A register of scores that were still green · updated 17 August 2026
Green that lies
Ten published numbers that stayed passing while the set they were
computed over quietly changed. Each one was found from the outside, from what the
vendor itself prints.
knn is the part nobody prints
Every score in machine learning is a fraction. Almost every dashboard prints the
quotient and hides the denominator. So when the denominator moves — because rows
were dropped, because a buffer swallowed a block, because a suite collected nothing,
because a run covered a different set — the number stays green and no reader can
tell. That single failure mode is what this page is a register of, and it is the only
thing I work on.
A worked example, free
Rather than describe the work: one published growth figure, rebuilt from the free public
record with the windows aligned day for day, the ingestion lag measured, four controls that
could have failed, and every API URL printed so the count can be disagreed with line by
line. No vendor is named in it. The count under the
percentage →
Check a rate yourself, in your own browser
A published percentage carries its denominator inside it. Paste any rate and the
population it claims to be over: every integer is enumerated, and the answer is either a
list of counts that produce it or the closed fact that none does. Nothing is sent
anywhere, and seven controls have to pass before any verdict is shown — two of them
added on 21 August, when the tool passed nine figures it should have refused.
The denominator check →
Those nine figures are the second free worked example, and the one most likely to be on
a desk this month. Ten published numbers say how many US employers pay for GLP-1 drugs;
they range from 15% to 67% and are quoted to committees deciding 2027 coverage. Your
browser enumerates every integer behind all ten, and nine of them clear the arithmetic
— but only two are counts over the base printed beside them, only one pins an
actual number, and the 52-point spread
turns out to be
which employers were counted, not what employers
do →
And one step further up the chain: a paid certificate whose two headline percentages
cannot be recomputed from the chart on its own facing page — where your browser
downloads both editions of the report, hashes them, and finds the charts in the newer one
to be byte-for-byte the charts from two years
earlier →
And the case where the denominator is not merely unprinted but three different
populations at once: a certification body computes a breach rate over certifications
issued, headlines it over certified environments, and a cyber insurer prices policies on it
restated over organizations. Your browser inflates the report’s own PDF streams,
rebuilds its subset fonts, and reads every integer it contains, to find that
the population under 99.62% is printed
nowhere →
And one where the number that turned out to be wrong was mine. I read an award page that
prints an n beside every percentage, did the arithmetic, found a cell that could
not exist, and emailed it to the publisher. Then a report from the same publisher’s other
product line printed the sentence that says what that n counts —
organizations, while the percentage is divided by respondents, a larger number printed nowhere.
The retraction and what survives it are on the page, and your browser can rerun all of it on
any of the three PDFs: the denominator that is never
printed →
And the simplest case of all, which needs no PDF and no download — two numbers in one
press release. A survey of 105 employers reports that 67% of them cover a class of drug, then
that 72% of those covering will keep the coverage. The first pair fixes the covering
group at exactly seventy, and your browser walks every whole number from nought to seventy to
find that none of them rounds to 72% →
The register
Each entry was reported to the vendor before it appeared here, with the reproduction
and the fix. Where a vendor has confirmed it in writing, that is marked. Nothing below
is a vulnerability, a leak, or anyone’s private data: every one of these is
recoverable from a public page or a public repository.
Vals AI
page says n = 1,2233 rows solve to 1543reported 15 Aug 2026
Three leaderboard rows were scored over 1543 items and ranked against rows scored over 1,223
public validation 20 + private validation 300 + test 1223 = 1543
The TaxEval v2 page documents its test set as 1,223 samples, and lists two
validation sets alongside it. Three model rows do not fit 1,223 under any epoch
count; they fit 1543 exactly — which is the sum of all three components the
page itself lists, and is prime, so it is not 1,223 counted some whole number of
times. Those rows sit in the same sorted column as 128 rows that do fit 1,223.
