Palimpsest

A public, tamper-evident record of what powerful actors quietly erase, and a way for anyone to prove, offline, that not one entry was changed after it was published.

Palimpsest is one primitive, a sealed append-only ledger you can verify without trusting us, pointed at two places where the record gets rewritten in the dark:

• The Verifiable Eval Registry. AI evaluation results, sealed at publication. The questions are frozen and hash-committed before any model is queried, every result is chained to the one before it, and a single edited number fails verification. Chinese state-aligned models and Western frontier models are held to the same tamper-evident, pre-registered machinery, each on its own frozen suite, watched over time for what they quietly stop answering. Not a lab, not a government, not us: if we edited a published number, our own verifier would report the break.
• The Censorship Observatory. Authoritarian deletion, measured as data. It reads the public record of what has been scrubbed, rewritten or blocked — across the network, the encyclopedia and the model — and turns what a state is burying into a live, openly licensed early-warning signal for journalists, researchers, and human rights defenders. Twenty-six signals refresh on their own, unattended, every number tracing back to public evidence.

Built entirely from open sources. It watches the censor, never the censored.

Prove it yourself, in one command

git clone https://github.com/beepboop2025/palimpsest && cd palimpsest
python3 scripts/verify_eval_registry.py   # the eval chain + the pre-registration rule
python3 scripts/verify_ledger.py          # the erasure / censorship ledger

No install, no key, no server, standard library only. Change one sealed byte and the verifier names the break. That is the entire idea: you do not have to trust the operator, you check.

Or watch it run live: the observatory (the live censorship signals), the Verifiable Eval Registry, and the Generative Firewall Index. A ten-second, zero-dependency taste: python3 demo/palimpsest_demo.py pulls the live China Digital Times feed and ranks what the censor is focused on right now (--source sample runs offline).

The registry, live. Chinese state-aligned and Western frontier models under one tamper-evident, pre-registered machinery, each family on its own frozen suite, every run sealed, chain intact. The drift panel catches real events: as of the 11 July 2026 panel it had recorded one Western model refusing a benign legal question its three peers answered, on a probe set frozen before any of them was queried. Later readings are their own sealed entries; the panel is a moving record, not a fixed claim.

The observatory headline: the Censorship Fear Index (one auditable 0–100 number), the top censor target, and the reachable selectivity and novelty signals. Velocity is shown suppressed, never faked. Representative data.

Why a record that cannot be quietly rewritten

Two different kinds of evidence are becoming load-bearing, and both live in files the publishing side can edit after the fact.

AI evaluations. Every serious safety claim about a frontier model now routes through evals. Labs decide whether to ship on eval results, responsible-scaling policies trigger on them, and regulators are starting to cite them. Yet the results sit in ordinary web pages, PDFs, and git repos the publisher controls. If a capability number later becomes inconvenient, the cheapest response is a quiet revision. Nobody has to lie; the page just changes, and no outsider can prove it ever said anything different.

Authoritarian censorship. Before roughly 2013 a deletion often left a mark you could see and count. Today it usually does not: a post simply stops existing, with no notice and nothing left behind. For the people it hurts most, that silence is the point. What a state rushes to delete is also one of the clearest readings of what it actually fears. Every deletion is a kind of confession.

Both problems have the same shape: the before state is unprovable. Palimpsest makes it provable. Seal the record when it is published, and any later edit, deletion, reorder, or cherry-pick becomes detectable by anyone, forever, without trusting the person who sealed it.

The integrity architecture

The central claim is that the published record cannot be revised after the fact. Here is exactly what enforces that, who each layer defends against, and, crucially, what none of it can do. A trust claim without a threat model is marketing; the full model is in docs/INTEGRITY.md.

Layers 1–2 are self-verification, and are built and tested today. Layers 3–6 exist for the one adversary self-verification cannot stop, an operator who rewrites the whole file and re-serves it, including us. The anchoring step (4–5) is wired into the refresh pipeline; the witness (6) is a single stdlib file anyone can run.

What it does not protect against, stated plainly: lying at capture time (the chain preserves a false reading faithfully, so probes are pre-registered and raw responses are hashed for re-runs); the short window between sealing and the first external anchor; suppression by omission (mitigated by an open, cron-scheduled pipeline that abstains loudly rather than skipping silently); and endpoint compromise (an attacker could append false new entries, but still cannot rewrite old ones without tripping layers 3–6). The honest limits are the point, and they live in docs/INTEGRITY.md.

