Someone tells you their model scores 0.87, up from 0.81. Every number is real. The claim can still be worthless.
Moving a threshold after seeing the result is the obvious version, and everybody watches for it. The version that actually happens is quieter: run the eval nine times across seeds, temperatures and retrieval settings, publish the run that cleared the bar, and say nothing about the other eight. Nothing was falsified. Nothing is checkable.
Git commits do not catch this. Signed results do not catch this. A vendor's own eval platform structurally cannot, because the record of discarded attempts would be held by the party the absence benefits.
Before you run, you publish a seal: your metric, threshold, decision rule and dataset digest, appended to a public Merkle log. After you run, an attestation binds your results to that seal. The log assigns the attempt number, not the client. A seal with five attestations shows five attempts, with all five verdicts, permanently.
Iterating is normal. Hiding iteration is the problem. Multiple attempts verify as
VERIFIED WITH DISCLOSURES: a pass that carries context, not a failure.
Datasets, models, prompts and outputs never leave your machine. Only digests, metadata and verdicts cross the boundary. There is no override on a sealed decision rule, not by flag, config, or paid tier. Amendment is impossible; supersession with a public reason is mandatory.
Verify an attestation in your browser, or read the specification.