Proven
Demonstrated by a replayable witness — the finding reproducibly holds. Re-run the witness and it lands again.
●SELF-SERVE DETECT — THE FREE WEDGE
Point it at a finetune
before you trust it.
Name an open-weight finetune. Protora returns the read: which recipe produced it, how it differs from its base, and — the one that matters — whether it introduced any behavior its description never mentions. Each finding carries a replayable witness; where it can’t prove something, it abstains.
STAGED · THE FREE WEDGE
Point it at a finetune before you trust it — a witnessed read of what it did, with an explicit abstain for what it couldn’t prove.
STAGED●WHAT IT IS
A witnessed read of what
a finetune actually did.
A builder names an open-weight finetune (or uploads one), optionally names a base or a sibling to compare against, and Protora returns the read: the findings, the per-finding witnesses, and the abstain list. Nothing is asserted that cannot be proven.
Self-serve is being built — the surface below is staged. What Protora already does, and what it proved this cycle, is real; the deepest version of this read is open now as an audit.
- The safety-strip check — whether the finetune’s safety was removed, read from the weights without eliciting any harm. Witnessed. On the most-finetuned open bases (Qwen and Llama today).
- The recipe fingerprint — what kind of finetune this is, witnessed, calibrated per base family.
- The comparison — how it differs from its base, or from another finetune. Witnessed.
- Undisclosed-behavior findings — anything it introduced that its description doesn’t mention.
- Per-finding witnesses — click any finding to see its replayable artifact.
- The abstain list — every finding Protora would not make, with a reason.
- Calibrated confidence — inferred findings labeled as inference, never shown as proven.
●THE DISCIPLINE, MADE CONCRETE
Three verdicts. No fourth.
Every read sorts into one of three states, and the boundary between them is the whole product. The honesty is the point: Protora tells you what it proved, what it suspects, and what it won’t claim.
Inferred
Ranked suspicion, followed with calibrated confidence. Labeled as inference — never dressed up as proven.
Abstain
Cannot be proven, so it is stated explicitly, with a reason. Never a manufactured finding to look thorough.
●PROVEN THIS CYCLE
Two self-serve reads carry
a graded receipt.
Small batteries, mechanism-proven; broader coverage staged. Each figure below carries its own coverage stamp — and where a claim would exceed what was measured, it isn’t made.
The safety-strip check — read from the weights, harm-free
● CAUGHTPoint Protora at a finetune and it will tell you whether its safety was removed (“abliterated”) — read directly from the weights, without ever eliciting a harmful response from the model, and architecture-robust. It caught real public abliterated releases on both Qwen and Llama, and did not false-fire on benign finetunes or on an adversarial finetune built to look like the tampering.
0.92–0.96refusal rate,
before0.00refusal rate,
after the strip — caught
before0.00refusal rate,
after the strip — caught
Controls held: benign finetunes and the adversarial look-alike did not fire. Witnessed strikes live in the public record.
●RED-TEAM — WE STRESS-TESTED OUR OWN CHECK
The first-shipped check was attacked by someone who knows the detector and engineers a safety-strip to slip past it — and one real evasion was found. It was then hardened to key on a property intrinsic to the tampering itself, not a surface artifact an attacker can mask. The hardened check catches that evasion class and adaptive combinations of it, still false-fires on none of the benign controls, and still fires on real tampering.
Residual gaps, named — not hidden: a fully adaptive attacker who tunes specifically against the hardened check, and certain unusual tampering patterns, remain tested-not-yet-closed. We keep red-teaming the shipped detector and publish what still gets through. Owning the evasions is the same discipline as owning the misses.
The deep-pass receipts — held-out behavior prediction, and the reference/differential backdoor read — live with the audit + dossier, the signed version of this read.
●WHY IT’S FREE TO CHECK
Capped on volume.
Never on trust.
Self-serve detect is the adoption and content engine — free to check, so it turns “should I run this finetune?” into a habit, and habit into published detections that feed the public record. The deeper, signed reads live up the ladder — audit, monitoring, excise, drift guard — where a team needs to trust, or fix, a model it ships.
Free to check
- Full witnesses — every finding replayable
- Full abstain honesty — nothing hidden
- Full fidelity — the same read, not a lite one
- Capped on volume / model size — never on trust
THE CAP IS ON HOW MUCH · NEVER ON WHETHER IT’S TRUE
Audit + dossier
- The deepest detect pass on one model, at full depth
- The signed compliance dossier + abstain register
- Open now — a repeatable, signed engagement
Self-serve is staged — this describes what it will offer when it opens, not something available today. The deepest version of the read is open now as an audit.
○EXPLICITLY OUT OF SCOPE
What it is not.
It reads a finetune and tells you, with proof, what it did — or abstains. It is not a thing that scores, hosts, or chats.
- Not a benchmark leaderboard.
- Not a fine-tuning platform.
- Not a model host / inference API.
- Not a chatbot-about-your-model.
The finetune you just
downloaded — what did it do?
Self-serve is staged. The read is already proven — and its deepest, signed version is open now as an audit. Bring one finetune; Protora will tell you what it did, prove it, and name plainly what it couldn’t prove.
Every engagement is scoped per case and quoted per offer — tell us what you need, and we’ll scope it and send you an offer.