Application 1 — the Verifiable Eval Registry

A public, tamper-evident record of AI-model evaluations. See docs/EVAL-REGISTRY.md.

• Pre-registration by construction. The probe set is frozen and hash-committed into the chain before any model is queried. A run whose questions were not frozen first is rejected by the verifier, so results cannot be cherry-picked or p-hacked after the answers exist.
• Sealed at publication. Each result is hash-chained to its predecessor and fingerprinted by a Merkle root. Edit a published number and scripts/verify_eval_registry.py reports the break.
• The first live audit: cross-lab refusal drift. The registry runs separate frozen suites with no model in common: cn-sensitive-generative-firewall-v1 (DeepSeek, Qwen) and frontier-overrefusal-v1/-v2 (OpenAI, Anthropic, Meta, Mistral). No model has ever been run under both. What is shared is the machinery, not the questions: the same tamper-evident, pre-registered apparatus audits a state-aligned model and a Western frontier model, each on its own frozen suite, tracked run over run for what a model quietly stops answering, an undisclosed behavioral change no changelog admits.
• Measured so it survives review. Every rate carries a Wilson interval and every suite publishes the smallest change a single look could detect. The standing alarm is a mixture supermartingale, so its false-alarm rate is bounded over the lifetime of a watch that re-reads every model every six hours, rather than per look. Each question is asked in three meaning-preserving wordings, because refusal behaviour is sensitive to phrasing and one wording cannot tell a policy from a tripwire. A frozen anchor set re-scores the classifier on every run, so an instrument change can never be published as a model change. Design and honest limits: docs/FRONTIER-DRIFT.md.
• The labels are recomputable, not just tamper-evident. The v2 suite seals a hash over the raw response digests and publishes the responses, so a reader can check that the text served is the text sealed, re-derive every label, and disagree with ours on the record. That closes most of the gap docs/INTEGRITY.md previously had to concede, where a mislabelled response would be sealed perfectly and verify clean forever.

python3 scripts/verify_eval_registry.py        # chain integrity + the pre-registration rule
python3 scripts/verify_refusal_transcripts.py  # published text -> sealed hash -> labels
python3 scripts/prove_inclusion.py 5           # inclusion proof for a single sealed result

Live: palimpsest.info/readings/eval-registry.html.

Application 2 — the Censorship Observatory

Continuous, quantified measurement of content-layer censorship: what gets deleted, how selectively, how fast, and what is newly sensitive. It fills the gap between network-layer measurement (OONI, GreatFire, Citizen Lab) and hand-documented deletion lists (China Digital Times); it ingests their public data and shares its own back.

The method: treat the censor as a sensor. Palimpsest reads the public record of what has already been removed — China Digital Times' curated deletion and directive coverage, alongside the network and model layers — and computes the Deletion-Differential Threat Index (DDTI) from what the censor chose to touch:

Velocity is listed because it is the third thing you would want and the second thing we would publish, not because it is available. A CDT item carries an editorial date, not a deletion timestamp, so no latency is derivable from this source and the reading omits it rather than estimating it. Measuring it needs the archive-and-recheck instrument below.

The index is therefore attention allocation, not a deletion rate — the reading says so in its own scope field: censor_attention_allocation (numerator-only; not a true deletion rate). It ranks what drew the censor's attention; it does not claim to know what share of posts on a topic were removed, because that denominator is not observable from outside.

What is built but not running. The censorwatch package implements the archive-and-recheck method properly: capture a public post as it appears, re-check it on an age-tiered schedule, and confirm a deletion only after repeated consistent observations. It is feature-flagged (CENSORWATCH_ENABLED), has never been enabled in production, and has archived zero posts. It needs an in-country egress path to be meaningful, which the project does not have. Until then this is a description of an instrument, not of a running signal, and nothing on the board is derived from it.

The DDTI distils into a single, auditable 0–100 Censorship Fear Index, how hard is the state working to bury things right now, reported component by component, never a black box.

Validated by retrodiction. Run against six documented events (Li Wenliang, Peng Shuai, the Sitong Bridge protest, the White Paper protests, and more), the scorer ranks the correct term first every time and flags event-born euphemisms as novel from only a handful of deletions. Reproduce it: PYTHONPATH=. python3 scripts/validate_ddti.py. See docs/VALIDATION.md and the method in docs/METHODOLOGY.md.

