The ROOT experiment lab

Agent Architecture Explorer

How does a request travel from a user’s intent to a verified result?

Pan, zoom and select nodes in the conceptual ROOTVIEL pipeline: untrusted input and tool output become hypotheses, a verifier promotes only what it can settle, and enforcement sits outside the reasoning agent.

You learn
Reasoning proposes; a deterministic verifier and a policy engine — outside the model — decide what becomes evidence and what is allowed to act.

• ↳ ROOTFRAME: the verifiable runtime
• ↳ Academy — Foundations of agents & security

Agent Authorization & Policy Enforcement

An agent can propose any action — so what decides whether it is allowed to happen?

Step a proposed action through capability checks and a policy engine, and watch an out-of-scope request get denied before any effect.

You learn
Reasoning is not authorizing: a deterministic boundary, outside the model, approves or denies every side-effecting action.

• ↳ Academy — Cryptographic delegation

Prompt Injection Lab

Can a hidden instruction inside a document make an agent act against you?

Watch a direct and an indirect injection land against a naive agent, then switch on a deterministic enforcement layer and watch the same payload get contained. Three synthetic scenarios, entirely in your browser.

You learn
Origin-bound, deterministic authorization contains an injection even when detection misses it — the point is the mechanism, not a score.

• ↳ Article — Prompt injection
• ↳ Walkthrough — Prompt Injection Detection

Prompt Injection Detection

How does a pipeline decide whether text an agent read is data or an instruction?

A step-by-step trace of origin labelling, injection detection and policy validation, ending in an auditable decision.

You learn
Origin labelling, detection and a deterministic policy — the final say never belongs to the model.

• ↳ Interactive demo

RAG Security Assessment

What happens when a poisoned document enters a retrieval-augmented agent?

Follow a poisoned document with a hidden instruction through provenance scoring and conflict detection until it is quarantined.

You learn
Retrieved content is untrusted data; provenance scoring and conflict detection decide what context is trusted, and the model’s confidence is not evidence.

• ↳ Knowledge Base — AI, LLM & agents

Multi-Agent Vulnerability Analysis

How does a multi-agent system turn tool findings into evidence without trusting them?

Ingestion, normalization, correlation, risk classification and verification — with one finding proven and one left honestly UNKNOWN.

You learn
Findings are ingested as claims to be checked; a deterministic verifier promotes a claim only when it can settle a property, and unverified items stay UNKNOWN.

• ↳ Article — RAVEN

Multi-Agent Attack Chain Analysis

How do agents reconstruct an attack chain without mistaking coincidence for cause?

Independent findings are correlated in time into a candidate chain; one link is corroborated, one stays a hypothesis, and impact carries its uncertainty.

You learn
A reconstructed chain is a hypothesis until corroborated by independent evidence; correlation is not causation; impact is estimated, not proven.

• ↳ Knowledge Base — Agentic architecture

Epistemic Verification

When is a claim allowed to become evidence — and when must it stay UNKNOWN?

Walk a claim up the ladder — hypothesis, evidence, corroborated or rejected — and see high confidence explicitly refused as proof.

You learn
A language model’s confidence is not proof; a claim is promoted only when a deterministic, LLM-free check settles a property under stated assumptions.

• ↳ Article — The cognitive cycle

Security Evidence & Provenance

How do you tell that a record was produced honestly and not altered?

Capture an observation, derive a transform, and watch an integrity check accept an intact record and reject a tampered one.

You learn
A provenance chain attests how a record was produced under assumptions — never that the underlying conclusion is true. A valid signature is not a true statement.

• ↳ Academy — Applied cryptography for agents

Sign & verify a message

What exactly does a valid signature prove — and what does it not?

A hands-on Academy lab: sign a synthetic message, verify it, then alter one byte and watch verification fail.

You learn
A signature attests authenticity and integrity under a key, not that the message is true or wise.

Build a delegation chain

How do you grant authority you can later narrow and revoke?

Construct a principal→delegate chain and reduce a permission, then confirm which action is no longer authorized.

You learn
Capabilities delegate authority and attenuate scope down a chain; the holder can only act within what was granted.

• ↳ Verify scope attenuation

Prevent replay with nonces

Why does reusing a one-time value get rejected?

A hands-on Academy lab: send a nonce-bound message, then replay it and observe the rejection.

You learn
A nonce binds a message to a single use; replaying it is detected and refused.

Hash-chain an audit log

How does a log make tampering evident?

Build a hash-chained log and edit a past entry to watch every later link fail to verify.

You learn
Each entry commits to the previous one, so altering any entry breaks the chain from that point on.

Merkle inclusion proof

How do you prove an item is in a set without revealing the set?

Construct a Merkle tree and verify an inclusion proof against the root.

You learn
A Merkle path proves membership against a root with a logarithmic-size witness.

A first zero-knowledge circuit

What does it mean to prove you know something without showing it?

A hands-on first look at a zero-knowledge circuit and what its proof does and does not establish.

You learn
A circuit encodes a statement; a valid proof attests the statement holds under the circuit’s assumptions, revealing nothing else.

Notes, commitments & nullifiers

How can a deposit and a later withdrawal be unlinkable on a public chain?

Step through the Rootzk note lifecycle diagrams — deposit, the Merkle anonymity set, a zero-knowledge withdrawal, and the privacy gate — under an explicit observer model.

You learn
A commitment hides a note in an anonymity set; a nullifier derived from different inputs prevents double-spend without identifying the note. Unlinkability is only as large as the anonymity set.

• ↳ Academy — Nullifiers & the privacy pool
• ↳ Academy — Privacy protocols in practice

Agentic System Failure Modes

What happens when a worker stops, duplicates, or returns late?

Interrupt a worker and follow the recovery: a retry under an idempotency key, a late zombie result discarded, an inconsistent result quarantined.

You learn
Idempotency keys, health detection and reconciliation keep a failure from becoming an unauthorized or duplicated effect; uncorroborated results are never promoted.

• ↳ Knowledge Base — Infrastructure & systems

Contract vulnerability reproduction

How is an on-chain vulnerability turned into a hypothesis and reproduced in a bounded local scenario?

A Rootchain experience on reproducing and verifying a smart-contract flaw in a bounded scenario. No interactive experience yet — the background is documented in the Knowledge Base.

You learn
A finding is proven only when the attack is executed in a sandbox and a deterministic check confirms it — reentrancy, access control, proxy/upgrade flaws.

• ↳ Knowledge Base — Web3 & smart contracts