To people and institutions across the United States, and to anyone anywhere who faces the same problem.
AI systems are moving into the decisions that carry the most weight. They help price loans, read scans, flag security threats, sort legal filings, grade student work, and now they help run the labs that build the next systems. The pace is real and still climbing. What has not kept up is any dependable way to hold a machine's output accountable after the fact.
When a model produces an answer that affects someone's money, health, freedom, or safety, the person on the receiving end usually cannot check it. They have to trust whoever ran the model. That arrangement worked better when the parties trusted each other, and we are past that point. Institutions distrust each other. The public has lost faith in them. The tools stay opaque even to the people who deploy them. Capability ships every week while the means to check it lags behind.
So the question underneath all of this is narrow and old. Can you check a result without trusting the party who produced it? For most AI-assisted work today the honest answer is no, and that gap is where the harm collects.
I want to describe one mechanism that helps, and I want to be careful about its limits.
Call it re-derivable verification. An accepted result should carry a receipt. A skeptic should be able to take that receipt to their own machine and reach the same verdict by re-running the recorded check, offline, without contacting you and without trusting you. No learned model sits on the path that decides what passes. The thing that accepts an answer is a real check: a test that runs, or a data-only certificate that recomputes. The receipt records what was checked and the values involved. An independent party feeds it to their own witness and gets one of three outcomes. The verdict matches, it has drifted, or it cannot be verified.
A verdict a stranger can reproduce offline survives the failures that break trust-based review. A captured auditor cannot fake a verdict that a skeptic re-runs for themselves, and neither can a self-interested lab or a government. The property holds regardless of who holds the result: given the same check, the same evidence, and the same stated assumptions, a correct implementation returns the same verdict for any actor, company, lab, or nation. Regulatory capture and conflict of interest are the failures it is proof against, because the reward for being right is a verdict anyone can repeat, and there is nothing to gain by lying about one.
I have built this into a working tool so it is not only an argument. It is called Flywheel, and the engine installs with pip install flywheel-verify. It runs an AI task with any model you choose, local or hosted, behind one common surface, and it runs a permission-gated coding agent over your own folders. Every accepted answer emits a proof receipt, and an independent witness re-runs the recorded check offline and recomputes the hash for a match, drift, or unverifiable verdict. It is source-available, and the whole loop runs on your own machine. I would rather people try to break the receipts than take my word for any of this.
The limits matter as much as the mechanism. A receipt proves that a check reproduces. It does not prove that an answer is true of the world. A weak check makes a weak receipt. Re-derivable verification moves the question from whether you trust the producer to whether you trust the check, which is progress only where the check is public and meaningful. It is not a capability claim. On my own benchmark the verified loop shows no measured accuracy gain over a single pass, and the interval includes zero. What I can defend is the reproducible receipt and the containment around what the tool is allowed to do. A more accurate answer is the direction this kind of mechanism points at, and it is not something I am claiming here. This work is aimed at accountability, not at making models more capable of harm, and it does not extend to domains where building the capability is itself the danger.
The research world is living this failure right now. Conferences are taking in tens of thousands of submissions, many machine-written, reviewed under time pressure by people who are themselves leaning on machines. A reviewer wrote recently that an AI-drafted paper had a real idea buried in it but was communicated too poorly to accept, and that whether a paper earns acceptance is a human judgment no receipt can make for you. That is exactly right, and it marks the boundary. What a receipt can do is take the checkable part off the reviewer's plate, the part that asks whether a number reproduces or code runs to the result it claims, so their scarce judgment goes to the part only a person can do. The common proposal of more machine review, where the reviewer is itself an opaque model, only moves the trust problem somewhere else.
The end I am working toward is larger than any one tool. It is trustworthy AI that reaches ordinary people without asking them to trust a party they cannot inspect. Work you can check is work you can trust and then walk away from, and that is the point. The aim is to give people back their time, not to capture it. A relationship with these systems should leave a person secure, not anxious.
What I am asking for is modest. Where AI assists public work, in courts, agencies, hospitals, elections, and the safety evaluations that labs publish about their own systems, make a re-derivable check part of the floor a result has to clear. A floor is not the whole answer, and I am not pretending it is. Where a check cannot be made public or meaningful, say so plainly rather than paper over it. And when an AI-assisted result reaches you and carries weight over someone's life, ask for the receipt, re-run the check yourself, and keep the honest limits in view while you do.
None of this belongs to one country or one company. The problem is shared by anyone whose decisions are about to be shaped by systems they cannot inspect. I am one independent person, building in the open, and my own tools are small against the size of the problem. The idea carries further than I can, and it needs no one's permission to adopt.
Signed,
Zain Dana Harper
Zentropy Labs