We publish our failures, not just our successes.
Five canonical broken bundles. Five expected failure verdicts. If our verifier ever passes one of these, our verifier is broken — and the public can prove it. That separates H33 from compliance theater.
An adversarial failure vector is a deliberately broken PQ-Verified bundle that the verifier must refuse to recognize as conformant. Each one proves the negative half of the standard: PQ-Verified recognizes and asserts post-quantum conformance, which is only meaningful if it also reliably refuses to recognize non-conforming inputs.
Why this exists: a standard whose recognizer never says FAIL recognizes nothing. Published failures let anyone confirm the recognizer rejects tampered, malformed, and unknown-schema bundles exactly as the standard says.
- These vectors exercise how PQ-Verified recognizes conformance (and refuses non-conformance); they do not constitute the independent verdict — that is Verification, where a third party re-checks the artifact offline, trusting no one.
- A failing vector means "this bundle is not recognized as conformant" — it is not a maturity score of any product or organization; scoring against a rubric is HICS.
- The evidence inside a (real) bundle is produced by H33-74, the portable 74-byte PQ evidence primitive; PQ-Verified recognizes conformance over that evidence, it does not produce it.
Use them to confirm a verifier (yours or ours) correctly refuses to recognize broken bundles — a conformance-recognition regression test. Do not use them as a source of independent verdicts about a real artifact (run the verifier on the real artifact instead), nor as a maturity assessment. Note: acceptance of a real bundle still requires the 3-of-3 PQ AND-gate — ML-DSA, FALCON/FN-DSA, and SLH-DSA must all validate; two of three is a false grant.
The Five Vectors
Each tampered bundle is derived from a real H33-PQ Verified Privacy-pillar bundle by a single deliberate mutation.
Tampered body — single-character mutation of publishing_rule
A single character in publishing_rule is case-flipped. The schema's const field is byte-locked, so any modification — no matter how small — is detected without secret-key material.
Invalid signature surface — result enum violation
verification_record.result set to "BROKEN" — a value outside the schema enum [PASS, FAIL, PENDING]. Signals a malformed verifier-output binding.
Altered evidence-binding hash — non-hex fingerprint
verifier_fingerprint replaced with non-hex characters. The fingerprint MUST match ^[0-9a-f]{96}$ (SHA3-384). Tampering with the binding hash is detected at parse time.
Broken authority chain — required field removed
The required top-level field fhe_iq_attestation was removed. Verifier walks the schema's required[] list and refuses to "best guess" a missing structural element.
Schema mismatch — unknown schema_version
schema_version overwritten to a non-published value. The verifier refuses to validate against unknown schemas — no "best guess," no degraded validation, no silent pass.
Run them yourself
No H33 contact required at any step.
Expected output (excerpt):
{
"all_matched": true,
"vector_count": 5,
"vectors": [
{ "vector": "01-tampered-body", "expected": "FAILED", "actual": "FAILED", "matches": true },
{ "vector": "02-invalid-signature", "expected": "FAILED", "actual": "FAILED", "matches": true },
{ "vector": "03-altered-evidence-hash", "expected": "FAILED", "actual": "FAILED", "matches": true },
{ "vector": "04-broken-authority-chain", "expected": "FAILED", "actual": "FAILED", "matches": true },
{ "vector": "05-schema-mismatch", "expected": "FAILED", "actual": "FAILED", "matches": true }
]
}
If all_matched: false, either the vectors are mis-published or the verifier has regressed. File at security@h33.ai.
Most vendors publish successes. H33 publishes failures too.
A standard whose verifier never says FAIL is not a standard — it's a logo. Adversarial vectors are first-class evidence that the verifier rejects bad inputs the way the standard says it does. If anyone publishes a bundle that fails any of these checks, every verifier in the world will catch it. That's the entire point.
What is an adversarial failure vector?
A deliberately broken PQ-Verified bundle — derived from a real bundle by one intentional mutation — that the verifier must refuse to recognize as conformant. Each vector proves PQ-Verified reliably refuses non-conforming inputs, which is what makes its recognition of conformance meaningful.
Does a FAILED vector give me an independent verdict on a real artifact?
No. These vectors exercise how PQ-Verified recognizes conformance and refuses non-conformance. Rendering the independent verdict on a real artifact — a third party re-checking it offline, trusting no one — is Verification. Run the open-source verifier on the real artifact for that.
Is a failing vector a low maturity score?
No. A failing vector means "not recognized as conformant." PQ-Verified recognizes conformance; it does not score software or controls maturity against a rubric — that is HICS.
Why must a real bundle satisfy all three signature families?
Acceptance requires the 3-of-3 PQ AND-gate: ML-DSA and FALCON/FN-DSA and SLH-DSA must all validate. Two of three is a false grant, never conformant. The evidence being recognized is produced by H33-74; PQ-Verified recognizes conformance over it rather than producing it.