeforever · never metered · regulators never charged
Supervisory access	Regulators: unlimited verification, confirmations, viewer seats.	● operational	Freenever invoiced
Developer sandbox	Unsealed runs, watermarked NOT AN ASSURANCE ARTIFACT.	● operational	FreeA1–A3 engagements
Confirmation of Seal	A dated, logged, counterparty-addressed record with explicit scope and validity window — single, pack, or standing.	● operational	$95single · 10-pack $600 · 20-pack $1,000 · enterprise $650 / $5,000 / $9,000
Re-seal / re-issue	Same evidence, fresh signature on key rotation.	◆ quoted	Quotedat scoping
Governance Dossier Review	EU AI Act Art. 9 risk management · Art. 14 human oversight · Art. 10 data governance · Art. 72/73 post-market monitoring. Audit-ready advisory memorandum & gap matrix.	● operational	$2,500fixed · enterprise $6,250 · separate line item
Proof of value	60 days · two endpoints · up to four sealed examinations; each follows its per-route price.	◆ quoted	Quotedat scoping
Professional services	Onboarding & framework mapping · custom battery development · training & enablement · regulatory response support.	◆ quoted	Quotedonboarding waived above $500k first-year commitment
Academic licence	Academic Battery II under a non-transferable ACADEMIC seal class — prevents resale as commercial assurance.	◆ quoted	QuotedA1–A3 routes
Installed Runner	Routes A6/A7 productised: Node / Site / Sovereign licences, battery maintenance, seal token blocks for air-gapped redemption.	○ roadmap	TBDlicensing terms in design · enterprise & sovereign buyers welcome at scoping

Returning for another examination?

Exposure accounting is a proposed standard admission gate. For repeat standard-service engagements, the scope should distinguish regression on previously used cases from a fresh examination on separately reserved, validated material, or specify both. Related model versions and customer exposure matter; a new name does not reset history.

An offline prototype is fixture-tested; live integration is pending. Exposure limitations affect what the evidence supports, not the model's canonical score. Published service entitlements and fees remain unchanged; additional fresh examination work is agreed at scoping.

How repeat-examination evidence is distinguished · Repeat-testing FAQ

01Choose the depth

02Choose the route

03State your claims

04Fixed fee at scoping

If your model claims something, we assess whether each declared claim can be tested within the agreed scope — then test what can be, and report what cannot as unverified.

Specimen examinations

Read a specimen before you buy one.

Historical reports produced by the battery over simulated demonstration data, marked DEMONSTRATION throughout. Two of the five are blocked. These examples show earlier diagnosis and disclosure formats; they are not templates for a current commissioned examination.

Legacy examples — current replacements pending. Produced under doctrine prior to v3.3.0, these unsigned demonstration downloads contain a superseded certification floor and statistical method. The two blocked originals also display a historical letter grade that is not valid under the current no-letter rule. Each download now includes a first-page explanation and a LEGACY banner on every historical page. Original content is preserved, not recalculated. No real model was examined, and no specimen is a seal. Read the current method for current requirements.

New public methods guide. Explore purpose-built synthetic examples and measurement explanations, with a four-page PDF. Unsigned; no model run; not a certificate or a replacement for the legacy examination specimens below.

№ 01Detected stream only

The Exemplar

specimen exemplar · downloads as atbae-specimen-exemplar-legacy-notice-2026-09-13.pdf · PDF with historical-use notice · demonstration report · simulated data · unsigned · LEGACY

In this historical simulation, clears every gate with margin to spare. The statistical annex discloses the underlying uncertainty: zero observed breaches across seven hundred trials still consumes ninety-seven percent of the permissible risk ceiling on the confidence bound alone.

Historical descriptive score 99.2 · non-certifyingRead the historical report →

№ 02Detected stream only

The Contender

specimen distinction · downloads as atbae-specimen-distinction-legacy-notice-2026-09-13.pdf · PDF with historical-use notice · demonstration report · simulated data · unsigned · LEGACY

Strong across all thirteen classes, and the descriptive band holds on every one of twelve runs. Reliability and consistency is where the points went, not safety.

Historical descriptive score 96.8 · non-certifyingRead the historical report →

№ 03Detected stream only

The Capable

specimen standard · downloads as atbae-specimen-standard-legacy-notice-2026-09-13.pdf · PDF with historical-use notice · demonstration report · simulated data · unsigned · LEGACY

Clears every gate in the detected stream, with one finding named — and the descriptive band is not reproducible: five of twelve runs land a band lower, and the confidence interval crosses the boundary. The report says so plainly.

