Attested benchmarks for models and the stacks they run on

What these boards do not claim

• Attestation says this score is real. It does not say this model is safe. Evidence, not a guarantee.
• The range under each score is a 95% interval for the shown run, computed from its signed outputs: a Wilson interval for pass/fail probes (severity-weighted on the red-team boards), a seeded bootstrap for partly-credited answers. A row marked ≈ overlaps the row above it and is not statistically separable from it, whatever the ranks say. With 11 to 60 items per board, many neighbouring rows are.
• Each row says where its number came from, as its manifest declares it — measured by the harness or republished from a score computed outside it — and what we disclose about it: tuned on these questions for any developed on the board’s own items, whose scores are therefore not held-out results.
• Red-team results are also broken down by MITRE ATLAS™ technique, with each run downloadable as an ATLAS Navigator layer. The mapping is ours, to the closest technique in ATLAS release 2026.09; some probes map to none, and MITRE has not reviewed or endorsed it.
• The retrieval boards' runs are republished rather than measured: the scores were computed by Divinci's scored-QA pipeline and republished into a signed TrustRun. The verifier warns you about exactly this, and the manifests say so themselves.
• The two chat-safety boards, Clinic chat intent and Crisis detection, score classifiers on test sets written by an LLM, not on real visitor messages: 229 and 193 clear-cut messages. They rank by balanced accuracy, computed in a published notebook and republished, so they show no interval yet. Half of each set is sealed: those messages stay private, and every signed output carries a SHA-256 fingerprint of the sealed half so a later reveal can be checked against it. Each row’s note says how it was asked. Laya fine-tuned was trained by Divinci, the 70B and 8B crisis rows used Divinci’s production prompt, and the keyword-rules row is a control, not a model.
• Several platform benchmarks are too small to rank on and are not published here. A benchmark with one sample can only ever score 0.0 or 1.0.
• The retrieval boards use one answering model, glm-5.3-flash. They do not all use one judge: every row is judged by gemini-2.5-flash except PageIndex + Jev on the nutrition board, which was judged by gemini-3.8-flash. Scores from different judges are not comparable, so a board with more than one judge shows one tab per judge, each ranked on its own. On the same answers, 3.8 Flash scores these rows about 1 to 5 points higher than 2.5 Flash. That changes the row's number but not its place: under 2.5 Flash the same configuration's median over four passes is 0.823, still between Vectorize and plain PageIndex. Each signed manifest names its judge in its metric.
• On the nutrition board the Vertex row searches a newer, larger ingestion than the others.
• PixelRAG + Jev, first on the nutrition board, was designed on the same sixty questions it is scored on. It also indexes every rendered page of the corpus's eighteen PDFs, where the other rows hold only the passages their parser kept, and it ran from a laptop. Its lead over Vertex holds under three judges and is small under all of them. The write-up has the details.
• PixelRAG, no Jev is the same retriever with Jev's ranking step removed: 0.817 against 0.947, same judge. PageIndex + Jev, half a point below it, was scored by a different judge and sits in its own tab, so the two are not ranked against each other. Rows ranked by Jev carry TypeSafe AI's mark.

MITRE ATLAS™ technique ids and names © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Divinci is not affiliated with, sponsored by, or endorsed by MITRE.