No row on the site publishes a sample count. Every row publishes accuracy and a
standard error, and for a proportion those two printed numbers are a system of two
equations in two integers, which has a unique solution over the range the printed
precision brackets. The counts are therefore not estimated. They are solved. The
control that rules out rounding: each model is scored twice, in two tabs, over the
same set — and the recovered count agrees in 128 of 128 cases, and 47 of 47
on their GPQA board. A rounding artefact would wander between tabs. It does not.
Separately on that GPQA board, where the page states 198 questions, one model
solves to 197 — and 197 is prime.
Epoch AI
34 of 813 rowsdisagree with the stated setreported 14 Aug 2026
The denominator was recovered from the decimal itself, and 34 rows do not match the set they claim
Same method, run against a published benchmark table: 34 rows out of 813 recover a
denominator that is not the set size the page states. Two of the recovered values
are 197 and 1319, both prime, so neither can be explained as the documented set
scored a whole number of times.
The finding has a corollary that matters more than the rows: rounding a
score to four decimal places or fewer destroys the denominator. Below that
precision the recovery is no longer unique, and a reader who tries anyway will get a
confident wrong answer. Publishing one integer per row costs nothing and removes the
need for anyone to invert an error bar to learn what a score was computed over.
Langfuse
UI: 8 items, accuracy 1.00092 items failed
92 items failed, so the run reported 8 items at perfect accuracy
The denominator counted survivors. Of 100 items, 92 failed before they could be
scored and left the set entirely; the remaining 8 all passed. The dashboard
therefore reported a complete run of 8 items at accuracy 1.000 — correct
arithmetic over the wrong set, and no field anywhere in the view says the run was
asked for 100.
promptfoo
threshold gate: passtests collected: 0
A suite that collected zero tests passes its own threshold
passRate = 0/0 = NaN · NaN < threshold → false → gate does not fire
The pass rate over an empty suite is not a number, and every comparison against
not-a-number is false — including the one that is supposed to fail the build.
So the single check whose job is to notice that quality dropped is structurally
incapable of firing on the case where quality is unmeasured. A misconfigured glob,
a renamed directory, a bad filter: the run goes green and reports nothing missing.
DeepEval
report: passmetric verdict: False
A metric returned False and the reporting layer wrote None over it
The judged verdict was negative. On the way from the metric to the report, the
value became None — and a missing verdict is not treated as a
failure, it is treated as nothing to report. The run reads as passing. The layer
that overwrote the answer is the layer whose only job is to display it, which is
why nobody inspecting the metric ever sees the problem.
LangSmith · LangChain
100% pass3 of 10 cases ranreported 13 Aug 2026
confirmed by vendor
100% over a suite that shrank from ten cases to three
A pytest status hook reported every collected case as passing, over a suite that
had lost seven of its ten cases before execution. The summary line is honest about
the three and silent about the seven, and there is no printed total to compare it
against. A green wall after a refactor that quietly stopped collecting most of the
suite looks exactly like a green wall after a good run.
LangChain confirmed it in writing the next day:
We agree that the pytest plugin can present an incomplete test run
misleadingly, and we're tracking a product-quality fix to report incomplete suites
accurately.
LangChain, 14 August 2026
The same reply contains the sentence I now quote more often than the finding itself.
Declining to treat it as a security matter, they noted that the behaviour
“does not alter pytest's underlying test results or exit status”
— which is precisely correct, and precisely the reason a reader believes the
green. The exit status is clean because the work that would have failed was never
attempted.
Galileo
0 rows processed128 rows processed
The flush buffer was doing double duty as the row counter
Rows are flushed in blocks of 128, and the number surfaced to the user is what is
left in the buffer rather than what went through it. A run whose size is an exact
multiple of the block size therefore reports that it processed nothing — and
a run of 130 reports 2. The buffer is an implementation detail that became the
published denominator.
SWE-bench
leaderboard: 3 rows abovea 4th-place row was dropped
A bare except swallowed the row that belonged in fourth place
One submission’s row never reached the public leaderboard: the code path that
assembles the table catches every exception without distinguishing them, so a single
malformed field removes an entrant instead of reporting an error. The board looks
complete. There is no count of rows attempted next to the count of rows shown, so
the absence cannot be seen from the page.
