# An open letter on checking the machines

To people and institutions across the United States, and to anyone anywhere who
faces the same problem.

AI systems are moving into the decisions that carry the most weight. They help
price loans, read scans, flag security threats, sort legal filings, grade student
work, and now they help run the labs that build the next systems. The pace is real
and still climbing. What has not kept up is any dependable way to hold a machine's
output accountable after the fact.

When a model produces an answer that affects someone's money, health, freedom, or
safety, the person on the receiving end usually cannot check it. They have to trust
whoever ran the model. That arrangement worked better when the parties trusted each
other, and we are past that point. Institutions distrust each other. The public has
lost faith in them. The tools stay opaque even to the people who deploy them.
Capability ships every week while the means to check it lags behind.

So the question underneath all of this is narrow and old. Can you check a result
without trusting the party who produced it? For most AI-assisted work today the
honest answer is no, and that gap is where the harm collects.

I want to describe one mechanism that helps, and I want to be careful about its
limits.

Call it re-derivable verification. An accepted result should carry a receipt. A
skeptic should be able to take that receipt to their own machine and reach the same
verdict by re-running the recorded check, offline, without contacting you and
without trusting you. No learned model sits on the path that decides what passes.
The thing that accepts an answer is a real check: a test that runs, or a data-only
certificate that recomputes. The receipt records what was checked and the values
involved. An independent party feeds it to their own witness and gets one of three
outcomes. The verdict matches, it has drifted, or it cannot be verified.

A verdict a stranger can reproduce offline survives the failures that break
trust-based review. A captured auditor cannot fake a verdict that a skeptic re-runs
for themselves, and neither can a self-interested lab or a government. The property
holds regardless of who holds the result: given the same check, the same evidence,
and the same stated assumptions, a correct implementation returns the same verdict
for any actor, company, lab, or nation. Regulatory capture and conflict of interest
are the failures it is proof against, because the reward for being right is a verdict
anyone can repeat, and there is nothing to gain by lying about one.

I have built this into a working tool so it is not only an argument. It is called
Flywheel, and the engine installs with `pip install flywheel-verify`. It runs an AI
task with any model you choose, local or hosted, behind one common surface, and it
runs a permission-gated coding agent over your own folders. Every accepted answer
emits a proof receipt, and an independent witness re-runs the recorded check offline
and recomputes the hash for a match, drift, or unverifiable verdict. It is
source-available, and the whole loop runs on your own machine. I would rather people
try to break the receipts than take my word for any of this.

The limits matter as much as the mechanism. A receipt proves that a check
reproduces. It does not prove that an answer is true of the world. A weak check
makes a weak receipt. Re-derivable verification moves the question from whether you
trust the producer to whether you trust the check, which is progress only where the
check is public and meaningful. It is not a capability claim. On my own benchmark
the verified loop shows no measured accuracy gain over a single pass, and the
interval includes zero. What I can defend is the reproducible receipt and the
containment around what the tool is allowed to do. A more accurate answer is the direction
this kind of mechanism points at, and it is not something I am claiming here. This
work is aimed at accountability, not at making models more capable of harm, and it
does not extend to domains where building the capability is itself the danger.

The research world is living this failure right now. Conferences are taking in tens
of thousands of submissions, many machine-written, reviewed under time pressure by
people who are themselves leaning on machines. A reviewer wrote recently that an
AI-drafted paper had a real idea buried in it but was communicated too poorly to
accept, and that whether a paper earns acceptance is a human judgment no receipt can
make for you. That is exactly right, and it marks the boundary. What a receipt can
do is take the checkable part off the reviewer's plate, the part that asks whether a
number reproduces or code runs to the result it claims, so their scarce judgment
goes to the part only a person can do. The common proposal of more machine review,
where the reviewer is itself an opaque model, only moves the trust problem somewhere
else.

The end I am working toward is larger than any one tool. It is trustworthy AI that
reaches ordinary people without asking them to trust a party they cannot inspect.
Work you can check is work you can trust and then walk away from, and that is the
point. The aim is to give people back their time, not to capture it. A relationship
with these systems should leave a person secure, not anxious.

What I am asking for is modest. Where AI assists public work, in courts, agencies,
hospitals, elections, and the safety evaluations that labs publish about their own
systems, make a re-derivable check part of the floor a result has to clear. A floor
is not the whole answer, and I am not pretending it is. Where a check cannot be made
public or meaningful, say so plainly rather than paper over it. And when an
AI-assisted result reaches you and carries weight over someone's life, ask for the
receipt, re-run the check yourself, and keep the honest limits in view while you do.

None of this belongs to one country or one company. The problem is shared by anyone
whose decisions are about to be shaped by systems they cannot inspect. I am one
independent person, building in the open, and my own tools are small against the
size of the problem. The idea carries further than I can, and it needs no one's
permission to adopt.

Signed,

Zain Dana Harper

Zentropy Labs