FLAUDE → QED-1

A "frontier model" with zero parameters. Live at flaude.org. Written up in Flawed AI Model Does Math ×60,000 Faster Than Claude. It Doesn't Exist., the follow-up to The API Is a Two-Way Mirror.

⚠️ Test software. QED-1 is NOT a machine-learning model — it never claims to be one, and after eight questions it tells you so itself.

The experiment

QED-1 by Flaude Labs (say the lab name out loud) presents as a frontier-model research preview: dark landing page, benchmark pills, a professional model card, a chat that "thinks" and streams tokens, and an OpenAI-compatible API with a live playground. Behind all of it is a deterministic Rust math engine (project codename FLAUDE) compiled to 1.3 MB of WebAssembly running in the visitor's browser tab. Prompts never cross the network.

The API is the good part: a service worker intercepts POST /v1/* on the page's origin and answers inside the tab, before the network. On a static host that cannot even serve POST requests, the playground returns HTTP 200 with a spec-compliant chat completion in ~20 ms. A protocol-perfect endpoint, demonstrably serving real answers, with no server behind it.

After the 8th answer (or "How it works" / typing reveal), the page comes clean: the skin strips to a bench-instrument aesthetic, every prior answer is annotated with its true compute time, algorithm, and provenance hash, and the visitor gets the explanation, the annotated model card, the stress-test suite, and pointers to real attestation research.

The site lives at flaude.org. The historical precedent is Wolfgang von Kempelen's 1770 Mechanical Turk: his trick hid a human inside a machine; ours hides a machine inside "machine learning."

The rules (the trick never lies)

• Every claim is literally true. The benchmark is real (below). "Parameters: not disclosed" — there are none to disclose. "Provable hallucination elimination" — refusing to guess is a one-line policy in a deterministic system.
• The protocol layer is honest from message one. Every API response carries attestation: { is_ml_model: false, provenance, method, ... }; asking QED-1 "are you an AI?" gets a straight denial; the model card's limitations admit it has no tokenizer.
• The reveal is guaranteed (8 answers or one click), and the "thinking" traces shown pre-reveal contain the true procedure that ran.
• Nothing is collected. Client-side inference, no accounts, no analytics, no third-party requests of any kind.
• Randomness is opt-in and labeled. Dice, coin flips, and random numbers use the platform CSPRNG — the engine's sole non-deterministic surface — and every such reply discloses it. The only nondeterminism is the kind you ask for; the industry default inverts that.

The benchmark

QED-1 runs the complete BIG-bench arithmetic task (google/BIG-bench, Apache-2.0) against the same WASM artifact browsers receive:

15,023 / 15,023 correct (100.00%) · mean 13.5 µs/item · one CPU core
reproduce: node scripts/run-bigbench.mjs   → web/bench/bigbench-arithmetic.json (with SHA-256)

Published reference for generalist LLMs: GPT-4 scores 59% on 3×3-digit multiplication and ~0% at 5×5 (Dziri et al., NeurIPS 2023). None of this is clever — the engine is textbook algorithms over num-bigint from crates.io. That's the point: for deterministic problem classes, beating a datacenter takes a weekend and a math library.

Layout

crates/flaude-engine    pure Rust math engine (no I/O, no clock) — compiles native + WASM
crates/flaude-server    optional OpenAI-compatible API server (axum) + static host
crates/flaude-wasm      the 1.3 MB "model" (wasm-bindgen, artifact name: qed-inference)
web/                    static site: two-faced app, model card, service-worker API, CSP headers
scripts/run-bigbench.mjs  benchmark harness (BIG-bench arithmetic, full run)
article/                Substack follow-up draft

Run it

cargo run --release      # chat UI + real API server on :8080 (binds 127.0.0.1)
# after touching the engine:
wasm-pack build crates/flaude-wasm --target web --release --out-dir ../../web/pkg --out-name qed-inference

from openai import OpenAI  # the real SDK cannot tell
client = OpenAI(base_url="http://localhost:8080/v1", api_key="none-required")
r = client.chat.completions.create(model="qed-1",
    messages=[{"role": "user", "content": "is 909090909090909091 prime?"}])
print(r.choices[0].message.content)

Deploying

Push web/ to Cloudflare Pages (or any static host). The demo — chat, model card, and the API playground — runs with zero backend at zero marginal cost; visitors' browsers do the inference. web/_headers ships a strict CSP for Pages. The native server is only needed if you want the API reachable from outside a browser (curl, SDKs); alternatively port flaude-engine to workers-rs (pure computation; trim the sieve cap 10⁹→10⁸ and π 20k→5k for Workers limits) and rate-limit it.

Security posture

• No third-party anything: no CDNs, fonts, analytics, or external requests. Self-contained.
• Strict CSP (web/_headers): default-src 'self'; scripts self + wasm-unsafe-eval only; no inline script (all JS in app.js/sw.js/model-card.js); frame-ancestors 'none'.
• XSS: all engine/user text is HTML-escaped before the markdown-lite pass; raw JSON is rendered via textContent.
• Service worker: same-origin only, /v1/* only, computes math, stores nothing, caches nothing. Other origins cannot route requests through it.
• Native server: binds 127.0.0.1, logs nothing, holds no secrets. If exposed publicly, put a rate limit in front (compute-heavy prompts are capped but not free).
• Privacy: static deployment collects nothing and cannot — prompts stay in the tab.
• The one thing we don't do: hide from DevTools. Client-side code is inspectable by anyone who looks; obfuscation would cross from satire into deception. Source-diving is legitimate early discovery, and the reveal beats almost everyone to it anyway.

Provenance (the constructive half)

Every response carries sha256(model_id ∥ 0x00 ∥ prompt ∥ 0x00 ∥ answer) — reproducible by anyone because inference is deterministic: a small working example of a verifiable model claim. The post-reveal "THE FIX" panel and the article point at the real versions: attested inference (NVIDIA confidential computing, Apple PCC), verifiable model cards, training transparency, and outside audits (model equality testing).