Feb 1, 2026

Global AI Safety Notary: A Decentralised Protocol for International AI Incident Reporting

Augusta Lina, Caleb Rudnick, Dennis Kiptanui

Global AI Safety Notary is a decentralised incident reporting platform that creates immutable, verifiable records of AI safety incidents on the blockchain. Built on the Ethereum Attestation Service (EAS), the platform enables researchers, developers, and organisations to report and track AI failures, including bias, hallucinations, safety violations, and data leaks, with full transparency and accountability.

The Problem:

International AI governance suffers from a fundamental trust deficit. Nations are reluctant to report AI safety incidents to centralised bodies controlled by potential adversaries, creating dangerous information silos where critical safety lessons go unshared.

Key Features:

- Immutable Incident Records: Every report is stored as an on-chain attestation on Ethereum Sepolia, ensuring records cannot be altered or deleted

- Structured Reporting: Multi-step form capturing incident type, severity (1-5), model identifier, organization, location, and detailed descriptions

- Searchable Registry: Browse, filter, and search all reported incidents by type, severity, or keywords

- Blockchain Verification: Direct links to EASScan for independent verification of attestation data

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow
Arrow
Arrow

I wanted to hate this because I think defi is terrible and its technical challenge landscape snipes people too easily, but i'm actually sympathetic about using ethereum in this context. Sovereignty/neutrality seems like an upside (tho its a little misleading how much distributed consensus actually buys you here), transparancy, attestations, and availability are I think table stakes and ethereum has some natural ways into this. I just think immutability is a very blunt weapon to deploy against a threat model that shouldn't be much of a priority. Normal reputation and law should I think catch someone trying to falsify a record, meanwhile immutability has a lot of downsides (mainly that it tempts you to interact with defi or any chain at all, which is corrosive to your goals / invites grifters and shitcoin-weather gamblers into the AI governance space).

Minor nitpicks:

- don't use "layer" terminology in figure 1 because l1 and l2 are technical terms in defi so there's a naming collision.

- This sentence "The user interface was styled using Tailwind CSS, enabling rapid development of a responsive, accessible design" was completely unnecessary: we know that UI design is trivially vibecodeable these days, it doesn't really matter to us the specific typescript or CSS library.

Setting aside my prejudice against blockchain, the execution is solid and thank you for actually building on an actual testnet. You also justify your arguments well, and zero in on the aspects of blockchain that are relevant to you, which I appreciated.

The project clearly explains how to use a verified method to securely share records of incidents. However, the core analogous system - aviation safety parallel (ASRS) - may not transfer well to AI. ASRS works partly because airlines don't own aircraft manufacturers, they only own depreciating aircraft — pilots can report Boeing defects without much harming Ryanair, especially as most of the firm's competitors also operate the same aircraft. By contrast AI labs are vertically integrated: they are simultaneously manufacturer and operator, so reporting is self-incriminating. Incident reports on a public blockchain cannot be meaningfully anonymised ("x had a safety incident" identifies the lab), creating adverse incentives where public visibility discourages rather than encourages reporting. The confidentiality that makes aviation reporting work is incompatible with the transparency that blockchain provides.

Cite this work

@misc {

title={

(HckPrj) Global AI Safety Notary: A Decentralised Protocol for International AI Incident Reporting

},

author={

Augusta Lina, Caleb Rudnick, Dennis Kiptanui

},

date={

2/1/26

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

View All

View All

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.