Verified Is Not Trustworthy

There is a move we make constantly and rarely notice. A system verifies something (a signature checks out, a certificate is current, a backtest looks strong, a transaction is valid on-chain), and on the strength of that verification, we trust the thing. We treat the check and the trust as one act. They are not. A check confirms a narrow, technical fact. Trust is a claim about a much larger property the check does not actually establish. Most of the time the gap between them is harmless. Sometimes it is where the entire failure lives.

Over the past stretch I ran five adversarial reviews, each one taking the strongest honest case for an industry claim and testing it against the primary literature until it broke. They were meant to be independent: different sectors, different evidence, different experts. Financial-AI provenance. Modernizing mainframe COBOL with AI. Whether machine learning beats classical methods in markets. Whether DeFi is "trustless." Whether security certifications mean a vendor is secure. Five unrelated questions.

They broke in the same place.

Provenance. Regulators now require that the origin and lineage of a financial model be documented and auditable. The tooling can sign the bytes and name the signer, but it cannot witness that the training data was clean, and the enterprise platforms record lineage as ordinary, editable database rows. Documented is not verified.

COBOL. AI can translate the code, and the demos are real. But the hard part of moving a bank off a forty-year-old system was never translation: it is proving the new program behaves identically to the old one, with no written specification to check against, in a domain where a sub-penny rounding difference is a regulatory event. Translated is not equivalent.

Quant ML. Machine learning does add genuine value in specific market tasks. But "reliably beats classical methods" is inflated by costs that get quietly omitted, by edges (profitable advantages) that live in stocks too small to trade at size, and by the enormous number of model variants silently tried before one looks good. A strong backtest is not realized return.

DeFi. "Don't trust, verify" is the slogan. But cryptographic verification confirms a transaction is valid: it says nothing about whether the price feed was manipulated, the bridge validators were compromised, or three large holders control the governance vote. There is even a theorem: you cannot connect two blockchains without trusting some third party. Trust isn't removed; it moves somewhere less visible. Verified is not safe.

Enterprise security. A SOC 2 or FedRAMP certificate attests that described controls were tested over a past window, within a scope the vendor itself chose. Companies holding current certifications are breached regularly, often through the build pipeline the audit never looked at: the automated steps that turn source code into shipped software. Attested is not assured.

Five sectors. One shape: a verified-looking artifact mistaken for the property it is taken to warrant. Once you see it, you cannot unsee it. And the most striking part is that the last review closed back onto the first: the fix for un-inspectable software supply chains (reproducible builds, signed provenance you can re-check yourself) is the same mechanism the provenance review identified for regulated AI. It is one gap, not five.

There is also a way to close it, and it is the same move every time. Don't accept the artifact's self-report. Re-derive the property from evidence outside the thing that's claiming it. Account honestly for what you did and did not check. And give a three-valued verdict instead of a binary one: it matches, it drifts, or it cannot be verified, and never quietly fill that last case with a guess. Much of the harm in all five sectors comes from treating "cannot be verified" as "fine."

I want to be exact about what this is, because the work is about not over-claiming and would be a hypocrite otherwise. This is a research synthesis, not a proof. It is AI-assisted: research agents gathered and cross-checked sources in parallel; I did the synthesis, adjudicated the verdicts, and independently re-verified the load-bearing claims, and several first-pass claims were corrected or dropped along the way, which is the discipline working rather than failing. The strongest claim here (that these five are the same gap rather than five merely similar ones) I label as an argument, not a theorem. It is exactly as strong as its evidence, and no stronger.

The full corpus (five sourced reviews and a synthesis, with a SHA-256 manifest staking a dated claim on every file) is public:

• GitHub: github.com/HarperZ9/witnessing-spine
• Zenodo: 10.5281/zenodo.20778927

If it's wrong, that is the most useful thing you could tell me. It is built to be attacked.

Zain Dana Harper is an independent researcher in Seattle. This corpus is a companion to a longer philosophical argument, Conferred Existence, on the same theme: that nothing (a model, a market, a machine, or a person) carries its own warrant.  ↑ top