Five canonical broken bundles. Five expected failure verdicts. If our verifier ever passes one of these, our verifier is broken — and the public can prove it. That separates H33 from compliance theater.
Each tampered bundle is derived from a real H33-PQ Verified Pillar 4 (Privacy) bundle by a single deliberate mutation.
A single character in publishing_rule is case-flipped. The schema's const field is byte-locked, so any modification — no matter how small — is detected without secret-key material.
verification_record.result set to "BROKEN" — a value outside the schema enum [PASS, FAIL, PENDING]. Signals a malformed verifier-output binding.
verifier_fingerprint replaced with non-hex characters. The fingerprint MUST match ^[0-9a-f]{96}$ (SHA3-384). Tampering with the binding hash is detected at parse time.
The required top-level field fhe_iq_attestation was removed. Verifier walks the schema's required[] list and refuses to "best guess" a missing structural element.
schema_version overwritten to a non-published value. The verifier refuses to validate against unknown schemas — no "best guess," no degraded validation, no silent pass.
No H33 contact required at any step.
Expected output (excerpt):
{
"all_matched": true,
"vector_count": 5,
"vectors": [
{ "vector": "01-tampered-body", "expected": "FAILED", "actual": "FAILED", "matches": true },
{ "vector": "02-invalid-signature", "expected": "FAILED", "actual": "FAILED", "matches": true },
{ "vector": "03-altered-evidence-hash", "expected": "FAILED", "actual": "FAILED", "matches": true },
{ "vector": "04-broken-authority-chain", "expected": "FAILED", "actual": "FAILED", "matches": true },
{ "vector": "05-schema-mismatch", "expected": "FAILED", "actual": "FAILED", "matches": true }
]
}
If all_matched: false, either the vectors are mis-published or the verifier has regressed. File at security@h33.ai.
A standard whose verifier never says FAIL is not a standard — it's a logo. Adversarial vectors are first-class evidence that the verifier rejects bad inputs the way the standard says it does. If anyone publishes a bundle that fails any of these checks, every verifier in the world will catch it. That's the entire point.