← Blog

Certificates Name Their Model

Cody Lee Walker · codylee.ca · 2026-07

Suppose you've done everything right: measured, per image, how far it can shrink before a model misreads it. One question remains, and it's the one that breaks most "LLM-safe" compression claims: which model?

Because the answer does not transfer.

The cleanest experiment we could build

We wanted ground truth with no human labels to argue about, so we used a deterministic falling-sand simulation (seed 7, fixed timestep — the same frame census, byte-identical, every run). The answers to "how many water cells?" are conservation laws, not annotations. Two frames, ten questions, five compression rungs, two models:

Read the second row twice. At the rung the certificate authorized for Claude, Claude holds 100% — the guarantee did its job. gpt-4o-mini, handed the same images, drops to 71%. Same pixels, same "safe" compression, 29% of its answers gone. (And at x0.05, where both models are coin-flipping, a pixel-error metric still calls the images "isomorphic".)

Transfer is one-directional

The full cross-model matrix says this isn't a quirk of one pair. Bands calibrated for a fragile reader transfer safely up the robustness ordering (0.96+ accuracy when a more robust model reads them). Bands calibrated for a robust reader transfer down at 0.58–0.71 — catastrophic. Robustness spans a wide range: our calibrated tolerance scale runs from 0.75 (Gemini Flash, the most forgiving reader we measured) to 0.5 (open-weights models, the most brittle).

This is why per-model calibration isn't a feature — it's the product. A fidelity guarantee that doesn't name its reader is an aggregate wearing a guarantee's clothing. It also has a sharp operational corollary: the day you swap models, your compression policy is stale. A pipeline tuned on GPT sends silently-lossy images to Claude; an upgrade to a more robust model wastes tokens on caution it no longer needs.

What naming the model buys you

Every starlens certificate carries its target: this image, compressed this far, is isomorphic for claude-sonnet-4.6, witnessed by this instrument, within this calibrated tolerance, sealed as record_sha256. Swap models and the certificates tell you — rather than your error rate telling you three weeks later. Providers' own escape hatches can't do this: OpenAI's detail:low saves 85% at 96% accuracy on gpt-4o-mini, a genuinely good trade — but it's one flat setting, no per-request verdict, portable to exactly zero other providers.

The certified band held 100% for its named model in the ladder above. That's the sentence a certificate buys — and why it's the thing worth paying for, not the compression itself.

Run the ladder yourself: the sim, the census, and every sealed model call are in the starlens flagship demo.