Five major AI model cards now cite a single third-party evaluator. OpenAI, Anthropic, Google, Meta, xAI—their latest releases all reference Vals AI’s benchmark scores. If that evaluator is compromised, the entire AI industry’s trust model collapses. This is not a hypothetical. It’s the same structural flaw I saw in early DeFi oracles: a single point of failure masked by rapid adoption.
Vals AI just closed a $40M Series A led by a16z at a $400M valuation. The pitch is seductive: replace static academic benchmarks with dynamic, real-world task evaluation drawn from GitHub pull requests. The company claims its revenue has grown 8x year-over-year. But the numbers are opaque, and the technical architecture raises deeper questions about trust, independence, and the very notion of “third-party” in a heavily funded ecosystem.
As a Layer2 research lead who has spent years dissecting protocol-level trust assumptions, I see a pattern here. Vals AI is building an evaluation infrastructure that, without cryptographic verification, will become the new oracle problem for AI. The market is buying speed and convenience, but the exit door—the ability to verify the evaluator’s integrity—remains locked.
Context: What Vals AI Actually Does
Vals AI positions itself as an “enterprise evaluation platform” for large language models. Instead of relying on public datasets like GSM8K or HumanEval—which are now widely contaminated by training data—Vals extracts real development tasks from any GitHub repository’s historical pull requests. It then uses hidden tests to automatically judge whether the model’s output matches the expected solution. The result is a personalized score for each codebase, giving enterprises a supposedly reliable measure of a model’s production readiness.
The company also extends evaluation to non-code domains: finance, legal, medical. The promise is a unified benchmark across disciplines, bridging the gap between academic performance and practical utility. Vals Smith, the CEO, claims that major AI labs now cite their results in official model cards. That’s a strong signal of institutional adoption.
But here’s the catch. The entire evaluation pipeline is proprietary, centralized, and unaudited. The hidden test generation, the task extraction, the scoring algorithms—all run on Vals’s own infrastructure. There is no on-chain verification, no cryptographic commitment, no independent replication. The industry is essentially trusting a single startup as the arbiter of model quality.
Core: The Technical Architecture and Its Hidden Fault Lines
Let me break down the technical stack based on available information and my own experience auditing protocol-level systems.
1. Task Extraction from GitHub PRs
Vals crawls public GitHub repositories, extracts pull requests that contain both a code change and a description of the problem, and then uses a combination of heuristics and language models to generate a “hidden test” that the model must pass. This is essentially a productized version of SWE-bench, the dynamic evaluation benchmark released by Princeton researchers.
The innovation lies in the personalization: each enterprise gets a custom evaluation set based on its own codebase. This reduces the risk of data contamination—at least theoretically. But here’s the problem: if the PRs come from public repositories, they could easily overlap with the training data of frontier models. Vals would need to filter out PRs created after a model’s training cutoff, and even then, the model might have seen similar patterns in other codebases. The company has not disclosed its contamination prevention methodology.
2. Hidden Test Generation
This is the core intellectual property. Vals claims to automatically generate tests that evaluate correctness, security, and performance. But automated test generation is a notoriously difficult problem. In my experience as a Solidity auditor, I’ve seen countless automated fuzzers miss critical edge cases. The same applies here: a hidden test might pass a model’s output even if the output is incorrect, or it might fail a correct output due to minor formatting differences.
More importantly, the tests themselves are black boxes to the model vendors. If a vendor can reverse-engineer the test generation logic—perhaps by submitting multiple queries and analyzing the feedback—they could game the evaluation. This is the same attack vector as “adaptive poisoning” in machine learning. Vals’s documentation does not address how they prevent this.
3. Centralized Scoring and Reporting
All evaluation results are computed and stored on Vals’s servers. The company provides a dashboard for clients, but there is no way for an external party to verify the scores independently. This is a classic trust model: you must believe that Vals is honest, that its infrastructure is secure, and that its scoring algorithms are correct.
In my 14 years observing blockchain infrastructure, I’ve learned one thing: centralized trust models fail eventually. Either through human error, malicious insider action, or external compromise. The question is not if, but when.
4. Cross-Domain Evaluation
Vals claims to evaluate models on finance, legal, and medical tasks. But these domains require domain-specific expertise for test generation and validation. The company likely needs human annotators to verify the quality of these tests, which introduces scalability and cost constraints. The article does not mention how many annotators they employ or how they ensure consistency.
Trade-off Synthesis
Vals AI’s approach offers a clear trade-off: higher relevance and lower contamination risk compared to static benchmarks, but at the cost of transparency and verifiability. The architecture is optimized for speed and convenience, not for trustlessness. For a startup trying to capture market share, this is a rational choice. But for the industry, it’s a dangerous precedent.
Contrarian: The Hidden Security Blind Spots
Let me now add the contrarian layer that most analysis misses. The risks go beyond technical contamination.
1. The a16z Conflict of Interest
a16z is the lead investor in Vals AI. a16z also has a massive portfolio of AI companies, including some that are likely Vals’s customers. If Vals provides evaluation services to a16z portfolio companies, its “third-party” status becomes questionable. The evaluator is effectively funded by the same ecosystem it evaluates. This is analogous to a credit rating agency being paid by the companies it rates—a conflict that led to the 2008 financial crisis.
2. Model Card Citations as Marketing
The fact that OpenAI, Anthropic, etc. cite Vals in their model cards does not necessarily mean they trust Vals. It could be a marketing arrangement: Vals provides free evaluation, and the labs get a third-party endorsement. This is common in the early stages of a new industry. The real test will come when Vals gives a negative score to a major lab’s model. Will that lab continue to use Vals? Probably not, which means the evaluation system is inherently biased toward positive results.
3. Data Contamination from Public Repos
Even if Vals uses private repos for enterprise clients, the initial “zero-friction” demo uses any public GitHub repo. This means the company collects vast amounts of code from the public domain. If Vals’s own models are trained on this data—for example, to improve test generation—they could inadvertently leak information about the tests themselves. The company has not disclosed whether they use customer data for training.
4. The Oracle Problem for AI
This is where my blockchain background comes in. The AI industry is building a centralized oracle for model quality. Vals is the single source of truth. If Vals gets hacked, or if its employees are bribed, the entire evaluation ecosystem collapses. The solution is not to eliminate Vals, but to make its operations cryptographically verifiable. Commit the hidden tests to a smart contract, timestamp the evaluation results, and allow independent parties to challenge the scores. This is exactly what we did for data availability in blockchain: we moved from trusting a single sequencer to verifying proofs.
Vals has not taken any steps toward decentralization. The company is building a walled garden, and the industry is walking in willingly.
Takeaway: The Vulnerability Forecast
Within 18 months, we will see the first major scandal involving AI evaluation. A model will be certified as “safe” by a centralized evaluator, only to exhibit harmful behavior in production. The industry will scramble for alternatives, and blockchain-based verification protocols will emerge as the natural solution.
Vals AI’s $40M raise is a bet on the centralization of AI trust. I’m betting on the opposite: that the market will eventually demand provable, transparent evaluation. The speed of adoption is an illusion if the exit door is locked.
Logic prevails, but bias hides in the edge cases. The edge case here is that Vals’s entire business model depends on us not questioning the evaluator. In a truly trustless system, the evaluator is the protocol, not the company. Until then, we are building a house of cards on a centralized foundation.
The question is not whether Vals will succeed. The question is whether the industry will learn from history before the crash.
