Same confident voice.
One of these is invented.
A model says “I know this” and “I’m making this up” in identical words — and it can’t tell you which. Aperture reads underneath them and marks every answer on the map or off it.
A model that doesn’t know it’s wrong can’t warn you.
Ask a model about a company that never existed and it will give you a founder, a city, a year — in the exact voice it uses for the truth. It has no sense of its own blind spots, and it never flags when it’s reaching past them. That single gap — a confident fabrication you can’t tell from a real answer — is what keeps AI out of the rooms where being wrong has a cost: the agent that acts on the answer, the filing, the diagnosis, the trade. You can’t put a model in a loop you can’t trust.
We tested it against the truth — and published the misses.
The tools that caught us — public, and pointed at our own work first.
Photon is the model. The honesty toolbox is how anyone checks a model — ours or yours — with no GPU, no logprobs, and no cooperation from the model itself. The same surface floor that disqualified our own headline above is one file you can run in your browser, on your own benchmark.
8 of 14 published honesty benchmarks fail that floor — and four of them are ours, sitting at the top of our own table.
Every tool ships four things or it does not ship: a verdict, the break-test that would catch it lying, its own measured false-positive rate, and an offline replay a stranger runs with no call back to us. A tool that fails its own kill condition physically cannot show green.
Does a benchmark measure honesty, or string shape?
Binds every published number to a source. Fails closed.
Re-derive a signed verdict offline, one stdlib file.
Scores a manifest; refuses to hide our own failures.
curl -O honesty.tools/verifier/nulltest.py && python3 nulltest.py your_benchmark.json
Every verdict is re-derivable by you, offline, with one standard-library file and no trust in us. There is no external co-signer yet — that gap is named, not hidden.
It grounds what it can. Escalates what it can’t. Abstains rather than guess.
The default read is Photon, the honest orchestrator. A self-hosted 35B checks every entity against verified registries and answers what it can ground or is genuinely confident on — those reads are handled locally, at no frontier cost. Only the hard, unverifiable tail escalates to two independent frontier minds, which must agree or the read says so and abstains. The honesty isn’t one model that knows everything — it’s a router that knows what it doesn’t, anchored to the public record.
And the model it routes from — Photon Base, the 35B we self-host — we read deeper still: its activations directly, a weights-free probe of its own internal state that flags when it’s reaching past what it knows. One forward pass, nothing rewritten. the research →
Run it on your own hardware, grounded on your own facts.
And everything around the read.
sk-apt- key: POST /v1/verify grounds a claim and signs a receipt. Free to try — or run your own stack.We run it on ourselves.
Photon Base is our served flagship — carrying the lens, honest by construction. The off-map certificate runs live, read-only, on the served model — zero downtime. Not a slide — the instrument running on the model that’s answering you right now.
Don’t trust our check — run your own. The open verifier checks any receipt offline against the pinned key; the append-only Merkle log that would make a suppressed or swapped receipt third-party detectable is built and published, but not yet operating — no receipt is witnessed in a public log, there is no tree-head endpoint, and the root would be ours to sign; verify-session verifies a whole agent run — every receipt and the root over their order, so a dropped or reordered step is caught; and where a fixed rule settles the answer, a deterministic witness lets a stranger re-derive it offline. Provenance, not truth.
Put it between your model and what matters.