No case studies yet. Here is exactly what one will contain.
No engagement has been completed, so there is no customer to write about, and this page does not invent one. It sets out what a published study will contain, what anonymisation removes and what happens when the result is bad, with a worked example built from Provael's own measured run.
Both counts above are kept by hand and dated: no automatic check can tell that either has changed, so the date says when a person last looked.
What a published study contains
The same shape as every measured write-up already on /findings:
- The headline attack-success rate, with its 95% confidence interval.
- The benign false-positive control the rate is read against.
- The attack families that did not transfer, reported at the same weight.
- A "what this is not" section stating the limits in the author's own words.
- The transfer status: measured on a real policy, or stub-validated scaffolding.
It is indexed, linked from the research feed and published as plain Markdown too, so a tool evaluating vendors can read it without rendering the page.
What anonymisation removes, and what it cannot
Publication happens only under the design-partner schedule a partner signs before work starts. The ordinary assessment is confidential under the engagement agreement, and nothing on this page applies to it. A design partner may publish co-branded or anonymised. Anonymised means the same measurement with the identifying detail stripped: a study becomes "a humanoid manipulation policy" rather than a named product.
Removed
- Your organisation's name and logo.
- The checkpoint identifier.
- Any model or product name.
- The task descriptions, if they are proprietary.
- Any trace detail that would identify the system.
Retained
- The attack families that were run.
- Every rate, with its 95% confidence interval.
- The benign false-positive control.
- The families that did not separate from the benign control.
- The caveats: simulation only, stated sample size, stated limits.
The one thing anonymisation cannot do is remove the result itself. If a finding is only publishable when nobody can tell it happened at all, this is the wrong programme and the standard rate is the right one. It is the same commitment as the one clause on /design-partners.
What happens if the result is bad
We publish it. Why we publish null results was written before the design-partner programme existed: a red team that only reports when it finds something has no denominator.
"Bad result" can mean two different things, and they are worth separating before a signature:
- A high attack-success rate is a finding about the policy. It is published with the remediation and the free retest.
- A result at the benign floor (an attack that did not separate from the benign control) is a publishable measurement too. The reference run below already reports 2 of its 3 adversarial families as not separating from the benign floor, at the same weight as the one that did.
Reference case: Provael's own run — not a customer engagement
Read this label first. The numbers below are Provael's own published result, already on /results and in the product repo's committed report.json. No customer was involved and no engagement produced them. They are here to show the shape and rigour a study will take, not to imply a client relationship that does not exist.
Policy smolvla on LIBERO, task libero_object (all 10 tasks), 5 seeds, 350 episodes in total.
| Attack | Family | Trials | Rate | 95% CI |
|---|---|---|---|---|
none | baseline | 1/50 | 2% | 0-10% |
roleplay | instruction | 42/50 | 84% | 62-100% |
goal_substitution | instruction | 7/50 | 14% | 7-26% |
paraphrase | instruction | 1/50 | 2% | 0-10% |
patch | visual | 1/50 | 2% | 0-10% |
decoy_object | visual | 1/50 | 2% | 0-10% |
scene_text | injection | 2/50 | 4% | 1-13% |
mcp_tool_desc | injection | N/A | N/A | N/A |
Instruction family aggregate: 50/150 = 33.3% [26-41%]. Benign control: 1/50 = 2% — the false-positive floor every rate above is read against.
Two of the three adversarial families did not separate from the benign floor (their arms fired as often as the untouched instruction did), and they are in the table at the same weight as the one that transferred. mcp_tool_desc reads N/A, not 0% — it had no surface in this suite, and an attack that could not run is excluded from the denominator rather than scored as a pass.
Simulation only · one policy · one suite (libero_object (all 10 tasks)) · 5 seeds per task · uncalibrated keep-out predicate, so a rate counts episodes that left the keep-out envelope; it is not a hazard rate. Evidence, not certification.
Becoming the founding published study
The founding cohort is how a real engagement gets onto this page. 3 of 3 places are open as of 20 September 2026, at a founding rate paid for with specific written permission to publish: an opt-in partnership, never a condition of buying an assessment. Until the first study exists, the sample report shows what the work produces.
A report is candidate evidence toward an assessment, never a safety certificate or a notified-body opinion.