A broader read of the same leaderboard turned up seven separate defects, including
one submission appearing as two rows, and independently verified entries ranking
below unverified ones because the sort ignores the verification flag.
Ragas
SKIPPED counted as success11 months in the open
A skipped case counted toward the success total for eleven months
A case that never ran was tallied with the cases that passed. The behaviour sat in
released code for eleven months, which is the part worth dwelling on: this class of
defect does not announce itself, does not page anyone, and does not appear in a bug
tracker, because the observable symptom is a number that looks fine.
Weights & Biases
monitor: greennothing was being watched
confirmed by vendor
A monitor that stays green over a set that shrank to nothing
All three points I raised were confirmed. Their own summary of the behaviour is the
clearest statement of the whole class:
…stays green until someone re-runs it.
Weights & Biases, 11 August 2026
That is the definition of the problem. A status that can only be falsified by
re-doing the work is not a status; it is a memory of a status, presented as a
current one.
Why the usual defences do not catch this
Signing does not help. A signature attests that a result is the one
that was produced. It says nothing about what the result was produced over. There is no
cryptographic operation that can attest to absence — that no row was
dropped between the harness and the report — because absence leaves nothing to
sign. Every finding above would survive a fully signed pipeline intact.
Alerting does not help either, because nothing crashed. In each case
the software completed, returned, and printed a number in range. Monitoring watches for
the run that fails; this is the run that succeeds over less than it was asked to cover.
And a passing test suite is exactly what a shrunken suite looks like.
The green wall is produced identically by the good case and the empty one. That is why
the check has to be arithmetic on the denominator, run before the result ships, by
someone whose only job is to try to make it fail.
What this register does not claim
No claim about cause or intent. Where a row does not fit its stated
set, I state the arithmetic and stop. Why the run covered a different set is the
vendor’s to determine; several of the findings above have innocent explanations
and are still defects, because the reader cannot tell either way.
No claim of harm, and no security claims. Nothing here is an
exploit, and nothing here required access I was not given by a public page.
Columns I could not read, I did not report. On two of the boards
above, the pooled summary columns do not solve uniquely, so I make no statement about
them at all — including one specific row that fits no convention I tried, which I
am not presenting as a defect.
Where only one instrument speaks, that is said out loud. Every
number above was recomputed by at least two independent methods, one of which knows
nothing about the other’s assumptions. The handful of rows where the second
method is silent were flagged as such in the report the vendor received.
Three of these findings started as mistakes of mine and were caught by a control before
they left the house: I once published a false finding by checking an object where I should
have checked a field. That is why every claim here carries a control designed to fail, and
why the report a vendor gets includes the controls that did fail on me first.
The arrangement
Standing monthly work, on your leaderboards and your evaluation pipeline, before results
ship rather than after. Each month you get the denominators recovered from what you
publish, the rows that disagree with the set they claim, and a reproduction for each one.
Monthly
400 USD for up to three published boards or tools.
With your pipeline
500 USD monthly, including your internal evaluation runs,
not only the public output.
First month
3 000 USD, which is the month that does the deep read.
If nothing is found
The entry month costs nothing. If the deep read turns up no row that disagrees with
its stated set, you owe nothing and we stop there.
Written to whoever owns the number, not to a support queue — and I would rather
show you a month of it than describe it. vovchuklena@gmail.com
The tool behind it
The one class no after-the-fact recompute can catch is a suite that shrank:
once seven of ten items are gone, the report and the recomputation agree — both read
1.0000. Catching it needs the count pinned before the run. That check
is a zero-dependency CLI you can install and run yourself today:
pip install runreceipt — then runreceipt selftest proves all
seven rules on install. Live on PyPI,
one-page write-up at runreceipt.surge.sh. It has no
dependencies on purpose: it is the thing that checks the other tools, so it imports none of them.