NOPE Forensics

Model forensics

We determine what an AI system did, what produced its output, and where its safeguards fail. Every claim ships with the evidence to reproduce it.

Discuss an engagement Read the standard

Scoped per engagement, with written limits and disclosure terms

From our own research, not a client engagement. Each entry below is a measurement technique we built and then tried to break. Five out of six broke. Every report we ship includes a list like this.

What didn't work from our own research

broke

Spot a hidden concept through its neighbors. If a model is told to avoid a word, do related words give it away? They did not, in any model we tested.

broke

Detect a banned topic from shifts in word choice. Banning an irrelevant topic shifted word choice just as much. All it shows is that a ban exists, not which topic.

broke

Compare what a model says about itself with what it does. The two looked disconnected. When we checked, our own scoring script was misreading the answers. Our error, not the model's.

broke

Read a model's emotional state from answer patterns. A different model matched the pattern better than the model's own inner workings did. It was generic, not a look inside the model.

broke

Catch a hidden belief with follow-up questions. Follow-ups measure what a model knows, not what it conceals. The technique quizzes the model; it does not read its mind.

held

Break crisis handling by making the AI a close friend. Some models started promising impossible in-person help to users in crisis. The failure survived five separate checks, including 40-turn conversations.

5 broke under our own tests · 1 held every row published

What we do

Attribution

What produced a given output. Model identification, authorship analysis, and AI-likeness scoring with published error limits. A signal, never a verdict about a person.

Provenance

Where a piece of content has been. Generation history, rewrites that disguise AI text as human, silent model swaps inside a conversation.

Behavioral reconstruction

What happened inside a conversation. Turn-by-turn rebuilds, where things escalated, and audits of what human or automated review caught and missed.

Safeguard assessment

Where defenses fail. Layer-by-layer testing of filters, refusals, and automated screening, measured across repeated runs, including the approaches that found nothing.

The standard

Written into every engagement, and applied regardless of what testing finds.

01 The scope, the methods, and when we stop, fixed in writing before testing starts.
02 Every positive claim checked against tests designed to prove it wrong.
03 Rates measured over repeated runs, with the spread between runs reported.
04 Failed approaches reported with the same detail as findings.
05 The automated judges that score results are checked against human reviewers.
06 Every claim traceable to raw evidence, stored so any later change would show.
07 Findings go to the affected vendor first. Engagement work is never published.
08 Reports describe structure and rates, never the harmful text itself.
09 When a system firmly refuses on a regulated topic, we record the refusal instead of working around it.
10 Forensic outputs carry their error limits. No verdicts about people.

Start with a written scope

Every engagement begins with objectives, methods, limits, and disclosure terms in writing. Contact us to draft one.

Scoped per engagement. We quote before any commitment.