Historical descriptive score 90.6 · non-certifyingRead the historical report →

№ 04Block

The Middling

specimen median · downloads as atbae-specimen-median-legacy-notice-2026-09-13.pdf · PDF with historical-use notice · demonstration report · simulated data · unsigned · LEGACY

Blocked on integrity gates. The composite is void the moment a gate fails — but the diagnosis is not, and neither is the remediation map.

Blocked · 7 of 10 gates breached · legacy grade supersededRead the historical report →

№ 05Block

The Pretender

specimen deficient · downloads as atbae-specimen-deficient-legacy-notice-2026-09-13.pdf · PDF with historical-use notice · demonstration report · simulated data · unsigned · LEGACY

Eight of ten release gates breached — fraudulent invoices drafted, capability overstatement accepted, a child-safety boundary lapsed. Every failure is diagnosed, evidenced and bounded, down to the exact trial count behind each rate.

Why we publish this one An assurance instrument that never issues a block is not an assurance instrument. We publish our failures to prove the gates are immutable — that they are not negotiated with, and that a bad result is reported as a bad result rather than softened into a score.

Blocked · 8 of 10 gates breached · legacy grade supersededRead the historical report →

Current rule: non-certifying results receive no letter grade

A non-certifying verdict carries no letter grade and no overall score anywhere in the sealed document. Where issued, descriptive numerics — numbers only, never a grade or a label — reside in a separate companion artifact with its own integrity hash, stripped before the report is hashed. Separate authentication is established through verification of the companion's own manifest and signatures, and confers no certification. The companion references the report by hash; it is never an entry in the report's signed manifest. A grade appended to a non-certifying result creates a severe misrepresentation risk — it invites the reader to conflate an unanchored score with a verified result. We remove the temptation rather than police it.

A full CERTIFIED PASS — our internal verdict label within this examination scheme, not a statutory certification, accreditation or legal-conformity attestation — additionally requires a human-adjudicated classifier-sensitivity bound, selection chained to a public randomness beacon, and dual adjudication whose disagreement is added to the bound. Undeclared deployment surfaces are ineligible. Each report states its own conditions on its face.

Verification

Anyone can check a seal. Free, forever.

Two levels of disclosure

Verification is free for everyone, always. What differs is how much comes back — and that depends on who is asking, which is why the checkpoint asks you to say. Requests are authenticated — never anonymous — and we log exactly what is checked, by whom, and when, under the retention schedule in the privacy policy.

Standard · general requestors

Authenticity, nothing more

Whether the seal is genuine
The examination date or dates
The subject model identifier recorded at firing
Checked against the signed revocation list — a genuine seal on a revoked report returns revoked, never clean

Never returns results, grades or findings

Regulatory · verified authorities

The record, for those with standing

The examination outcome
The commissioning party
The scope of examination
Released only after registry validation, letterhead, official-domain, switchboard-callback and administrative confirmation, with dual-person approval and an immutable disclosure log

Free · days, not hours · no fixed turnaround

Open the verification checkpoint

Free forever · regulators and supervisory authorities never charged

Independent key channel

Every ATBAE manifest carries two independent signatures from our signing station — classical Ed25519 and post-quantum ML-DSA-65 (FIPS 204) — and is independently time-stamped under RFC 3161. Both key fingerprints are published on the checkpoint page — on this website, separate from any signed package — so they never travel solely inside the document they authenticate. A signature whose fingerprint differs from that page is not ours, whatever the package claims. Manifests sealed before 2026-08-31 carry classical signatures only and are never silently retrofitted.

Verification is not a revenue line and never will be. A seal only means something if the person relying on it can check it. Identity is declared and verified so that disclosure matches standing — it is authenticated, not harvested, and we do not tell the commissioning client who asked unless they elected Verification Transparency. Where a regulator lawfully directs us to withhold notice, we comply unconditionally.

What we charge for is a Confirmation of Seal — a dated, logged, counterparty-addressed record with an explicit scope and validity window, of the kind a vendor-risk team can put in a file.

Commission an examination

State your model's declared capabilities —
we will structure the examination with appropriate rigor.

Scoping is a bilateral technical consultation, not an automated form. Tell us the endpoint, the decision your model informs, and the framework you answer to. Quiet, infrequent replies — no marketing, ever.

Open the intake form The product floor →

Risk coverage · research development

What an AI attempts matters. So does what the evidence establishes.

Our private expanded engine now includes synthetic workflow examinations and local control specimens addressing action authority, privacy, delegation and changing permissions. These development results do not extend earlier reports or the published certification gates.

Explore the risk connections, implementation status and remaining examination gaps →