Live signals (auto-published)

palimpsest.info is self-updating public infrastructure. Thirty independent observatory signals refresh on their own schedules via GitHub Actions on this repo, so every run, its code, and its output are publicly auditable (the badges above are live run status). No hidden server publishes. The Verifiable Eval Registry auto-publishes two further feeds of its own (readings/eval-registry-latest.json and readings/refusal-drift-latest.json), for thirty-two self-refreshing feeds in all.

Every value is provenance-tracked to its source document, and a signal abstains rather than fabricates when its source returns nothing. Nothing is published without evidence. Researcher docs, schemas, and citation (BibTeX) are at palimpsest.info/for-researchers.

It generalises beyond China. The method is country-agnostic; what changes per information space is the lexicon. China ships today; Iran loads from config alone (the Woman-Life-Freedom-era starter lexicon). Adding a country is a gazetteer plus a registry entry, not a rewrite. See config/regions/.

What is built, and what is not

Velocity was the honest blocker on the censorship side: from outside the wall, the moment a post dies is unobservable. The Wayback Reconstruction vantage now recovers it retroactively from open egress, reading the Internet Archive's capture timeline so every deletion is published as an explicit archive-witnessed bracket (last seen alive to first seen gone), never a false-precise instant. What still needs in-country or seam vantage is real-time velocity at minute resolution. The method built for that, UNDERTEXT many-vantage differential observation (disagreement between vantage points is the signal), is built and tested here; what scaling adds is the vantage backends. See docs/UNDERTEXT.md.

Safety is the architecture

See SAFETY.md and docs/ETHICS.md. In short: public data only; nobody inside China is ever asked to act; a deletion is never claimed lightly (the detector probes a known-live control post each cycle and suppresses all deletion writes when the network is unreliable); the sensitive-terms gazetteer is human-authored and never delegated to a Beijing-aligned model; and no state-aligned model is ever the analyst. Every figure ships with its uncertainty and known biases stated openly. Those rules are enforced in code (core/governance.py), not just documented.

Running it

# Zero-dependency demo (recommended first run), no venv needed:
python3 demo/palimpsest_demo.py                 # live CDT pull + ranking
python3 demo/palimpsest_demo.py --source sample # offline deletion demo

# Verify the sealed records (stdlib only, no install):
python3 scripts/verify_eval_registry.py         # eval chain + pre-registration rule
python3 scripts/verify_ledger.py                # the erasure ledger
python3 scripts/prove_inclusion.py 5            # inclusion proof for one attestation
python3 ops/witness/palimpsest_witness.py       # become an independent witness

# Pure, offline cores (no database):
PYTHONPATH=. python3 scripts/validate_ddti.py       # retrodiction backtest (6/6 events)
PYTHONPATH=. python3 scripts/fear_index_demo.py     # Fear Index across documented events
PYTHONPATH=. python3 scripts/forecaster_demo.py     # the censorship forecaster (a "called shot")

# Tests, core (stdlib only, no install, no venv):
PYTHONPATH=. python3 -m pytest tests/ -q                      # stdlib only, no install needed

# Tests, full (adds the censorwatch layer, which needs the dependencies):
python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
PYTHONPATH=. python3 -m pytest tests/ censorwatch/tests/ -q   # adds the velocity-leg suite

The live velocity leg needs PostgreSQL, Redis, and in-country / seam egress; see censorwatch/DEPLOY.md. It stays inert unless CENSORWATCH_ENABLED is set.

Documentation

Status and license

Developed in the open as a public good. This is past the prototype stage and short of a finished product: twenty-eight feeds refresh unattended on public CI, the sealed chains verify offline from a clean clone, and the whole thing runs without anyone touching it. What it is not yet is independently replicated, externally witnessed at scale, or in-country. Those are named openly in docs/INTEGRITY.md and in the built-versus-not table above rather than smoothed over. Free and open source; it is not a commercial product and never monetizes the people or topics it observes. Licensed under the MIT License so other tools can freely build on the feeds and reuse the measurement and sealing layers.

Acknowledgements and prior art

Palimpsest is built to complement, not repeat, the work of China Digital Times, GreatFire, Citizen Lab, and OONI. It ingests CDT deletion data as one input and is designed to share its data back. It draws on the academic measurement tradition of WeiboScope and the deletion-speed studies of Zhu et al. (2013) and Bamman et al. (2012), whose decade-old figures it re-measures rather than assumes. The sealing layer draws on trusted-archive integrity work (ARCHANGEL) and standard transparency-log constructions.