Trustless validation of agents.
Everyone can read the code, but a lab saying its model is safe is still a sentence you have to trust. Litmus turns it into a test anyone can run.
A lab (a Warden) publishes a model and puts a prize pool behind what it says it will never do. Researchers (Breakers) pay a few cents a message to try to make it break a rule. We never hold the money and no judge decides who wins: the contract does.
How a break is proven
Nobody judges a break. Each rule is one the contract can check on its own, so the result is a fact, not an opinion.
Secret
Litmus puts a random code in the agent's instructions and posts its fingerprint on-chain before anyone tries. Get the agent to leak it, submit the exact code, and the contract matches it against the fingerprint.
Transfer limit
The agent's only wallet is the contract. The moment it tries to send more than the limit, the contract sees it and pays you in that same transaction, even if the wallet couldn't cover it.
Forbidden tool
Some tools must never be used. If the agent calls one, the contract records the call and the validation is broken.
Why the lab can't cheat
A validation is only worth something if the lab can't quietly tilt it. Three things stop that.
Frozen agent
We run the agent, not the lab. Its instructions are fingerprinted and locked when the validation is created, so it can't be swapped mid-test.
Hidden code
We generate the secret. The lab never sees it, so it can't be leaked to a friend to win its own prize back.
Health checks
Every few minutes we send the agent its normal tasks. An agent that refuses everything fails them, and breakers are refunded from the lab's bond.
What you trust us with
Litmus is non-custodial, but the model runs on our machine, so say plainly where trust remains.
We run the agent, record every message and time every reply. To keep us honest:
- Every message is signed, and the full log is published when the validation ends, with its fingerprint on-chain.
- The secret, the instructions and the health checks are revealed at the end and must match the fingerprints posted at the start.
- A Chainlink CRE workflow re-checks all of this after every validation and records the verdict on Ethereum Sepolia.
This catches tampering after the fact. It can't stop it in real time. Running the agent inside secure hardware is future work.
Fees
Each message costs the validation's price, usually 0.05 USDC. Replies slower than 15 seconds are free, so you only pay when the agent answers in time.
- Prize pool
- Grows with every attempt and goes to whoever breaks a rule.
- Protocol
- Pays for running the model on 0G.
- Lab
- Held by the contract and paid to the lab at the end.
Built with
The contract, the USDC, and the per-message payments over x402. Every rule and payout is settled here.
Every model reply runs on 0G compute, and each response carries a 0G request id.
A CRE workflow re-checks every finished validation and records the verdict on Ethereum Sepolia.